@cotal-ai/core 0.29.2 → 0.30.0

package/dist/identity.d.ts

@@ -91,6 +91,9 @@ export declare function credsClaims(creds: string): {
  *  mismatch, not a cred to keep silently forever. Shared by the endpoint's `delivery.creds` renewal
  *  and the membership feed's rw-cred renewal so the 75% convention is defined once. */
 export declare function credsRenewalDelayMs(creds: string): number;
+/** Combine a host-signed user JWT with a locally held matching user nkey seed. The seed never
+ * crosses the authority protocol; this is the participant-side materialization step. */
+export declare function credsFromJwt(jwt: string, identity: Identity): string;
 /** The full identity (id + seed) carried by a creds file — what a standing-renewal REMINTER needs:
  *  re-signing a fresh JWT for the file's EXISTING nkey (never a new one) is what lets the renewed
  *  cred pass the endpoint's identity pin, so renewal can never silently swap who a daemon is. Same

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;oFACoF;AACpF,wBAAgB,WAAW,IAAI,QAAQ,CAItC;AAED;;;;qFAIqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;CACrC;AAED;8EAC8E;AAC9E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAGnE;AAED;+FAC+F;AAC/F,wBAAgB,iBAAiB,IAAI,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAGrE;AAED;;;;;kBAKkB;AAClB,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;4CAE4C;AAC5C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED;;;;;;;;;;;;;oCAaoC;AACpC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAatD;AAED;;;;;;;;;;6FAU6F;AAC7F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;;6FAG6F;AAC7F,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAQpH;AAED;;;;;uFAKuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;yEAGyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAWzD"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;oFACoF;AACpF,wBAAgB,WAAW,IAAI,QAAQ,CAItC;AAED;;;;qFAIqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;CACrC;AAED;8EAC8E;AAC9E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAGnE;AAED;+FAC+F;AAC/F,wBAAgB,iBAAiB,IAAI,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAGrE;AAED;;;;;kBAKkB;AAClB,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;4CAE4C;AAC5C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED;;;;;;;;;;;;;oCAaoC;AACpC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAatD;AAED;;;;;;;;;;6FAU6F;AAC7F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;;6FAG6F;AAC7F,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAQpH;AAED;;;;;uFAKuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;wFACwF;AACxF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAQpE;AAED;;;yEAGyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAWzD"}

package/dist/identity.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { fmtCreds } from "@nats-io/jwt";
 import { createUser, fromSeed } from "@nats-io/nkeys";
 /** Generate a fresh user nkey identity locally. The seed is derived here and never
  *  leaves the generating process except as a creds file handed to its own agent. */
@@ -114,6 +115,17 @@ export function credsRenewalDelayMs(creds) {
     const expMs = claims.exp * 1000;
     return iatMs + 0.75 * (expMs - iatMs) - Date.now();
 }
+/** Combine a host-signed user JWT with a locally held matching user nkey seed. The seed never
+ * crosses the authority protocol; this is the participant-side materialization step. */
+export function credsFromJwt(jwt, identity) {
+    const claims = JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8"));
+    if (claims.sub !== identity.id)
+        throw new Error(`JWT subject ${String(claims.sub)} != local identity ${identity.id}`);
+    const kp = fromSeed(new TextEncoder().encode(identity.seed));
+    if (kp.getPublicKey() !== identity.id)
+        throw new Error(`local identity seed does not match ${identity.id}`);
+    return new TextDecoder().decode(fmtCreds(jwt, kp));
+}
 /** The full identity (id + seed) carried by a creds file — what a standing-renewal REMINTER needs:
  *  re-signing a fresh JWT for the file's EXISTING nkey (never a new one) is what lets the renewed
  *  cred pass the endpoint's identity pin, so renewal can never silently swap who a daemon is. Same

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAcD;8EAC8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,OAAO,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;oCAaoC;AACpC,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC3H,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qDAAsD,CAAW,CAAC,OAAO,0CAA0C,CAAC,CAAC;IAAC,CAAC;IACnJ,MAAM,CAAC,GAAG,MAAuE,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAC7F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yJAAyJ,CAAC,CAAC;IAC7K,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;6FAU6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8E,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;uFAKuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,qDAAqD;IACxF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAChC,MAAM,IAAI,KAAK,CAAC,6KAA6K,CAAC,CAAC;IACjM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAcD;8EAC8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,OAAO,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;oCAaoC;AACpC,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC3H,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qDAAsD,CAAW,CAAC,OAAO,0CAA0C,CAAC,CAAC;IAAC,CAAC;IACnJ,MAAM,CAAC,GAAG,MAAuE,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAC7F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yJAAyJ,CAAC,CAAC;IAC7K,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;6FAU6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8E,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;uFAKuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,qDAAqD;IACxF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAChC,MAAM,IAAI,KAAK,CAAC,6KAA6K,CAAC,CAAC;IACjM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;wFACwF;AACxF,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAkB;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;IACnH,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,QAAQ,CAAC,EAAE;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -62,6 +62,7 @@ export * from "./runtime.js";
 export * from "./terminal.js";
 export * from "./registry.js";
 export * from "./auth-provider.js";
+export * from "./remote-manager-authority.js";
 export * from "./canonical.js";
 export * from "./artifact.js";
 export * from "./parts.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -62,6 +62,7 @@ export * from "./runtime.js";
 export * from "./terminal.js";
 export * from "./registry.js";
 export * from "./auth-provider.js";
+export * from "./remote-manager-authority.js";
 export * from "./canonical.js";
 export * from "./artifact.js";
 export * from "./parts.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/lease.d.ts

@@ -51,12 +51,21 @@ export declare function openDeliveryRegistry(nc: import("@nats-io/transport-node
  *  or the timeout elapses. Used by the CLI's `ensureDelivery` to wait for readiness before the manager
  *  spawns agents (so their boot self-join finds the responder). Connects with the daemon's own scoped
  *  creds (`id` sets the `_INBOX_<id>` prefix the cred's `sub.allow` permits for the kv.get reply).
- *  Returns false on timeout / unreachable — the caller treats it as non-fatal (boot self-join reconciles). */
+ *  Returns false on timeout / unreachable — the caller treats it as non-fatal (boot self-join reconciles).
+ *
+ *  `holder` is WHOSE readiness is being waited for, and it is NOT optional information (#837).
+ *  This used to accept ANY ready lease, which made it answer a question nobody asked: a daemon that
+ *  was SIGKILLed leaves its `ready:true` record behind for the rest of the bucket TTL, so a freshly
+ *  launched replacement that LOST the CAS and exited was reported ready off the corpse's lease —
+ *  `up` printed green with no daemon running at all. Pass the launched daemon's endpoint id
+ *  (`idFromCreds` of the cred it was given) to demand that daemon; pass `undefined` only when
+ *  ADOPTING a daemon that was already running, whose id is genuinely not knowable from here. */
 export declare function waitForDeliveryLease(opts: {
     servers: string;
     space: string;
     creds: string;
     id: string;
+    holder: string | undefined;
     timeoutMs?: number;
 }): Promise<boolean>;
 //# sourceMappingURL=lease.d.ts.map

package/dist/lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAI3C;;;;qEAIqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;4GAK4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B;;;;;8BAK0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf;0GACsG;IACtG,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;6GAC6G;AAC7G,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,EAAE,CAAC,CAEb;AAED;;;;8GAI8G;AAC9G,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BnB"}
+{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAI3C;;;;qEAIqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;4GAK4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B;;;;;8BAK0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf;0GACsG;IACtG,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;6GAC6G;AAC7G,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,EAAE,CAAC,CAEb;AAED;;;;;;;;;;;;gGAYgG;AAChG,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}

package/dist/lease.js

@@ -23,7 +23,15 @@ export async function openDeliveryRegistry(nc, space) {
  *  or the timeout elapses. Used by the CLI's `ensureDelivery` to wait for readiness before the manager
  *  spawns agents (so their boot self-join finds the responder). Connects with the daemon's own scoped
  *  creds (`id` sets the `_INBOX_<id>` prefix the cred's `sub.allow` permits for the kv.get reply).
- *  Returns false on timeout / unreachable — the caller treats it as non-fatal (boot self-join reconciles). */
+ *  Returns false on timeout / unreachable — the caller treats it as non-fatal (boot self-join reconciles).
+ *
+ *  `holder` is WHOSE readiness is being waited for, and it is NOT optional information (#837).
+ *  This used to accept ANY ready lease, which made it answer a question nobody asked: a daemon that
+ *  was SIGKILLed leaves its `ready:true` record behind for the rest of the bucket TTL, so a freshly
+ *  launched replacement that LOST the CAS and exited was reported ready off the corpse's lease —
+ *  `up` printed green with no daemon running at all. Pass the launched daemon's endpoint id
+ *  (`idFromCreds` of the cred it was given) to demand that daemon; pass `undefined` only when
+ *  ADOPTING a daemon that was already running, whose id is genuinely not knowable from here. */
 export async function waitForDeliveryLease(opts) {
     const deadline = Date.now() + (opts.timeoutMs ?? 8000);
     let nc;
@@ -38,9 +46,12 @@ export async function waitForDeliveryLease(opts) {
         while (Date.now() < deadline) {
             const e = await kv.get(leaseKey(0));
             if (e && e.operation !== "DEL" && e.operation !== "PURGE") {
-                // Wait for READY (responder bound), not just lease existence (single-flight slot claimed).
+                // READY (responder bound), not merely lease existence (single-flight slot claimed) — AND
+                // held by the daemon we are waiting for, when the caller named one. A foreign or stale
+                // holder's ready flag says nothing about ours.
                 try {
-                    if (e.json().ready === true)
+                    const info = e.json();
+                    if (info.ready === true && (opts.holder === undefined || info.holder === opts.holder))
                         return true;
                 }
                 catch { /* re-poll */ }

package/dist/lease.js.map

@@ -1 +1 @@
-{"version":3,"file":"lease.js","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAoCzD;6GAC6G;AAC7G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAoD,EACpD,KAAa;IAEb,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;8GAI8G;AAC9G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAM1C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACvD,IAAI,EAAmD,CAAC;IACxD,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvE,WAAW,EAAE,UAAU,IAAI,CAAC,EAAE,EAAE;YAChC,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1D,2FAA2F;gBAC3F,IAAI,CAAC;oBAAC,IAAI,CAAC,CAAC,IAAI,EAAqB,CAAC,KAAK,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"lease.js","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAoCzD;6GAC6G;AAC7G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAoD,EACpD,KAAa;IAEb,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;gGAYgG;AAChG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAO1C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACvD,IAAI,EAAmD,CAAC;IACxD,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvE,WAAW,EAAE,UAAU,IAAI,CAAC,EAAE,EAAE;YAChC,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1D,yFAAyF;gBACzF,uFAAuF;gBACvF,+CAA+C;gBAC/C,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAqB,CAAC;oBACzC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACrG,CAAC;gBAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/provision.d.ts

@@ -5,7 +5,7 @@ import { type EpServeGrant, type EpIssuanceGate } from "./endpoint-service.js";
 import { type Identity } from "./identity.js";
 import { type BackupPermissionScope, type RestorePermissionScope } from "./backup.js";
 /** Cred profiles. Each profile has an explicit permission arm and a D5 lifetime classification. */
-export type Profile = "agent" | "observer" | "admin" | "supervisor" | "provisioner" | "deprovisioner" | "retirement-requester" | "lifecycle-executor" | "endpoint-serve-executor" | "operator" | "purger" | "backup" | "restore" | "delivery" | "membership-rw" | "probe" | "channel-writer" | "channel-purger" | "teardown" | "control-caller-privileged" | "control-caller-admin" | "deployer" | "endpoint-serve" | "goal-writer" | "session-caller" | "session-serving" | "session-ledger" | "endpoint-evictor";
+export type Profile = "agent" | "observer" | "admin" | "supervisor" | "provisioner" | "deprovisioner" | "retirement-requester" | "lifecycle-executor" | "endpoint-serve-executor" | "operator" | "purger" | "backup" | "restore" | "delivery" | "membership-rw" | "probe" | "channel-writer" | "channel-purger" | "teardown" | "control-caller-privileged" | "control-caller-admin" | "deployer" | "endpoint-serve" | "goal-writer" | "session-caller" | "session-serving" | "session-ledger" | "endpoint-evictor" | "remote-manager";
 export type CredentialLifetimeClass = "standing-renewable" | "rotation-renewed" | "one-shot" | "static-operator-managed" | "mixed";
 export type CredentialKind = Profile | "membership-observer" | "connection-evictor";
 export interface CredentialLifetimePolicy {
@@ -281,6 +281,15 @@ export interface MintOpts {
         sessionId: string;
         epoch: number;
     };
+    /** `remote-manager` profile only: the server-derived owner, fixed server-selected actor, and the
+     * ONE locally-selected manager instance id this credential may supervise. REQUIRED for that profile. The builder pins its
+     * manager lease/presence and same-owner provisioning resources; no caller-supplied subject rows
+     * or profile fallback are accepted. */
+    remoteManager?: {
+        instanceId: string;
+        owner: string;
+        actor: string;
+    };
     /** `deployer` profile only: which v0.4 ep instrument set its `launch`/`ps` rows carry. Defaults
      *  to `"admin"` (the static operator's ephemeral deploy cred). The user-mode `deployer` VIEW
      *  mints `"privileged"` instead, so a spawn-scoped deploy reaches the manager where its
@@ -380,6 +389,14 @@ export declare function provisionAgentDurables(provisioner: DurableProvisioner,
  *  `allowSubscribe` (live tail bind-only + per-channel history grants). Every profile is now
  *  enumerated least-privilege — there is no allow-all cred (the former `manager` is deleted). */
 export declare function mintCreds(auth: SpaceAuth, identity: Identity, profile: Profile, opts?: MintOpts): Promise<string>;
+/** Issue a host-signed NATS user JWT for a caller-generated nkey. The private seed stays with
+ * the remote manager. This is deliberately narrower than {@link mintCreds}: only the typed remote
+ * manager protocol may request it, and every profile still goes through the same permission and
+ * lifetime builders. */
+export declare function mintPublicUserJwt(auth: SpaceAuth, publicId: string, profile: Profile, opts: MintOpts): Promise<{
+    jwt: string;
+    exp: number;
+}>;
 /** Build the NATS user permission object for a profile: a default-deny allow-list scoped to
  *  exactly what each profile does. Every profile is now enumerated least-privilege — the former
  *  allow-all `manager` is gone (its roles split across supervisor/provisioner/operator/purger and the

package/dist/provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAkCL,KAAK,iBAAiB,EAWvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAMhI,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,mGAAmG;AACnG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,oBAAoB,GACpB,yBAAyB,GACzB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,GAKhB,aAAa,GAGb,gBAAgB,GAKhB,iBAAiB,GAKjB,gBAAgB,GAQhB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,4GAA4G;IAC5G,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CA+BjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;;;;;;;2EAS2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;2EAKuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;0EAO0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,UAAU,EAAE,gBAAgB;CAAG;AAElE;;uGAEuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAG9F;AAED;qEACqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAcpG;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;yGAEyG;AACzG,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB7E;AAED;;;;;;;mGAOmG;AACnG,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED;;sEAEsE;AACtE,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBzG;AAED;;iFAEiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;sGAKkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;sFAUkF;IAClF,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;mGAS+F;IAC/F,mBAAmB,CAAC,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAC1C;4FACoF;QACpF,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IACF;;;;;;;oEAOgE;IAChE,iBAAiB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;;;;;;;;kCAQ8B;IAC9B,qBAAqB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;kCAE8B;IAC9B,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;;;8DAG0D;IAC1D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;;8DAG0D;IAC1D,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;+BAI2B;IAC3B,WAAW,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IACrC;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAoBD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;0EAEsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAED;;;;;;;;;;;;2FAY2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmYzB;AAy7BD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;;;;;;;;;;oFAUoF;AACpF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;CAC5B,GAAG,MAAM,CAST;AAkBD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;mEAI+D;IAC/D,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;kEAI8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8DAC0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,MAAM,CAwCR"}
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAkCL,KAAK,iBAAiB,EAWvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAMhI,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,mGAAmG;AACnG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,oBAAoB,GACpB,yBAAyB,GACzB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,GAKhB,aAAa,GAGb,gBAAgB,GAKhB,iBAAiB,GAKjB,gBAAgB,GAQhB,kBAAkB,GAGlB,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,4GAA4G;IAC5G,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAgCjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;;;;;;;2EAS2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;2EAKuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;0EAO0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,UAAU,EAAE,gBAAgB;CAAG;AAElE;;uGAEuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAG9F;AAED;qEACqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAcpG;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;yGAEyG;AACzG,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB7E;AAED;;;;;;;mGAOmG;AACnG,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED;;sEAEsE;AACtE,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBzG;AAED;;iFAEiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;sGAKkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;sFAUkF;IAClF,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;mGAS+F;IAC/F,mBAAmB,CAAC,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAC1C;4FACoF;QACpF,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IACF;;;;;;;oEAOgE;IAChE,iBAAiB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;;;;;;;;kCAQ8B;IAC9B,qBAAqB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;kCAE8B;IAC9B,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;;;8DAG0D;IAC1D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;;8DAG0D;IAC1D,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;2CAGuC;IACvC,aAAa,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE;;;;+BAI2B;IAC3B,WAAW,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IACrC;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAoBD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;0EAEsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAED;;;wBAGwB;AACxB,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BvC;AAED;;;;;;;;;;;;2FAY2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0YzB;AA0/BD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;;;;;;;;;;oFAUoF;AACpF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;CAC5B,GAAG,MAAM,CAST;AAkBD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;mEAI+D;IAC/D,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;kEAI8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8DAC0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,MAAM,CAwCR"}

package/dist/provision.js

@@ -72,6 +72,7 @@ export const CREDENTIAL_LIFETIMES = {
     "session-serving": { class: "one-shot", defaultTtlSeconds: 24 * 60 * 60, note: "per-session SERVING cred (P2 item 6): rails-only for ONE §13.6 session, the mirror of session-caller with the directions swapped; minted at redemption and TTL-BOUND to the session (the 24h default is the SESSION_GRANT_MAX_TTL ceiling, never a standing lifetime); NEVER renewed - a new session mints a new cred, and the session's terminal revokes this one by name" },
     "session-ledger": { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "manager", note: "manager's session LEDGER (P2 item 6): the dedicated sessions-bucket `session.<id>` rows and NOTHING else - no session rail of any shape. Standing because SPEC 13.6 makes it the durable revocation authority that must survive the serving endpoint; the manager re-mints for the SAME nkey on the half-TTL loop (the goal-writer precedent)" },
     "endpoint-evictor": { class: "one-shot", defaultTtlSeconds: 60, note: "one re-registration's verify-evict window (P2 item 3): a scoped delivery-admin caller that kicks+verifies the SUPERSEDED serve family before the epoch advances; 60s bounds a copied cred to a minute" },
+    "remote-manager": { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "auth-service", note: "the scoped remote manager lifecycle: own lease/presence plus same-owner agent provisioning; issued only by the typed supervise protocol, never by cotal mint or a raw view/profile string" },
     "membership-observer": { class: "rotation-renewed", defaultTtlSeconds: ROTATION_RENEWED_TTL_SEC, renewalOwner: "system-account rotation", note: "$SYS-account CONNZ observer; NOT online-renewable ($SYS seed dies at `up`) - bounded exp, renewed only by rotateSystemAccount + broker restart; doctor warns near expiry" },
     "connection-evictor": { class: "rotation-renewed", defaultTtlSeconds: ROTATION_RENEWED_TTL_SEC, renewalOwner: "system-account rotation", note: "$SYS-account KICK-only live-eviction cred (D5 slice 4); same rotation-renewed posture as the observer" },
 };
@@ -400,6 +401,41 @@ export async function mintCreds(auth, identity, profile, opts = {}) {
     }
     return creds;
 }
+/** Issue a host-signed NATS user JWT for a caller-generated nkey. The private seed stays with
+ * the remote manager. This is deliberately narrower than {@link mintCreds}: only the typed remote
+ * manager protocol may request it, and every profile still goes through the same permission and
+ * lifetime builders. */
+export async function mintPublicUserJwt(auth, publicId, profile, opts) {
+    if (!/^U[A-Z2-7]{55}$/.test(publicId))
+        throw new Error("mintPublicUserJwt: publicId must be a user nkey");
+    if (!["remote-manager", "endpoint-serve", "goal-writer", "session-ledger", "session-serving"].includes(profile))
+        throw new Error(`mintPublicUserJwt: profile "${profile}" is not part of the closed remote manager protocol`);
+    const pr = {
+        owner: opts.principal?.owner ?? DEV_OWNER,
+        actor: opts.principal?.actor ?? publicId,
+        connId: publicId,
+        ...(opts.lifecycleUid ? { lifecycleUid: opts.lifecycleUid } : {}),
+    };
+    const perms = profile === "endpoint-serve"
+        ? endpointServePermissions(auth.space, pr, opts)
+        : permissionsFor(profile, auth.space, pr, opts);
+    const validDates = userValidDates(profile, opts);
+    if (validDates.exp === undefined)
+        throw new Error(`mintPublicUserJwt: profile "${profile}" must be bounded`);
+    const jwt = await encodeUser(profile, fromPublic(publicId), fromPublic(auth.account.pub), { ...perms, tags: principalTags(pr.owner, pr.actor) }, { signer: fromSeed(new TextEncoder().encode(auth.account.signingSeed)), ...validDates });
+    if (profile === "endpoint-serve") {
+        if (!opts.serveIssuance)
+            throw new Error("mintPublicUserJwt: endpoint-serve requires serveIssuance");
+        await finalizeServeIssuance(opts.serveIssuance, opts.endpointServe, {
+            credentialId: rawDigest(jwt).replace("sha256:", "sha256-"),
+            credentialKey: publicId,
+            holderActor: pr.actor,
+            sourceChain: ["root"],
+            exp: validDates.exp,
+        });
+    }
+    return { jwt, exp: validDates.exp };
+}
 /** Build the NATS user permission object for a profile: a default-deny allow-list scoped to
  *  exactly what each profile does. Every profile is now enumerated least-privilege — the former
  *  allow-all `manager` is gone (its roles split across supervisor/provisioner/operator/purger and the
@@ -489,6 +525,13 @@ export function permissionsFor(profile, space, pr, opts) {
         }, caller);
         return { pub: { allow: rows }, sub: { allow: [epCallerReplyFilter(space, caller), `_INBOX_${pr.connId}.>`] } };
     }
+    if (profile === "manager-service")
+        throw new Error('permissionsFor: "manager-service" is not a generic profile; use the typed remote manager authority protocol');
+    if (profile === "remote-manager") {
+        if (!opts.remoteManager)
+            throw new Error('permissionsFor: "remote-manager" requires opts.remoteManager ({instanceId, owner} of the authorized manager lifecycle)');
+        return remoteManagerPermissions(space, pr, opts.remoteManager);
+    }
     if (profile === "endpoint-evictor") {
         // P2 item 3 (slice 3a): a SCOPED delivery-admin caller for ONE re-registration's verify-evict.
         // Publish EXACTLY this credential's OWN delivery-admin control subject + $JS.API.INFO; subscribe
@@ -866,6 +909,66 @@ function supervisorPermissions(space, pr) {
         },
     };
 }
+/** The long-lived REMOTE MANAGER base credential. This is intentionally smaller than the local
+ * supervisor+provisioner union: it registers only its own manager presence, holds only its own
+ * manager-instance lease key, and may provision only lifecycle-keyed resources under its derived
+ * owner. Endpoint registration, contract publication and serving use separate instance-pinned
+ * credentials returned by the same typed host protocol. Per-agent provisioning deliberately does
+ * NOT ride this credential: NATS consumer names are single tokens, so a broker grant cannot safely
+ * express a prefix wildcard inside `dm_<owner>-<actor>-<uid>`. That operation stays on the host's
+ * authenticated provisioning protocol, where the requested descendant is fresh-validated before
+ * an exact one-shot grant is used. */
+function remoteManagerPermissions(space, pr, pin) {
+    if (pin.owner !== pr.owner)
+        throw new Error(`permissionsFor: remote-manager owner ${JSON.stringify(pin.owner)} does not match the authenticated principal owner ${JSON.stringify(pr.owner)}`);
+    const iid = assertLifecycleToken(pin.instanceId, "remote manager instanceId");
+    const allowedActors = new Set([`manager_${iid}`, `manager_exec_${iid}`]);
+    if (!allowedActors.has(pin.actor) || pr.actor !== pin.actor)
+        throw new Error(`permissionsFor: remote-manager actor must be the server-selected manager_${iid} or manager_exec_${iid} for instance ${iid}`);
+    const PKV = `KV_${presenceBucket(space)}`;
+    const MKV = `KV_${managerBucket(space)}`;
+    const AUTH = epAuthBucket(space);
+    const REC = recordsBucket(space);
+    const gateKey = epgateKey("manager", iid);
+    const credPrefix = epcredFamilyPrefix("manager", iid);
+    const recordKeys = [
+        recordSpecKey(RECORD_KINDS.svc, ["manager", iid]),
+        recordStatusKey(RECORD_KINDS.svc, ["manager", iid]),
+        recordAtomicKey(GOVERN_HEAD, ["manager"]),
+    ];
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO",
+                // Own manager-instance lease only. The local supervisor profile spans lease.* because one
+                // host manages every local instance; a remote user grant must not.
+                `$JS.API.STREAM.INFO.${MKV}`,
+                `$JS.API.STREAM.MSG.GET.${MKV}`,
+                `$KV.${managerBucket(space)}.${MANAGER_LEASE_KEY}.${iid}`,
+                // Own presence key + roster watch.
+                `$KV.${presenceBucket(space)}.${principalKey(pr.owner, pr.actor).key}`,
+                `$JS.API.STREAM.INFO.${PKV}`,
+                `$JS.API.CONSUMER.CREATE.${PKV}.>`,
+                `$JS.API.CONSUMER.INFO.${PKV}.>`,
+                "$JS.FC.>",
+                // This instance's manager service registration + credential family only.
+                `$KV.${AUTH}.${gateKey}`,
+                `$KV.${AUTH}.${credPrefix}.>`,
+                ...recordKeys.map((key) => `$KV.${REC}.${key}`),
+                `${spacePrefix(space)}.epc.*`,
+                `$JS.API.DIRECT.GET.${epcStreamName(space)}.${spacePrefix(space)}.epc.>`,
+                `$JS.API.DIRECT.GET.${epcStreamName(space)}`,
+                `$JS.API.STREAM.MSG.GET.KV_${AUTH}`,
+                `$JS.API.CONSUMER.CREATE.KV_${AUTH}.>`,
+                `$JS.API.CONSUMER.INFO.KV_${AUTH}.>`,
+                `$JS.API.CONSUMER.DELETE.KV_${AUTH}.>`,
+                ...recordKeys.map((key) => `$JS.API.DIRECT.GET.KV_${REC}.$KV.${REC}.${key}`),
+                `$JS.API.STREAM.MSG.GET.KV_${REC}`,
+            ],
+        },
+        sub: { allow: [`_INBOX_${pr.connId}.>`] },
+    };
+}
 /** The human-CLI OPERATOR permission set (closure (ii), residual 2) — the ephemeral key the headless
  *  client commands mint (`cotal send dm|msg|ask`, `cotal dm`, `personas list --running`, via
  *  `openTransient`). It does exactly what those do: POST as itself (chat/DM/anycast — self-scoped, can