@cotal-ai/core 0.10.1 → 0.11.1

package/dist/agent-file.d.ts

@@ -28,11 +28,20 @@ export interface AgentDef {
     model?: string;
     /** Connector-defined model variant handed to the launcher (e.g. OpenCode reasoning effort). */
     variant?: string;
+    /** Opaque, connector-specific launch options — an arbitrary key→value map that core never
+     *  interprets. Connectors forward well-shaped keys raw into their host form (`claude` flags,
+     *  OpenCode config); a connector with no option surface fails loud. `--opt k=v` on the CLI, a
+     *  manifest `launchOptions:`, or a nested `launchOptions:` block here all feed the same bag. */
+    launchOptions?: Record<string, unknown>;
     /** Capabilities this agent may exercise on the control plane (auth mode → minted into the
      *  cred's publish allow-list). Today `spawn` is the only one: it grants publish to the
      *  privileged control subject (start/purge/definePersona/named stop). Default-deny when
      *  absent — nats-server, not a handler, is the boundary. Granting authority is operator-level
-     *  (`definePersona` is itself privileged), so no peer can self-grant via its own agent file. */
+     *  (`definePersona` is itself privileged), so no peer can self-grant via its own agent file.
+     *  NOTE: because launchOptions is a raw passthrough, `spawn` is HOST-LAUNCH AUTHORITY — its holder
+     *  can drive the connector's full launch surface on the manager host (Claude `--mcp-config` /
+     *  `--add-dir` / permission flags, OpenCode agent-config keys). Grant it as host-launch authority,
+     *  not as a narrow "add a teammate" permission. */
     capabilities?: string[];
     /** Authenticated id of the agent that first defined this persona via `definePersona` (P6). A
      *  POLICY field, not content: the privileged tier may *redefine* an existing file only if its

package/dist/agent-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-file.d.ts","sourceRoot":"","sources":["../src/agent-file.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;6GACyG;IACzG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;yCAGqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;qFAEiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;oFAEgF;IAChF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;0EACsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;oGAIgG;IAChG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;oGAIgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;qDACiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmCD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAoGpD;AAED;;;8CAG8C;AAC9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAsB/D;AAmBD;;mDAEmD;AACnD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAKtE;AAED;;;kGAGkG;AAClG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAMpF"}
+{"version":3,"file":"agent-file.d.ts","sourceRoot":"","sources":["../src/agent-file.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;6GACyG;IACzG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;yCAGqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;qFAEiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;oFAEgF;IAChF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;0EACsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;oGAGgG;IAChG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;;;;;;uDAQmD;IACnD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;oGAIgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;qDACiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmBD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAmHpD;AAED;;;8CAG8C;AAC9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CA0B/D;AAED;;mDAEmD;AACnD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAKtE;AAED;;;kGAGkG;AAClG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAMpF"}

package/dist/agent-file.js

@@ -25,42 +25,26 @@
  */
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { assertValidName } from "./resolve.js";
 import { assertValidChannel, channelInAllow, isConcreteChannel } from "./subjects.js";
-/** Strip wrapping quotes from a scalar value. */
-function unquote(v) {
-    if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))
-        return v.slice(1, -1);
-    return v;
-}
-/** Parse the frontmatter subset we support: `key: value` scalars and inline
- *  `key: [a, b]` string lists. Throws on anything fancier — block lists, nested
- *  maps and multi-doc YAML are deliberately unsupported (no silent fallback). */
-function parseFrontmatter(src) {
-    const out = {};
-    for (const raw of src.split("\n")) {
-        const line = raw.trim();
-        if (!line || line.startsWith("#"))
-            continue;
-        const colon = line.indexOf(":");
-        if (colon < 1)
-            throw new Error(`agent file: unparseable frontmatter line "${raw}"`);
-        const key = line.slice(0, colon).trim();
-        const val = line.slice(colon + 1).trim();
-        if (val.startsWith("[")) {
-            if (!val.endsWith("]"))
-                throw new Error(`agent file: unterminated list for "${key}"`);
-            out[key] = val
-                .slice(1, -1)
-                .split(",")
-                .map((s) => unquote(s.trim()))
-                .filter(Boolean);
-        }
-        else {
-            out[key] = unquote(val);
-        }
+/** Parse the frontmatter block as YAML (the `yaml` library — spec-compliant quoting/escaping and
+ *  safe scalar typing, so a value with a `:`/`#`/quote can't be misread). Must be a mapping; a
+ *  sequence, scalar, or malformed block fails loud. Values keep their YAML types (string, number,
+ *  boolean, nested map/list); {@link loadAgentFile} coerces the modelled scalar fields. */
+function parseFrontmatter(src, path) {
+    let doc;
+    try {
+        doc = parseYaml(src);
+    }
+    catch (e) {
+        throw new Error(`agent file ${path}: invalid YAML frontmatter — ${e.message}`);
     }
-    return out;
+    if (doc === null || doc === undefined)
+        return {};
+    if (typeof doc !== "object" || Array.isArray(doc))
+        throw new Error(`agent file ${path}: frontmatter must be a YAML mapping (key: value pairs)`);
+    return doc;
 }
 /** Load and parse an agent definition file (Markdown + `---` frontmatter). */
 export function loadAgentFile(path) {
@@ -68,19 +52,25 @@ export function loadAgentFile(path) {
     const m = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(src);
     if (!m)
         throw new Error(`agent file ${path}: missing "---" frontmatter block`);
-    const fm = parseFrontmatter(m[1]);
+    const fm = parseFrontmatter(m[1], path);
     const persona = m[2].trim();
     const str = (k) => {
         const v = fm[k];
-        if (Array.isArray(v))
+        if (v === undefined || v === null)
+            return undefined;
+        if (typeof v === "object")
             throw new Error(`agent file ${path}: "${k}" must be a scalar`);
-        return v;
+        return String(v);
     };
     const list = (k) => {
         const v = fm[k];
-        if (v === undefined)
+        if (v === undefined || v === null)
             return undefined;
-        return Array.isArray(v) ? v : [v];
+        return (Array.isArray(v) ? v : [v]).map((x) => {
+            if (x === null || typeof x === "object")
+                throw new Error(`agent file ${path}: "${k}" list items must be scalars`);
+            return String(x);
+        });
     };
     const name = str("name");
     if (!name)
@@ -94,7 +84,7 @@ export function loadAgentFile(path) {
     // an unmigrated file would otherwise lose its read/post scope without warning (no silent degrade).
     for (const old of ["channels", "publish"])
         if (old in fm)
-            throw new Error(`agent file ${path}: "${old}" was renamed — use "subscribe"/"allowSubscribe" (read) and "allowPublish" (post)`);
+            throw new Error(`agent file ${path}: "${old}" was renamed - use "subscribe"/"allowSubscribe" (read) and "allowPublish" (post)`);
     const subscribe = list("subscribe");
     const allowSubscribe = list("allowSubscribe");
     const allowPublish = list("allowPublish");
@@ -121,7 +111,7 @@ export function loadAgentFile(path) {
     // channel can't be both at once. Fail loud (no silent no-op), matching the checks above.
     const both = (quiet ?? []).filter((c) => (muted ?? []).includes(c));
     if (both.length)
-        throw new Error(`agent file ${path}: channel(s) [${both.join(", ")}] are in both quiet and muted — pick one`);
+        throw new Error(`agent file ${path}: channel(s) [${both.join(", ")}] are in both quiet and muted - pick one`);
     for (const [field, chans] of [["quiet", quiet], ["muted", muted]])
         for (const ch of chans ?? []) {
             try {
@@ -135,13 +125,22 @@ export function loadAgentFile(path) {
             if (!channelInAllow(effAllow, ch))
                 throw new Error(`agent file ${path}: ${field} channel "${ch}" is not within your read ACL / allowSubscribe [${effAllow.join(", ")}]`);
         }
+    // Opaque connector-specific launch options — a mapping core never interprets (each connector
+    // reads its own keys). A scalar/sequence here is a config error (it must be `key: value` pairs).
+    const launchOptionsRaw = fm["launchOptions"];
+    let launchOptions;
+    if (launchOptionsRaw !== undefined && launchOptionsRaw !== null) {
+        if (typeof launchOptionsRaw !== "object" || Array.isArray(launchOptionsRaw))
+            throw new Error(`agent file ${path}: "launchOptions" must be a mapping of key: value pairs`);
+        launchOptions = launchOptionsRaw;
+    }
     // Sweep every scalar frontmatter key we don't model into meta, verbatim — connector launcher
     // hints ride here so core stays ignorant of surface-specific keys.
-    const known = new Set(["name", "role", "kind", "description", "tags", "subscribe", "allowSubscribe", "allowPublish", "quiet", "muted", "model", "variant", "capabilities", "owner"]);
+    const known = new Set(["name", "role", "kind", "description", "tags", "subscribe", "allowSubscribe", "allowPublish", "quiet", "muted", "model", "variant", "launchOptions", "capabilities", "owner"]);
     const meta = {};
     for (const [k, v] of Object.entries(fm))
-        if (!known.has(k) && typeof v === "string")
-            meta[k] = v;
+        if (!known.has(k) && v !== null && typeof v !== "object")
+            meta[k] = String(v);
     return {
         name,
         role: str("role"),
@@ -155,6 +154,7 @@ export function loadAgentFile(path) {
         muted,
         model: str("model"),
         variant: str("variant"),
+        launchOptions,
         capabilities: list("capabilities"),
         owner: str("owner"),
         meta: Object.keys(meta).length ? meta : undefined,
@@ -169,60 +169,45 @@ export function saveAgentFile(path, def) {
     if (!def.name)
         throw new Error('saveAgentFile: "name" is required');
     assertValidName(def.name);
-    const lines = ["---", `name: ${fmScalar(def.name)}`];
+    // Build the frontmatter mapping in read order, then serialize with the `yaml` library — it owns
+    // all quoting/escaping (a value with a `:`/`#`/`[`/quote round-trips safely, which the old
+    // hand-rolled writer had to special-case). `lineWidth: 0` keeps scalars on one line (no folding).
+    const fm = { name: def.name };
     if (def.role)
-        lines.push(`role: ${fmScalar(def.role)}`);
+        fm.role = def.role;
     if (def.kind)
-        lines.push(`kind: ${fmScalar(def.kind)}`);
+        fm.kind = def.kind;
     if (def.description)
-        lines.push(`description: ${fmScalar(def.description)}`);
+        fm.description = def.description;
     if (def.tags?.length)
-        lines.push(`tags: [${def.tags.map(fmItem).join(", ")}]`);
+        fm.tags = def.tags;
     if (def.subscribe?.length)
-        lines.push(`subscribe: [${def.subscribe.map(fmItem).join(", ")}]`);
+        fm.subscribe = def.subscribe;
     if (def.allowSubscribe?.length)
-        lines.push(`allowSubscribe: [${def.allowSubscribe.map(fmItem).join(", ")}]`);
+        fm.allowSubscribe = def.allowSubscribe;
     if (def.allowPublish?.length)
-        lines.push(`allowPublish: [${def.allowPublish.map(fmItem).join(", ")}]`);
+        fm.allowPublish = def.allowPublish;
     if (def.quiet?.length)
-        lines.push(`quiet: [${def.quiet.map(fmItem).join(", ")}]`);
+        fm.quiet = def.quiet;
     if (def.muted?.length)
-        lines.push(`muted: [${def.muted.map(fmItem).join(", ")}]`);
+        fm.muted = def.muted;
     if (def.model)
-        lines.push(`model: ${fmScalar(def.model)}`);
+        fm.model = def.model;
     if (def.variant)
-        lines.push(`variant: ${fmScalar(def.variant)}`);
+        fm.variant = def.variant;
+    if (def.launchOptions && Object.keys(def.launchOptions).length)
+        fm.launchOptions = def.launchOptions;
     if (def.capabilities?.length)
-        lines.push(`capabilities: [${def.capabilities.map(fmItem).join(", ")}]`);
+        fm.capabilities = def.capabilities;
     if (def.owner)
-        lines.push(`owner: ${fmScalar(def.owner)}`);
+        fm.owner = def.owner;
     if (def.meta)
         for (const [k, v] of Object.entries(def.meta))
-            lines.push(`${k}: ${fmScalar(v)}`);
-    lines.push("---");
+            fm[k] = v;
+    const frontmatter = stringifyYaml(fm, { lineWidth: 0 }).trimEnd();
     const body = def.persona ? `${def.persona.trim()}\n` : "";
     mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${lines.join("\n")}\n\n${body}`);
-}
-/** Render a frontmatter scalar so {@link loadAgentFile} reads it back unchanged. Quotes values
- *  the parser would otherwise misread (a leading `[`, a `,`/`:`/`#`, edge whitespace, or empty);
- *  throws on values the line-based format can't represent (a newline, or both quote styles). */
-function fmScalar(value) {
-    if (/[\r\n]/.test(value))
-        throw new Error(`saveAgentFile: value cannot contain a newline: ${JSON.stringify(value)}`);
-    if (value !== "" && value === value.trim() && !/^[[]/.test(value) && !/[,:#"']/.test(value))
-        return value;
-    if (!value.includes('"'))
-        return `"${value}"`;
-    if (!value.includes("'"))
-        return `'${value}'`;
-    throw new Error(`saveAgentFile: value cannot contain both quote styles: ${JSON.stringify(value)}`);
-}
-/** A list item additionally cannot hold a comma — the parser splits on `,` before unquoting. */
-function fmItem(value) {
-    if (value.includes(","))
-        throw new Error(`saveAgentFile: list item cannot contain a comma: ${JSON.stringify(value)}`);
-    return fmScalar(value);
+    writeFileSync(path, `---\n${frontmatter}\n---\n\n${body}`);
 }
 /** Resolve a name-or-path to an agent file. A path (absolute, contains a slash — `/` or, on
  *  Windows, `\` — or ends in `.md`) is used as given; a bare name maps to the directory

package/dist/agent-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-file.js","sourceRoot":"","sources":["../src/agent-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAkDtF,iDAAiD;AACjD,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;iFAEiF;AACjF,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,GAAG,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,GAAG,CAAC,CAAC;YACtF,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG;iBACX,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;iBACZ,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;iBAC7B,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,mCAAmC,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAsB,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAwB,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACtC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,sBAAsB,CAAC,CAAC;IACrE,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU;QACjD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,wCAAwC,CAAC,CAAC;IAE9E,oGAAoG;IACpG,8FAA8F;IAC9F,mGAAmG;IACnG,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;QACvC,IAAI,GAAG,IAAI,EAAE;YACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,MAAM,GAAG,mFAAmF,CAC/G,CAAC;IAEN,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,iGAAiG;IACjG,qFAAqF;IACrF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,4FAA4F;IAC5F,0FAA0F;IAC1F,MAAM,YAAY,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,KAAK,MAAM,EAAE,IAAI,YAAY;QAC3B,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,wBAAwB,EAAE,mCAAmC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtG,CAAC;IAEN,uGAAuG;IACvG,kHAAkH;IAClH,yFAAyF;IACzF,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM;QACb,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAU;QACxE,KAAK,MAAM,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,KAAK,aAAa,EAAE,4CAA4C,CAAC,CAAC;YAC3G,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,KAAK,aAAa,EAAE,mDAAmD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1I,CAAC;IAEH,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IACrL,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjG,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,IAAgC;QACtC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;QAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,SAAS;QACT,cAAc;QACd,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;QACvB,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;QAClC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACjD,OAAO,EAAE,OAAO,IAAI,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAa;IACvD,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,SAAS,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/E,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,IAAI,GAAG,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvG,IAAI,GAAG,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,IAAI;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;gGAEgG;AAChG,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrH,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1G,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC;IAC9C,MAAM,IAAI,KAAK,CAAC,0DAA0D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,gGAAgG;AAChG,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtH,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;mDAEmD;AACnD,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,UAAkB;IAC5D,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrF,OAAO,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;kGAGkG;AAClG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAgC;IAC1E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1C,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-file.js","sourceRoot":"","sources":["../src/agent-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AA2DtF;;;2FAG2F;AAC3F,SAAS,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACjD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,yDAAyD,CAAC,CAAC;IAC/F,OAAO,GAA8B,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,mCAAmC,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAsB,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAwB,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAClH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,sBAAsB,CAAC,CAAC;IACrE,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU;QACjD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,wCAAwC,CAAC,CAAC;IAE9E,oGAAoG;IACpG,8FAA8F;IAC9F,mGAAmG;IACnG,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;QACvC,IAAI,GAAG,IAAI,EAAE;YACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,MAAM,GAAG,mFAAmF,CAC/G,CAAC;IAEN,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,iGAAiG;IACjG,qFAAqF;IACrF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,4FAA4F;IAC5F,0FAA0F;IAC1F,MAAM,YAAY,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,KAAK,MAAM,EAAE,IAAI,YAAY;QAC3B,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,wBAAwB,EAAE,mCAAmC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtG,CAAC;IAEN,uGAAuG;IACvG,kHAAkH;IAClH,yFAAyF;IACzF,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM;QACb,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAU;QACxE,KAAK,MAAM,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,KAAK,aAAa,EAAE,4CAA4C,CAAC,CAAC;YAC3G,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,KAAK,aAAa,EAAE,mDAAmD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1I,CAAC;IAEH,6FAA6F;IAC7F,iGAAiG;IACjG,MAAM,gBAAgB,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,aAAkD,CAAC;IACvD,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAChE,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,yDAAyD,CAAC,CAAC;QAC/F,aAAa,GAAG,gBAA2C,CAAC;IAC9D,CAAC;IAED,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IACtM,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAEvH,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,IAAgC;QACtC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;QAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,SAAS;QACT,cAAc;QACd,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;QACvB,aAAa;QACb,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;QAClC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACjD,OAAO,EAAE,OAAO,IAAI,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAa;IACvD,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,gGAAgG;IAChG,2FAA2F;IAC3F,kGAAkG;IAClG,MAAM,EAAE,GAA4B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,IAAI;QAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACjC,IAAI,GAAG,CAAC,IAAI;QAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACjC,IAAI,GAAG,CAAC,WAAW;QAAE,EAAE,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACtD,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM;QAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACzC,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM;QAAE,EAAE,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IACxD,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM;QAAE,EAAE,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;IACvE,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM;QAAE,EAAE,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACjE,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM;QAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM;QAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK;QAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACpC,IAAI,GAAG,CAAC,OAAO;QAAE,EAAE,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC1C,IAAI,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM;QAAE,EAAE,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IACrG,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM;QAAE,EAAE,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACjE,IAAI,GAAG,CAAC,KAAK;QAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACpC,IAAI,GAAG,CAAC,IAAI;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,WAAW,YAAY,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;mDAEmD;AACnD,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,UAAkB;IAC5D,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrF,OAAO,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;kGAGkG;AAClG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAgC;IAC1E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/auth-provider.d.ts

@@ -0,0 +1,207 @@
+import { type Extension } from "./registry.js";
+/**
+ * The one extension kind an identity/auth implementation registers so a composition root can turn
+ * on USER-MODE auth (the human-owner identity plane over per-agent NATS identity) WITHOUT importing
+ * that implementation. `@cotal-ai/auth` self-registers one on import; the `cotal` binary pulls the
+ * package in, and the CLI resolves it generically (`registry.all<AuthProvider>("auth-provider")`).
+ *
+ * Guarded core: this seam is IdP-agnostic and knows nothing about callouts, bearers, ledgers, or
+ * any concrete IdP. It exchanges a NARROW provisioning input (exactly the signing material the
+ * provider's function requires — never the whole space trust bundle) for the operator-signed
+ * accounts the broker config preloads, plus opaque client metadata and a service handle. All
+ * auth-specific substance stays behind these types.
+ *
+ * No provider registered ⇒ user-mode auth is unavailable and requesting it MUST fail loud (no
+ * static fallback) — a library root that never imports the auth package simply cannot serve a
+ * user-auth space.
+ */
+export interface AuthProvider extends Extension {
+    readonly kind: "auth-provider";
+    /**
+     * Ensure this space's user-auth material exists under `input.dir` (generated + persisted on the
+     * first call, reused verbatim after — account identities and signing keys MUST be stable across
+     * restarts or previously-issued credentials break) and describe what the composition root must
+     * wire up. Idempotent. This call may hold the provisioning seeds BRIEFLY; the long-lived service
+     * process must load only provider-owned projected files written here, never the space's full
+     * trust bundle.
+     */
+    prepareServer(input: AuthPrepareInput): Promise<AuthPrepared>;
+    /**
+     * CLIENT side: produce the connect material for a user-mode space from THIS machine's session
+     * state (the login cache + the provider's space-scoped state under `dir`). `actor` is the
+     * ledger-granted agent-instance the caller connects as. Returns what {@link EndpointOptions}'
+     * user mode consumes (`bearer` + `sentinelCreds`). MUST fail loud with the EXACT operator
+     * action when anything is missing — not logged in (`cotal login --idp …`), the auth service
+     * down (how to restart it), the actor ungranted (how to grant) — and NEVER falls back to any
+     * other auth mode.
+     *
+     * `view` requests an ELEVATED per-connection profile (opaque to core; the provider validates it
+     * against its closed view enum and the fresh ledger grant) — the god-view/purge/registry-write/
+     * deploy connections the operator surfaces (`web`, `console`, `history clear`, `channels`,
+     * `spawn -f`) ride. An under-scoped or unknown view MUST fail loud with the exact re-grant.
+     */
+    userCredentials(opts: {
+        dir: string;
+        space: string;
+        actor: string;
+        view?: string;
+    }): Promise<{
+        bearer: string;
+        sentinelCreds: string;
+    }>;
+    /**
+     * The derived owner token (`u_…`) of THIS machine's cached login for the given space — resolved
+     * offline from the login session + the space's local user-auth material (no IdP round trip).
+     * The spawn paths use it to answer "whose agents are these": a foreground/manifest spawn runs
+     * the agents under the OPERATOR's owner. MUST fail loud when not logged in (naming the exact
+     * `cotal login --idp …` line) or when the space has no user-auth material under `dir`.
+     */
+    ownerForLogin(opts: {
+        dir: string;
+        space: string;
+    }): Promise<string>;
+    /**
+     * Read-only OFFLINE introspection for status surfaces (`cotal status`): this machine's cached
+     * login for the space and — where the space's ledger is locally readable — whether that login's
+     * `actor` is granted. Never network-bound and never a mint; "not signed in" is a REPORTED state
+     * here, not a thrown one. Throws only when the space has no user-auth material under `dir`
+     * (there is nothing to report status about).
+     */
+    userStatus(opts: {
+        dir: string;
+        space: string;
+        actor: string;
+    }): Promise<UserAuthStatus>;
+    /**
+     * SERVER side, agent lifecycle: author an agent grant for `(owner, actor)` in this space's
+     * ledger — the spawn path's half of "actors are server-ledger-authorized, never taken from
+     * connect payloads". Returns the ONE-TIME plaintext agent secret (persisted only as a hash;
+     * the caller delivers it to the agent process via a 0600 file and never sees it again) plus
+     * the sentinel creds the agent presents alongside its bearers. Upsert — re-granting an actor
+     * rotates its secret. MUST fail loud when the space has no user-auth material under `dir`.
+     */
+    grantAgent(opts: {
+        dir: string;
+        space: string;
+        owner: string;
+        actor: string;
+        scope: string[];
+        allowSubscribe: string[];
+        allowPublish: string[];
+        role?: string;
+        /** The spawning principal (`<owner>.<actor>` dot-form) — the grant's audit link. */
+        parent?: string;
+        label?: string;
+    }): Promise<{
+        actorToken: string;
+        sentinelCreds: string;
+    }>;
+    /** Revoke an agent grant. False when there was nothing to revoke. New exchanges and new
+     *  connects die immediately (both boundaries read the ledger fresh); an already-live
+     *  connection dies at its bearer-bound JWT expiry (live eviction is a separate lever). */
+    revokeAgent(opts: {
+        dir: string;
+        owner: string;
+        actor: string;
+    }): Promise<boolean>;
+    /**
+     * Read-only FRESH capability-scope read for one granted principal — `undefined` when the
+     * principal holds no grant (for an authorization read, unknowable is "no grant": fail-closed).
+     * Never a mint, never a write. The manager's named-target control authorization (owner-domain
+     * stop/attach) consults it for its else-branch — "does the caller hold `admin`?" — reading
+     * fresh so a scope edit bites the caller's next control op with no restart or reconnect.
+     */
+    actorScope(opts: {
+        dir: string;
+        owner: string;
+        actor: string;
+    }): Promise<string[] | undefined>;
+    /**
+     * Registry name of the provider's self-registered {@link Command} that prints ONE fresh agent
+     * bearer to stdout and exits (flags: `--dir <state-dir> --space <space> --owner <o> --actor <a>
+     * --token-file <path>`). A long-lived agent endpoint execs it per refresh — the exchange
+     * protocol, discovery, and secret handling stay entirely behind the provider; the agent-side
+     * runtime only runs an argv and reads a line. */
+    readonly agentBearerCommand: string;
+}
+/** The ONE registered auth provider, or a thrown sentence naming the fix. More than one registered
+ *  is ambiguous and refuses just as loudly — there is no pick-the-first fallback. Lives in core so
+ *  every surface that resolves the provider generically (CLI, manager) shares one resolution. */
+export declare function resolveAuthProvider(): AuthProvider;
+/** What {@link AuthProvider.userStatus} reports. Fields are absent when locally unknowable —
+ *  absence is honest ("can't tell from here"), never a guess. */
+export interface UserAuthStatus {
+    /** The space's pinned IdP base URL (always known — it is part of the user-auth material). */
+    idpUrl: string;
+    /** This machine's cached login for that IdP; absent = not signed in. */
+    login?: {
+        sub: string;
+        expiresAt: number;
+    };
+    /** The login's derived owner token (`u_…`) for this space. */
+    owner?: string;
+    /** The (owner, actor) interactive ledger row: its lists when granted, `"not-granted"` when the
+     *  locally-readable ledger has no row. Absent when the ledger is not on this machine. */
+    grant?: {
+        scope: string[];
+        allowSubscribe: string[];
+        allowPublish: string[];
+        role?: string;
+        label?: string;
+    } | "not-granted";
+}
+/** The provisioning input — deliberately NARROW (a capability boundary, not a convenience): the
+ *  operator seed signs the provider's dedicated account(s) once; the data-account signing seed is
+ *  projected into the service's own key file because minting scoped data-account users at connect
+ *  time IS the service's function. Nothing else of the space bundle crosses this seam. */
+export interface AuthPrepareInput {
+    space: string;
+    /** The space operator's signing seed — used once per fresh space, to sign the provider's
+     *  dedicated account(s) into the operator's trust chain. */
+    operatorSeed: string;
+    /** The data account users are bound into: its public key + the signing seed that mints its
+     *  users (projected to the service's key file; the ACCOUNT seed itself never crosses). */
+    account: {
+        pub: string;
+        signingSeed: string;
+    };
+    /** The provider's OWN state dir. The caller keys it — today `<root>/.cotal/auth/<space>`; a
+     *  future (broker, space) key is a caller change, never an on-disk format break. */
+    dir: string;
+    /** The operator's external identity-provider base URL (`up --user-auth --idp <url>`), OPAQUE to
+     *  core — the provider pins/persists it (first call requires one; a later call must match the
+     *  persisted pin or omit it; re-pointing an IdP is a migration, never a flag flip). */
+    idpUrl?: string;
+}
+/** What `prepareServer` hands back to the composition root. */
+export interface AuthPrepared {
+    /** Operator-signed accounts the broker config must preload in its resolver (e.g. a dedicated
+     *  callout account, which must never share the data account). */
+    extraAccounts: Array<{
+        pub: string;
+        jwt: string;
+    }>;
+    /** NON-SECRET client-facing metadata (trust pins, provider id) for the workstation layer's mesh
+     *  registry, so connects from other directories can print exact recovery actions. Opaque to
+     *  core — the workspace layer owns the concrete shape. */
+    publicAuth: Record<string, unknown>;
+    /** The long-lived auth service this space needs running alongside its broker. */
+    service: AuthServiceSpec;
+}
+/** The provider's daemon, by contract rather than convention: which registered {@link Command} to
+ *  spawn (the CLI re-execs `cotal <command> --space … --server …` detached, pid/log space-scoped),
+ *  and how to know it is actually SERVING — so `up` never records a usable user mesh on a
+ *  half-started service, and never invents ad-hoc readiness sleeps. */
+export interface AuthServiceSpec {
+    /** Registry name of the self-registered daemon command (e.g. `"auth-service"`). Resolved through
+     *  the command registry and exec'd as argv — never shell-interpolated. */
+    command: string;
+    /** Wait until the running service is READY (every plane bound — e.g. broker subscription AND
+     *  local endpoints). Resolves with the service's runtime, non-secret endpoint metadata for the
+     *  mesh registry; THROWS (with the reason) on timeout — the caller surfaces it, loudly. */
+    ready(opts: {
+        dir: string;
+        timeoutMs?: number;
+    }): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=auth-provider.d.ts.map

package/dist/auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxI;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzF;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oFAAoF;QACpF,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;8FAE0F;IAC1F,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC/F;;;;;qDAKiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;iGAEiG;AACjG,wBAAgB,mBAAmB,IAAI,YAAY,CASlD;AAED;iEACiE;AACjE,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6FACyF;IACzF,KAAK,CAAC,EACF;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACpG,aAAa,CAAC;CACnB;AAED;;;0FAG0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB;8FAC0F;IAC1F,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C;wFACoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ;;2FAEuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B;qEACiE;IACjE,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD;;8DAE0D;IAC1D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,iFAAiF;IACjF,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;uEAGuE;AACvE,MAAM,WAAW,eAAe;IAC9B;8EAC0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;+FAE2F;IAC3F,KAAK,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpF"}

package/dist/auth-provider.js

@@ -0,0 +1,13 @@
+import { registry } from "./registry.js";
+/** The ONE registered auth provider, or a thrown sentence naming the fix. More than one registered
+ *  is ambiguous and refuses just as loudly — there is no pick-the-first fallback. Lives in core so
+ *  every surface that resolves the provider generically (CLI, manager) shares one resolution. */
+export function resolveAuthProvider() {
+    const providers = registry.all("auth-provider");
+    if (providers.length === 0)
+        throw new Error("no auth provider is registered in this build - user auth needs one (the `cotal` binary registers @cotal-ai/auth; a custom composition root must import an auth package)");
+    if (providers.length > 1)
+        throw new Error(`multiple auth providers registered (${providers.map((p) => p.name).join(", ")}) - cannot choose between them`);
+    return providers[0];
+}
+//# sourceMappingURL=auth-provider.js.map

package/dist/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AAsGzD;;iGAEiG;AACjG,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAe,eAAe,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAC;IACJ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAClI,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC"}

package/dist/channels.d.ts

@@ -66,6 +66,9 @@ export declare function seedChannelRegistry(opts: {
     servers: string;
     space: string;
     creds?: string;
+    /** User mode: a `channel-writer`-view bearer + the space's sentinel creds (instead of a creds file). */
+    bearer?: string;
+    sentinelCreds?: string;
     file: ChannelRegistryFile;
 }): Promise<void>;
 /** Write the space-wide default delivery class at space creation IF it is not already set (SPEC §4:
@@ -89,6 +92,9 @@ export declare function deleteChannels(opts: {
     servers: string;
     space: string;
     creds?: string;
+    /** User mode: a `channel-writer`-view bearer + the space's sentinel creds (instead of a creds file). */
+    bearer?: string;
+    sentinelCreds?: string;
     channels: string[];
 }): Promise<void>;
 /** Connect, read the whole registry (defaults + every channel entry) into a
@@ -98,5 +104,9 @@ export declare function readChannelRegistry(opts: {
     servers: string;
     space: string;
     creds?: string;
+    /** User mode: the caller's OWN agent-view bearer + the space's sentinel creds — the registry is
+     *  world-readable in-space, so no elevated view is needed for the read side. */
+    bearer?: string;
+    sentinelCreds?: string;
 }): Promise<ChannelRegistryFile>;
 //# sourceMappingURL=channels.d.ts.map

package/dist/channels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../src/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG3F,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhF,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAED;iFACiF;AACjF,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;yDACyD;AACzD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAgB9D;AAED;;sDAEsD;AACtD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,GAAG,IAAI,CAIhE;AAED;8EAC8E;AAC9E,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM/C;AAED;8EAC8E;AAC9E,wBAAgB,eAAe,CAC7B,GAAG,EAAE,aAAa,GAAG,SAAS,EAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,OAAO,CAET;AAED;8EAC8E;AAC9E,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,aAAa,GAAG,SAAS,EAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;8CAI8C;AAC9C,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,aAAa,GAAG,SAAS,EAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,aAAa,CAEf;AAED;;wFAEwF;AACxF,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED,iEAAiE;AACjE,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAEpC;AAED,4DAA4D;AAC5D,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAEtF;AAED;gFACgF;AAChF,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;wFACwF;AACxF,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxF;AAYD;;;iGAGiG;AACjG,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,mBAAmB,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED;;;;;mGAKmG;AACnG,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,aAAa,CAAC;CAC9B,GAAG,OAAO,CAAC,OAAO,CAAC,CAenB;AAED;;;;iDAIiD;AACjD,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED;;qCAEqC;AACrC,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+B/B"}
+{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../src/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGvE,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhF,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAED;iFACiF;AACjF,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;yDACyD;AACzD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAgB9D;AAED;;sDAEsD;AACtD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,GAAG,IAAI,CAIhE;AAED;8EAC8E;AAC9E,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM/C;AAED;8EAC8E;AAC9E,wBAAgB,eAAe,CAC7B,GAAG,EAAE,aAAa,GAAG,SAAS,EAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,OAAO,CAET;AAED;8EAC8E;AAC9E,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,aAAa,GAAG,SAAS,EAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;8CAI8C;AAC9C,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,aAAa,GAAG,SAAS,EAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,aAAa,CAEf;AAED;;wFAEwF;AACxF,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED,iEAAiE;AACjE,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAEpC;AAED,4DAA4D;AAC5D,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAEtF;AAED;gFACgF;AAChF,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;wFACwF;AACxF,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxF;AAYD;;;iGAGiG;AACjG,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,mBAAmB,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED;;;;;mGAKmG;AACnG,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,aAAa,CAAC;CAC9B,GAAG,OAAO,CAAC,OAAO,CAAC,CAUnB;AAED;;;;iDAIiD;AACjD,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAED;;qCAEqC;AACrC,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0B/B"}