@cotal-ai/core 0.48.2 → 0.50.0

package/dist/remote-manager-authority.d.ts

@@ -9,7 +9,7 @@
 export interface RemoteManagerAuthorityRequest {
     v: 1;
     kind: "manager-service-authority";
-    operation: "prepare" | "activate" | "renew" | "session";
+    operation: "prepare" | "activate" | "renew" | "session" | "retire";
     space: string;
     /** The interactive ledger actor authenticating the request (normally `cli`). */
     actor: string;
@@ -27,6 +27,18 @@ export interface RemoteManagerAuthorityRequest {
         epoch: number;
         exp: number;
     };
+    /** Retire only: one fresh requester nkey plus the exact terminal operation. The opId is stable
+     * across retries but is never bearer authority; the target is what the returned grant confines. */
+    retirement?: {
+        id: string;
+        target: {
+            owner: string;
+            actor: string;
+            lifecycleUid: string;
+        };
+        opId: string;
+        serveEpoch: number;
+    };
     /** Activate only: the manager's canonical contract artifacts, already content-addressed by the
      * client. The host publishes exactly these after re-hashing and derives the registered surface;
      * arbitrary extra contracts are refused by closed artifact count/digest checks. */
@@ -75,6 +87,7 @@ export interface RemoteManagerAuthorityMaterial {
     lifecycleUid: string;
     requestId: string;
     registrationProof?: string;
+    retirement?: RemoteManagerAuthorityRequest["retirement"];
     issuedAt: number;
     expiresAt: number;
     actors: RemoteManagerActors;
@@ -90,7 +103,119 @@ export interface RemoteManagerAuthorityMaterial {
         goalWriter: RemoteManagerCredential;
         sessionLedger: RemoteManagerCredential;
         sessionServing: RemoteManagerCredential;
+        retirementRequester: RemoteManagerCredential;
     }>;
 }
+/**
+ * Closed request for a remote manager to revalidate one retained managed agent on its host.
+ *
+ * The actor token and sentinel credential are existing per-agent material, not new authority. They
+ * cross only the authenticated manager-authority HTTPS exchange and are consumed by the host's
+ * current provider state. The host returns no credential or secret, only the current non-secret
+ * ledger authority shape.
+ */
+export interface RemoteRetainedAgentValidationRequest {
+    v: 1;
+    kind: "manager-retained-agent-validation";
+    space: string;
+    /** The interactive actor whose fresh `supervise` grant authorizes this manager lifecycle. */
+    actor: string;
+    instanceId: string;
+    managerLifecycleUid: string;
+    requestId: string;
+    registrationProof: string;
+    serveEpoch: number;
+    identities: RemoteManagerAuthorityRequest["identities"];
+    target: {
+        owner: string;
+        actor: string;
+        lifecycleUid: string;
+    };
+    actorToken: string;
+    sentinelCreds: string;
+}
+/** Exact non-secret answer to one retained-agent validation request. */
+export interface RemoteRetainedAgentValidationResult {
+    v: 1;
+    kind: "manager-retained-agent-validation";
+    space: string;
+    owner: string;
+    actor: string;
+    instanceId: string;
+    managerLifecycleUid: string;
+    requestId: string;
+    registrationProof: string;
+    serveEpoch: number;
+    target: RemoteRetainedAgentValidationRequest["target"];
+    authority: import("./auth-provider.js").RetainedAgentAuthority;
+}
+/** Closed host-owned boot scan. The participant supplies no filter and receives parsed manager
+ * goal-index rows for its authenticated owner only, never a records credential or raw KV body. */
+export interface RemoteManagerGoalIndexScanRequest {
+    v: 1;
+    kind: "manager-goal-index-scan";
+    space: string;
+    actor: string;
+    instanceId: string;
+    managerLifecycleUid: string;
+    requestId: string;
+    registrationProof: string;
+    serveEpoch: number;
+    identities: RemoteManagerAuthorityRequest["identities"];
+}
+export interface RemoteManagerGoalIndexScanResult {
+    v: 1;
+    kind: "manager-goal-index-scan";
+    space: string;
+    owner: string;
+    actor: string;
+    instanceId: string;
+    managerLifecycleUid: string;
+    requestId: string;
+    registrationProof: string;
+    serveEpoch: number;
+    entries: import("./endpoint-action.js").GoalIndexEntry[];
+}
+/** Closed, non-transferable serve-time admin decision for one exact endpoint caller. */
+export interface RemoteManagerAdminAuthorizationRequest {
+    v: 1;
+    kind: "manager-admin-authorization";
+    space: string;
+    /** Interactive actor whose current `supervise` grant authorizes this manager lifecycle. */
+    actor: string;
+    instanceId: string;
+    managerLifecycleUid: string;
+    requestId: string;
+    registrationProof: string;
+    serveEpoch: number;
+    identities: RemoteManagerAuthorityRequest["identities"];
+    /** Registered manager relay of the broker-authenticated endpoint caller tuple. */
+    caller: {
+        owner: string;
+        actor: string;
+        lifecycleUid: string;
+    };
+}
+/** Exact echo plus one host-derived boolean. No scope or ledger row crosses the seam. */
+export interface RemoteManagerAdminAuthorizationResult {
+    v: 1;
+    kind: "manager-admin-authorization";
+    space: string;
+    owner: string;
+    actor: string;
+    instanceId: string;
+    managerLifecycleUid: string;
+    requestId: string;
+    registrationProof: string;
+    serveEpoch: number;
+    identities: RemoteManagerAuthorityRequest["identities"];
+    caller: RemoteManagerAdminAuthorizationRequest["caller"];
+    authorized: boolean;
+}
 export declare function remoteManagerActors(instanceId: string): RemoteManagerActors;
+/** Deterministic proof binding one remote Manager lifecycle to its owner, identities, and artifacts. */
+export declare function remoteManagerRegistrationProof(owner: string, request: RemoteManagerAuthorityRequest): string;
+/** The one terminal operation identity for a managed lifecycle. It is derived, never selected:
+ * manager retries, hosted authority issuance, and the auth barrier therefore converge on one op. */
+export declare function managedRetirementOpId(lifecycleUid: string): string;
 //# sourceMappingURL=remote-manager-authority.d.ts.map

package/dist/remote-manager-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-manager-authority.d.ts","sourceRoot":"","sources":["../src/remote-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,2BAA2B,CAAC;IAClC,SAAS,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB;yEACqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;;uFAEmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9B,UAAU,EAAE;QACV,UAAU,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3B,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzB,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtB,UAAU,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3B,aAAa,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KAC/B,CAAC;CACH;AAED;8FAC8F;AAC9F,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,8BAA8B;IAC7C,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,2BAA2B,CAAC;IAClC,SAAS,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,EAAE,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACxD;iGAC6F;IAC7F,4FAA4F;IAC5F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,uBAAuB,CAAC;QACpC,QAAQ,EAAE,uBAAuB,CAAC;QAClC,KAAK,EAAE,uBAAuB,CAAC;QAC/B,UAAU,EAAE,uBAAuB,CAAC;QACpC,aAAa,EAAE,uBAAuB,CAAC;QACvC,cAAc,EAAE,uBAAuB,CAAC;KACzC,CAAC,CAAC;CACJ;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAQ3E"}
+{"version":3,"file":"remote-manager-authority.d.ts","sourceRoot":"","sources":["../src/remote-manager-authority.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,2BAA2B,CAAC;IAClC,SAAS,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB;yEACqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;uGACmG;IACnG,UAAU,CAAC,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/D,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF;;uFAEmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9B,UAAU,EAAE;QACV,UAAU,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3B,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzB,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtB,UAAU,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3B,aAAa,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KAC/B,CAAC;CACH;AAED;8FAC8F;AAC9F,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,8BAA8B;IAC7C,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,2BAA2B,CAAC;IAClC,SAAS,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,EAAE,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACxD;iGAC6F;IAC7F,4FAA4F;IAC5F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,uBAAuB,CAAC;QACpC,QAAQ,EAAE,uBAAuB,CAAC;QAClC,KAAK,EAAE,uBAAuB,CAAC;QAC/B,UAAU,EAAE,uBAAuB,CAAC;QACpC,aAAa,EAAE,uBAAuB,CAAC;QACvC,cAAc,EAAE,uBAAuB,CAAC;QACxC,mBAAmB,EAAE,uBAAuB,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oCAAoC;IACnD,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,mCAAmC,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,mCAAmC;IAClD,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,mCAAmC,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,oCAAoC,CAAC,QAAQ,CAAC,CAAC;IACvD,SAAS,EAAE,OAAO,oBAAoB,EAAE,sBAAsB,CAAC;CAChE;AAED;kGACkG;AAClG,MAAM,WAAW,iCAAiC;IAChD,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,yBAAyB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,6BAA6B,CAAC,YAAY,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,gCAAgC;IAC/C,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,yBAAyB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,sBAAsB,EAAE,cAAc,EAAE,CAAC;CAC1D;AAED,wFAAwF;AACxF,MAAM,WAAW,sCAAsC;IACrD,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,6BAA6B,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACxD,kFAAkF;IAClF,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,yFAAyF;AACzF,MAAM,WAAW,qCAAqC;IACpD,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,6BAA6B,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACzD,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAQ3E;AAED,wGAAwG;AACxG,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,GAAG,MAAM,CAY5G;AAED;oGACoG;AACpG,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/dist/remote-manager-authority.js

@@ -1,3 +1,5 @@
+import { rawDigest } from "./canonical.js";
+import { assertLifecycleToken } from "./subjects.js";
 export function remoteManagerActors(instanceId) {
     return {
         supervisor: `manager_${instanceId}`,
@@ -7,4 +9,23 @@ export function remoteManagerActors(instanceId) {
         sessionLedger: `manager_session_${instanceId}`,
     };
 }
+/** Deterministic proof binding one remote Manager lifecycle to its owner, identities, and artifacts. */
+export function remoteManagerRegistrationProof(owner, request) {
+    const artifactDigests = request.operation === "session" ? [] : (request.contractArtifacts ?? []).map((value) => rawDigest(JSON.stringify(value)));
+    return rawDigest(JSON.stringify({
+        v: 1,
+        space: request.space,
+        owner,
+        instanceId: request.instanceId,
+        lifecycleUid: request.managerLifecycleUid,
+        actors: remoteManagerActors(request.instanceId),
+        identities: request.identities,
+        artifactDigests,
+    }));
+}
+/** The one terminal operation identity for a managed lifecycle. It is derived, never selected:
+ * manager retries, hosted authority issuance, and the auth barrier therefore converge on one op. */
+export function managedRetirementOpId(lifecycleUid) {
+    return rawDigest(`retire:${assertLifecycleToken(lifecycleUid)}`).slice("sha256:".length, "sha256:".length + 26);
+}
 //# sourceMappingURL=remote-manager-authority.js.map

package/dist/remote-manager-authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-manager-authority.js","sourceRoot":"","sources":["../src/remote-manager-authority.ts"],"names":[],"mappings":"AAkFA,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO;QACL,UAAU,EAAE,WAAW,UAAU,EAAE;QACnC,QAAQ,EAAE,gBAAgB,UAAU,EAAE;QACtC,KAAK,EAAE,iBAAiB,UAAU,EAAE;QACpC,UAAU,EAAE,gBAAgB,UAAU,EAAE;QACxC,aAAa,EAAE,mBAAmB,UAAU,EAAE;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"remote-manager-authority.js","sourceRoot":"","sources":["../src/remote-manager-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAsMrD,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO;QACL,UAAU,EAAE,WAAW,UAAU,EAAE;QACnC,QAAQ,EAAE,gBAAgB,UAAU,EAAE;QACtC,KAAK,EAAE,iBAAiB,UAAU,EAAE;QACpC,UAAU,EAAE,gBAAgB,UAAU,EAAE;QACxC,aAAa,EAAE,mBAAmB,UAAU,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,OAAsC;IAClG,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClJ,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9B,CAAC,EAAE,CAAC;QACJ,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,mBAAmB;QACzC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,eAAe;KAChB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;oGACoG;AACpG,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,SAAS,CAAC,UAAU,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAClH,CAAC"}

package/dist/run-admission.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Run admission (SPEC 14.8): the immutable, manager-owned record of WHAT AUTHORITY a hosted
+ * workflow run was admitted under, beside the independent marker that revokes it.
+ *
+ * A hosted run acts on channels through the trusted mediator, whose credential is host-wide. The
+ * admission record is what confines that: it snapshots, at `run-start`, the caller's ISSUED
+ * ceiling (SPEC 13.15) as the run's channel ceiling, and every channel effect the host performs
+ * afterwards is checked against it. The record is created once, create-only, by a one-shot
+ * `run-admitter` credential the manager mints per run; the driver holds no grant on this store;
+ * the mediator reads it leader-served before each effect.
+ *
+ * Revocation is a SEPARATE create-only marker under its own key, so absence of revocation is a
+ * readable "no marker" on a store the reader can reach, never a missing record on a store it
+ * cannot. A failed read on either key is a refusal, not an absence.
+ *
+ * The store is its own bucket (`cotal_admission_<space>`, `allow_direct=false`): the driver-writable
+ * run/program/journal records and the registration-policy records are the wrong place for a
+ * record whose whole point is that the driver cannot influence it.
+ */
+import type { JetStreamManager } from "@nats-io/jetstream";
+import type { KV, Kvm } from "@nats-io/kv";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { type EpCaller } from "./endpoint-subjects.js";
+import { type IssuedAuthorityRef, type IssuedSubjectPermissions } from "./issued-authority.js";
+export declare function admissionBucket(space: string): string;
+export declare function admissionKey(endpoint: string, runId: string): string;
+export declare function revocationKey(endpoint: string, runId: string): string;
+/** Where a run's authority came from. `issued` is the only shape a served `run-start` admits;
+ *  `operator` is a local drive or an explicit migration, admitted from trusted operator evidence
+ *  the operator names, never inferred from program text. */
+export type RunAdmissionProvenance = {
+    readonly kind: "issued";
+    readonly ref: IssuedAuthorityRef;
+    readonly resolvedRevision: number;
+} | {
+    readonly kind: "operator";
+    readonly by: string;
+    readonly reason: string;
+};
+export interface RunAdmission {
+    readonly version: 1;
+    readonly space: string;
+    readonly endpoint: string;
+    readonly runId: string;
+    /** The admitting manager instance. */
+    readonly instanceId: string;
+    /** The caller the run was admitted for: the issued triple, or the operator's principal. */
+    readonly caller: EpCaller;
+    /** The channel ceiling the run's effects are checked against: the caller's issued publish and
+     *  subscribe ceilings, verbatim. Explicit `none` is deny-all. */
+    readonly ceiling: IssuedSubjectPermissions;
+    readonly provenance: RunAdmissionProvenance;
+    readonly admittedAt: number;
+}
+export interface RunRevocation {
+    readonly version: 1;
+    readonly runId: string;
+    readonly reason: string;
+    readonly by: string;
+    readonly revokedAt: number;
+}
+/** Validate a record at the consuming boundary: closed schema, version, coordinates. */
+export declare function admissionSnapshot(value: unknown): RunAdmission;
+export declare function revocationSnapshot(value: unknown, runId: string): RunRevocation;
+/** Create the admission, create-only. A second create for the same run is a conflict: a run is
+ *  admitted once, and a re-admission is a new run (a fork) or an explicit migration. */
+export declare function createRunAdmission(kv: KV, admission: RunAdmission): Promise<number>;
+/** Create the revocation marker, create-only and idempotent on an existing marker. */
+export declare function revokeRunAdmission(kv: KV, endpoint: string, revocation: RunRevocation): Promise<void>;
+export interface RunAdmissionView {
+    readonly admission: RunAdmission;
+    readonly revoked: RunRevocation | undefined;
+}
+/** The admission a host acts on: the record must exist, match its coordinates, and carry no
+ *  revocation marker. Missing, unreadable, malformed, mismatched, or revoked all refuse. */
+export declare function readRunAdmission(jsm: JetStreamManager, space: string, endpoint: string, runId: string): Promise<RunAdmissionView>;
+/** The channel checks a host applies, over the admitted ceiling. Concrete channels only: a
+ *  wildcard is not a channel a run can post to or await, and a generated name is checked after
+ *  it is derived, by the same rule. */
+export declare class RunAdmissionDenied extends EpEnvelopeError {
+    constructor(runId: string, what: string, channel: string);
+}
+export declare function assertAdmittedPublish(view: RunAdmissionView, channel: string, caller: EpCaller): void;
+export declare function assertAdmittedSubscribe(view: RunAdmissionView, channel: string): void;
+export declare function assertNotRevoked(view: RunAdmissionView): void;
+/** Create-or-verify the admission store: `allow_direct=false`, file, no eviction. */
+export declare function ensureAdmissionStore(jsm: JetStreamManager, kvm: Kvm, space: string): Promise<void>;
+//# sourceMappingURL=run-admission.d.ts.map

package/dist/run-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-admission.d.ts","sourceRoot":"","sources":["../src/run-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAgC,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAErF,OAAO,EAOL,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,uBAAuB,CAAC;AAG/B,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;4DAE4D;AAC5D,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B;qEACiE;IACjE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAoCD,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAoB9D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAM/E;AAsBD;wFACwF;AACxF,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAQzF;AAED,sFAAsF;AACtF,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3G;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;CAC7C;AAED;4FAC4F;AAC5F,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAevI;AAED;;uCAEuC;AACvC,qBAAa,kBAAmB,SAAQ,eAAe;gBACzC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIzD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,IAAI,CAIrG;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAIrF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAG7D;AAED,qFAAqF;AACrF,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBxG"}

package/dist/run-admission.js

@@ -0,0 +1,193 @@
+import { canonicalJson } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { assertIdToken, endpointToken } from "./endpoint-subjects.js";
+import { isCasLoss } from "./endpoint-records.js";
+import { AUTHORITY_STORE_IMMUTABLE_FLAGS, WRITE_ONCE_PER_KEY, assertStoreShape, issuedPermitsPattern, issuedPermitsSubject, readIssuedSubjectPermissions, } from "./issued-authority.js";
+import { chatSubject, token } from "./subjects.js";
+export function admissionBucket(space) {
+    return `cotal_admission_${token(space)}`;
+}
+export function admissionKey(endpoint, runId) {
+    return `admission.v1.${endpointToken(endpoint)}.${assertIdToken(runId, "runId")}`;
+}
+export function revocationKey(endpoint, runId) {
+    return `revoked.v1.${endpointToken(endpoint)}.${assertIdToken(runId, "runId")}`;
+}
+function closed(value, keys, label) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} must be a plain record`);
+    for (const key of Object.keys(value))
+        if (!keys.includes(key))
+            throw new Error(`${label} carries an unsupported field ${key}`);
+    return value;
+}
+function callerSnapshot(value) {
+    const raw = closed(value, ["owner", "actor", "uid", "generation"], "admission caller");
+    if (typeof raw.owner !== "string" || typeof raw.actor !== "string" || typeof raw.uid !== "string"
+        || (raw.generation !== undefined && typeof raw.generation !== "string"))
+        throw new Error("admission caller is malformed");
+    return Object.freeze({ owner: raw.owner, actor: raw.actor, uid: raw.uid, ...(raw.generation !== undefined ? { generation: raw.generation } : {}) });
+}
+function provenanceSnapshot(value) {
+    const raw = closed(value, ["kind", "ref", "resolvedRevision", "by", "reason"], "admission provenance");
+    if (raw.kind === "issued") {
+        const ref = closed(raw.ref, ["space", "owner", "actor", "uid", "generation"], "admission issued ref");
+        if (!["space", "owner", "actor", "uid", "generation"].every((k) => typeof ref[k] === "string")
+            || typeof raw.resolvedRevision !== "number" || !Number.isSafeInteger(raw.resolvedRevision) || raw.resolvedRevision <= 0
+            || raw.by !== undefined || raw.reason !== undefined)
+            throw new Error("issued admission provenance is malformed");
+        const pinned = { space: ref.space, owner: ref.owner, actor: ref.actor, uid: ref.uid, generation: ref.generation };
+        return Object.freeze({ kind: "issued", ref: Object.freeze(pinned), resolvedRevision: raw.resolvedRevision });
+    }
+    if (raw.kind === "operator") {
+        if (typeof raw.by !== "string" || raw.by.length === 0 || typeof raw.reason !== "string" || raw.reason.length === 0
+            || raw.ref !== undefined || raw.resolvedRevision !== undefined)
+            throw new Error("operator admission provenance is malformed");
+        return Object.freeze({ kind: "operator", by: raw.by, reason: raw.reason });
+    }
+    throw new Error("unsupported admission provenance");
+}
+/** Validate a record at the consuming boundary: closed schema, version, coordinates. */
+export function admissionSnapshot(value) {
+    const raw = closed(value, ["version", "space", "endpoint", "runId", "instanceId", "caller", "ceiling", "provenance", "admittedAt"], "run admission");
+    if (raw.version !== 1)
+        throw new Error(`unsupported run admission version ${String(raw.version)}`);
+    if (typeof raw.space !== "string" || typeof raw.endpoint !== "string" || typeof raw.runId !== "string" || typeof raw.instanceId !== "string"
+        || typeof raw.admittedAt !== "number" || !Number.isSafeInteger(raw.admittedAt) || raw.admittedAt <= 0)
+        throw new Error("run admission is malformed");
+    endpointToken(raw.space);
+    endpointToken(raw.endpoint);
+    assertIdToken(raw.runId, "runId");
+    const caller = callerSnapshot(raw.caller);
+    const provenance = provenanceSnapshot(raw.provenance);
+    if (provenance.kind === "issued") {
+        const r = provenance.ref;
+        if (r.space !== raw.space || r.owner !== caller.owner || r.actor !== caller.actor || r.uid !== caller.uid || caller.generation !== r.generation)
+            throw new Error("run admission's issued reference disagrees with its caller");
+    }
+    return Object.freeze({
+        version: 1, space: raw.space, endpoint: raw.endpoint, runId: raw.runId, instanceId: raw.instanceId,
+        caller, ceiling: readIssuedSubjectPermissions(raw.ceiling), provenance, admittedAt: raw.admittedAt,
+    });
+}
+export function revocationSnapshot(value, runId) {
+    const raw = closed(value, ["version", "runId", "reason", "by", "revokedAt"], "run revocation");
+    if (raw.version !== 1 || raw.runId !== runId || typeof raw.reason !== "string" || typeof raw.by !== "string"
+        || typeof raw.revokedAt !== "number" || !Number.isSafeInteger(raw.revokedAt) || raw.revokedAt <= 0)
+        throw new Error("run revocation is malformed");
+    return Object.freeze({ version: 1, runId, reason: raw.reason, by: raw.by, revokedAt: raw.revokedAt });
+}
+const enc = new TextEncoder();
+const dec = new TextDecoder("utf-8", { fatal: true });
+/** Leader-served point read of one admission-store key. Absence is `undefined`; a deletion
+ *  marker or an unreadable value is a refusal. */
+async function readLeader(jsm, space, key) {
+    const bucket = admissionBucket(space);
+    let m;
+    try {
+        m = await jsm.streams.getMessage(`KV_${bucket}`, { last_by_subj: `$KV.${bucket}.${key}` });
+    }
+    catch (e) {
+        if (e.code === 10037)
+            return undefined;
+        throw e;
+    }
+    if (!m)
+        return undefined;
+    if (m.header?.get("KV-Operation"))
+        throw new EpEnvelopeError("failed-precondition", `admission row ${key} carries a deletion marker; a deletion is never absence (SPEC 14.8)`);
+    return { value: JSON.parse(dec.decode(m.data)), revision: m.seq };
+}
+/** Create the admission, create-only. A second create for the same run is a conflict: a run is
+ *  admitted once, and a re-admission is a new run (a fork) or an explicit migration. */
+export async function createRunAdmission(kv, admission) {
+    const snap = admissionSnapshot(admission);
+    try {
+        return await kv.create(admissionKey(snap.endpoint, snap.runId), enc.encode(canonicalJson(snap)));
+    }
+    catch (e) {
+        if (isCasLoss(e))
+            throw new EpEnvelopeError("conflict", `run ${snap.runId} is already admitted; an admission is written once (SPEC 14.8)`);
+        throw e;
+    }
+}
+/** Create the revocation marker, create-only and idempotent on an existing marker. */
+export async function revokeRunAdmission(kv, endpoint, revocation) {
+    const snap = revocationSnapshot(revocation, revocation.runId);
+    try {
+        await kv.create(revocationKey(endpoint, snap.runId), enc.encode(canonicalJson(snap)));
+    }
+    catch (e) {
+        if (!isCasLoss(e))
+            throw e;
+    }
+}
+/** The admission a host acts on: the record must exist, match its coordinates, and carry no
+ *  revocation marker. Missing, unreadable, malformed, mismatched, or revoked all refuse. */
+export async function readRunAdmission(jsm, space, endpoint, runId) {
+    const entry = await readLeader(jsm, space, admissionKey(endpoint, runId));
+    if (entry === undefined)
+        throw new EpEnvelopeError("permission-denied", `run ${runId} has no admission record on endpoint ${endpoint}; a run with no admission runs no channel effect (SPEC 14.8)`);
+    let admission;
+    try {
+        admission = admissionSnapshot(entry.value);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("permission-denied", `run ${runId}'s admission record is unreadable (${e.message}); garbled trusted state never authorizes (SPEC 14.8)`);
+    }
+    if (admission.space !== space || admission.endpoint !== endpoint || admission.runId !== runId)
+        throw new EpEnvelopeError("permission-denied", `run ${runId}'s admission record names other coordinates (${admission.space}/${admission.endpoint}/${admission.runId}); refused (SPEC 14.8)`);
+    const marker = await readLeader(jsm, space, revocationKey(endpoint, runId));
+    const revoked = marker === undefined ? undefined : revocationSnapshot(marker.value, runId);
+    return Object.freeze({ admission, revoked });
+}
+/** The channel checks a host applies, over the admitted ceiling. Concrete channels only: a
+ *  wildcard is not a channel a run can post to or await, and a generated name is checked after
+ *  it is derived, by the same rule. */
+export class RunAdmissionDenied extends EpEnvelopeError {
+    constructor(runId, what, channel) {
+        super("permission-denied", `run ${runId} is not admitted to ${what} channel "${channel}" (SPEC 14.8)`);
+        this.name = "RunAdmissionDenied";
+    }
+}
+export function assertAdmittedPublish(view, channel, caller) {
+    assertNotRevoked(view);
+    const subject = chatSubject(view.admission.space, caller.owner, caller.actor, channel);
+    if (!issuedPermitsSubject(view.admission.ceiling.publish, subject))
+        throw new RunAdmissionDenied(view.admission.runId, "publish to", channel);
+}
+export function assertAdmittedSubscribe(view, channel) {
+    assertNotRevoked(view);
+    const pattern = chatSubject(view.admission.space, "*", "*", channel);
+    if (!issuedPermitsPattern(view.admission.ceiling.subscribe, pattern))
+        throw new RunAdmissionDenied(view.admission.runId, "read", channel);
+}
+export function assertNotRevoked(view) {
+    if (view.revoked !== undefined)
+        throw new EpEnvelopeError("permission-denied", `run ${view.admission.runId} was revoked by ${view.revoked.by} (${view.revoked.reason}); no further channel effect runs (SPEC 14.8)`);
+}
+/** Create-or-verify the admission store: `allow_direct=false`, file, no eviction. */
+export async function ensureAdmissionStore(jsm, kvm, space) {
+    const bucket = admissionBucket(space);
+    const stream = `KV_${bucket}`;
+    // WRITE-ONCE PER KEY, AT THE BROKER. Both rows are create-only and the marker is permanent
+    // (SPEC 14.8), and the create-only CAS enforces neither on its own: the `run-admitter` holds a
+    // `$KV.<bucket>.<key>` publish row, and that row carries a plain replacement of the value, a
+    // `Nats-Rollup` header (which replaces the row, or with `all` empties the bucket), a deletion
+    // marker, and a per-key purge. None of them is a CAS write, so none loses the CAS, and a
+    // replacement leaves no marker for the deletion-marker read to catch. The three immutability
+    // flags close rollup, message delete and purge; write-once closes the rest, so the admission a
+    // host reads is the one that was admitted, and each run and each marker still gets its one write.
+    const shape = { ...AUTHORITY_STORE_IMMUTABLE_FLAGS, ...WRITE_ONCE_PER_KEY };
+    if (await jsm.streams.info(stream).catch(() => undefined) === undefined) {
+        await kvm.create(bucket, { allow_direct: false });
+        const created = (await jsm.streams.info(stream)).config;
+        await jsm.streams.update(stream, { ...created, ...shape });
+    }
+    const cfg = (await jsm.streams.info(stream)).config;
+    if (cfg.allow_direct !== false || cfg.storage !== "file" || (cfg.max_age ?? 0) !== 0 || (cfg.max_msgs ?? -1) > 0 || (cfg.max_bytes ?? -1) > 0
+        || !Array.isArray(cfg.subjects) || cfg.subjects.length !== 1 || cfg.subjects[0] !== `$KV.${bucket}.>`)
+        throw new Error(`the run admission store ${bucket} has a drifted shape (allow_direct=${String(cfg.allow_direct)}); an authority store is never silently adopted - reprovision it (SPEC 14.8)`);
+    assertStoreShape(cfg, shape, bucket, "SPEC 14.8");
+}
+//# sourceMappingURL=run-admission.js.map

package/dist/run-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-admission.js","sourceRoot":"","sources":["../src/run-admission.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAiB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,GAG7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,mBAAmB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAa;IAC1D,OAAO,gBAAgB,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAa;IAC3D,OAAO,cAAc,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAClF,CAAC;AAiCD,SAAS,MAAM,CAAC,KAAc,EAAE,IAAuB,EAAE,KAAa;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IAC5H,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,GAAG,EAAE,CAAC,CAAC;IAC/H,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;WAC5F,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAa,CAAC;AAClK,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACvG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACtG,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;eACzF,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,gBAAgB,IAAI,CAAC;eACpH,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAuB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,GAAG,EAAE,GAAG,CAAC,GAAa,EAAE,UAAU,EAAE,GAAG,CAAC,UAAoB,EAAE,CAAC;QACxL,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;eAC7G,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS;YAC9D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;IACrJ,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;WACvI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC;QACzB,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAK,MAAkC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAC1K,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;QAClG,MAAM,EAAE,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;KACnG,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;WACvG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEtD;kDACkD;AAClD,KAAK,UAAU,UAAU,CAAC,GAAqB,EAAE,KAAa,EAAE,GAAW;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;IACN,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAC/D,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,qEAAqE,CAAC,CAAC;IAC9I,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACpE,CAAC;AAED;wFACwF;AACxF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,SAAuB;IACtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,KAAK,gEAAgE,CAAC,CAAC;QAC3I,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,QAAgB,EAAE,UAAyB;IAC1F,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAOD;4FAC4F;AAC5F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAqB,EAAE,KAAa,EAAE,QAAgB,EAAE,KAAa;IAC1G,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,KAAK,wCAAwC,QAAQ,8DAA8D,CAAC,CAAC;IAC7K,IAAI,SAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,KAAK,sCAAuC,CAAW,CAAC,OAAO,uDAAuD,CAAC,CAAC;IAChL,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK;QAC3F,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,KAAK,gDAAgD,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,wBAAwB,CAAC,CAAC;IAC/L,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;uCAEuC;AACvC,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,KAAa,EAAE,IAAY,EAAE,OAAe;QACtD,KAAK,CAAC,mBAAmB,EAAE,OAAO,KAAK,uBAAuB,IAAI,aAAa,OAAO,eAAe,CAAC,CAAC;QACvG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAsB,EAAE,OAAe,EAAE,MAAgB;IAC7F,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAChJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAsB,EAAE,OAAe;IAC7E,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAsB;IACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,mBAAmB,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,+CAA+C,CAAC,CAAC;AACzL,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,GAAQ,EAAE,KAAa;IACvF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;IAC9B,2FAA2F;IAC3F,+FAA+F;IAC/F,6FAA6F;IAC7F,8FAA8F;IAC9F,yFAAyF;IACzF,6FAA6F;IAC7F,+FAA+F;IAC/F,kGAAkG;IAClG,MAAM,KAAK,GAAG,EAAE,GAAG,+BAA+B,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAC5E,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxD,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;WACxI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,IAAI;QACrG,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,sCAAsC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,8EAA8E,CAAC,CAAC;IACjM,gBAAgB,CAAC,GAAyC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC1F,CAAC"}

package/dist/run-driver-grants.d.ts

@@ -18,11 +18,21 @@ export interface RunDriverGrantArgs {
     /** The driving instance's id and epoch: the coordinates its timer schedules are addressed by. */
     instanceId: string;
     epoch: number;
+    /** EXPLICIT PLACEMENT TARGET (#1616): the manager endpoint-instance the program named for a
+     *  `cwd` spawn. The descriptor is the one the existing instance-dispatch API already accepts —
+     *  `{ endpoint, instanceId }`, routed as `EpRoute { mode: "inst", instanceId }`
+     *  (endpoint-invoke.ts) — not a new field. Absent ⇒ legacy cwd-omitted behavior, unchanged. */
+    placement?: {
+        instanceId: string;
+    };
 }
 export declare function runDriverGrants(space: string, args: RunDriverGrantArgs, connId: string): {
     publish: string[];
     subscribe: string[];
 };
+/** The ONLY operations explicit placement adds reach for (#1616). `describe` is listed because the
+ *  baseline describe row is class-rail only, so a PINNED resolve is broker-refused without it. */
+export declare const PLACEMENT_COMMANDS: readonly string[];
 /** Trusted, per-run host connection. The endpoint-wide checkpoint writes and body-selected
  *  records/fact/timer/chat reads are its residual authority. The runtime confines those verbs
  *  behind journal-checked operations; this profile must never be given to the run driver.

package/dist/run-driver-grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-driver-grants.d.ts","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAOA,OAAO,EAA2E,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAYhI;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGvD;AAED,mHAAmH;AACnH,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBnI;AAED;;;gGAGgG;AAChG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0DrI;AAED,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;0CAGsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB;;;iFAG6E;IAC7E,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBvI"}
+{"version":3,"file":"run-driver-grants.d.ts","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAOA,OAAO,EAA2E,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAahI;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGvD;AAED,mHAAmH;AACnH,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd;;;mGAG+F;IAC/F,SAAS,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACpC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBnI;AAED;kGACkG;AAClG,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAwD,CAAC;AAEzG;;;gGAGgG;AAChG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAwErI;AAED,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;0CAGsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB;;;iFAG6E;IAC7E,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBvI"}

package/dist/run-driver-grants.js

@@ -7,6 +7,7 @@ import { createHash } from "node:crypto";
 import { spacePrefix, chatStream, presenceBucket, channelBucket, membersBucket, assertInboxConnId, DEV_OWNER } from "./subjects.js";
 import { endpointToken, assertIdToken, assertLifecycleToken, epCallerReplyFilter } from "./endpoint-subjects.js";
 import { recordsBucket } from "./endpoint-records.js";
+import { admissionBucket } from "./run-admission.js";
 import { runDriverJournalGrants, runJournalReplayGrants, recordsKvStreamName, epfStreamName, eptStreamName, epcStreamName, } from "./endpoint-binding.js";
 import { epRequestGrantRows, epDescribeAllGrantRow, BASELINE_LIFECYCLE_ENDPOINT } from "./endpoint-grants.js";
 /**
@@ -40,6 +41,9 @@ export function runDriverGrants(space, args, connId) {
         subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`],
     };
 }
+/** The ONLY operations explicit placement adds reach for (#1616). `describe` is listed because the
+ *  baseline describe row is class-rail only, so a PINNED resolve is broker-refused without it. */
+export const PLACEMENT_COMMANDS = Object.freeze(["describe", "resolve-cwd", "spawn"]);
 /** Trusted, per-run host connection. The endpoint-wide checkpoint writes and body-selected
  *  records/fact/timer/chat reads are its residual authority. The runtime confines those verbs
  *  behind journal-checked operations; this profile must never be given to the run driver.
@@ -98,8 +102,22 @@ export function runMediatorGrants(space, args, connId) {
         ...epRequestGrantRows(space, { endpoint: BASELINE_LIFECYCLE_ENDPOINT, command: "spawn" }, caller),
         ...epRequestGrantRows(space, { endpoint: BASELINE_LIFECYCLE_ENDPOINT, command: "turn", target: { mode: "owner", tOwner: caller.owner } }, caller),
         ...epRequestGrantRows(space, { endpoint: BASELINE_LIFECYCLE_ENDPOINT, command: "despawn", target: { mode: "owner", tOwner: caller.owner } }, caller),
+        // #1616 TARGET-BOUND PLACEMENT REACH. Minted ONLY when the program named an explicit target,
+        // and then only for that ONE validated instance and only these three operations. `routes: []`
+        // suppresses the class `one` row entirely, so this adds NO anycast fallback and no wildcard:
+        // `epRequestGrantRows` emits the single `ep.inst.<endpoint>.<iid>.<command>` row per command.
+        // Issuance stays inside the delegating caller's authority — the rows are stamped with the run's
+        // own caller block, so naming a target in a program grants nothing the caller could not do.
+        ...(args.placement === undefined
+            ? []
+            : PLACEMENT_COMMANDS.flatMap((command) => epRequestGrantRows(space, {
+                endpoint: BASELINE_LIFECYCLE_ENDPOINT, command, routes: [], instanceId: args.placement.instanceId,
+            }, caller))),
         // The contract store fetch a resolve performs (the subject-scoped form every agent holds).
         `$JS.API.DIRECT.GET.${epcStreamName(space)}.${p}.epc.>`,
+        // The run's admission and revocation rows (SPEC 14.8): a leader-served read before every
+        // channel effect. READ only; the admitter writes them.
+        `$JS.API.STREAM.MSG.GET.KV_${admissionBucket(space)}`,
         "$JS.API.INFO",
     ];
     return { publish, subscribe: [epCallerReplyFilter(space, caller), `_INBOX_${assertInboxConnId(connId)}.>`] };
@@ -128,6 +146,9 @@ export function runOperatorGrants(space, args, connId) {
         // The run and program records of the endpoint, read through the leader-served point read and
         // the consumer-free walk.
         `$JS.API.STREAM.MSG.GET.${recordsKvStreamName(space)}`,
+        // The run's admission and revocation rows (SPEC 14.8): a resume, takeback or served read
+        // decides on them before any drive. READ only; the admitter writes them.
+        `$JS.API.STREAM.MSG.GET.KV_${admissionBucket(space)}`,
         // The named run's journal replay, read-only, under this call's own takeover id.
         ...(args.runId === undefined ? [] : runJournalReplayGrants(space, args.runId, args.takeoverId)),
         // An ANSWER of one pause: its answer record (create-only), the checkpoint status a settle

package/dist/run-driver-grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-driver-grants.js","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAiB,MAAM,wBAAwB,CAAC;AAChI,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAE9G;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAcD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACrF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,OAAO,EAAE;YACP,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;YACtD,OAAO,OAAO,QAAQ,QAAQ,IAAI,GAAG,IAAI;YACzC,OAAO,OAAO,YAAY,QAAQ,IAAI,GAAG,EAAE;YAC3C,OAAO,OAAO,WAAW,QAAQ,IAAI,GAAG,IAAI;YAC5C,OAAO,OAAO,cAAc,QAAQ,IAAI,GAAG,IAAI;YAC/C,cAAc;SACf;QACD,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;;;gGAGgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACvF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG;QACd,wDAAwD;QACxD,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;QACtD,sDAAsD;QACtD,OAAO,OAAO,QAAQ,CAAC,IAAI,GAAG,IAAI;QAClC,OAAO,OAAO,YAAY,CAAC,IAAI,GAAG,EAAE;QACpC,OAAO,OAAO,WAAW,CAAC,IAAI,GAAG,IAAI;QACrC,OAAO,OAAO,cAAc,CAAC,IAAI,GAAG,IAAI;QACxC,OAAO,OAAO,OAAO,CAAC,IAAI;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,8FAA8F;QAC9F,iDAAiD;QACjD,GAAG,CAAC,QAAQ,CAAC,OAAO;QACpB,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,aAAa;QAC/C,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,0FAA0F;QAC1F,0EAA0E;QAC1E,uBAAuB,IAAI,EAAE;QAC7B,0BAA0B,IAAI,EAAE;QAChC,2BAA2B,IAAI,IAAI;QACnC,yBAAyB,IAAI,IAAI;QACjC,6BAA6B,IAAI,IAAI;QACrC,2BAA2B,IAAI,IAAI;QACnC,WAAW,IAAI,IAAI;QACnB,4FAA4F;QAC5F,oBAAoB;QACpB,uBAAuB,GAAG,EAAE;QAC5B,2BAA2B,GAAG,IAAI;QAClC,yBAAyB,GAAG,IAAI;QAChC,2BAA2B,GAAG,IAAI;QAClC,UAAU;QACV,2FAA2F;QAC3F,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,2FAA2F;QAC3F,sFAAsF;QACtF,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC;QACpC,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC;QACjG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACjJ,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACpJ,2FAA2F;QAC3F,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;QACvD,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/G,CAAC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA0B,EAAE,MAAc;IACzF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG;QACd,6FAA6F;QAC7F,0BAA0B;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,gFAAgF;QAChF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/F,0FAA0F;QAC1F,uFAAuF;QACvF,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,OAAO,OAAO,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,EAAE,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnL,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"run-driver-grants.js","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAiB,MAAM,wBAAwB,CAAC;AAChI,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAE9G;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAmBD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACrF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,OAAO,EAAE;YACP,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;YACtD,OAAO,OAAO,QAAQ,QAAQ,IAAI,GAAG,IAAI;YACzC,OAAO,OAAO,YAAY,QAAQ,IAAI,GAAG,EAAE;YAC3C,OAAO,OAAO,WAAW,QAAQ,IAAI,GAAG,IAAI;YAC5C,OAAO,OAAO,cAAc,QAAQ,IAAI,GAAG,IAAI;YAC/C,cAAc;SACf;QACD,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;kGACkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzG;;;gGAGgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACvF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG;QACd,wDAAwD;QACxD,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;QACtD,sDAAsD;QACtD,OAAO,OAAO,QAAQ,CAAC,IAAI,GAAG,IAAI;QAClC,OAAO,OAAO,YAAY,CAAC,IAAI,GAAG,EAAE;QACpC,OAAO,OAAO,WAAW,CAAC,IAAI,GAAG,IAAI;QACrC,OAAO,OAAO,cAAc,CAAC,IAAI,GAAG,IAAI;QACxC,OAAO,OAAO,OAAO,CAAC,IAAI;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,8FAA8F;QAC9F,iDAAiD;QACjD,GAAG,CAAC,QAAQ,CAAC,OAAO;QACpB,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,aAAa;QAC/C,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,0FAA0F;QAC1F,0EAA0E;QAC1E,uBAAuB,IAAI,EAAE;QAC7B,0BAA0B,IAAI,EAAE;QAChC,2BAA2B,IAAI,IAAI;QACnC,yBAAyB,IAAI,IAAI;QACjC,6BAA6B,IAAI,IAAI;QACrC,2BAA2B,IAAI,IAAI;QACnC,WAAW,IAAI,IAAI;QACnB,4FAA4F;QAC5F,oBAAoB;QACpB,uBAAuB,GAAG,EAAE;QAC5B,2BAA2B,GAAG,IAAI;QAClC,yBAAyB,GAAG,IAAI;QAChC,2BAA2B,GAAG,IAAI;QAClC,UAAU;QACV,2FAA2F;QAC3F,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,2FAA2F;QAC3F,sFAAsF;QACtF,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC;QACpC,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC;QACjG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACjJ,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACpJ,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,gGAAgG;QAChG,4FAA4F;QAC5F,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE;gBAChE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAU,CAAC,UAAU;aACnG,EAAE,MAAM,CAAC,CAAC,CAAC;QAChB,2FAA2F;QAC3F,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;QACvD,yFAAyF;QACzF,uDAAuD;QACvD,6BAA6B,eAAe,CAAC,KAAK,CAAC,EAAE;QACrD,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/G,CAAC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA0B,EAAE,MAAc;IACzF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG;QACd,6FAA6F;QAC7F,0BAA0B;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,yFAAyF;QACzF,yEAAyE;QACzE,6BAA6B,eAAe,CAAC,KAAK,CAAC,EAAE;QACrD,gFAAgF;QAChF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/F,0FAA0F;QAC1F,uFAAuF;QACvF,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,OAAO,OAAO,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,EAAE,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnL,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC"}