@cotal-ai/cli 0.10.1 → 0.11.0

package/dist/commands/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,aAAa,EACb,WAAW,EACX,SAAS,EACT,WAAW,GAGZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,OAAO,EACP,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AAI5D,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAwC,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACpC,MAAM,YAAY,EAAE,CAAC;IACrB,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,aAAa,EAAE,CAAC;IACtB,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAC;IACnB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/E,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,aAAa,CAAC,CAAC;IACvB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,GAAG,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxI,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAClI,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,OAAO,mBAAmB,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,MAAsC,EACtC,GAAW;IAEX,OAAO,CAAC,eAAe,CAAC,CAAC;IACzB,IAAI,MAA4C,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7B,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACjG,OAAO;IACT,CAAC;IACD,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAiB,CAAW,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAA4C;IACtE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,KAAK;QACL,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,gBAAgB,EAAE,KAAK;QACvB,0FAA0F;QAC1F,aAAa,EAAE,gBAAgB;QAC/B,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;KACtD,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,GAAG,CACD,QAAQ,EACR,gBAAgB;YACd,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1F,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAC9C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7G,IAAI,UAAU;YACZ,GAAG,CACD,iBAAiB,EACjB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CACvI,CAAC;IACN,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,OAAO,sBAAsB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAO;IACzB,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa;IACtC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,aAAa,EACb,WAAW,EACX,SAAS,EACT,WAAW,EACX,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,OAAO,EACP,cAAc,EACd,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AAI5D,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAwC,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACpC,MAAM,YAAY,EAAE,CAAC;IACrB,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,aAAa,EAAE,CAAC;IACtB,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAC;IACnB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/E,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACtH,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChH,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,GAAG,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxI,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAClI,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,OAAO,mBAAmB,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,MAAsC,EACtC,GAAW;IAEX,OAAO,CAAC,eAAe,CAAC,CAAC;IACzB,IAAI,MAA4C,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7B,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzD,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEzB,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,uFAAuF;QACvF,uFAAuF;QACvF,0FAA0F;QAC1F,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,EAA8B,CAAC;QACnC,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7G,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK;YAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,GAAG,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/F,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;YACd,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YACrH,IAAI,EAAE,CAAC,KAAK,KAAK,aAAa;gBAC5B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,cAAc,mBAAmB,GAAG,gBAAgB,cAAc,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;iBACpH,IAAI,EAAE,CAAC,KAAK;gBACf,GAAG,CACD,OAAO,EACP,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,YAAY,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnF,CAAC,CAAC,GAAG,CACH,YAAY,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtK,CACJ,CAAC;;gBACC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC;QAC7E,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAiB,CAAW,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9H,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACjG,OAAO;IACT,CAAC;IACD,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAiB,CAAW,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAA4C;IACtE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,KAAK;QACL,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,gBAAgB,EAAE,KAAK;QACvB,0FAA0F;QAC1F,aAAa,EAAE,gBAAgB;QAC/B,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;KACtD,CAAC,CAAC;IACH,MAAM,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;AAC7C,CAAC;AAED;sGACsG;AACtG,KAAK,UAAU,gBAAgB,CAAC,MAA4C,EAAE,QAAgB;IAC5F,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC,eAAe,CAAC;QAC5E,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,cAAc;KACtB,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,MAAM;QACN,aAAa;QACb,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,gBAAgB,EAAE,KAAK;QACvB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,4CAA4C;KACzF,CAAC,CAAC;IACH,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAiB,EAAE,gBAAyB;IACxE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,GAAG,CACD,QAAQ,EACR,gBAAgB;YACd,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1F,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAC9C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7G,IAAI,UAAU;YACZ,GAAG,CACD,iBAAiB,EACjB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CACvI,CAAC;IACN,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,OAAO,sBAAsB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAO;IACzB,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa;IACtC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/commands/topology.js

@@ -12,13 +12,13 @@ export async function topology(args) {
     const values = args.values;
     const [sub, ...positionals] = args.positionals;
     if (sub !== "view") {
-        console.error(c.red(`✗ unknown topology subcommand "${sub ?? ""}" — expected: view`));
+        console.error(c.red(`✗ unknown topology subcommand "${sub ?? ""}" - expected: view`));
         console.error(c.dim("cotal topology view -f <cotal.yaml>"));
         process.exit(1);
     }
     const file = values.file ?? positionals[0];
     if (!file) {
-        console.error(c.red("✗ a manifest file is required — `cotal topology view -f <cotal.yaml>`"));
+        console.error(c.red("✗ a manifest file is required - `cotal topology view -f <cotal.yaml>`"));
         process.exit(1);
     }
     try {

package/dist/commands/up.d.ts

@@ -5,6 +5,10 @@ export interface DetachOpts {
     storeDir?: string;
     space?: string;
     open?: boolean;
+    /** USER MODE: enable per-user auth (presence = on; `idpUrl` pins the IdP on first enable). */
+    userAuth?: {
+        idpUrl?: string;
+    };
     channels?: string;
     host?: string;
     /** Channel-registry seed in memory (the `cotal up -f` manifest path), used instead of reading a
@@ -29,5 +33,6 @@ export declare function startMeshDetached(opts?: DetachOpts): Promise<{
     pid: number;
     source: string;
     controlPlane: boolean;
+    authService: boolean;
 }>;
 //# sourceMappingURL=up.d.ts.map

package/dist/commands/up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAaA,OAAO,EAcL,KAAK,mBAAmB,EACxB,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAyBxB,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqHxD;AAmID,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;qEACiE;IACjE,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;yGACqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAAC,CAsCjF"}
+{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAaA,OAAO,EAgBL,KAAK,mBAAmB,EACxB,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AA6BxB,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4MxD;AAsMD,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;qEACiE;IACjE,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;yGACqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAgDvG"}

package/dist/commands/up.js

@@ -1,9 +1,10 @@
 import { spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { mkdirSync, writeFileSync, readFileSync, existsSync, openSync, statSync, readSync, closeSync, } from "node:fs";
-import { resolve } from "node:path";
-import { isReachable, DEFAULT_SERVER, createSpaceAuth, serverConfig, mintCreds, mintMembershipObserverCreds, newIdentity, setupSpaceStreams, seedChannelRegistry, ensureDefaultDeliveryClass, mkSecretDir, writeSecretFile, } from "@cotal-ai/core";
-import { authDir, loadSpaceAuth, saveSpaceAuth, clearCurrent, findMesh, getCurrent, loadMeshes, recordMesh, removeMesh, setCurrent, } from "@cotal-ai/workspace";
+import { join, resolve } from "node:path";
+import { isReachable, DEFAULT_SERVER, createSpaceAuth, serverConfig, mintCreds, mintConnectionEvictorCreds, mintMembershipObserverCreds, newIdentity, setupSpaceStreams, seedChannelRegistry, ensureDefaultDeliveryClass, mkSecretDir, writeSecretFile, } from "@cotal-ai/core";
+import { assertUserAuthInfo, authDir, loadSpaceAuth, saveSpaceAuth, clearCurrent, findMesh, getCurrent, loadMeshes, recordMesh, removeMesh, setCurrent, userAuthStateDir, } from "@cotal-ai/workspace";
+import { ensureAuthService, resolveAuthProvider, stopAuthService } from "../lib/auth-proc.js";
 import { resolveSpace } from "../lib/status.js";
 import { c } from "../ui.js";
 import { resolveNatsServer } from "../lib/nats-bin.js";
@@ -16,6 +17,18 @@ import { renderUpPlan, renderInherited, renderWarnings } from "../lib/manifest/r
 import { failManifest } from "./topology.js";
 export async function up(args) {
     const values = args.values;
+    const wantUser = Boolean(values["user-auth"]);
+    // The auth-mode flags contradict each other loudly, never silently (a user-auth space quietly
+    // started open would run agents on the wrong identity plane — the exact failure per-user-auth
+    // exists to prevent).
+    if (wantUser && values.open) {
+        console.error(c.red("✗ --user-auth and --open contradict - a user-auth space cannot run unauthenticated"));
+        process.exit(1);
+    }
+    if (values.idp && !wantUser && !values.file) {
+        console.error(c.red('✗ --idp is for user-auth spaces; pair it with --user-auth, or set broker.auth: "user" in a manifest'));
+        process.exit(1);
+    }
     // `up -f cotal.yaml` is a distinct path: bring up a FRESH mesh described by a manifest (broker +
     // channels + booted agents). It owns the whole space; deploying onto a RUNNING mesh is `spawn -f`.
     // CLI flags override the manifest (flag > manifest > default) so the same file runs at a different
@@ -28,6 +41,8 @@ export async function up(args) {
             space: values.space,
             runtime: values.runtime,
             open: values.open,
+            userAuth: wantUser,
+            idp: values.idp,
         });
         return;
     }
@@ -43,9 +58,57 @@ export async function up(args) {
         const held = loadMeshes().find((m) => m.server === server);
         if (held && held.root === root && (held.space === space || values.space === undefined)) {
             // A refresh of the SAME already-running mesh — its mode is fixed by how the live broker was
-            // started; preserve `held.mode` rather than relabel it from this invocation's `--open`.
-            recordOurMesh({ space: held.space, server, root, mode: held.mode, ts: new Date().toISOString() });
+            // started. A flag asking for a DIFFERENT mode must fail loud (silently preserving the old
+            // mode would hand the operator a mesh on the wrong identity plane); a bare refresh keeps the
+            // held mode.
+            const requested = wantUser ? "user" : values.open ? "open" : undefined;
+            if (requested && requested !== held.mode) {
+                const label = { auth: "static JWT auth", open: "no auth (--open)", user: "per-user auth" }[held.mode];
+                console.error(c.red(`✗ mesh "${held.space}" is already running at ${server} with ${label} - a running broker can't change auth mode; \`cotal down\` it first, then \`cotal up ${wantUser ? "--user-auth" : "--open"}\``));
+                process.exit(1);
+            }
             console.log(c.green(`✓ mesh "${held.space}" already running at ${server}`));
+            // USER MODE: re-upping IS the documented recovery for a dead auth service (the provider's
+            // failure copy says "restart it with `cotal up`"), so a refresh must re-ensure the service —
+            // never just reprint "already running" over a dead callout. No broker config is (re)written
+            // here, so healing on a bare `cotal up` is safe: the mode can't drift, only the daemon heals.
+            let userAuth = held.userAuth;
+            if (held.mode === "user") {
+                const auth = loadSpaceAuth(authDir(root));
+                if (!auth) {
+                    console.error(c.red(`✗ mesh "${held.space}" is user-auth but this root has no trust material under ${authDir(root)} - \`cotal down\` it, restore or re-provision \`.cotal/auth\`, then \`cotal up --user-auth\``));
+                    process.exit(1);
+                }
+                const stateDir = userAuthStateDir(root, held.space);
+                let prepared;
+                try {
+                    prepared = await resolveAuthProvider().prepareServer({
+                        space: held.space,
+                        operatorSeed: auth.operator.seed,
+                        account: { pub: auth.account.pub, signingSeed: auth.account.signingSeed },
+                        dir: stateDir,
+                        idpUrl: values.idp,
+                    });
+                }
+                catch (e) {
+                    console.error(c.red(`✗ ${e.message}`));
+                    process.exit(1);
+                }
+                const svc = await startUserAuthService(held.space, server, { prepared, stateDir });
+                userAuth = svc.userAuth;
+                // The refresh IS the recovery command — a heal that didn't heal must not exit 0.
+                if (!svc.ok)
+                    process.exitCode = 1;
+            }
+            // Auth/user meshes also need their resident renewal owner. A same-root refresh is the normal
+            // repair command after a stale/missing manager, so ensure the delivery daemon + manager before
+            // claiming the running mesh is healthy. Open meshes have no auth creds or delivery daemon.
+            if (held.mode !== "open") {
+                const controlPlane = await startDeliveryWithBroker(held.space, server);
+                if (!controlPlane)
+                    process.exitCode = 1;
+            }
+            recordOurMesh({ space: held.space, server, root, mode: held.mode, ...(userAuth ? { userAuth } : {}), ts: new Date().toISOString() });
             return;
         }
         const who = held ? `mesh "${held.space}" (${held.root})` : "a broker not started here";
@@ -55,35 +118,42 @@ export async function up(args) {
             server = next;
         }
         else {
-            console.error(c.red(`✗ ${server} is already in use by ${who} — to run "${space}" use \`--server nats://${host}:<port>\` with a free port`));
+            console.error(c.red(`✗ ${server} is already in use by ${who} - to run "${space}" use \`--server nats://${host}:<port>\` with a free port`));
             process.exit(1);
         }
     }
     if (values.detach) {
-        const { pid, source } = await startMeshDetached({
+        const { pid, source, authService } = await startMeshDetached({
             server,
             storeDir: values["store-dir"],
             space: values.space,
             open: values.open,
+            userAuth: wantUser ? { idpUrl: values.idp } : undefined,
             channels: values.channels,
             host,
         });
         console.log(c.dim(`Started nats-server (${source}).`));
-        console.log(c.green(`✓ mesh running in the background (pid ${pid}) — stop with: cotal down`));
+        console.log(c.green(`✓ mesh running in the background (pid ${pid}) - stop with: cotal down`));
+        // A user mesh whose auth service never became ready is recorded + running (a re-`cotal up`
+        // heals it), but this `up` did NOT deliver what was asked — automation must see that in the
+        // exit code, not only in the red line above.
+        if (!authService)
+            process.exitCode = 1;
         return;
     }
-    const storeDir = values["store-dir"] ? resolve(values["store-dir"]) : cotalPath("nats");
-    mkdirSync(storeDir, { recursive: true });
     const useAuth = !values.open;
     const space = values.space ?? resolveSpace(process.cwd());
-    assertAuthMatchesSpace(useAuth, space);
+    ensureRootForSpace(useAuth, space); // may pin the cwd as this space's root — before any cotalPath use
+    refuseOpenOverUserState(Boolean(values.open), space);
+    const storeDir = values["store-dir"] ? resolve(values["store-dir"]) : cotalPath("nats");
+    mkdirSync(storeDir, { recursive: true });
     await claimSpace(space, server, cotalRoot());
     const seedFile = loadChannelsFile(values.channels);
-    const setup = useAuth ? await authSetup(storeDir, server, space, host) : undefined;
+    const setup = useAuth ? await authSetup(storeDir, server, space, host, wantUser ? { idpUrl: values.idp } : undefined) : undefined;
     const port = Number(new URL(server).port) || 4222;
     const natsArgs = setup ? ["-c", setup.confPath] : ["-js", "-sd", storeDir, "-p", String(port), "-a", host];
     const { bin, source } = await resolveNatsServer();
-    console.log(c.dim(`Starting nats-server (JetStream, ${useAuth ? "JWT auth" : "OPEN/no-auth"}, ${source}) — store: ${storeDir}, bind: ${host}`));
+    console.log(c.dim(`Starting nats-server (JetStream, ${useAuth ? "JWT auth" : "OPEN/no-auth"}, ${source}) - store: ${storeDir}, bind: ${host}`));
     console.log(c.dim("Press Ctrl-C to stop.\n"));
     const child = spawn(bin, natsArgs, { stdio: "inherit" });
     child.on("error", (err) => {
@@ -91,10 +161,11 @@ export async function up(args) {
         process.exit(1);
     });
     // The control plane is coupled to the broker: stop the delivery daemon AND the detached manager
-    // when this `up` stops (Ctrl-C), so neither outlives the broker it serves — a surviving manager
-    // would reconnect-loop invisibly against the dead (or the NEXT) broker (the documented
-    // orphan-supervisor failure mode). Both kill by pidfile, symmetric.
-    const stop = () => { stopDelivery(); stopManager(); child.kill("SIGTERM"); };
+    // (AND the space's user-auth service) when this `up` stops (Ctrl-C), so none outlives the broker
+    // it serves — a surviving manager would reconnect-loop invisibly against the dead (or the NEXT)
+    // broker (the documented orphan-supervisor failure mode). All kill by pidfile, symmetric; the
+    // auth service's pid is space-scoped so no other space's daemon can ever be hit.
+    const stop = () => { stopDelivery(); stopManager(); stopAuthService(space); child.kill("SIGTERM"); };
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
     // The broker is gone — drop it from the registry (and the `current` pointer if it was the default)
@@ -102,6 +173,7 @@ export async function up(args) {
     child.on("exit", (code) => {
         stopDelivery();
         stopManager();
+        stopAuthService(space);
         // Only unrecord if the registry still points at THIS broker. A newer broker for the same space
         // (a concurrent `up`, or a different-port re-up that recorded after us) may have replaced our
         // record — removing by name would clobber the live winner and hide it from the registry.
@@ -115,13 +187,50 @@ export async function up(args) {
     });
     if (await waitReady(server, setup?.creds)) {
         await postStart(server, space, setup, seedFile);
+        // USER MODE: the auth service comes up FIRST among the daemons — until its callout answers,
+        // every user-mode connect to this broker is denied, so `up` must not report a usable user mesh
+        // (nor let agents race it) on a half-started auth plane. (Foreground `up` doesn't exit here, so
+        // `ok` has no exit code to carry — the red consequence line above is the operator signal.)
+        const svc = await startUserAuthService(space, server, setup);
+        // Record BEFORE the control plane comes up: the manager's fail-closed mode detection requires
+        // an authoritative registry entry (marker-without-registry is a refused start, not a guess),
+        // so the record must exist by the time it boots. A manager/delivery failure after this leaves
+        // a recorded-but-degraded mesh — the documented, healable posture.
+        recordOurMesh({
+            space, server, root: cotalRoot(),
+            mode: setup?.prepared ? "user" : useAuth ? "auth" : "open",
+            ...(svc.userAuth ? { userAuth: svc.userAuth } : {}),
+            ts: new Date().toISOString(),
+        });
         // Bring up the delivery daemon WITH the server (auth mode only — it self-gates on `.cotal/auth`).
         // It is part of the server, so `cotal up` starts it by default; open dev mode has no daemon.
+        // Class-2 credential renewal is NOT wired here: the MANAGER is the renewal owner (it is resident
+        // in every mesh mode — foreground, --detach, refresh — where this foreground process is not).
         await startDeliveryWithBroker(space, server);
-        recordOurMesh({ space, server, root: cotalRoot(), mode: useAuth ? "auth" : "open", ts: new Date().toISOString() });
     }
     await new Promise(() => { });
 }
+/** Bring the space's USER-AUTH service up with the broker (user mode only — `setup.prepared` is the
+ *  provider's output). Loud both ways (U5): a ready service prints the login line; a service that
+ *  never became ready prints the exact consequence + recourse. Returns the registry metadata either
+ *  way — the mesh IS a user-auth mesh even while its service is down (connects must say "auth
+ *  service down", never fall back to static semantics) — plus `ok`, so the exiting `up` surfaces
+ *  (detach / manifest / refresh-heal) turn a dead identity plane into a NON-ZERO exit: automation
+ *  must not read "user mesh up" from a mesh whose every user connect will be denied. */
+async function startUserAuthService(space, server, setup) {
+    if (!setup?.prepared || !setup.stateDir)
+        return { ok: true };
+    try {
+        const endpoints = await ensureAuthService({ space, server, stateDir: setup.stateDir, prepared: setup.prepared });
+        const info = assertUserAuthInfo({ ...setup.prepared.publicAuth, endpoints });
+        console.log(c.green("✓ user-auth service up") + c.dim(` - sign in with: cotal login --idp ${info.idp.url}`));
+        return { userAuth: info, ok: true };
+    }
+    catch (e) {
+        console.error(c.red(`✗ user-auth service did not come up (${e.message}) - user connects to "${space}" will fail until a re-\`cotal up\` succeeds`));
+        return { userAuth: assertUserAuthInfo(setup.prepared.publicAuth), ok: false };
+    }
+}
 /** `cotal up -f cotal.yaml` — bring up a FRESH mesh from a manifest (broker + channels + booted
  *  agents). `up -f` is a broker-CREATION command: `broker.servers` is the bind address for the NEW
  *  local broker, never a connect target. A broker already reachable there (local OR remote) means
@@ -137,7 +246,23 @@ async function upManifest(file, opts) {
         failManifest(e);
     }
     if (opts.runtime && !["pty", "tmux", "cmux"].includes(opts.runtime)) {
-        console.error(c.red(`✗ unknown --runtime "${opts.runtime}" — expected pty, tmux, or cmux`));
+        console.error(c.red(`✗ unknown --runtime "${opts.runtime}" - expected pty, tmux, or cmux`));
+        process.exit(1);
+    }
+    // The auth-mode sources (flags vs manifest) must AGREE — any mismatch names both sources and the
+    // exact correction in one sentence (a no-fallback identity decision, never a bare enum error).
+    const declared = prepared.manifest.broker?.auth;
+    const declaredStr = declared === undefined ? '"static" (the unset default)' : JSON.stringify(declared);
+    if (opts.open && declared === "user") {
+        console.error(c.red('✗ --open contradicts this manifest\'s broker.auth: "user" - a user-auth space cannot run unauthenticated. Drop --open, or change the manifest.'));
+        process.exit(1);
+    }
+    if (opts.userAuth && declared !== "user") {
+        console.error(c.red(`✗ --user-auth requires manifest broker.auth: "user" (this manifest's broker.auth is ${declaredStr}). Either set broker.auth: "user" in the manifest, or drop --user-auth.`));
+        process.exit(1);
+    }
+    if (opts.idp && declared !== "user") {
+        console.error(c.red(`✗ --idp is for user-auth spaces (this manifest's broker.auth is ${declaredStr}) - set broker.auth: "user" in the manifest, or drop --idp.`));
         process.exit(1);
     }
     // Apply CLI overrides to one effective manifest (flag > manifest > default) so render + seed +
@@ -147,6 +272,7 @@ async function upManifest(file, opts) {
     const server = m.broker?.servers ?? DEFAULT_SERVER;
     const host = m.broker?.host ?? "127.0.0.1";
     const open = m.broker?.auth === false; // default is auth
+    const userAuth = m.broker?.auth === "user" ? { idpUrl: opts.idp ?? m.broker?.idp } : undefined; // flag > manifest
     const runtime = m.runtime ?? "pty";
     if (opts.dryRun) {
         console.log(renderUpPlan(eff, server));
@@ -154,7 +280,7 @@ async function upManifest(file, opts) {
     }
     // up -f never adopts a running broker. Reachable at the bind address ⇒ redirect to spawn -f.
     if (await isReachable(server)) {
-        console.error(c.red(`✗ ${server} already has a broker — deploy this manifest onto it with \`cotal spawn -f ${file}\``));
+        console.error(c.red(`✗ ${server} already has a broker - deploy this manifest onto it with \`cotal spawn -f ${file}\``));
         process.exit(1);
     }
     // Connectors + their required binaries must exist before any mutation (no fallback).
@@ -163,21 +289,39 @@ async function upManifest(file, opts) {
         console.error(c.red(`✗ connector preflight failed: ${conn}`));
         process.exit(1);
     }
+    // USER-AUTH manifest: the agents run under the LOGGED-IN operator's owner, and the launch spec
+    // (consumed by the manager at boot) must carry it — so resolve it NOW. On a fresh mesh the
+    // derivation material doesn't exist yet; ensure it just-in-time (authSetup + prepareServer are
+    // idempotent ensure-* — the same contract the refresh-heal path already rides). Not logged in /
+    // no provider = the exact recovery sentence, before anything boots.
+    let owner;
+    if (userAuth) {
+        try {
+            mkdirSync(cotalPath("nats"), { recursive: true });
+            const setup = await authSetup(cotalPath("nats"), server, m.space, host, userAuth);
+            owner = await resolveAuthProvider().ownerForLogin({ dir: setup.stateDir, space: m.space });
+        }
+        catch (e) {
+            console.error(c.red(`✗ ${e.message}`));
+            process.exit(1);
+        }
+    }
     // The resolved launch spec is written FIRST so the ONE control-plane manager that comes up with
     // the broker (inside startMeshDetached) carries it. Exactly one manager serves a space (the
     // singleton lease): a second `supervise` started here for the launch would race the plain one for
     // the lease — the loser refuses, so either the agents never boot or the incumbent is orphaned
     // behind an overwritten pid file. The manager materializes each transient persona and mints creds
     // from the resolved policy — never re-reading a file for authority.
-    const specPath = writeLaunchSpec(cotalRoot(), buildLaunchSpec(eff, genRunId()));
+    const specPath = writeLaunchSpec(cotalRoot(), buildLaunchSpec(eff, genRunId(), owner));
     // A leftover detached manager (its broker is gone — the reachability check above proved nothing
     // lives at this address) would win the fresh mesh's lease and the launch manager would refuse.
     // Stop it, so the manager started below WITH the launch spec is THE manager.
     stopManager();
     let pid;
     let controlPlane = false;
+    let authService = true;
     try {
-        ({ pid, controlPlane } = await startMeshDetached({ server, space: m.space, open, host, seed: manifestToChannels(eff), runtime, launch: specPath }));
+        ({ pid, controlPlane, authService } = await startMeshDetached({ server, space: m.space, open, userAuth, host, seed: manifestToChannels(eff), runtime, launch: specPath }));
     }
     catch (e) {
         console.error(c.red(`✗ ${e.message}`));
@@ -188,10 +332,11 @@ async function upManifest(file, opts) {
     // Never claim a launch the control plane can't deliver: the manager carries the launch spec, so a
     // degraded control plane (announced above) means the agents are NOT coming up.
     if (controlPlane) {
-        console.log(c.green(`✓ launching ${eff.agents.length} agent(s)`) + c.dim(` via manager (${runtime}) — see .cotal/manager.log`));
+        // U6: on a user mesh the agents run under the OPERATOR's identity — say whose they are.
+        console.log(c.green(`✓ launching ${eff.agents.length} agent(s)`) + c.dim(` via manager (${runtime})${owner ? ` as you (owner ${owner})` : ""} - see .cotal/manager.log`));
     }
     else {
-        console.error(c.red(`✗ ${eff.agents.length} agent(s) NOT launched — the control plane did not come up (see above)`));
+        console.error(c.red(`✗ ${eff.agents.length} agent(s) NOT launched - the control plane did not come up (see above)`));
     }
     // Loud summary: any persona-inherited access an `include` manifest dragged in, plus warnings.
     const inherited = renderInherited(eff);
@@ -200,6 +345,11 @@ async function upManifest(file, opts) {
     if (eff.warnings.length)
         console.log("\n" + renderWarnings(eff.warnings));
     console.log(c.dim(`\nWatch: \`cotal console --space ${m.space}\` or \`cotal web\`   ·   Tear down: \`cotal down\``));
+    // A declared-user-auth manifest whose auth service never became ready: the mesh is up + recorded
+    // (re-`cotal up` heals), but this launch did not deliver a usable identity plane — exit non-zero
+    // so CI/wrappers don't read success (the red consequence line printed at the failure above).
+    if (!authService)
+        process.exitCode = 1;
 }
 /** Return a copy of the prepared manifest with CLI overrides applied to broker/space/runtime, so the
  *  whole launch (render, seed, broker, manager, launch spec) runs against one effective manifest. */
@@ -239,7 +389,7 @@ async function startDeliveryWithBroker(space, server, mgr) {
         // Non-fatal (live messaging is unaffected) — but never SILENT: without the manager,
         // `spawn --detach` / cotal_spawn have no responder, and the operator must hear it here,
         // not as an unexplained "no manager reachable" later.
-        console.error(c.dim(`! control plane degraded: ${e.message} — durable delivery/manager may be down; start one with: cotal supervise`));
+        console.error(c.dim(`! control plane degraded: ${e.message} - durable delivery/manager may be down; start one with: cotal supervise`));
         return false;
     }
 }
@@ -252,15 +402,16 @@ async function startDeliveryWithBroker(space, server, mgr) {
  */
 export async function startMeshDetached(opts = {}) {
     const server = opts.server ?? DEFAULT_SERVER;
-    const storeDir = opts.storeDir ? resolve(opts.storeDir) : cotalPath("nats");
-    mkdirSync(storeDir, { recursive: true });
     const useAuth = !opts.open;
     const space = opts.space ?? resolveSpace(process.cwd());
-    assertAuthMatchesSpace(useAuth, space);
+    ensureRootForSpace(useAuth, space); // may pin the cwd as this space's root — before any cotalPath use
+    refuseOpenOverUserState(Boolean(opts.open), space);
+    const storeDir = opts.storeDir ? resolve(opts.storeDir) : cotalPath("nats");
+    mkdirSync(storeDir, { recursive: true });
     await claimSpace(space, server, cotalRoot());
     const seedFile = opts.seed ?? loadChannelsFile(opts.channels);
     const host = opts.host ?? "127.0.0.1";
-    const setup = useAuth ? await authSetup(storeDir, server, space, host) : undefined;
+    const setup = useAuth ? await authSetup(storeDir, server, space, host, opts.userAuth) : undefined;
     const port = Number(new URL(server).port) || 4222;
     const args = setup ? ["-c", setup.confPath] : ["-js", "-sd", storeDir, "-p", String(port), "-a", host];
     const { bin, source } = await resolveNatsServer();
@@ -277,28 +428,61 @@ export async function startMeshDetached(opts = {}) {
     tailing = false;
     if (!ready) {
         child.kill("SIGTERM");
-        throw new Error(`nats-server did not become reachable at ${server} — see ${logPath}`);
+        throw new Error(`nats-server did not become reachable at ${server} - see ${logPath}`);
     }
     writeFileSync(cotalPath("nats.pid"), String(child.pid));
     await postStart(server, space, setup, seedFile);
+    // USER MODE: the auth service comes up FIRST among the daemons (see the foreground path).
+    const svc = await startUserAuthService(space, server, setup);
+    // Record BEFORE the control plane: the manager's fail-closed mode detection needs the
+    // authoritative registry entry at boot (marker-without-registry refuses). Detached: the entry
+    // outlives this process — `cotal down` removes it.
+    recordOurMesh({
+        space, server, root: cotalRoot(),
+        mode: setup?.prepared ? "user" : useAuth ? "auth" : "open",
+        ...(svc.userAuth ? { userAuth: svc.userAuth } : {}),
+        ts: new Date().toISOString(),
+    });
     // Bring up the delivery daemon WITH the detached broker (auth mode only; `cotal down` tears both down).
     const controlPlane = await startDeliveryWithBroker(space, server, { runtime: opts.runtime, launch: opts.launch });
-    // Detached: the registry entry outlives this process — `cotal down` removes it.
-    recordOurMesh({ space, server, root: cotalRoot(), mode: useAuth ? "auth" : "open", ts: new Date().toISOString() });
-    return { server, pid: child.pid ?? 0, source, controlPlane };
+    return { server, pid: child.pid ?? 0, source, controlPlane, authService: svc.ok };
+}
+/** THE FLIP, open-boot edition: `--open` must never boot a credless broker over a root whose
+ *  space has user-auth state on disk — that would serve the space's existing JetStream store to
+ *  anyone and re-record the mesh "open" over its user entry. The same fail-closed rule authSetup
+ *  enforces for static re-ups, applied to the one boot path that skips authSetup entirely. */
+function refuseOpenOverUserState(open, space) {
+    if (!open)
+        return;
+    const stateDir = userAuthStateDir(cotalRoot(), space);
+    if (!existsSync(stateDir))
+        return;
+    console.error(c.red(`✗ space "${space}" has user auth enabled (state under ${stateDir}) - \`--open\` would serve its streams without auth. Start it with \`cotal up --user-auth\`, or remove that directory deliberately to disable user auth (existing logins/grants die with it)`));
+    process.exit(1);
 }
-/** Today a root's `.cotal/auth` is created for one space (its account is space-bound), so starting it
- *  under a *different* explicit `--space` would run that space's name against the other space's trust
- *  material — the registry would then point a `spawn --space` at mismatched creds. Reject it. (When
- *  multi-space-per-root lands, this becomes provision-the-new-space instead of an error.) */
-function assertAuthMatchesSpace(useAuth, space) {
+/** Today a root's `.cotal/auth` is created for one space (its account is space-bound), so an
+ *  explicit `--space` naming a different space cannot run against this root's trust material — the
+ *  registry would point a `spawn --space` at mismatched creds. A mismatch only exists when
+ *  `--space` was given (the default IS this root's space): clear intent for a different mesh. When
+ *  the root was merely inherited from an ancestor folder (the cwd has no `.cotal` of its own),
+ *  honor that intent — make the cwd the new space's own root. Only a folder that itself holds the
+ *  other space's material refuses. (When multi-space-per-root lands, that refusal becomes
+ *  provision-the-new-space instead.) */
+function ensureRootForSpace(useAuth, space) {
     if (!useAuth)
         return;
-    const existing = loadSpaceAuth(authDir(cotalRoot()));
-    if (existing && existing.space !== space) {
-        console.error(c.red(`✗ this root's trust material is for space "${existing.space}", not "${space}" — drop \`--space\` (it defaults to "${existing.space}"), or run "${space}" from its own root`));
-        process.exit(1);
+    const root = cotalRoot();
+    const existing = loadSpaceAuth(authDir(root));
+    if (!existing || existing.space === space)
+        return;
+    const cwd = process.cwd();
+    if (root !== cwd) {
+        mkdirSync(join(cwd, ".cotal"), { recursive: true });
+        console.log(c.dim(`nearest mesh root ${root} is space "${existing.space}" - making this folder its own root for "${space}"`));
+        return;
     }
+    console.error(c.red(`✗ this folder is the root of space "${existing.space}" (${authDir(root)}), so it can't also run "${space}" - drop \`--space\` to run "${existing.space}", or start "${space}" from a different folder (it becomes that mesh's own root)`));
+    process.exit(1);
 }
 /** A space name maps to one mesh in the registry (the key `--space`/`use`/`down` act on). Before
  *  starting a broker, refuse to reuse a space already claimed by a DIFFERENT live mesh — a stale/dead
@@ -311,7 +495,7 @@ async function claimSpace(space, server, root) {
     if (!existing || (existing.server === server && existing.root === root))
         return;
     if (await isReachable(existing.server)) {
-        console.error(c.red(`✗ space "${space}" is already in use by a mesh at ${existing.server} (${existing.root}) — pick a different \`--space\`, or \`cotal down\` it first`));
+        console.error(c.red(`✗ space "${space}" is already in use by a mesh at ${existing.server} (${existing.root}) - pick a different \`--space\`, or \`cotal down\` it first`));
         process.exit(1);
     }
     removeMesh(space); // the prior holder's broker is gone — reclaim the name
@@ -329,7 +513,7 @@ function recordOurMesh(m) {
         return;
     }
     if (usableCurrent !== m.space)
-        console.log(c.dim(`"${m.space}" up; current is still "${usableCurrent}" — \`cotal use ${m.space}\` to switch`));
+        console.log(c.dim(`"${m.space}" up; current is still "${usableCurrent}" - \`cotal use ${m.space}\` to switch`));
 }
 /** Poll a growing log file and forward newly-appended lines until `stopped()` is true. */
 function tailLines(path, from, onLine, stopped) {
@@ -427,8 +611,14 @@ function loadChannelsFile(explicit) {
 }
 /** Ensure the space's trust material exists, render a server config, and mint a privileged
  *  setup creds (used to pre-create streams once the server is up). The account signing key
- *  in `.cotal/auth` is what `cotal mint` and the manager later use to issue per-agent creds. */
-async function authSetup(storeDir, server, space, host = "127.0.0.1") {
+ *  in `.cotal/auth` is what `cotal mint` and the manager later use to issue per-agent creds.
+ *
+ *  USER MODE (`user` set): additionally run the registered auth provider's `prepareServer` over the
+ *  SPACE-SCOPED state dir (`.cotal/auth/<space>/` — the multi-space-ready layout; nothing user-auth
+ *  lives flat) and preload its extra account(s) into the broker config. The inverse is fail-closed:
+ *  a space whose user-auth state exists MUST keep being started with --user-auth — regenerating the
+ *  config without the callout account would silently break every sentinel connect. */
+async function authSetup(storeDir, server, space, host = "127.0.0.1", user) {
     const dir = authDir(cotalRoot());
     let auth = loadSpaceAuth(dir);
     if (!auth) {
@@ -436,14 +626,39 @@ async function authSetup(storeDir, server, space, host = "127.0.0.1") {
         saveSpaceAuth(dir, auth); // strips the $SYS seed on disk, but leaves the in-memory `auth` intact …
         await provisionMembershipCreds(auth); // … so the observer can still be minted here (fresh-space only)
     }
+    const stateDir = userAuthStateDir(cotalRoot(), space); // the provider's space-scoped state dir
+    if (!user && existsSync(stateDir)) {
+        console.error(c.red(`✗ space "${space}" has user auth enabled (state under ${stateDir}) - start it with \`--user-auth\`, or remove that directory deliberately to disable user auth (existing logins/grants die with it)`));
+        process.exit(1);
+    }
+    let prepared;
+    if (user) {
+        // Registry composition: the provider came from the composition root (bin/cotal.ts imports
+        // @cotal-ai/auth); this package never imports it. No provider ⇒ resolveAuthProvider throws the
+        // exact fix. The narrow input is a capability boundary: operator seed (signs the provider's
+        // account once) + the data account's pub/signingSeed (projected for the service's minting duty).
+        try {
+            prepared = await resolveAuthProvider().prepareServer({
+                space,
+                operatorSeed: auth.operator.seed,
+                account: { pub: auth.account.pub, signingSeed: auth.account.signingSeed },
+                dir: stateDir,
+                idpUrl: user.idpUrl,
+            });
+        }
+        catch (e) {
+            console.error(c.red(`✗ ${e.message}`));
+            process.exit(1);
+        }
+    }
     const port = Number(new URL(server).port) || 4222;
     const confPath = resolve(dir, "server.conf");
-    writeFileSync(confPath, serverConfig(auth, { port, storeDir, host }));
+    writeFileSync(confPath, serverConfig(auth, { port, storeDir, host, ...(prepared ? { extraAccounts: prepared.extraAccounts } : {}) }));
     // Ephemeral setup cred: used only to probe reachability, pre-create the space streams/buckets
     // (setupSpaceStreams) and seed the channel registry (seedChannelRegistry) — all within the
     // enumerated `provisioner` scope. No broad `manager` residual for the up path.
     const creds = await mintCreds(auth, newIdentity(), "provisioner");
-    return { confPath, creds };
+    return { confPath, creds, ...(prepared ? { prepared, stateDir } : {}) };
 }
 /** Mint the two scoped creds the delivery daemon's membership feed loads (broker-sourced graph
  *  membership), at the FRESH `cotal up` while the in-memory `$SYS` signing seed still exists:
@@ -461,9 +676,15 @@ async function provisionMembershipCreds(auth) {
     try {
         const observer = await mintMembershipObserverCreds(auth, newIdentity());
         const rw = await mintCreds(auth, newIdentity(), "membership-rw");
+        // D5 slice 4: the KICK-only connection-evictor cred — same mint-only-at-fresh-`up` window as
+        // the observer ($SYS seed in memory here). The delivery daemon pairs it with the observer to
+        // close a revoked/removed principal's live connections. A space without it degrades to
+        // deny-new-only (durable reauth) — surfaced loudly by the removal path, never silent.
+        const evictor = await mintConnectionEvictorCreds(auth, newIdentity());
         mkSecretDir(cotalPath()); // harden .cotal/ before the creds land (born under a private ACL, no race)
         writeSecretFile(cotalPath("membership-observer.creds"), observer);
         writeSecretFile(cotalPath("membership-rw.creds"), rw);
+        writeSecretFile(cotalPath("connection-evictor.creds"), evictor);
         writeSecretFile(cotalPath("membership.json"), JSON.stringify({ accountId: auth.account.pub }));
     }
     catch (e) {