@sentropic/llm-mesh 0.26.0 → 0.26.1

package/README.md

@@ -335,3 +335,17 @@ only then publishes through npm OIDC provenance. The workflow never writes the v
 
 Published versions are immutable. Keep the previous and replacement clients valid for an agreed
 grace period, or explicitly accept that revocation breaks enrollment for older package versions.
+
+## CI seat envelope (L0a, synthetic)
+
+`SeatBundleV1` (`src/enrollment/seat-bundle.ts`, re-exported from
+`@sentropic/llm-mesh/node`) is the frozen five-CLI seat envelope shared by the
+central custody store, h2a native tests and mesh import. It carries identity,
+`cli` provenance, custodian/consumer authority, lifecycle epoch/generation and
+refresh-less consumer projections; validation rejects oversize bundles,
+owner/client mismatches, unknown fields, hidden refresh material, channel
+authority escalation and lineage conflicts. Package enrollment keeps existing identifiers: agy enrolls as
+`cloud-code`; the application receiver maps agy to `antigravity` transport,
+`cloudcode-pa` target and `productAccountSource: antigravity`, and refuses the
+`gemini` route. Native profile variants stay unverified until observed; see
+`spec/SPEC_EVOL_CI_SEATS.md` and `tests/enrollment/seat-bundle.test.ts`.

package/dist/enrollment/seat-bundle.d.ts

@@ -0,0 +1,104 @@
+export declare const SEAT_BUNDLE_SCHEMA_VERSION: 1;
+/** GitHub repository-secret snapshot limit; each serialized bundle must fit. */
+export declare const SEAT_BUNDLE_MAX_BYTES: number;
+export type SeatCli = 'agy' | 'codex' | 'vibe' | 'muse' | 'claude';
+export type SeatAuthority = 'custodian' | 'consumer' | 'native-store';
+export type SeatCredentialClass = 'renewable' | 'static-key' | 'access-only' | 'store-reference';
+export type SeatRefreshAuthority = 'custody' | 'none';
+/** Package enrollment identity per CLI; agy enrolls as cloud-code. */
+export declare const SEAT_PACKAGE_PROVIDER_ID: Record<SeatCli, string>;
+/** Application receiver tuple for agy; application cloud-code targets gemini and is refused. */
+export declare const SEAT_AGY_APPLICATION_TUPLE: {
+    readonly transportProviderId: "antigravity";
+    readonly targetProviderId: "cloudcode-pa";
+    readonly productAccountSource: "antigravity";
+};
+export interface SeatBundleIdentity {
+    schemaVersion: 1;
+    seatRef: string;
+    refreshFamilyRef?: string;
+    ownerScope: string;
+    cli: SeatCli;
+    packageProviderId: string;
+    issuingClientRef: string;
+    endpointFamily: string;
+    credentialFormatVersion: string;
+    nativeCliVersion?: string;
+    os?: 'linux' | 'macos' | 'windows';
+}
+export interface SeatBundleProvenance {
+    enrollmentSource: 'cli';
+    accountBinding: string;
+    entitlementClass: string;
+}
+export interface SeatBundleLifecycle {
+    epoch: number;
+    generation: number;
+    operationId: string;
+    issuedAt: string;
+    providerExpiry?: string;
+    localExpiryPolicy: string;
+    refreshAuthority: SeatRefreshAuthority;
+}
+export interface SeatCanonicalMaterial {
+    kind: 'renewable-material' | 'static-key-material';
+    materialRef: string;
+}
+export interface SeatAccessProjection {
+    kind: 'access' | 'static-key' | 'unavailable';
+    accessRef?: string;
+    reason?: string;
+}
+export interface SeatBundleV1 {
+    identity: SeatBundleIdentity;
+    provenance: SeatBundleProvenance;
+    authority: SeatAuthority;
+    credentialClass: SeatCredentialClass;
+    lifecycle: SeatBundleLifecycle;
+    canonical?: SeatCanonicalMaterial;
+    nativeUse?: SeatAccessProjection;
+    meshUse: SeatAccessProjection;
+}
+export type SeatValidationCode = 'schema-mismatch' | 'size-exceeded' | 'owner-mismatch' | 'client-mismatch' | 'stale-generation' | 'generation-conflict' | 'epoch-replacement-required' | 'unknown-field' | 'refresh-material-present' | 'nested-refresh-field' | 'authority-escalation' | 'invalid-lifecycle';
+export type SeatTransition = 'idempotent' | 'forward' | 'stale' | 'epoch-replacement-required' | 'conflict';
+export type SeatValidationResult = {
+    ok: true;
+    bundle: SeatBundleV1;
+    idempotentReimport?: boolean;
+} | {
+    ok: false;
+    code: SeatValidationCode;
+    detail: string;
+};
+/** Trusted channel context; absent authority defaults to least-privilege consumer. */
+export interface SeatValidationContext {
+    ownerScope?: string;
+    trustedAuthority?: SeatAuthority;
+    issuingClientRef?: string;
+    endpointFamily?: string;
+    predecessor?: Pick<SeatBundleLifecycle, 'epoch' | 'generation' | 'operationId'>;
+}
+export interface SeatReceipt {
+    seatRef: string;
+    cli: SeatCli;
+    epoch: number;
+    generation: number;
+    operationId: string;
+    outcome: 'valid' | 'invalid';
+    reason?: SeatValidationCode;
+    checkedAt: string;
+}
+/** Structural validation of one bundle; predecessor comparison stays in isStaleGeneration. */
+export declare function validateSeatBundle(bundle: unknown, ctx?: SeatValidationContext): SeatValidationResult;
+export type SeatLineageTuple = Pick<SeatBundleLifecycle, 'epoch' | 'generation' | 'operationId'>;
+/** Five-way lineage classification against the current tuple. */
+export declare function classifyTransition(current: SeatLineageTuple, incoming: SeatLineageTuple): SeatTransition;
+/** True when the incoming tuple is older than current; same epoch/generation reimports idempotently. */
+export declare function isStaleGeneration(current: Pick<SeatBundleLifecycle, 'epoch' | 'generation'>, incoming: Pick<SeatBundleLifecycle, 'epoch' | 'generation'>): boolean;
+/** True for a same-tuple reimport that must not mutate the receiving account. */
+export declare function isIdempotentReimport(current: Pick<SeatBundleLifecycle, 'epoch' | 'generation' | 'operationId'>, incoming: Pick<SeatBundleLifecycle, 'epoch' | 'generation' | 'operationId'>): boolean;
+/** The trusted path authority wins; a JSON field claiming an owner is not authorization. */
+export declare function resolveEffectiveAuthority(_claimed: SeatAuthority, trustedPathAuthority: SeatAuthority): SeatAuthority;
+/** Credential-free receipt; carries metadata only, never credential bytes. */
+export declare function createReceipt(bundle: SeatBundleV1, outcome: 'valid' | 'invalid', reason?: SeatValidationCode, checkedAt?: string): SeatReceipt;
+//# sourceMappingURL=seat-bundle.d.ts.map

package/dist/enrollment/seat-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-bundle.d.ts","sourceRoot":"","sources":["../../src/enrollment/seat-bundle.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,0BAA0B,GAAa,CAAC;AAErD,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAE/C,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,YAAY,GAAG,aAAa,GAAG,iBAAiB,CAAC;AAEjG,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEtD,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAM5D,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,0BAA0B;;;;CAI7B,CAAC;AA8BX,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,CAAC,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,KAAK,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,oBAAoB,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,oBAAoB,GAAG,qBAAqB,CAAC;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,UAAU,EAAE,oBAAoB,CAAC;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,eAAe,EAAE,mBAAmB,CAAC;IACrC,SAAS,EAAE,mBAAmB,CAAC;IAC/B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,GAClB,qBAAqB,GACrB,4BAA4B,GAC5B,eAAe,GACf,0BAA0B,GAC1B,sBAAsB,GACtB,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,4BAA4B,GAAG,UAAU,CAAC;AAE5G,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,aAAa,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AA2CD,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,CAkKrG;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC;AAEjG,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,GAAG,cAAc,CAQxG;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,YAAY,CAAC,EAC1D,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,YAAY,CAAC,GAC1D,OAAO,CAET;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC,EAC1E,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC,GAC1E,OAAO,CAET;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,aAAa,EACvB,oBAAoB,EAAE,aAAa,GAClC,aAAa,CAEf;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,kBAAkB,EAC3B,SAAS,CAAC,EAAE,MAAM,GACjB,WAAW,CAWb"}

package/dist/enrollment/seat-bundle.js

@@ -0,0 +1,304 @@
+// @sentropic/llm-mesh/enrollment/seat-bundle.ts
+//
+// SeatBundleV1: frozen five-CLI seat envelope and source contract.
+// Lot L0a, synthetic first: types plus static validators only.
+// This module performs no home, keyring, network or provider access.
+// Native profile variants stay UNVERIFIED until observed; fixtures are invented.
+export const SEAT_BUNDLE_SCHEMA_VERSION = 1;
+/** GitHub repository-secret snapshot limit; each serialized bundle must fit. */
+export const SEAT_BUNDLE_MAX_BYTES = 48 * 1024;
+/** Package enrollment identity per CLI; agy enrolls as cloud-code. */
+export const SEAT_PACKAGE_PROVIDER_ID = {
+    agy: 'cloud-code',
+    codex: 'codex',
+    vibe: 'mistral-vibe',
+    muse: 'muse',
+    claude: 'claude-code',
+};
+/** Application receiver tuple for agy; application cloud-code targets gemini and is refused. */
+export const SEAT_AGY_APPLICATION_TUPLE = {
+    transportProviderId: 'antigravity',
+    targetProviderId: 'cloudcode-pa',
+    productAccountSource: 'antigravity',
+};
+/** Channel rank: a bundle claim above the granted channel is an escalation. */
+const AUTHORITY_RANK = { consumer: 0, 'native-store': 1, custodian: 2 };
+/** Refresh-capable key pattern, matched case-insensitively against every key. */
+const REFRESH_KEY_PATTERN = /refresh|session.?token|device.?(code|token)/i;
+const TOP_LEVEL_KEYS = [
+    'identity', 'provenance', 'authority', 'credentialClass',
+    'lifecycle', 'canonical', 'nativeUse', 'meshUse',
+];
+const IDENTITY_KEYS = [
+    'schemaVersion', 'seatRef', 'refreshFamilyRef', 'ownerScope', 'cli',
+    'packageProviderId', 'issuingClientRef', 'endpointFamily',
+    'credentialFormatVersion', 'nativeCliVersion', 'os',
+];
+const PROVENANCE_KEYS = ['enrollmentSource', 'accountBinding', 'entitlementClass'];
+const LIFECYCLE_KEYS = [
+    'epoch', 'generation', 'operationId', 'issuedAt',
+    'providerExpiry', 'localExpiryPolicy', 'refreshAuthority',
+];
+const CANONICAL_KEYS = ['kind', 'materialRef'];
+const PROJECTION_KEYS = ['kind', 'accessRef', 'reason'];
+function fail(code, detail) {
+    return { ok: false, code, detail };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function unknownKey(value, allowed) {
+    return Object.keys(value).find((k) => !allowed.includes(k)) ?? null;
+}
+function findRefreshKey(value, depth) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const hit = findRefreshKey(item, depth + 1);
+            if (hit)
+                return hit;
+        }
+        return null;
+    }
+    if (!isRecord(value))
+        return null;
+    for (const key of Object.keys(value)) {
+        if (REFRESH_KEY_PATTERN.test(key))
+            return { key, depth };
+        const hit = findRefreshKey(value[key], depth + 1);
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+function nonEmpty(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function validDate(value) {
+    return typeof value === 'string' && !Number.isNaN(Date.parse(value));
+}
+function validInt(value, min) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= min;
+}
+/** Structural validation of one bundle; predecessor comparison stays in isStaleGeneration. */
+export function validateSeatBundle(bundle, ctx) {
+    let serialized = '';
+    try {
+        serialized = JSON.stringify(bundle) ?? '';
+    }
+    catch {
+        return fail('schema-mismatch', 'bundle is not JSON-serializable');
+    }
+    if (new TextEncoder().encode(serialized).length > SEAT_BUNDLE_MAX_BYTES) {
+        return fail('size-exceeded', 'bundle exceeds 48 KiB');
+    }
+    if (!isRecord(bundle))
+        return fail('schema-mismatch', 'bundle must be an object');
+    const badTop = unknownKey(bundle, TOP_LEVEL_KEYS);
+    if (badTop)
+        return fail('unknown-field', `unknown top-level field: ${badTop}`);
+    const { identity, provenance, authority, credentialClass, lifecycle, canonical, nativeUse, meshUse } = bundle;
+    if (!isRecord(identity))
+        return fail('schema-mismatch', 'identity must be an object');
+    if (!isRecord(provenance))
+        return fail('schema-mismatch', 'provenance must be an object');
+    if (!isRecord(lifecycle))
+        return fail('schema-mismatch', 'lifecycle must be an object');
+    if (!isRecord(meshUse))
+        return fail('schema-mismatch', 'meshUse must be an object');
+    const badIdentity = unknownKey(identity, IDENTITY_KEYS);
+    if (badIdentity)
+        return fail('unknown-field', `unknown identity field: ${badIdentity}`);
+    const badProvenance = unknownKey(provenance, PROVENANCE_KEYS);
+    if (badProvenance)
+        return fail('unknown-field', `unknown provenance field: ${badProvenance}`);
+    const badLifecycle = unknownKey(lifecycle, LIFECYCLE_KEYS);
+    if (badLifecycle)
+        return fail('unknown-field', `unknown lifecycle field: ${badLifecycle}`);
+    if (identity['schemaVersion'] !== SEAT_BUNDLE_SCHEMA_VERSION) {
+        return fail('schema-mismatch', 'identity.schemaVersion must be 1');
+    }
+    const cli = identity['cli'];
+    if (cli !== 'agy' && cli !== 'codex' && cli !== 'vibe' && cli !== 'muse' && cli !== 'claude') {
+        return fail('client-mismatch', 'identity.cli must be one of the five seat CLIs');
+    }
+    if (identity['packageProviderId'] !== SEAT_PACKAGE_PROVIDER_ID[cli]) {
+        return fail('client-mismatch', `identity.packageProviderId must be ${SEAT_PACKAGE_PROVIDER_ID[cli]}`);
+    }
+    if (!nonEmpty(identity['issuingClientRef'])) {
+        return fail('client-mismatch', 'identity.issuingClientRef must be non-empty');
+    }
+    if (!nonEmpty(identity['endpointFamily'])) {
+        return fail('client-mismatch', 'identity.endpointFamily must be non-empty');
+    }
+    if (ctx?.issuingClientRef !== undefined && identity['issuingClientRef'] !== ctx.issuingClientRef) {
+        return fail('client-mismatch', 'identity.issuingClientRef does not match the expected client');
+    }
+    if (ctx?.endpointFamily !== undefined && identity['endpointFamily'] !== ctx.endpointFamily) {
+        return fail('client-mismatch', 'identity.endpointFamily does not match the expected family');
+    }
+    if (!nonEmpty(identity['seatRef']))
+        return fail('schema-mismatch', 'identity.seatRef must be non-empty');
+    if (!nonEmpty(identity['ownerScope']))
+        return fail('schema-mismatch', 'identity.ownerScope must be non-empty');
+    if (!nonEmpty(identity['credentialFormatVersion'])) {
+        return fail('schema-mismatch', 'identity.credentialFormatVersion must be non-empty');
+    }
+    if (identity['os'] !== undefined &&
+        identity['os'] !== 'linux' &&
+        identity['os'] !== 'macos' &&
+        identity['os'] !== 'windows') {
+        return fail('schema-mismatch', 'identity.os must be linux, macos or windows');
+    }
+    if (ctx?.ownerScope !== undefined && identity['ownerScope'] !== ctx.ownerScope) {
+        return fail('owner-mismatch', 'identity.ownerScope does not match the verified owner');
+    }
+    if (provenance['enrollmentSource'] !== 'cli')
+        return fail('schema-mismatch', 'provenance.enrollmentSource must be cli');
+    if (!nonEmpty(provenance['accountBinding']))
+        return fail('schema-mismatch', 'provenance.accountBinding must be non-empty');
+    if (!nonEmpty(provenance['entitlementClass'])) {
+        return fail('schema-mismatch', 'provenance.entitlementClass must be non-empty');
+    }
+    if (!validInt(lifecycle['epoch'], 1))
+        return fail('invalid-lifecycle', 'lifecycle.epoch must be an integer >= 1');
+    if (!validInt(lifecycle['generation'], 0)) {
+        return fail('invalid-lifecycle', 'lifecycle.generation must be an integer >= 0');
+    }
+    if (!nonEmpty(lifecycle['operationId']))
+        return fail('invalid-lifecycle', 'lifecycle.operationId must be non-empty');
+    if (!validDate(lifecycle['issuedAt']))
+        return fail('invalid-lifecycle', 'lifecycle.issuedAt must be a valid date');
+    if (!nonEmpty(lifecycle['localExpiryPolicy'])) {
+        return fail('invalid-lifecycle', 'lifecycle.localExpiryPolicy must be non-empty');
+    }
+    if (lifecycle['refreshAuthority'] !== 'custody' && lifecycle['refreshAuthority'] !== 'none') {
+        return fail('invalid-lifecycle', 'lifecycle.refreshAuthority must be custody or none');
+    }
+    if (lifecycle['providerExpiry'] !== undefined && !validDate(lifecycle['providerExpiry'])) {
+        return fail('invalid-lifecycle', 'lifecycle.providerExpiry must be a valid date');
+    }
+    if (authority !== 'custodian' && authority !== 'consumer' && authority !== 'native-store') {
+        return fail('schema-mismatch', 'authority must be custodian, consumer or native-store');
+    }
+    const effective = resolveEffectiveAuthority(authority, ctx?.trustedAuthority ?? 'consumer');
+    if (AUTHORITY_RANK[authority] > AUTHORITY_RANK[effective]) {
+        return fail('authority-escalation', 'bundle claims more authority than the channel grants');
+    }
+    const credClass = credentialClass;
+    if (credClass !== 'renewable' && credClass !== 'static-key' && credClass !== 'access-only' && credClass !== 'store-reference') {
+        return fail('schema-mismatch', 'credentialClass must be a known class');
+    }
+    if (credClass === 'static-key' && identity['refreshFamilyRef'] !== undefined) {
+        return fail('schema-mismatch', 'a static key carries no refresh family');
+    }
+    if (credClass !== 'static-key' && !nonEmpty(identity['refreshFamilyRef'])) {
+        return fail('schema-mismatch', 'a non-static seat requires refreshFamilyRef');
+    }
+    if (effective === 'custodian' && credClass === 'renewable' && lifecycle['refreshAuthority'] !== 'custody') {
+        return fail('invalid-lifecycle', 'a custodian renewable bundle holds custody refresh authority');
+    }
+    if (effective !== 'custodian') {
+        if (lifecycle['refreshAuthority'] !== 'none') {
+            return fail('authority-escalation', 'only the custodian holds refresh authority');
+        }
+        if (credClass === 'renewable') {
+            return fail('authority-escalation', 'only the custodian carries renewable credentials');
+        }
+        if (credClass === 'store-reference' && effective !== 'native-store') {
+            return fail('authority-escalation', 'store references are accepted on the native-store channel only');
+        }
+        if (canonical !== undefined) {
+            return fail('authority-escalation', 'a non-custodian payload cannot carry canonical material');
+        }
+    }
+    for (const [name, projection] of [['nativeUse', nativeUse], ['meshUse', meshUse]]) {
+        if (projection === undefined)
+            continue;
+        if (!isRecord(projection))
+            return fail('schema-mismatch', `${name} must be an object`);
+        if (projection['kind'] !== 'access' && projection['kind'] !== 'static-key' && projection['kind'] !== 'unavailable') {
+            return fail('schema-mismatch', `${name}.kind must be access, static-key or unavailable`);
+        }
+        if (projection['accessRef'] !== undefined && typeof projection['accessRef'] !== 'string') {
+            return fail('schema-mismatch', `${name}.accessRef must be a string`);
+        }
+        if (projection['reason'] !== undefined && typeof projection['reason'] !== 'string') {
+            return fail('schema-mismatch', `${name}.reason must be a string`);
+        }
+        const hit = findRefreshKey(projection, 0);
+        if (hit) {
+            return hit.depth === 0
+                ? fail('refresh-material-present', `${name} carries refresh material: ${hit.key}`)
+                : fail('nested-refresh-field', `${name} hides a nested renewal field: ${hit.key}`);
+        }
+        const bad = unknownKey(projection, PROJECTION_KEYS);
+        if (bad)
+            return fail('unknown-field', `unknown ${name} field: ${bad}`);
+    }
+    if (canonical !== undefined) {
+        if (!isRecord(canonical))
+            return fail('schema-mismatch', 'canonical must be an object');
+        if (canonical['kind'] !== 'renewable-material' && canonical['kind'] !== 'static-key-material') {
+            return fail('schema-mismatch', 'canonical.kind must be a known material kind');
+        }
+        if (!nonEmpty(canonical['materialRef'])) {
+            return fail('schema-mismatch', 'canonical.materialRef must be a non-empty string');
+        }
+        const bad = unknownKey(canonical, CANONICAL_KEYS);
+        if (bad)
+            return fail('unknown-field', `unknown canonical field: ${bad}`);
+    }
+    if (ctx?.predecessor !== undefined) {
+        const transition = classifyTransition(ctx.predecessor, {
+            epoch: lifecycle['epoch'],
+            generation: lifecycle['generation'],
+            operationId: lifecycle['operationId'],
+        });
+        if (transition === 'stale')
+            return fail('stale-generation', 'incoming tuple is older than current');
+        if (transition === 'conflict')
+            return fail('generation-conflict', 'same generation with a different operation');
+        if (transition === 'epoch-replacement-required') {
+            return fail('epoch-replacement-required', 'a new epoch requires the controlled replacement operation');
+        }
+        if (transition === 'idempotent')
+            return { ok: true, bundle: bundle, idempotentReimport: true };
+    }
+    return { ok: true, bundle: bundle };
+}
+/** Five-way lineage classification against the current tuple. */
+export function classifyTransition(current, incoming) {
+    if (incoming.epoch !== current.epoch) {
+        return incoming.epoch < current.epoch ? 'stale' : 'epoch-replacement-required';
+    }
+    if (incoming.generation !== current.generation) {
+        return incoming.generation < current.generation ? 'stale' : 'forward';
+    }
+    return incoming.operationId === current.operationId ? 'idempotent' : 'conflict';
+}
+/** True when the incoming tuple is older than current; same epoch/generation reimports idempotently. */
+export function isStaleGeneration(current, incoming) {
+    return classifyTransition({ ...current, operationId: '' }, { ...incoming, operationId: '' }) === 'stale';
+}
+/** True for a same-tuple reimport that must not mutate the receiving account. */
+export function isIdempotentReimport(current, incoming) {
+    return classifyTransition(current, incoming) === 'idempotent';
+}
+/** The trusted path authority wins; a JSON field claiming an owner is not authorization. */
+export function resolveEffectiveAuthority(_claimed, trustedPathAuthority) {
+    return trustedPathAuthority;
+}
+/** Credential-free receipt; carries metadata only, never credential bytes. */
+export function createReceipt(bundle, outcome, reason, checkedAt) {
+    return {
+        seatRef: bundle.identity.seatRef,
+        cli: bundle.identity.cli,
+        epoch: bundle.lifecycle.epoch,
+        generation: bundle.lifecycle.generation,
+        operationId: bundle.lifecycle.operationId,
+        outcome,
+        ...(reason !== undefined ? { reason } : {}),
+        checkedAt: checkedAt ?? new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=seat-bundle.js.map

package/dist/enrollment/seat-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-bundle.js","sourceRoot":"","sources":["../../src/enrollment/seat-bundle.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,mEAAmE;AACnE,+DAA+D;AAC/D,qEAAqE;AACrE,iFAAiF;AAEjF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAU,CAAC;AAErD,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAU/C,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,GAAG,EAAE,YAAY;IACjB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,aAAa;CACtB,CAAC;AAEF,gGAAgG;AAChG,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,mBAAmB,EAAE,aAAa;IAClC,gBAAgB,EAAE,cAAc;IAChC,oBAAoB,EAAE,aAAa;CAC3B,CAAC;AAEX,+EAA+E;AAC/E,MAAM,cAAc,GAAkC,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAEvG,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;AAE3E,MAAM,cAAc,GAAG;IACrB,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB;IACxD,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS;CACxC,CAAC;AAEX,MAAM,aAAa,GAAG;IACpB,eAAe,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK;IACnE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB;IACzD,yBAAyB,EAAE,kBAAkB,EAAE,IAAI;CAC3C,CAAC;AAEX,MAAM,eAAe,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,CAAU,CAAC;AAE5F,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU;IAChD,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB;CACjD,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,aAAa,CAAU,CAAC;AAExD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AA8FjE,SAAS,IAAI,CAAC,IAAwB,EAAE,MAAc;IACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,OAA0B;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,GAAW;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,GAA2B;IAC7E,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,4BAA4B,MAAM,EAAE,CAAC,CAAC;IAC/E,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC9G,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;IACxF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,2BAA2B,WAAW,EAAE,CAAC,CAAC;IACxF,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC9D,IAAI,aAAa;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,6BAA6B,aAAa,EAAE,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,4BAA4B,YAAY,EAAE,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,eAAe,CAAC,KAAK,0BAA0B,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7F,OAAO,IAAI,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,mBAAmB,CAAC,KAAK,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,iBAAiB,EAAE,sCAAsC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,EAAE,gBAAgB,KAAK,SAAS,IAAI,QAAQ,CAAC,kBAAkB,CAAC,KAAK,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjG,OAAO,IAAI,CAAC,iBAAiB,EAAE,8DAA8D,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,EAAE,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC,cAAc,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IACzG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IAC/G,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;IACvF,CAAC;IACD,IACE,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS;QAC5B,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO;QAC1B,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO;QAC1B,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,EAAE,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,UAAU,CAAC,kBAAkB,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IACxH,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAC3H,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,mBAAmB,EAAE,8CAA8C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;IACrH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;IACnH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,mBAAmB,EAAE,+CAA+C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,SAAS,CAAC,kBAAkB,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,kBAAkB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5F,OAAO,IAAI,CAAC,mBAAmB,EAAE,oDAAoD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,SAAS,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC,mBAAmB,EAAE,+CAA+C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC,iBAAiB,EAAE,uDAAuD,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,IAAI,UAAU,CAAC,CAAC;IAC5F,IAAI,cAAc,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,sBAAsB,EAAE,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC;IAClC,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC9H,OAAO,IAAI,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,IAAI,QAAQ,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC,mBAAmB,EAAE,8DAA8D,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,kBAAkB,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,sBAAsB,EAAE,4CAA4C,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,sBAAsB,EAAE,kDAAkD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,SAAS,KAAK,iBAAiB,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,sBAAsB,EAAE,gEAAgE,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,sBAAsB,EAAE,yDAAyD,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAU,EAAE,CAAC;QAC3F,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;QACvF,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzF,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,0BAA0B,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC1C,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,GAAG,CAAC,KAAK,KAAK,CAAC;gBACpB,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,IAAI,8BAA8B,GAAG,CAAC,GAAG,EAAE,CAAC;gBAClF,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,IAAI,kCAAkC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,eAAe,EAAE,WAAW,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACxF,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,oBAAoB,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,qBAAqB,EAAE,CAAC;YAC9F,OAAO,IAAI,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAClD,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,eAAe,EAAE,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE;YACrD,KAAK,EAAE,SAAS,CAAC,OAAO,CAAW;YACnC,UAAU,EAAE,SAAS,CAAC,YAAY,CAAW;YAC7C,WAAW,EAAE,SAAS,CAAC,aAAa,CAAW;SAChD,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACpG,IAAI,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QAChH,IAAI,UAAU,KAAK,4BAA4B,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,4BAA4B,EAAE,2DAA2D,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,UAAU,KAAK,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAiC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAiC,EAAE,CAAC;AACjE,CAAC;AAID,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE,QAA0B;IACtF,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;IACjF,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/C,OAAO,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;AAClF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,iBAAiB,CAC/B,OAA0D,EAC1D,QAA2D;IAE3D,OAAO,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC;AAC3G,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAClC,OAA0E,EAC1E,QAA2E;IAE3E,OAAO,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,YAAY,CAAC;AAChE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,yBAAyB,CACvC,QAAuB,EACvB,oBAAmC;IAEnC,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAC3B,MAAoB,EACpB,OAA4B,EAC5B,MAA2B,EAC3B,SAAkB;IAElB,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;QAChC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK;QAC7B,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;QACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;QACzC,OAAO;QACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACjD,CAAC;AACJ,CAAC"}

package/dist/node/index.d.ts

@@ -1,4 +1,6 @@
 export type { KeyringAdapter } from '../service/facade.js';
+export type { SeatAccessProjection, SeatAuthority, SeatBundleIdentity, SeatBundleLifecycle, SeatBundleProvenance, SeatBundleV1, SeatCanonicalMaterial, SeatCli, SeatCredentialClass, SeatLineageTuple, SeatReceipt, SeatRefreshAuthority, SeatTransition, SeatValidationCode, SeatValidationContext, SeatValidationResult, } from '../enrollment/seat-bundle.js';
+export { SEAT_AGY_APPLICATION_TUPLE, SEAT_BUNDLE_MAX_BYTES, SEAT_BUNDLE_SCHEMA_VERSION, SEAT_PACKAGE_PROVIDER_ID, classifyTransition, createReceipt, isIdempotentReimport, isStaleGeneration, resolveEffectiveAuthority, validateSeatBundle, } from '../enrollment/seat-bundle.js';
 export { EncryptedFileKeyring } from './keyring/encrypted-file-keyring.js';
 export { EnvKeyring } from './keyring/env-keyring.js';
 export { InMemoryKeyring } from './keyring/in-memory-keyring.js';

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC"}

package/dist/node/index.js

@@ -1,3 +1,4 @@
+export { SEAT_AGY_APPLICATION_TUPLE, SEAT_BUNDLE_MAX_BYTES, SEAT_BUNDLE_SCHEMA_VERSION, SEAT_PACKAGE_PROVIDER_ID, classifyTransition, createReceipt, isIdempotentReimport, isStaleGeneration, resolveEffectiveAuthority, validateSeatBundle, } from '../enrollment/seat-bundle.js';
 export { EncryptedFileKeyring } from './keyring/encrypted-file-keyring.js';
 export { EnvKeyring } from './keyring/env-keyring.js';
 export { InMemoryKeyring } from './keyring/in-memory-keyring.js';

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/llm-mesh",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Provider-agnostic LLM access runtime SDK for Sentropic.",
   "type": "module",
   "license": "MIT",