instar 1.3.704 → 1.3.705

package/dist/users/UserManager.d.ts

@@ -27,9 +27,30 @@ export declare class UserManager {
     private users;
     private channelIndex;
     private usersFile;
+    private readonly stateDir;
+    /**
+     * silent-loss-refusal-conservation §2.D — the server-held HMAC key that
+     * verifies a signed `allowTestIdentity` marker on a legitimate fixture-collision
+     * profile. Loaded only by the server process (NOT authToken/dashboardPin).
+     * Absent (CLI / read-only probe / tests) → a fixture-collision profile is
+     * refused (write) / skipped (load) unless the double-keyed test escape is on —
+     * a marker can be neither minted nor verified without the key (safe direction).
+     */
+    private readonly testIdentityKey;
     /** WS2.6 user-record replication emitter (injected, dark by default). Absent ⇒ strict no-op. */
     private userReplication;
-    constructor(stateDir: string, initialUsers?: UserProfile[]);
+    constructor(stateDir: string, initialUsers?: UserProfile[], opts?: {
+        testIdentityKey?: string;
+    });
+    /**
+     * silent-loss-refusal-conservation §2.D — is a fixture-identity write/load
+     * PERMITTED for this profile? A match is permitted only when (a) the
+     * double-keyed test escape is active (env + on-disk test-home marker) OR (b) the
+     * profile carries a signed `allowTestIdentity` marker that VERIFIES under the
+     * server key (a legitimate name-collision, dashboard-PIN-minted). Returns the
+     * matched marker string when the write/load must be REFUSED, or null when it is
+     * permitted (either no match, or an accepted override). */
+    private refusedTestIdentity;
     /**
      * Late-bind the WS2.6 user-record replication emitter (server.ts constructs the journal/clock
      * AFTER the manager). Idempotent; passing undefined/null detaches (back to single-machine

package/dist/users/UserManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserManager.d.ts","sourceRoot":"","sources":["../../src/users/UserManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAG1E;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACnC,gFAAgF;IAChF,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9D;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,SAAS,CAAS;IAC1B,gGAAgG;IAChG,OAAO,CAAC,eAAe,CAAuC;gBAElD,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE;IAK1D;;;;;OAKG;IACH,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAInF;;;OAGG;IACH,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI;IAIxD;;OAEG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI;IAO5D;;;;;;;OAOG;IACH,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAQrE;;;;;;;OAOG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAW/D;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAI3C;;OAEG;IACH,SAAS,IAAI,WAAW,EAAE;IAI1B;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IA6BtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IA4BnC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAM1D;;;OAGG;IACH,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW;IAYpG;;;OAGG;IACH,qBAAqB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAQpF;;OAEG;IACH,SAAS,IAAI,WAAW,EAAE;IAI1B,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,SAAS;IAoCjB,OAAO,CAAC,YAAY;CA+BrB"}
+{"version":3,"file":"UserManager.d.ts","sourceRoot":"","sources":["../../src/users/UserManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAU1E;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACnC,gFAAgF;IAChF,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9D;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,gGAAgG;IAChG,OAAO,CAAC,eAAe,CAAuC;gBAElD,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE;IAO/F;;;;;;;+DAO2D;IAC3D,OAAO,CAAC,mBAAmB;IAQ3B;;;;;OAKG;IACH,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAInF;;;OAGG;IACH,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI;IAIxD;;OAEG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI;IAO5D;;;;;;;OAOG;IACH,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAQrE;;;;;;;OAOG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAW/D;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAI3C;;OAEG;IACH,SAAS,IAAI,WAAW,EAAE;IAI1B;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAmCtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IA4BnC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAM1D;;;OAGG;IACH,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW;IAYpG;;;OAGG;IACH,qBAAqB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAQpF;;OAEG;IACH,SAAS,IAAI,WAAW,EAAE;IAI1B,OAAO,CAAC,eAAe;IAsBvB,OAAO,CAAC,SAAS;IAsEjB,OAAO,CAAC,YAAY;CA+BrB"}

package/dist/users/UserManager.js

@@ -8,16 +8,48 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { SafeFsExecutor } from '../core/SafeFsExecutor.js';
+import { matchTestIdentity, testIdentitiesAllowed, verifyAllowTestIdentity, TestIdentityRefusedError, } from './testIdentityMarkers.js';
+import { setRegistryHighWater } from '../core/registryHighWater.js';
 export class UserManager {
     users = new Map();
     channelIndex = new Map(); // "type:identifier" -> userId
     usersFile;
+    stateDir;
+    /**
+     * silent-loss-refusal-conservation §2.D — the server-held HMAC key that
+     * verifies a signed `allowTestIdentity` marker on a legitimate fixture-collision
+     * profile. Loaded only by the server process (NOT authToken/dashboardPin).
+     * Absent (CLI / read-only probe / tests) → a fixture-collision profile is
+     * refused (write) / skipped (load) unless the double-keyed test escape is on —
+     * a marker can be neither minted nor verified without the key (safe direction).
+     */
+    testIdentityKey;
     /** WS2.6 user-record replication emitter (injected, dark by default). Absent ⇒ strict no-op. */
     userReplication = null;
-    constructor(stateDir, initialUsers) {
+    constructor(stateDir, initialUsers, opts) {
         this.usersFile = path.join(stateDir, 'users.json');
+        this.stateDir = stateDir;
+        this.testIdentityKey = opts?.testIdentityKey;
         this.loadUsers(initialUsers);
     }
+    /**
+     * silent-loss-refusal-conservation §2.D — is a fixture-identity write/load
+     * PERMITTED for this profile? A match is permitted only when (a) the
+     * double-keyed test escape is active (env + on-disk test-home marker) OR (b) the
+     * profile carries a signed `allowTestIdentity` marker that VERIFIES under the
+     * server key (a legitimate name-collision, dashboard-PIN-minted). Returns the
+     * matched marker string when the write/load must be REFUSED, or null when it is
+     * permitted (either no match, or an accepted override). */
+    refusedTestIdentity(profile) {
+        const marker = matchTestIdentity(profile);
+        if (!marker)
+            return null;
+        if (testIdentitiesAllowed(this.stateDir))
+            return null;
+        if (verifyAllowTestIdentity(this.testIdentityKey, profile.id, marker, profile.allowTestIdentity))
+            return null;
+        return marker;
+    }
     /**
      * Late-bind the WS2.6 user-record replication emitter (server.ts constructs the journal/clock
      * AFTER the manager). Idempotent; passing undefined/null detaches (back to single-machine
@@ -120,6 +152,14 @@ export class UserManager {
             this.channelIndex.set(`${channel.type}:${channel.identifier}`, profile.id);
         }
         this.persistUsers();
+        // silent-loss-refusal-conservation §2.D set-point: a successful register/upsert
+        // of a (validated non-fixture) user means the authoritative local registry now
+        // holds a real user — set the monotonic high-water marker so a later emptying
+        // classifies POPULATED (emptied-by-deletion), not never-populated.
+        try {
+            setRegistryHighWater(this.stateDir, 'user-registered');
+        }
+        catch { /* best-effort */ }
     }
     /**
      * Remove a user.
@@ -201,6 +241,16 @@ export class UserManager {
         if (!Array.isArray(profile.permissions)) {
             throw new Error(`UserProfile(${profile.id}).permissions must be an array`);
         }
+        // silent-loss-refusal-conservation §2.D — fixture refusal at the WRITE path
+        // (API/CLI/registration). "Test Identity Never Enters Production State": a
+        // typed throw so a fixture id can never be persisted into the production
+        // registry (the 2026-07-01 clobber's write side). A legitimate name-collision
+        // supplies a dashboard-PIN-minted signed `allowTestIdentity`; an isolated test
+        // home sets the double-keyed escape.
+        const refused = this.refusedTestIdentity(profile);
+        if (refused) {
+            throw new TestIdentityRefusedError(profile.id, refused);
+        }
     }
     loadUsers(initialUsers) {
         // Load from file if exists
@@ -213,6 +263,19 @@ export class UserManager {
                         console.warn(`[UserManager] Skipping malformed user entry: ${JSON.stringify(user).slice(0, 100)}`);
                         continue;
                     }
+                    // silent-loss-refusal-conservation §2.D — fixture refusal at the LOAD
+                    // path. Refuse-and-skip-with-loud-alert (NEVER throw — a constructor
+                    // throw fails boot). A fixture row that slipped into an already-polluted
+                    // store is dropped from the in-memory registry so it can never resolve
+                    // as a real sender; the §4 boot migration quarantines it off disk.
+                    const refused = this.refusedTestIdentity(user);
+                    if (refused) {
+                        console.error(`[UserManager] REFUSING to load fixture/test identity "${user.id}" (matched marker "${refused}") from the user registry ` +
+                            `— "Test Identity Never Enters Production State" (silent-loss-refusal-conservation §2.D). ` +
+                            `The row is skipped in-memory; the boot migration quarantines it off disk. ` +
+                            `If this is a legitimate user, register them via the dashboard-PIN-authed allow-identity override.`);
+                        continue;
+                    }
                     this.users.set(user.id, user);
                     for (const channel of user.channels) {
                         if (channel.type && channel.identifier) {
@@ -235,10 +298,32 @@ export class UserManager {
         if (initialUsers) {
             for (const user of initialUsers) {
                 if (!this.users.has(user.id)) {
-                    this.upsertUser(user);
+                    // upsertUser → validateProfile refuses a fixture initialUsers entry
+                    // (typed throw). Guard so a fixture in config.users can't fail boot;
+                    // a real initialUsers merge below sets the high-water marker.
+                    try {
+                        this.upsertUser(user);
+                    }
+                    catch (err) {
+                        if (err instanceof TestIdentityRefusedError) {
+                            console.error(`[UserManager] Skipped fixture identity from initialUsers: ${err.message}`);
+                            continue;
+                        }
+                        throw err;
+                    }
                 }
             }
         }
+        // silent-loss-refusal-conservation §2.D set-point: if the authoritative local
+        // registry holds ≥1 resolvable real user, this machine has "held a real user"
+        // — set the monotonic high-water marker so a LATER emptying classifies as
+        // POPULATED (emptied-by-deletion → keep rejecting), not never-populated.
+        if (this.users.size > 0) {
+            try {
+                setRegistryHighWater(this.stateDir, 'load-observed-real-user');
+            }
+            catch { /* best-effort */ }
+        }
     }
     persistUsers() {
         const dir = path.dirname(this.usersFile);

package/dist/users/UserManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserManager.js","sourceRoot":"","sources":["../../src/users/UserManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAqB3D,MAAM,OAAO,WAAW;IACd,KAAK,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC5C,YAAY,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,8BAA8B;IAC7E,SAAS,CAAS;IAC1B,gGAAgG;IACxF,eAAe,GAAkC,IAAI,CAAC;IAE9D,YAAY,QAAgB,EAAE,YAA4B;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,OAAkD;QAC1E,IAAI,CAAC,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAgB;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,OAAoB;QACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,yBAAyB,CAAC,cAAsB;QAC9C,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,WAAmB;QACxC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAoB;QAC7B,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE9B,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,aAAa,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,kCAAkC,aAAa,sBAAsB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,oFAAoF;QACpF,2FAA2F;QAC3F,yDAAyD;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAE9C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,wFAAwF;gBACxF,mFAAmF;gBACnF,uFAAuF;YACzF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc,EAAE,UAAkB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrF,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,cAAmE;QACpF,MAAM,OAAO,GAAgB;YAC3B,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,cAAc;SAClB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,EAAE;SACxI,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAEO,eAAe,CAAC,OAAoB;QAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,EAAE,gCAAgC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,YAA4B;QAC5C,2BAA2B;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACjF,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;oBACxB,yBAAyB;oBACzB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBAClF,OAAO,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;wBACnG,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;oBAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACpC,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;4BACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;wBAC1E,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAChF,OAAO,CAAC,KAAK,CAAC,mDAAmD,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,oEAAoE;QACpE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACzF,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACpF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACrH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,gGAAgG;QAChG,yFAAyF;QACzF,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,uFAAuF;oBACvF,yFAAyF;gBAC3F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"UserManager.js","sourceRoot":"","sources":["../../src/users/UserManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAqBpE,MAAM,OAAO,WAAW;IACd,KAAK,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC5C,YAAY,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,8BAA8B;IAC7E,SAAS,CAAS;IACT,QAAQ,CAAS;IAClC;;;;;;;OAOG;IACc,eAAe,CAAqB;IACrD,gGAAgG;IACxF,eAAe,GAAkC,IAAI,CAAC;IAE9D,YAAY,QAAgB,EAAE,YAA4B,EAAE,IAAmC;QAC7F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;+DAO2D;IACnD,mBAAmB,CAAC,OAAmF;QAC7G,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,uBAAuB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9G,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,OAAkD;QAC1E,IAAI,CAAC,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAgB;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,OAAoB;QACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,yBAAyB,CAAC,cAAsB;QAC9C,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,WAAmB;QACxC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAoB;QAC7B,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE9B,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,aAAa,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,kCAAkC,aAAa,sBAAsB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,mEAAmE;QACnE,IAAI,CAAC;YAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7F,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,oFAAoF;QACpF,2FAA2F;QAC3F,yDAAyD;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAE9C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,wFAAwF;gBACxF,mFAAmF;gBACnF,uFAAuF;YACzF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc,EAAE,UAAkB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrF,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,cAAmE;QACpF,MAAM,OAAO,GAAgB;YAC3B,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,cAAc;SAClB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,EAAE;SACxI,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAEO,eAAe,CAAC,OAAoB;QAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,EAAE,gCAAgC,CAAC,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,+EAA+E;QAC/E,qCAAqC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,YAA4B;QAC5C,2BAA2B;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACjF,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;oBACxB,yBAAyB;oBACzB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBAClF,OAAO,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;wBACnG,SAAS;oBACX,CAAC;oBACD,sEAAsE;oBACtE,qEAAqE;oBACrE,yEAAyE;oBACzE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;oBAC/C,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,KAAK,CACX,yDAAyD,IAAI,CAAC,EAAE,sBAAsB,OAAO,4BAA4B;4BACzH,2FAA2F;4BAC3F,4EAA4E;4BAC5E,mGAAmG,CACpG,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;oBAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACpC,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;4BACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;wBAC1E,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAChF,OAAO,CAAC,KAAK,CAAC,mDAAmD,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,oEAAoE;oBACpE,qEAAqE;oBACrE,8DAA8D;oBAC9D,IAAI,CAAC;wBACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;4BAC5C,OAAO,CAAC,KAAK,CAAC,6DAA6D,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;4BAC1F,SAAS;wBACX,CAAC;wBACD,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,8EAA8E;QAC9E,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,oEAAoE;QACpE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACzF,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACpF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACrH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,gGAAgG;QAChG,yFAAyF;QACzF,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,uFAAuF;oBACvF,yFAAyF;gBAC3F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/users/testIdentityMarkers.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Test-Identity Refusal (silent-loss-refusal-conservation §2.D — "Test Identity
+ * Never Enters Production State"). The 2026-07-01 silent-loss incident began 19
+ * days earlier when a live-test / harness run clobbered a machine's `users.json`
+ * with FIXTURE identities. A registry populated with only fixtures rejects every
+ * real sender (including the operator) once sender re-validation arms.
+ *
+ * This module is the single source of truth for WHICH identities are fixtures
+ * and HOW a legitimate name-collision is overridden. It is pure + dependency-free
+ * so both the write-path guard (UserManager.validateProfile — typed throw) and the
+ * load-path guard (UserManager.loadUsers — refuse-and-skip, never throw) and the
+ * §4 boot remediation share ONE matcher and can never drift.
+ *
+ * MATCH RULE (round-2 adversarial #10): exact match on the known fixture platform
+ * IDS + reserved-token anchored prefixes on ids — DISPLAY NAME IS NEVER A MATCH
+ * CRITERION (a real user named "Olivia" registers fine). See §2.D / decision 3.
+ */
+import type { UserProfile } from '../core/types.js';
+/**
+ * The closed fixture-identity set. IDS + reserved tokens only — never a
+ * display-name. Exact-match on the known platform ids; anchored-prefix match on
+ * the reserved `livetest`/`g3test` tokens.
+ *
+ * - `slackIds`   — the demo Slack workspace user ids used by the live-test harness.
+ * - `harnessIds` — the `u-*` / `U_*` fixture user ids the integration harness writes.
+ * - `reservedTokenPrefixes` — anchored id/username prefixes the isolated test-home
+ *   scaffold uses (`livetest…`, `g3test…`).
+ */
+export declare const TEST_IDENTITY_MARKERS: {
+    readonly slackIds: readonly ["U0BA7QGPBQS", "U0BA5NW9QA2", "U0B9SFJ7QAK", "U0B9SFV2BAT", "U0BA4L8RMFF"];
+    readonly harnessIds: readonly ["u-olivia", "u-adam", "u-mia", "u-cory", "u-oscar", "U_OLIVIA", "U_ADAM", "U_MIA", "U_CORY", "U_OSCAR"];
+    readonly reservedTokenPrefixes: readonly ["livetest", "g3test"];
+};
+/**
+ * Does a single string token match a fixture marker? Exact match against the
+ * known-id set, OR an anchored (^) reserved-token prefix. Case-sensitive on the
+ * exact set (platform ids are case-significant); the reserved-token prefix is
+ * matched case-INsensitively (a `LiveTest…` id is still a fixture).
+ */
+export declare function matchesTestIdentityToken(token: string | undefined | null): string | null;
+/**
+ * Classify a profile against the fixture-identity set. Checks the id, the Slack
+ * user id, and slack-typed channel identifiers — NEVER the display name.
+ * Returns the matched marker string (for the audit + the allow-marker) or null.
+ */
+export declare function matchTestIdentity(profile: Pick<UserProfile, 'id' | 'slackUserId' | 'channels'>): string | null;
+/** Typed error thrown by the WRITE path (validateProfile) when a fixture identity
+ *  is written without a verifying allow-marker + the double-keyed test escape. */
+export declare class TestIdentityRefusedError extends Error {
+    readonly marker: string;
+    constructor(profileId: string, marker: string);
+}
+/** The on-disk marker a test home's scaffold writes to opt that home into
+ *  fixture-identity writes. Its PRESENCE is the second key; contents are ignored. */
+export declare const TEST_HOME_MARKER_FILENAME = ".instar-test-home";
+/**
+ * The narrow escape is double-keyed (§2.D / decision 11): the env var
+ * `INSTAR_ALLOW_TEST_IDENTITIES=1` is honored ONLY when an on-disk test-home
+ * marker is ALSO present under the state dir. Env-set-but-marker-absent → refuse
+ * (a stray env var on a production box can never open the door).
+ */
+export declare function testIdentitiesAllowed(stateDir: string, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * A profile that legitimately collides with a fixture marker carries a signed
+ * allow-marker `{ marker, sig }`. The PIN gates MINTING (the route); the LOAD
+ * path VERIFIES the HMAC with no PIN. `sig = HMAC-SHA256(serverKey, userId + ":" + marker)`
+ * where `serverKey` is a server-held vault secret loaded only by the server
+ * process — NOT the authToken/dashboardPin, NOT a state-dir file a plain
+ * users.json writer reads (§2.D / decision 23, honest threat model).
+ */
+export interface AllowTestIdentityMarker {
+    marker: string;
+    sig: string;
+}
+/**
+ * Derive the server-held allow-marker HMAC key from the machine SIGNING key PEM
+ * — a server-held secret loaded only by the server process, NOT the
+ * authToken/dashboardPin and NOT users.json (§2.D / decision 23, honest scope:
+ * a fully-FS-privileged process is out of scope). Returns undefined when no
+ * signing key exists (a single-machine non-mesh install) — then a fixture
+ * override can be neither minted nor verified (the safe direction). The raw PEM
+ * is never used directly; the key is a domain-separated hash of it.
+ */
+export declare function loadTestIdentityKey(stateDir: string): string | undefined;
+/** Mint the HMAC signature for a legitimate fixture-collision override. */
+export declare function signAllowTestIdentity(serverKey: string, userId: string, marker: string): string;
+/**
+ * Verify a profile's signed allow-marker on the LOAD path (no PIN present).
+ * Constant-time compare. Returns true iff the profile carries an
+ * `allowTestIdentity` whose `marker` equals the matched marker AND whose `sig`
+ * recomputes under the server key. A missing/bogus sig → false → quarantine.
+ */
+export declare function verifyAllowTestIdentity(serverKey: string | undefined | null, userId: string, matchedMarker: string, allow: AllowTestIdentityMarker | undefined | null): boolean;
+//# sourceMappingURL=testIdentityMarkers.d.ts.map

package/dist/users/testIdentityMarkers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testIdentityMarkers.d.ts","sourceRoot":"","sources":["../../src/users/testIdentityMarkers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;CAOxB,CAAC;AAOX;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQxF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,aAAa,GAAG,UAAU,CAAC,GAAG,MAAM,GAAG,IAAI,CAc9G;AAED;kFACkF;AAClF,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAU9C;AAID;qFACqF;AACrF,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAOrG;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUxE;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACpC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,uBAAuB,GAAG,SAAS,GAAG,IAAI,GAChD,OAAO,CAaT"}

package/dist/users/testIdentityMarkers.js

@@ -0,0 +1,170 @@
+/**
+ * Test-Identity Refusal (silent-loss-refusal-conservation §2.D — "Test Identity
+ * Never Enters Production State"). The 2026-07-01 silent-loss incident began 19
+ * days earlier when a live-test / harness run clobbered a machine's `users.json`
+ * with FIXTURE identities. A registry populated with only fixtures rejects every
+ * real sender (including the operator) once sender re-validation arms.
+ *
+ * This module is the single source of truth for WHICH identities are fixtures
+ * and HOW a legitimate name-collision is overridden. It is pure + dependency-free
+ * so both the write-path guard (UserManager.validateProfile — typed throw) and the
+ * load-path guard (UserManager.loadUsers — refuse-and-skip, never throw) and the
+ * §4 boot remediation share ONE matcher and can never drift.
+ *
+ * MATCH RULE (round-2 adversarial #10): exact match on the known fixture platform
+ * IDS + reserved-token anchored prefixes on ids — DISPLAY NAME IS NEVER A MATCH
+ * CRITERION (a real user named "Olivia" registers fine). See §2.D / decision 3.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * The closed fixture-identity set. IDS + reserved tokens only — never a
+ * display-name. Exact-match on the known platform ids; anchored-prefix match on
+ * the reserved `livetest`/`g3test` tokens.
+ *
+ * - `slackIds`   — the demo Slack workspace user ids used by the live-test harness.
+ * - `harnessIds` — the `u-*` / `U_*` fixture user ids the integration harness writes.
+ * - `reservedTokenPrefixes` — anchored id/username prefixes the isolated test-home
+ *   scaffold uses (`livetest…`, `g3test…`).
+ */
+export const TEST_IDENTITY_MARKERS = {
+    slackIds: ['U0BA7QGPBQS', 'U0BA5NW9QA2', 'U0B9SFJ7QAK', 'U0B9SFV2BAT', 'U0BA4L8RMFF'],
+    harnessIds: [
+        'u-olivia', 'u-adam', 'u-mia', 'u-cory', 'u-oscar',
+        'U_OLIVIA', 'U_ADAM', 'U_MIA', 'U_CORY', 'U_OSCAR',
+    ],
+    reservedTokenPrefixes: ['livetest', 'g3test'],
+};
+const EXACT_IDS = new Set([
+    ...TEST_IDENTITY_MARKERS.slackIds,
+    ...TEST_IDENTITY_MARKERS.harnessIds,
+]);
+/**
+ * Does a single string token match a fixture marker? Exact match against the
+ * known-id set, OR an anchored (^) reserved-token prefix. Case-sensitive on the
+ * exact set (platform ids are case-significant); the reserved-token prefix is
+ * matched case-INsensitively (a `LiveTest…` id is still a fixture).
+ */
+export function matchesTestIdentityToken(token) {
+    if (typeof token !== 'string' || !token)
+        return null;
+    if (EXACT_IDS.has(token))
+        return token;
+    const lower = token.toLowerCase();
+    for (const prefix of TEST_IDENTITY_MARKERS.reservedTokenPrefixes) {
+        if (lower.startsWith(prefix))
+            return token;
+    }
+    return null;
+}
+/**
+ * Classify a profile against the fixture-identity set. Checks the id, the Slack
+ * user id, and slack-typed channel identifiers — NEVER the display name.
+ * Returns the matched marker string (for the audit + the allow-marker) or null.
+ */
+export function matchTestIdentity(profile) {
+    const idMatch = matchesTestIdentityToken(profile.id);
+    if (idMatch)
+        return idMatch;
+    const slackMatch = matchesTestIdentityToken(profile.slackUserId ?? null);
+    if (slackMatch)
+        return slackMatch;
+    if (Array.isArray(profile.channels)) {
+        for (const ch of profile.channels) {
+            if (ch && ch.type === 'slack') {
+                const chMatch = matchesTestIdentityToken(ch.identifier);
+                if (chMatch)
+                    return chMatch;
+            }
+        }
+    }
+    return null;
+}
+/** Typed error thrown by the WRITE path (validateProfile) when a fixture identity
+ *  is written without a verifying allow-marker + the double-keyed test escape. */
+export class TestIdentityRefusedError extends Error {
+    marker;
+    constructor(profileId, marker) {
+        super(`Refusing to persist test/fixture identity "${profileId}" (matched marker "${marker}") into the production user registry ` +
+            `— "Test Identity Never Enters Production State" (silent-loss-refusal-conservation §2.D). ` +
+            `A legitimate name-collision uses the dashboard-PIN-authed X-Instar-Allow-Identity override; ` +
+            `an isolated test home sets INSTAR_ALLOW_TEST_IDENTITIES=1 plus the on-disk test-home marker.`);
+        this.name = 'TestIdentityRefusedError';
+        this.marker = marker;
+    }
+}
+// ── Double-keyed test escape (env + on-disk test-home marker) ────────────────
+/** The on-disk marker a test home's scaffold writes to opt that home into
+ *  fixture-identity writes. Its PRESENCE is the second key; contents are ignored. */
+export const TEST_HOME_MARKER_FILENAME = '.instar-test-home';
+/**
+ * The narrow escape is double-keyed (§2.D / decision 11): the env var
+ * `INSTAR_ALLOW_TEST_IDENTITIES=1` is honored ONLY when an on-disk test-home
+ * marker is ALSO present under the state dir. Env-set-but-marker-absent → refuse
+ * (a stray env var on a production box can never open the door).
+ */
+export function testIdentitiesAllowed(stateDir, env = process.env) {
+    if (env.INSTAR_ALLOW_TEST_IDENTITIES !== '1')
+        return false;
+    try {
+        return fs.existsSync(path.join(stateDir, TEST_HOME_MARKER_FILENAME));
+    }
+    catch {
+        return false;
+    }
+}
+function allowMarkerMessage(userId, marker) {
+    return `${userId}:${marker}`;
+}
+/**
+ * Derive the server-held allow-marker HMAC key from the machine SIGNING key PEM
+ * — a server-held secret loaded only by the server process, NOT the
+ * authToken/dashboardPin and NOT users.json (§2.D / decision 23, honest scope:
+ * a fully-FS-privileged process is out of scope). Returns undefined when no
+ * signing key exists (a single-machine non-mesh install) — then a fixture
+ * override can be neither minted nor verified (the safe direction). The raw PEM
+ * is never used directly; the key is a domain-separated hash of it.
+ */
+export function loadTestIdentityKey(stateDir) {
+    for (const name of ['signing-key.pem', 'signing-private.pem']) {
+        try {
+            const pem = fs.readFileSync(path.join(stateDir, 'machine', name), 'utf-8');
+            if (pem && pem.trim()) {
+                return crypto.createHash('sha256').update(`instar-test-identity-allow:${pem}`).digest('hex');
+            }
+        }
+        catch { /* try next / none */ }
+    }
+    return undefined;
+}
+/** Mint the HMAC signature for a legitimate fixture-collision override. */
+export function signAllowTestIdentity(serverKey, userId, marker) {
+    return crypto.createHmac('sha256', serverKey).update(allowMarkerMessage(userId, marker)).digest('hex');
+}
+/**
+ * Verify a profile's signed allow-marker on the LOAD path (no PIN present).
+ * Constant-time compare. Returns true iff the profile carries an
+ * `allowTestIdentity` whose `marker` equals the matched marker AND whose `sig`
+ * recomputes under the server key. A missing/bogus sig → false → quarantine.
+ */
+export function verifyAllowTestIdentity(serverKey, userId, matchedMarker, allow) {
+    if (!serverKey)
+        return false;
+    if (!allow || typeof allow.marker !== 'string' || typeof allow.sig !== 'string')
+        return false;
+    if (allow.marker !== matchedMarker)
+        return false;
+    const expected = signAllowTestIdentity(serverKey, userId, matchedMarker);
+    try {
+        const a = Buffer.from(expected, 'hex');
+        const b = Buffer.from(allow.sig, 'hex');
+        if (a.length !== b.length || a.length === 0)
+            return false;
+        return crypto.timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=testIdentityMarkers.js.map

package/dist/users/testIdentityMarkers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testIdentityMarkers.js","sourceRoot":"","sources":["../../src/users/testIdentityMarkers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,CAAU;IAC9F,UAAU,EAAE;QACV,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;QAClD,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;KAC1C;IACV,qBAAqB,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAU;CAC9C,CAAC;AAEX,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAS;IACrD,GAAG,qBAAqB,CAAC,QAAQ;IACjC,GAAG,qBAAqB,CAAC,UAAU;CACpC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA6D;IAC7F,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;IACzE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;gBACxD,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;kFACkF;AAClF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAAS;IACxB,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CACH,8CAA8C,SAAS,sBAAsB,MAAM,uCAAuC;YAC1H,2FAA2F;YAC3F,8FAA8F;YAC9F,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,gFAAgF;AAEhF;qFACqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC1F,IAAI,GAAG,CAAC,4BAA4B,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAiBD,SAAS,kBAAkB,CAAC,MAAc,EAAE,MAAc;IACxD,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3E,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,MAAc,EAAE,MAAc;IACrF,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAoC,EACpC,MAAc,EACd,aAAqB,EACrB,KAAiD;IAEjD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9F,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.704",
+  "version": "1.3.705",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",