@cotal-ai/core 0.48.1 → 0.49.0

package/dist/issued-authority.js

@@ -0,0 +1,497 @@
+/**
+ * Issued authority (SPEC §13.15): binding one invocation to an IMMUTABLE, issuer-accepted
+ * permission ceiling, separate from caller identity.
+ *
+ * `EpCaller` says who is calling. An issued authority says what the credential they are calling
+ * with was granted, as the issuer accepted it, and it is what a hosted effect performed on the
+ * caller's behalf is confined by. It rides the request subject on a versioned rail
+ * (`ep.v1`, the generation second-to-last before the nonce), so the broker pins it with the same
+ * grant discipline that pins the caller triple: a credential can publish under exactly the
+ * generation its rows name, and a legacy credential cannot publish on the versioned rail at all.
+ *
+ * Three things live here, in the order an issuance runs them:
+ *  - the reference and the permission model (what a ceiling IS: explicit `all`/`none`/`patterns`
+ *    allow plus deny, imported from the native JWT fragment so an omitted list can never read as
+ *    a narrow one);
+ *  - the evidence store (`cotal_issued_<space>`): immutable evidence, a one-field attempt row
+ *    whose state is `prepared | active | aborted | revoked`, and a reverse index from each source
+ *    gate to the issuances that depend on it. Create-only; a generation is never reused;
+ *    activation is a CAS at the revision the prepare observed;
+ *  - the accepted row (`cotal_accepted_<space>`): how a connected client learns which generation
+ *    the issuer bound, by reading one row keyed by a token it chose, over a per-key `DIRECT.GET`
+ *    grant its ceiling carries. The client never trusts what it proposed or what a file says.
+ *
+ * What this does NOT establish: that a request arriving on a generation-pinned subject was
+ * published by the grant holder. Origin is a property of the current grant set (no peer-held
+ * profile pairs a write with a raw stream read on one stream), guarded by the auth census, and
+ * mediated reads stay the remedy.
+ */
+import { randomBytes } from "node:crypto";
+import { DiscardPolicy } from "@nats-io/jetstream";
+import { canonicalJson, rawDigest } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { isCasLoss } from "./endpoint-records.js";
+import { assertGeneration, callerTokens, endpointToken } from "./endpoint-subjects.js";
+export { assertGeneration, isIssuedCaller, EP_RAIL_V1 } from "./endpoint-subjects.js";
+import { subjectMatches, token } from "./subjects.js";
+/** A fresh generation: 128 bits, hex. Chosen by the ISSUER, never by the client. */
+export function mintGeneration() {
+    return randomBytes(16).toString("hex");
+}
+/** A fresh accepted-row token: same grammar, chosen by the party that will connect. */
+export function mintAcceptedToken() {
+    return randomBytes(16).toString("hex");
+}
+function refSnapshot(value) {
+    closed(value, ["space", "owner", "actor", "uid", "generation"], "issued reference");
+    endpointToken(value.space);
+    callerTokens(value);
+    assertGeneration(value.generation);
+    return Object.freeze({ space: value.space, owner: value.owner, actor: value.actor, uid: value.uid, generation: value.generation });
+}
+function closed(value, keys, label) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)
+        || (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null))
+        throw new Error(`${label} must be a plain record`);
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== "string" || !keys.includes(key))
+            throw new Error(`${label} carries an unsupported field ${String(key)}`);
+        if (!Object.hasOwn(Object.getOwnPropertyDescriptor(value, key), "value"))
+            throw new Error(`${label} cannot carry accessors`);
+    }
+    return value;
+}
+function subjectToken(value, pattern) {
+    if (typeof value !== "string" || value.length === 0 || /\s/u.test(value)
+        || [...value].some((ch) => ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127))
+        throw new Error("a subject must be nonempty without whitespace or control characters; queue-qualified forms are not a ceiling entry");
+    const parts = value.split(".");
+    for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (!part || (part.includes("*") && (!pattern || part !== "*"))
+            || (part.includes(">") && (!pattern || part !== ">" || i !== parts.length - 1)))
+            throw new Error(`subject "${value}" has an invalid token or wildcard`);
+    }
+    return value;
+}
+function patterns(value) {
+    if (!Array.isArray(value))
+        throw new Error("subject patterns must be an explicit array");
+    return Object.freeze(value.map((entry) => subjectToken(entry, true)));
+}
+function permission(allow, deny) {
+    return Object.freeze({ allow: Object.freeze(allow), deny });
+}
+/** Read a stored permission value back, refusing every shape but the explicit one. */
+export function readIssuedSubjectPermission(value) {
+    const raw = closed(value, ["allow", "deny"], "subject permission");
+    const allow = closed(raw.allow, ["mode", "patterns"], "subject allow");
+    const deny = patterns(raw.deny);
+    if (allow.mode === "all" || allow.mode === "none") {
+        if (Object.hasOwn(allow, "patterns"))
+            throw new Error("only patterns mode carries a patterns field");
+        return permission({ mode: allow.mode }, deny);
+    }
+    if (allow.mode !== "patterns")
+        throw new Error("unsupported subject allow mode");
+    const listed = patterns(allow.patterns);
+    if (listed.length === 0)
+        throw new Error("patterns mode requires a nonempty list");
+    return permission({ mode: "patterns", patterns: listed }, deny);
+}
+export function readIssuedSubjectPermissions(value) {
+    const raw = closed(value, ["publish", "subscribe"], "issued permissions");
+    return Object.freeze({ publish: readIssuedSubjectPermission(raw.publish), subscribe: readIssuedSubjectPermission(raw.subscribe) });
+}
+/** The native NATS fragment (`{pub, sub}` with `allow`/`deny` lists) as the JWT carries it: an
+ *  omitted or empty allow is UNRESTRICTED subject to denies. This is the one importer, and it
+ *  takes the fragment, never a whole JWT: `resp` and queue-qualified rows need semantics of their
+ *  own and are refused rather than dropped. */
+export function importNativeSubjectPermissions(value) {
+    const raw = closed(value, ["pub", "sub"], "native permissions");
+    const direction = (v) => {
+        if (v === undefined)
+            return permission({ mode: "all" }, Object.freeze([]));
+        const r = closed(v, ["allow", "deny"], "native subject permission");
+        const allow = Object.hasOwn(r, "allow") ? patterns(r.allow) : Object.freeze([]);
+        const deny = Object.hasOwn(r, "deny") ? patterns(r.deny) : Object.freeze([]);
+        return permission(allow.length ? { mode: "patterns", patterns: allow } : { mode: "all" }, deny);
+    };
+    for (const key of ["pub", "sub"])
+        if (Object.hasOwn(raw, key) && raw[key] === undefined)
+            throw new Error("an explicit native direction must not be undefined");
+    return Object.freeze({ publish: direction(raw.pub), subscribe: direction(raw.sub) });
+}
+/** Does the ceiling permit ONE concrete subject? Deny wins; `none` permits nothing. */
+export function issuedPermitsSubject(value, concrete) {
+    const parsed = readIssuedSubjectPermission(value);
+    subjectToken(concrete, false);
+    if (parsed.deny.some((pattern) => subjectMatches(pattern, concrete)))
+        return false;
+    if (parsed.allow.mode === "none")
+        return false;
+    return parsed.allow.mode === "all" || parsed.allow.patterns.some((pattern) => subjectMatches(pattern, concrete));
+}
+/** Does policy pattern `cap` cover EVERY subject `pattern` matches? Token-wise, both in the
+ *  NATS grammar; a non-terminal `>` on either side fails closed. */
+function patternCovers(cap, pattern) {
+    const c = cap.split(".");
+    const p = pattern.split(".");
+    if (c.slice(0, -1).includes(">") || p.slice(0, -1).includes(">"))
+        return false;
+    for (let i = 0; i < c.length; i++) {
+        if (c[i] === ">")
+            return p.length > i;
+        if (i >= p.length)
+            return false;
+        if (c[i] === "*") {
+            if (p[i] === ">")
+                return false;
+            continue;
+        }
+        if (c[i] !== p[i])
+            return false;
+    }
+    return c.length === p.length;
+}
+/** Could patterns `a` and `b` match one common subject? Conservative: a `>` on either side past
+ *  the common prefix counts as overlap. */
+function patternsOverlap(a, b) {
+    const x = a.split(".");
+    const y = b.split(".");
+    const n = Math.max(x.length, y.length);
+    for (let i = 0; i < n; i++) {
+        const s = x[i], t = y[i];
+        if (s === ">" || t === ">")
+            return true;
+        if (s === undefined || t === undefined)
+            return false;
+        if (s === "*" || t === "*")
+            continue;
+        if (s !== t)
+            return false;
+    }
+    return true;
+}
+/** Does the ceiling permit a SUBSCRIPTION whose filter is `pattern` (which may carry wildcards)?
+ *  Every subject the filter could deliver must sit inside one allow entry, and no deny entry may
+ *  overlap it: a subscription is a claim over a set of subjects, so a partial cover is a refusal,
+ *  never a narrower grant invented on the caller's behalf. */
+export function issuedPermitsPattern(value, pattern) {
+    const parsed = readIssuedSubjectPermission(value);
+    subjectToken(pattern, true);
+    if (parsed.deny.some((d) => patternsOverlap(d, pattern)))
+        return false;
+    if (parsed.allow.mode === "none")
+        return false;
+    return parsed.allow.mode === "all" || parsed.allow.patterns.some((a) => patternCovers(a, pattern));
+}
+/** The per-space evidence store. `allow_direct=false`: every read here is a fence (leader-served,
+ *  revision-pinned), and Direct Get's follower reads would defeat read-your-writes. */
+export function issuedBucket(space) {
+    return `cotal_issued_${token(space)}`;
+}
+/** The per-space accepted-row store. Its own bucket, and `allow_direct` ON: per-key scoping is
+ *  only expressible on a `DIRECT.GET` grant, and a stream-wide `STREAM.MSG.GET` on a shared bucket
+ *  would let a client read every other client's row. */
+export function acceptedBucket(space) {
+    return `cotal_accepted_${token(space)}`;
+}
+export function issuedEvidenceKey(ref) {
+    const snap = refSnapshot(ref);
+    return `v1.${callerTokens(snap).join(".")}.${snap.generation}`;
+}
+export function issuedAttemptKey(ref) {
+    return `attempt.${issuedEvidenceKey(ref)}`;
+}
+function sourceSnapshot(value) {
+    closed(value, ["space", "bucket", "key"], "issued source");
+    endpointToken(value.space);
+    if (typeof value.bucket !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(value.bucket)
+        || typeof value.key !== "string" || value.key.length > 1024
+        || !/^[a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*$/.test(value.key))
+        throw new Error("invalid issued source coordinate");
+    return Object.freeze({ space: value.space, bucket: value.bucket, key: value.key });
+}
+/** The reverse index prefix for one source: `bysource.v1.<sha256([1, space, bucket, key])>.`.
+ *  The digest keeps the key one token; the generation suffix on the full key is load-bearing, since
+ *  without it a reused root credential id would merge two issuances into one entry. */
+export function issuedSourcePrefix(source) {
+    const s = sourceSnapshot(source);
+    return `bysource.v1.${rawDigest(JSON.stringify([1, s.space, s.bucket, s.key])).slice("sha256:".length)}.`;
+}
+export function issuedSourceIndexKey(source, ref) {
+    if (source.space !== ref.space)
+        throw new Error("an issued source names a foreign space");
+    return issuedSourcePrefix(source) + issuedEvidenceKey(ref).slice("v1.".length);
+}
+function evidenceSnapshot(value) {
+    const raw = closed(value, ["version", "ref", "sources", "permissions", "expiresAt"], "issued evidence");
+    if (raw.version !== 1 || !Array.isArray(raw.sources))
+        throw new Error("unsupported issued evidence");
+    const ref = refSnapshot(raw.ref);
+    const sources = Object.freeze(raw.sources.map(sourceSnapshot));
+    for (const source of sources)
+        if (source.space !== ref.space)
+            throw new Error("an issued source names a foreign space");
+    if (new Set(sources.map(issuedSourcePrefix)).size !== sources.length)
+        throw new Error("duplicate issued source");
+    const expiresAt = raw.expiresAt;
+    if (expiresAt !== undefined && (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt <= 0))
+        throw new Error("issued evidence expiresAt must be a positive integer (unix seconds)");
+    if (sources.length === 0 && expiresAt === undefined)
+        throw new Error("an issuance bound to no source gate must carry expiresAt; nothing else can end its liveness");
+    const permissions = readIssuedSubjectPermissions(raw.permissions);
+    return Object.freeze({ version: 1, ref, sources, permissions, ...(expiresAt !== undefined ? { expiresAt } : {}) });
+}
+/** The broker-enforced part of every authority store's immutability (SPEC 13.12): no rollup
+ *  header, no message delete, no purge. The records store carries the same three. */
+export const AUTHORITY_STORE_IMMUTABLE_FLAGS = Object.freeze({ allow_rollup_hdrs: false, deny_delete: true, deny_purge: true });
+/** Write-once per key: one message per subject and `discard: new` applied per subject, so the
+ *  broker refuses the SECOND message on a key whatever it carries. Other keys are unaffected. */
+export const WRITE_ONCE_PER_KEY = Object.freeze({ max_msgs_per_subject: 1, discard: DiscardPolicy.New, discard_new_per_subject: true });
+/** Append-only per key: unlimited per-key history, nothing ever removed. A reader that wants the
+ *  row that was created reads the FIRST message on its key. */
+export const APPEND_ONLY_PER_KEY = Object.freeze({ max_msgs_per_subject: -1 });
+/** Every field of `shape` must read back from the broker as set; the mismatches are named. */
+export function assertStoreShape(cfg, shape, bucket, spec) {
+    const drifted = Object.entries(shape).filter(([k, v]) => cfg[k] !== v).map(([k]) => `${k}=${String(cfg[k])}`);
+    if (drifted.length > 0)
+        throw new Error(`the authority store ${bucket} has a drifted shape (${drifted.join(", ")}); an authority store is never silently adopted - reprovision it (${spec})`);
+}
+/** The two issued-authority streams, for the provisioner's create-or-verify inventory. */
+export function issuedStoreStreamNames(space) {
+    return [`KV_${issuedBucket(space)}`, `KV_${acceptedBucket(space)}`];
+}
+const enc = new TextEncoder();
+const dec = new TextDecoder("utf-8", { fatal: true });
+const bytes = (value) => enc.encode(canonicalJson(value));
+export function openIssuedStore(kv, jsm, space) {
+    endpointToken(space);
+    const bucket = issuedBucket(space);
+    const stream = `KV_${bucket}`;
+    const staged = new WeakMap();
+    const own = (ref) => {
+        if (ref.space !== space)
+            throw new Error("issued reference names a foreign space");
+        return issuedEvidenceKey(ref);
+    };
+    // LEADER-SERVED point read. `kv.get` on an `allow_direct=false` bucket already rides
+    // STREAM.MSG.GET, but the fence is stated here rather than inherited from a client default.
+    // `first` reads the FIRST message on the key: the store keeps unlimited per-key history and
+    // removes nothing (see ensureIssuedStores), so the first message on an immutable row's key is
+    // the row that was created, whatever was published on that key since. The attempt row reads
+    // last, because it advances by CAS at the revision the last read observed.
+    async function read(key, at = "last") {
+        let m;
+        try {
+            const subject = `$KV.${bucket}.${key}`;
+            // `next_by_subj` is the wire's first-on-or-after-sequence read (STREAM.MSG.GET, no `seq`
+            // means from the start); the client's request union omits it, the implementation forwards it.
+            const query = (at === "first" ? { next_by_subj: subject } : { last_by_subj: subject });
+            m = await jsm.streams.getMessage(stream, query);
+        }
+        catch (e) {
+            if (e.code === 10037)
+                return undefined;
+            throw e;
+        }
+        if (!m)
+            return undefined;
+        if (m.header?.get("KV-Operation"))
+            throw new EpEnvelopeError("failed-precondition", `issued row ${key} carries a deletion marker; a deletion is never absence (SPEC 13.15)`);
+        return { value: JSON.parse(dec.decode(m.data)), revision: m.seq };
+    }
+    async function readEvidence(ref) {
+        const key = own(ref);
+        const entry = await read(key, "first");
+        if (entry === undefined)
+            throw new EpEnvelopeError("permission-denied", `no issued evidence for generation ${ref.generation}; an unrecorded generation authorizes nothing (SPEC 13.15)`);
+        const evidence = evidenceSnapshot(entry.value);
+        if (canonicalJson(evidence.ref) !== canonicalJson(refSnapshot(ref)))
+            throw new EpEnvelopeError("permission-denied", `issued evidence at ${key} names a different reference; garbled trusted state never authorizes`);
+        return { evidence, digest: rawDigest(canonicalJson(evidence)) };
+    }
+    async function readAttempt(ref, digest) {
+        const key = issuedAttemptKey(ref);
+        const entry = await read(key);
+        if (entry === undefined)
+            throw new EpEnvelopeError("permission-denied", `no issued attempt row at ${key}; evidence without an attempt was never prepared (SPEC 13.15)`);
+        const row = closed(entry.value, ["version", "state", "digest"], "issued attempt");
+        if (row.version !== 1 || row.digest !== digest || !["prepared", "active", "aborted", "revoked"].includes(row.state))
+            throw new EpEnvelopeError("permission-denied", `issued attempt row ${key} is malformed or pins a different evidence digest`);
+        return { state: row.state, revision: entry.revision };
+    }
+    async function retire(ref) {
+        const { digest } = await readEvidence(ref);
+        for (let i = 0; i < 4; i++) {
+            const row = await readAttempt(ref, digest);
+            if (row.state === "aborted" || row.state === "revoked")
+                return row.state;
+            const state = row.state === "prepared" ? "aborted" : "revoked";
+            try {
+                await kv.update(issuedAttemptKey(ref), bytes({ version: 1, state, digest }), row.revision);
+                return state;
+            }
+            catch (error) {
+                if (!isCasLoss(error))
+                    throw error;
+            }
+        }
+        throw new Error(`retiring generation ${ref.generation} lost repeated CAS attempts`);
+    }
+    return Object.freeze({
+        async stage(input) {
+            const evidence = evidenceSnapshot(input);
+            const key = own(evidence.ref);
+            // A fresh generation only: an explicit read refuses first, the create-only CAS is the second line.
+            if (await read(key, "first") !== undefined)
+                throw new EpEnvelopeError("conflict", `generation ${evidence.ref.generation} already has issued evidence; a generation is never reused (SPEC 13.15)`);
+            const digest = rawDigest(canonicalJson(evidence));
+            await kv.create(key, bytes(evidence));
+            const revision = await kv.create(issuedAttemptKey(evidence.ref), bytes({ version: 1, state: "prepared", digest }));
+            for (const source of evidence.sources)
+                await kv.create(issuedSourceIndexKey(source, evidence.ref), bytes({ source, ref: evidence.ref }));
+            const handle = Object.freeze({ key });
+            staged.set(handle, { evidence, revision, digest, consumed: false });
+            return handle;
+        },
+        async release(prepared, finalizeExisting) {
+            const snap = staged.get(prepared);
+            if (snap === undefined || snap.consumed)
+                throw new Error("unknown or already released issuance");
+            snap.consumed = true;
+            try {
+                await finalizeExisting();
+                // At the revision the PREPARE observed, never a re-read one: a retirement that landed in
+                // between wins here, and re-reading would let a released credential ride a revoked attempt.
+                await kv.update(`attempt.${prepared.key}`, bytes({ version: 1, state: "active", digest: snap.digest }), snap.revision);
+            }
+            catch (error) {
+                try {
+                    await retire(snap.evidence.ref);
+                }
+                catch (cleanup) {
+                    throw new AggregateError([error, cleanup], "issuance failed and its retirement is unconfirmed; no material may be released");
+                }
+                throw error;
+            }
+        },
+        retire,
+        async resolve(ref, sourceIsLive, now = () => Math.floor(Date.now() / 1000)) {
+            const { evidence, digest } = await readEvidence(ref);
+            const before = await readAttempt(ref, digest);
+            if (before.state !== "active")
+                throw new EpEnvelopeError("permission-denied", `generation ${ref.generation} is ${before.state}; only an active issuance authorizes (SPEC 13.15)`);
+            if (evidence.expiresAt !== undefined && now() >= evidence.expiresAt)
+                throw new EpEnvelopeError("permission-denied", `generation ${ref.generation} expired at ${evidence.expiresAt} (SPEC 13.15)`);
+            for (const source of evidence.sources) {
+                if (!(await sourceIsLive(source)))
+                    throw new EpEnvelopeError("permission-denied", `generation ${ref.generation} depends on ${source.bucket}/${source.key}, which is no longer live (SPEC 13.15)`);
+            }
+            const after = await readAttempt(ref, digest);
+            if (after.state !== "active" || after.revision !== before.revision)
+                throw new EpEnvelopeError("permission-denied", `generation ${ref.generation} changed during resolution; refused (SPEC 13.15)`);
+            return Object.freeze({ evidence, revision: after.revision });
+        },
+        async confirm(ref, permissions) {
+            const { evidence, digest } = await readEvidence(ref);
+            const row = await readAttempt(ref, digest);
+            if (row.state !== "active")
+                throw new EpEnvelopeError("permission-denied", `generation ${ref.generation} is ${row.state}; a renewal rides an active issuance only (SPEC 13.15)`);
+            if (canonicalJson(evidence.permissions) !== canonicalJson(readIssuedSubjectPermissions(permissions)))
+                throw new EpEnvelopeError("failed-precondition", `generation ${ref.generation} was issued for a different ceiling; a permission change is a fresh generation on a new connection, never a renewal (SPEC 13.15)`);
+        },
+        async retireSource(source) {
+            const s = sourceSnapshot(source);
+            if (s.space !== space)
+                throw new Error("an issued source names a foreign space");
+            let count = 0;
+            const keys = await kv.keys(`${issuedSourcePrefix(s)}>`);
+            for await (const key of keys) {
+                const entry = await read(key, "first");
+                if (entry === undefined)
+                    continue;
+                const index = closed(entry.value, ["source", "ref"], "issued source index");
+                const ref = refSnapshot(index.ref);
+                if (canonicalJson(index.source) !== canonicalJson(s) || key !== issuedSourceIndexKey(s, ref))
+                    throw new Error(`issued source index ${key} does not agree with its own coordinates`);
+                const { evidence } = await readEvidence(ref);
+                if (!evidence.sources.some((x) => canonicalJson(x) === canonicalJson(s)))
+                    throw new Error(`issued source index ${key} names a source absent from its evidence`);
+                await retire(ref);
+                count++;
+            }
+            return count;
+        },
+    });
+}
+/** Create-or-verify the two issued-authority stores. Evidence: `allow_direct=false`, file,
+ *  no eviction. Accepted: `allow_direct=true`, file, no eviction. A drifted store fails loud. */
+export async function ensureIssuedStores(jsm, kvm, space) {
+    // IMMUTABLE AT THE BROKER, not by CAS discipline alone. The `issuer` holds a bucket-wide publish
+    // row on the evidence store, and that row carries a plain replacement of a row, a `Nats-Rollup`
+    // header, a deletion marker and a per-key purge; none is a CAS write, so the create-only CAS
+    // and the deletion-marker read see none of them. The three immutability flags close rollup,
+    // message delete and purge on both stores. What closes plain replacement differs by store:
+    //
+    // - the ACCEPTED store is write-once per key: a row is written once at release and never
+    //   advanced, so the broker refuses any second message on its key, and the client's
+    //   `DIRECT.GET` still serves the one row there is;
+    // - the EVIDENCE store is append-only: the attempt row advances by CAS (`prepared` to `active`
+    //   to a terminal state), so a one-message cap is not an option there. Instead nothing on a key
+    //   is ever removed, and every immutable row (the evidence, the source index) is read as the
+    //   FIRST message on its key, so a later write on the same key is inert to every reader. The
+    //   attempt row is read last-by-key, as its CAS requires.
+    for (const [bucket, direct] of [[issuedBucket(space), false], [acceptedBucket(space), true]]) {
+        const stream = `KV_${bucket}`;
+        const shape = { ...AUTHORITY_STORE_IMMUTABLE_FLAGS, ...(direct ? WRITE_ONCE_PER_KEY : APPEND_ONLY_PER_KEY) };
+        if (await jsm.streams.info(stream).catch(() => undefined) === undefined) {
+            await kvm.create(bucket, { allow_direct: direct });
+            const created = (await jsm.streams.info(stream)).config;
+            await jsm.streams.update(stream, { ...created, ...shape });
+        }
+        const cfg = (await jsm.streams.info(stream)).config;
+        if (cfg.allow_direct !== direct || cfg.storage !== "file" || (cfg.max_age ?? 0) !== 0 || (cfg.max_msgs ?? -1) > 0 || (cfg.max_bytes ?? -1) > 0
+            || !Array.isArray(cfg.subjects) || cfg.subjects.length !== 1 || cfg.subjects[0] !== `$KV.${bucket}.>`)
+            throw new Error(`the issued-authority store ${bucket} has a drifted shape (allow_direct=${String(cfg.allow_direct)}); an authority store is never silently adopted - reprovision it (SPEC 13.15)`);
+        assertStoreShape(cfg, shape, bucket, "SPEC 13.15");
+    }
+}
+// ---- the accepted row ----------------------------------------------------------------------------
+export function acceptedKey(acceptedToken) {
+    return `accepted.v1.${assertGeneration(acceptedToken, "accepted token")}`;
+}
+/** The read grant an issued ceiling carries for exactly its own accepted row and nothing else. */
+export function acceptedReadGrant(space, acceptedToken) {
+    const bucket = acceptedBucket(space);
+    return `$JS.API.DIRECT.GET.KV_${bucket}.$KV.${bucket}.${acceptedKey(acceptedToken)}`;
+}
+/** Written by the issuer at release, create-only: a token is redeemed once. */
+export async function writeAcceptedRow(kv, acceptedToken, ref) {
+    await kv.create(acceptedKey(acceptedToken), bytes({ version: 1, ref: refSnapshot(ref) }));
+}
+/** Read by the CLIENT over its own connection: the reference the ISSUER wrote, so a client that
+ *  proposed or was told a different generation learns the accepted one here. The broker admits
+ *  the read only under the ceiling's per-key grant, which is what binds the answer to the
+ *  credential this connection presented. */
+export async function readAcceptedRow(nc, space, acceptedToken, timeoutMs = 3000) {
+    const bucket = acceptedBucket(space);
+    const response = await nc.request(`$JS.API.DIRECT.GET.KV_${bucket}.$KV.${bucket}.${acceptedKey(acceptedToken)}`, new Uint8Array(0), { timeout: timeoutMs });
+    const status = response.headers?.get("Status");
+    if (status)
+        throw new EpEnvelopeError("permission-denied", `no accepted row for this token (${status}); the connection holds no issued authority (SPEC 13.15)`);
+    const row = closed(JSON.parse(dec.decode(response.data)), ["version", "ref"], "accepted row");
+    if (row.version !== 1)
+        throw new Error("unsupported accepted-row version");
+    const ref = refSnapshot(row.ref);
+    if (ref.space !== space)
+        throw new EpEnvelopeError("permission-denied", "the accepted row names a foreign space");
+    return ref;
+}
+/** The named refusal an endpoint returns for a legacy (unversioned) invocation of a command
+ *  that requires issued authority (SPEC §13.15 compatibility). */
+/** `details[].kind` of the refusal a command requiring issued caller authority returns to a
+ *  LEGACY arrival: the request rode the unversioned rail, so no generation binds it (SPEC 13.15). */
+export const EP_UNBOUND_CALLER_AUTHORITY = "ai.cotal.ep.unbound-caller-authority";
+//# sourceMappingURL=issued-authority.js.map

package/dist/issued-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issued-authority.js","sourceRoot":"","sources":["../src/issued-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAA0C,MAAM,oBAAoB,CAAC;AAG3F,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAiB,MAAM,wBAAwB,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAqB,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAWtD,oFAAoF;AACpF,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACpF,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;AACrI,CAAC;AAuBD,SAAS,MAAM,CAAC,KAAc,EAAE,IAAuB,EAAE,KAAa;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAClE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5H,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAE,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IAChI,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,OAAgB;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;WACnE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;IACxI,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;eAC1D,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,oCAAoC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB,EAAE,IAAuB;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrG,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACnF,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACrI,CAAC;AAED;;;+CAG+C;AAC/C,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,CAAC,CAAU,EAA2B,EAAE;QACxD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,2BAA2B,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAClG,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC/J,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,KAA8B,EAAE,QAAgB;IACnF,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAClD,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;oEACoE;AACpE,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED;2CAC2C;AAC3C,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS;QACrC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;8DAG8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,KAA8B,EAAE,OAAe;IAClF,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAClD,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACrG,CAAC;AA8BD;uFACuF;AACvF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,gBAAgB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;wDAEwD;AACxD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,kBAAkB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,OAAO,WAAW,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,eAAe,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;WAC/E,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI;WACxD,CAAC,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;uFAEuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,eAAe,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAuB,EAAE,GAAuB;IACnF,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC1F,OAAO,kBAAkB,CAAC,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACxG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAyB,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAE,GAAG,CAAC,OAA6B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACxH,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC;QAClH,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,KAAK,SAAS;QACjD,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,MAAM,WAAW,GAAG,4BAA4B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AA0CD;qFACqF;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAChI;iGACiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;AACxI;+DAC+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,GAA4B,EAAE,KAA8B,EAAE,MAAc,EAAE,IAAY;IACzH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,IAAI,GAAG,CAAC,CAAC;AAC1K,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,MAAM,KAAK,GAAG,CAAC,KAAc,EAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAE/E,MAAM,UAAU,eAAe,CAAC,EAAM,EAAE,GAAqB,EAAE,KAAa;IAC1E,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuG,CAAC;IAClI,MAAM,GAAG,GAAG,CAAC,GAAuB,EAAU,EAAE;QAC9C,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACnF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,qFAAqF;IACrF,4FAA4F;IAC5F,4FAA4F;IAC5F,8FAA8F;IAC9F,4FAA4F;IAC5F,2EAA2E;IAC3E,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAuB,MAAM;QAC5D,IAAI,CAAC,CAAC;QACN,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,MAAM,IAAI,GAAG,EAAE,CAAC;YACvC,yFAAyF;YACzF,8FAA8F;YAC9F,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAe,CAAC;YACrG,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC/D,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;YAC/B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,cAAc,GAAG,sEAAsE,CAAC,CAAC;QAC5I,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACpE,CAAC;IACD,KAAK,UAAU,YAAY,CAAC,GAAuB;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,qCAAqC,GAAG,CAAC,UAAU,4DAA4D,CAAC,CAAC;QACzL,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAuB,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sBAAsB,GAAG,sEAAsE,CAAC,CAAC;QAClJ,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,KAAK,UAAU,WAAW,CAAC,GAAuB,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,4BAA4B,GAAG,+DAA+D,CAAC,CAAC;QACxK,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAClF,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAe,CAAC;YAC3H,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sBAAsB,GAAG,mDAAmD,CAAC,CAAC;QAC/H,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAA2B,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC;IACD,KAAK,UAAU,MAAM,CAAC,GAAuB;QAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC;YACzE,MAAM,KAAK,GAAuB,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YACrC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,UAAU,6BAA6B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,KAAK,CAAC,KAAqB;YAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,mGAAmG;YACnG,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,cAAc,QAAQ,CAAC,GAAG,CAAC,UAAU,yEAAyE,CAAC,CAAC;YAClM,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACnH,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;gBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzI,MAAM,MAAM,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,QAA0B,EAAE,gBAAqC;YAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACjG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,gBAAgB,EAAE,CAAC;gBACzB,yFAAyF;gBACzF,4FAA4F;gBAC5F,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gFAAgF,CAAC,CAAC;gBAC/H,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM;QACN,KAAK,CAAC,OAAO,CAAC,GAAuB,EAAE,YAA2D,EAAE,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACzJ,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,cAAc,GAAG,CAAC,UAAU,OAAO,MAAM,CAAC,KAAK,mDAAmD,CAAC,CAAC;YAClL,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,QAAQ,CAAC,SAAS;gBACjE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,cAAc,GAAG,CAAC,UAAU,eAAe,QAAQ,CAAC,SAAS,eAAe,CAAC,CAAC;YAC/H,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,cAAc,GAAG,CAAC,UAAU,eAAe,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,wCAAwC,CAAC,CAAC;YACnK,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;gBAChE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,cAAc,GAAG,CAAC,UAAU,kDAAkD,CAAC,CAAC;YACjI,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAuB,EAAE,WAAqC;YAC1E,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBACxB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,cAAc,GAAG,CAAC,UAAU,OAAO,GAAG,CAAC,KAAK,wDAAwD,CAAC,CAAC;YACvJ,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,aAAa,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;gBAClG,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,cAAc,GAAG,CAAC,UAAU,kIAAkI,CAAC,CAAC;QACrN,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAuB;YACxC,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACjF,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACvC,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;gBAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,GAAyB,CAAC,CAAC;gBACzD,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,oBAAoB,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC1F,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,0CAA0C,CAAC,CAAC;gBACxF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;oBACtE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,0CAA0C,CAAC,CAAC;gBACxF,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,KAAK,EAAE,CAAC;YACV,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;iGACiG;AACjG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,GAAQ,EAAE,KAAa;IACrF,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,4FAA4F;IAC5F,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,oFAAoF;IACpF,oDAAoD;IACpD,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,6FAA6F;IAC7F,0DAA0D;IAC1D,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAU,EAAE,CAAC;QACtG,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,EAAE,GAAG,+BAA+B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7G,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YACxD,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;eACzI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,IAAI;YACrG,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,sCAAsC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,+EAA+E,CAAC,CAAC;QACrM,gBAAgB,CAAC,GAAyC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,qGAAqG;AAErG,MAAM,UAAU,WAAW,CAAC,aAAqB;IAC/C,OAAO,eAAe,gBAAgB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,aAAqB;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,yBAAyB,MAAM,QAAQ,MAAM,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAM,EAAE,aAAqB,EAAE,GAAuB;IAC3F,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;4CAG4C;AAC5C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAkB,EAAE,KAAa,EAAE,aAAqB,EAAE,SAAS,GAAG,IAAI;IAC9G,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,yBAAyB,MAAM,QAAQ,MAAM,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5J,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mCAAmC,MAAM,0DAA0D,CAAC,CAAC;IAChK,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAyB,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,wCAAwC,CAAC,CAAC;IAClH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;kEACkE;AAClE;qGACqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GAAG,sCAAsC,CAAC"}

package/dist/issuer-session.d.ts

@@ -0,0 +1,30 @@
+/**
+ * One issuance window (SPEC 13.15): an ephemeral `issuer` connection over which a mint stages
+ * and releases its evidence and writes the accepted row, a lifecycle terminal retires the
+ * issuances bound to its ledger family, and a host resolves the evidence a caller's request
+ * rides. The connection lives for the callback only; no standing credential holds a grant on
+ * either issued-authority store.
+ */
+import { type JetStreamManager } from "@nats-io/jetstream";
+import { type KV } from "@nats-io/kv";
+import type { NatsConnection } from "@nats-io/transport-node";
+import { type IssuedSourceRef, type IssuedStore } from "./issued-authority.js";
+import { type SpaceAuth } from "./provision.js";
+export interface IssuerSession {
+    readonly nc: NatsConnection;
+    readonly jsm: JetStreamManager;
+    readonly store: IssuedStore;
+    readonly accepted: KV;
+    /** Is a recorded source gate still live? The one source shape this repo issues against is a
+     *  static incarnation's credential ledger family (`cred.<uid>` on the auth store), whose
+     *  liveness is its issuance gate: a `retired` gate, or no gate, is a dead source. Any other
+     *  coordinate is refused rather than guessed live. */
+    sourceIsLive(source: IssuedSourceRef): Promise<boolean>;
+}
+export declare function withIssuerSession<T>(args: {
+    servers: string;
+    space: string;
+    auth: SpaceAuth;
+    tls: boolean;
+}, fn: (session: IssuerSession) => Promise<T>): Promise<T>;
+//# sourceMappingURL=issuer-session.d.ts.map

package/dist/issuer-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-session.d.ts","sourceRoot":"","sources":["../src/issuer-session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAK9D,OAAO,EAAiD,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE9H,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtB;;;0DAGsD;IACtD,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EACvE,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CA4BZ"}

package/dist/issuer-session.js

@@ -0,0 +1,51 @@
+/**
+ * One issuance window (SPEC 13.15): an ephemeral `issuer` connection over which a mint stages
+ * and releases its evidence and writes the accepted row, a lifecycle terminal retires the
+ * issuances bound to its ledger family, and a host resolves the evidence a caller's request
+ * rides. The connection lives for the callback only; no standing credential holds a grant on
+ * either issued-authority store.
+ */
+import { jetstreamManager } from "@nats-io/jetstream";
+import { Kvm } from "@nats-io/kv";
+import { dialerFor } from "./endpoint.js";
+import { epAuthBucket } from "./endpoint-binding.js";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { issuanceGateKey, parseIssuanceGate } from "./lifecycle-state.js";
+import { acceptedBucket, issuedBucket, openIssuedStore } from "./issued-authority.js";
+import { newIdentity } from "./identity.js";
+import { mintCreds } from "./provision.js";
+import { standaloneConnectOpts } from "./streams.js";
+export async function withIssuerSession(args, fn) {
+    const creds = await mintCreds(args.auth, newIdentity(), "issuer");
+    const nc = await dialerFor(args.servers)({ servers: args.servers, ...standaloneConnectOpts({ creds, tls: args.tls }), maxReconnectAttempts: 0 });
+    try {
+        const kvm = new Kvm(nc);
+        const jsm = await jetstreamManager(nc);
+        const store = openIssuedStore(await kvm.open(issuedBucket(args.space)), jsm, args.space);
+        const accepted = await kvm.open(acceptedBucket(args.space));
+        const auth = epAuthBucket(args.space);
+        const sourceIsLive = async (source) => {
+            const m = /^cred\.([a-z0-9]{26,32})$/.exec(source.key);
+            if (source.space !== args.space || source.bucket !== auth || m === null)
+                throw new EpEnvelopeError("permission-denied", `issued source ${source.bucket}/${source.key} is not a coordinate this host can attest; refused (SPEC 13.15)`);
+            const key = issuanceGateKey(m[1]);
+            let entry;
+            try {
+                entry = await jsm.streams.getMessage(`KV_${auth}`, { last_by_subj: `$KV.${auth}.${key}` });
+            }
+            catch (e) {
+                if (e.code === 10037)
+                    return false;
+                throw e;
+            }
+            if (!entry || entry.header?.get("KV-Operation"))
+                return false;
+            return parseIssuanceGate(entry.data, key, m[1]).state !== "retired";
+        };
+        return await fn({ nc, jsm, store, accepted, sourceIsLive });
+    }
+    finally {
+        await nc.drain().catch(() => nc.close());
+    }
+}
+//# sourceMappingURL=issuer-session.js.map

package/dist/issuer-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-session.js","sourceRoot":"","sources":["../src/issuer-session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAA0C,MAAM,uBAAuB,CAAC;AAC9H,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAcrD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuE,EACvE,EAA0C;IAE1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IACjJ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAuB,EAAoB,EAAE;YACvE,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBACrE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iBAAiB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,iEAAiE,CAAC,CAAC;YAChK,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAC3D,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9D,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;QACvE,CAAC,CAAC;QACF,OAAO,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}