shadok-ai 0.17.26 → 0.17.27

package/README.md

@@ -639,8 +639,8 @@ know before opening it up:
     add, and flags it to every admin. There is no mail yet: this panel is the
     channel, so keep an eye on its badge.
   - While it is on, the instance password (`admin`) **cannot sign in to the
-    browser** — it lives in every agent's environment and no one could reset it;
-    use a named account. Agents, Telegram and peers keep working (they never use
+    browser** — no one could reset it (and agents started before it was removed
+    from their environment still hold it); use a named account. Agents, Telegram and peers keep working (they never use
     the login), but account and two-factor management is reserved to a signed-in
     person: an agent's key can no longer create or reset accounts.
   - Passkeys need a **secure context**: `https://` (see "Behind TLS") or
@@ -653,6 +653,22 @@ know before opening it up:
     session issued before it was switched on (they stop working). What it does
     not: anything already running as the machine's user — same soft isolation as
     profiles.
+- **An agent is not the admin.** An agent authenticates to its own cockpit with
+  `SHADOK_SESSION_KEY`, and that key makes it **that agent**: a member of its own
+  channel's group, never an admin. It can drive its siblings (in multi-tenant:
+  the agents of its own group plus public ones), schedule prompts on its
+  channel, store a secret it obtained, record in the ledger, send you files,
+  reload itself — and is refused (`403`) on account, peer, Telegram, backend and
+  the other admin routes, and on every **browser-only** route (guardrails, shell
+  mode, uploads…), which now require a signed-in person's session rather than
+  an `Origin` header. Agents are no longer handed the admin's cookie
+  (`SHADOK_AUTH`) nor the instance password (`SHADOK_GUI_PASSWORD`). An agent
+  that a restricted peer spawned stays in that peer's box.
+  **Upgrading:** the first start of this version signs out whoever is signed in
+  with the instance password (once). Agents spawned before it still hold the
+  password in their environment — **change the password** (`--password` /
+  `SHADOK_GUI_PASSWORD`) and **reload those agents** (version menu → *Restart all
+  agents*) to take it away from them.
 - Once people are named, **a prompt carries its sender**: the agent sees who
   asked, and the other browsers show the name above the message instead of
   "pilot (elsewhere)". The server takes that name from the session, never from

package/context/agents-skill/SKILL.md

@@ -229,8 +229,11 @@ curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
   "http://127.0.0.1:$SHADOK_PORT/channels"
 ```
 
-`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
-environment at spawn and expires after a week, so never rely on it alone. A
+That key is your ONLY credential, and it does not expire. You are no longer
+handed a cookie or the cockpit password, and a call made with the key is made
+as YOU — an agent of your own group, never an admin: account, backend and
+other cockpit-admin routes answer `403`, and so do the person-only (browser)
+ones. That is by design; ask the human when you need one of those. A
 `401` means that header is missing — or that you were started before this
 existed, in which case nothing you hold can authenticate any more and only a
 human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/context/agents-skill/pilotctl.mjs

@@ -69,17 +69,12 @@ export function resolvePeer(peersOut, alias) {
   if (!p || typeof p.url !== "string" || typeof p.token !== "string" || !p.url || !p.token) return null;
   return { url: p.url.replace(/\/+$/, ""), token: p.token };
 }
-// When a GUI password is set, the server injects SHADOK_AUTH=sk_auth=<token>
-// into every agent's env; loopback HTTP + WS calls must present it as the cookie
-// or the password gate 401s them — exactly what secret.py / schedule.py and the
-// Telegram bridge already do. Empty when no password is set → no change.
-// The session key is the DURABLE half and is sent whenever it is set.
-// SHADOK_AUTH is a dated cookie frozen into this process's environment at
-// spawn, so it expires after a week and nothing can refresh it — an agent
-// older than that got 401 on every call here. The key is derived from the
-// session id, verifies for as long as the agent runs, and grants exactly what
-// the cookie did. Both are sent: the cookie still works, and an older server
-// that does not know the header simply ignores it.
+// An agent authenticates with its own session key (SHADOK_SESSION_KEY) — its
+// ONLY credential: the server no longer hands agents a cookie or the cockpit
+// password. The key is derived from the session id, verifies for as long as the
+// agent runs, and makes the caller THIS AGENT (its own group's agents, never an
+// admin). A human running pilotctl by hand has no key; on a password-protected
+// cockpit they can export SHADOK_AUTH (their own `sk_auth=…` cookie) instead.
 export const authHeaders = () =>
   PEER
     ? // Targeting a remote peer: the ONLY credential it accepts is the peer token.
@@ -100,7 +95,7 @@ export const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 // `ws` already has them, so it is returned untouched.
 //
 // Both accept the non-standard `{ headers }` option, which is what carries the
-// SHADOK_AUTH cookie past the password gate — verified against a real upgrade
+// auth headers past the password gate — verified against a real upgrade
 // handler on the built-in, not assumed.
 function makeWS(url, opts) {
   if (!WS)

package/context/files-skill/SKILL.md

@@ -57,9 +57,8 @@ curl -sS -X POST -H "content-type: application/json" \
   "http://127.0.0.1:$SHADOK_PORT/files"
 ```
 
-`$SHADOK_AUTH` (a cookie) is still accepted elsewhere, but it was frozen into
-this process's environment at spawn and expires after a week, so never rely on
-it alone. A `401` or `403` means that header is missing — or that you were
+That key is your only credential and it does not expire (no cookie, no
+cockpit password is handed to an agent). A `401` or `403` means that header is missing — or that you were
 started before this existed, in which case nothing you hold can authenticate
 any more and only a human can fix it: ask them for *Reload agent* on your ⋯
 menu.

package/context/ledger-skill/ledger.mjs

@@ -30,7 +30,6 @@ import { upsertEntry, searchEntries, ageDays, resolveId, normEntity, rowKind, KI
 
 const PORT = (process.env.SHADOK_PORT || "").trim();
 const KEY = (process.env.SHADOK_SESSION_KEY || "").trim();
-const AUTH = (process.env.SHADOK_AUTH || "").trim();
 // On-server: a port AND a session key. The key is what proves WHICH agent calls,
 // and it is what the server scopes the authoring group by — without it there is
 // no identity, so we fall back to the local file.
@@ -79,9 +78,7 @@ async function api(method, p, body, { soft404 = false } = {}) {
       method,
       headers: {
         "content-type": "application/json",
-        ...(AUTH ? { Cookie: AUTH } : {}),
-        // The durable credential: the cookie in the env expires after a week,
-        // the session key does not (invariant 33).
+        // The agent's only credential; it does not expire (invariant 33).
         ...(KEY ? { "x-shadok-session-key": KEY } : {}),
       },
       body: body === undefined ? undefined : JSON.stringify(body),

package/context/pilot-prompt.md

@@ -81,7 +81,9 @@ Claude Code sessions in parallel. A human pilots you from a browser chat
 - The cockpit exposes a local API at `http://127.0.0.1:$SHADOK_PORT`. If you
   call it yourself, authenticate with `-H "x-shadok-session-key:
   $SHADOK_SESSION_KEY"` — a `401` means that header is missing. (The shadok
-  skills already do this for you.)
+  skills already do this for you.) That key is your only credential and it
+  makes you an agent of your own group, not an admin: admin-only and
+  person-only routes answer `403` by design.
 
 ## Language — two different rules, don't mix them up
 - **Anything you write into a repo is in English**: code comments, identifiers,

package/context/reload-skill/SKILL.md

@@ -32,8 +32,11 @@ curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
   "http://127.0.0.1:$SHADOK_PORT/channels"
 ```
 
-`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
-environment at spawn and expires after a week, so never rely on it alone. A
+That key is your ONLY credential, and it does not expire. You are no longer
+handed a cookie or the cockpit password, and a call made with the key is made
+as YOU — an agent of your own group, never an admin: account, backend and
+other cockpit-admin routes answer `403`, and so do the person-only (browser)
+ones. That is by design; ask the human when you need one of those. A
 `401` means that header is missing — or that you were started before this
 existed, in which case nothing you hold can authenticate any more and only a
 human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/context/reload-skill/reload.mjs

@@ -6,7 +6,6 @@ import http from "node:http";
 
 const key = process.env.SHADOK_SESSION_KEY;
 const port = process.env.SHADOK_PORT || "3789";
-const cookie = process.env.SHADOK_AUTH; // "sk_auth=…" when a GUI password is set
 
 if (!key) {
   console.error("SHADOK_SESSION_KEY is not set — not running under the shadok-ai cockpit?");
@@ -23,9 +22,8 @@ const req = http.request(
     headers: {
       "content-type": "application/json",
       "content-length": Buffer.byteLength(body),
-      ...(cookie ? { cookie } : {}),
-      // The key authenticates too, and unlike the cookie it cannot age out —
-      // which matters most here: an expired cookie left the agent unable to
+      // The agent's only credential, and it cannot age out — which matters
+      // most here: an expired cookie once left an agent unable to
       // reach the one endpoint that would have repaired it.
       "x-shadok-session-key": key,
     },

package/context/scheduler-skill/SKILL.md

@@ -137,8 +137,11 @@ curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
   "http://127.0.0.1:$SHADOK_PORT/channels"
 ```
 
-`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
-environment at spawn and expires after a week, so never rely on it alone. A
+That key is your ONLY credential, and it does not expire. You are no longer
+handed a cookie or the cockpit password, and a call made with the key is made
+as YOU — an agent of your own group, never an admin: account, backend and
+other cockpit-admin routes answer `403`, and so do the person-only (browser)
+ones. That is by design; ask the human when you need one of those. A
 `401` means that header is missing — or that you were started before this
 existed, in which case nothing you hold can authenticate any more and only a
 human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/context/scheduler-skill/scripts/schedule.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // schedule — manage the CURRENT shadok-ai channel's scheduled prompts (crons)
 // through the local server API. Reads SHADOK_SESSION_ID / SHADOK_PORT /
-// SHADOK_AUTH from the env (injected by shadok-ai into every agent).
+// SHADOK_SESSION_KEY from the env (injected by shadok-ai into every agent).
 //
 // Node, not Python: shadok-ai IS a Node program, so the runtime is guaranteed
 // present wherever a skill runs. The Dockerfile's python3 is there to build
@@ -25,7 +25,7 @@ function env() {
   const port = process.env.SHADOK_PORT;
   const sid = process.env.SHADOK_SESSION_ID;
   if (!port || !sid) die("Not inside a shadok-ai channel (SHADOK_PORT / SHADOK_SESSION_ID unset).");
-  return { base: `http://127.0.0.1:${port}`, sid, auth: process.env.SHADOK_AUTH ?? "" , key: process.env.SHADOK_SESSION_KEY ?? "" };
+  return { base: `http://127.0.0.1:${port}`, sid, key: process.env.SHADOK_SESSION_KEY ?? "" };
 }
 
 async function api(ctx, method, path, body) {
@@ -35,9 +35,7 @@ async function api(ctx, method, path, body) {
       method,
       headers: {
         "content-type": "application/json",
-        ...(ctx.auth ? { Cookie: ctx.auth } : {}),
-        // Durable half — see the note in pilotctl.mjs: the cookie is frozen
-        // into this process's env at spawn and expires after a week.
+        // The agent's ONLY credential (no cookie is handed to agents any more).
         ...(ctx.key ? { "x-shadok-session-key": ctx.key } : {}),
       },
       body: body === undefined ? undefined : JSON.stringify(body),

package/context/scheduler-skill/test/schedule.test.mjs

@@ -86,7 +86,9 @@ test("add posts the channel's own sessionId, the guard and the timezone", async
     check: "sh guard.sh",
     tz: "Europe/Paris",
   });
-  assert.equal(srv.seen[0].cookie, "sk_auth=tok");
+  // No cookie any more, even if one sits in the env: the session key is an
+  // agent's only credential.
+  assert.equal(srv.seen[0].cookie, undefined);
   assert.match(res.out, /scheduled \[abcdef01\] daily 09:00 \(Europe\/Paris\) \+guard/);
 });
 

package/context/secrets-skill/SKILL.md

@@ -81,8 +81,11 @@ curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
   "http://127.0.0.1:$SHADOK_PORT/channels"
 ```
 
-`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
-environment at spawn and expires after a week, so never rely on it alone. A
+That key is your ONLY credential, and it does not expire. You are no longer
+handed a cookie or the cockpit password, and a call made with the key is made
+as YOU — an agent of your own group, never an admin: account, backend and
+other cockpit-admin routes answer `403`, and so do the person-only (browser)
+ones. That is by design; ask the human when you need one of those. A
 `401` means that header is missing — or that you were started before this
 existed, in which case nothing you hold can authenticate any more and only a
 human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/context/secrets-skill/scripts/secret.mjs

@@ -7,7 +7,7 @@
 // leaks. There is deliberately no way to read a value back out — `list` prints
 // names only, and there is no `get`.
 //
-// Reads SHADOK_PORT / SHADOK_AUTH from the env (injected into every agent).
+// Reads SHADOK_PORT / SHADOK_SESSION_KEY from the env (injected into every agent).
 //
 // Node, not Python: shadok-ai IS a Node program, so the runtime is guaranteed
 // present wherever a skill runs — the image's python3 exists to build native
@@ -29,7 +29,7 @@ class UsageError extends Error {}
 function env() {
   const port = process.env.SHADOK_PORT;
   if (!port) die("Not inside a shadok-ai agent (SHADOK_PORT unset).");
-  return { base: `http://127.0.0.1:${port}`, auth: process.env.SHADOK_AUTH ?? "" , key: process.env.SHADOK_SESSION_KEY ?? "" };
+  return { base: `http://127.0.0.1:${port}`, key: process.env.SHADOK_SESSION_KEY ?? "" };
 }
 
 async function api(ctx, method, path, body) {
@@ -39,9 +39,7 @@ async function api(ctx, method, path, body) {
       method,
       headers: {
         "content-type": "application/json",
-        ...(ctx.auth ? { Cookie: ctx.auth } : {}),
-        // Durable half — see the note in pilotctl.mjs: the cookie is frozen
-        // into this process's env at spawn and expires after a week.
+        // The agent's ONLY credential (no cookie is handed to agents any more).
         ...(ctx.key ? { "x-shadok-session-key": ctx.key } : {}),
       },
       body: body === undefined ? undefined : JSON.stringify(body),
@@ -102,7 +100,6 @@ async function apiSoft(ctx, method, path, body) {
       method,
       headers: {
         "content-type": "application/json",
-        ...(ctx.auth ? { Cookie: ctx.auth } : {}),
         ...(ctx.key ? { "x-shadok-session-key": ctx.key } : {}),
       },
       body: body === undefined ? undefined : JSON.stringify(body),

package/context/secrets-skill/test/secret.test.mjs

@@ -27,7 +27,9 @@ test("set reads the value from stdin and sends it in the body", async () => {
   await srv.close();
   assert.equal(res.code, 0, res.err);
   assert.deepEqual(srv.seen.body, { name: "A", value: "s3cr3t" });
-  assert.equal(srv.seen.cookie, "sk_auth=tok");
+  // No cookie any more, even if one sits in the env: the session key is an
+  // agent's only credential.
+  assert.equal(srv.seen.cookie, undefined);
   // The value must never be echoed back — the reply lands in the transcript.
   assert.doesNotMatch(res.out, /s3cr3t/);
   // And the user has to be told the secret is inert until attached.

package/dist/accounts.d.ts

@@ -79,6 +79,19 @@ export declare function userWriteVerdict(o: {
  * cookie for any user. Untidy becomes impersonation the moment accounts exist.
  */
 export declare function sessionSecret(): Buffer;
+/**
+ * Bootstrap-admin cookies issued BEFORE this instant are dead.
+ *
+ * Until agents stopped being handed one, every agent carried `SHADOK_AUTH` — a
+ * bootstrap-admin cookie valid for a week, from the network too. Those cookies
+ * are indistinguishable from a person's bootstrap login, so the only way to
+ * retire them is by date: the first boot of a server that no longer issues them
+ * records "now", once, and from then on an older bootstrap cookie is refused.
+ * Cost: whoever is signed in with the instance password signs in again, once.
+ * Named accounts are untouched (their cookies were never given to agents).
+ * Best-effort: a write that fails returns 0, i.e. today's behaviour.
+ */
+export declare function bootstrapSessionsAfter(now: number): number;
 /** `<user base64url>.<issuedAt>.<mfa>.<hmac>` — the name is encoded so a dot in
  *  it cannot shift the fields. The ROLE is deliberately absent: it is re-read
  *  from the account file at use time, so a demotion takes effect immediately

package/dist/accounts.js

@@ -59,6 +59,12 @@ export function userWriteVerdict(o) {
     if (o.action === "create") {
         if (name === BOOTSTRAP_ADMIN)
             return { ok: false, error: `"${BOOTSTRAP_ADMIN}" is reserved for the instance password` };
+        // `agent:<sessionId>` is how an AGENT is named as a principal
+        // (src/agent-principal.ts). Authorization never trusts the name — it reads
+        // the principal's own `agent` field — but a person wearing an agent's name
+        // would be one more thing for a reader of the logs to get wrong.
+        if (name.startsWith("agent:"))
+            return { ok: false, error: `"agent:" names are reserved for agents` };
         return o.exists ? { ok: false, error: `${name} already exists` } : { ok: true };
     }
     return o.exists ? { ok: true } : { ok: false, error: `no such account: ${name}` };
@@ -87,6 +93,37 @@ export function sessionSecret() {
     fs.chmodSync(f, 0o600);
     return secret;
 }
+/**
+ * Bootstrap-admin cookies issued BEFORE this instant are dead.
+ *
+ * Until agents stopped being handed one, every agent carried `SHADOK_AUTH` — a
+ * bootstrap-admin cookie valid for a week, from the network too. Those cookies
+ * are indistinguishable from a person's bootstrap login, so the only way to
+ * retire them is by date: the first boot of a server that no longer issues them
+ * records "now", once, and from then on an older bootstrap cookie is refused.
+ * Cost: whoever is signed in with the instance password signs in again, once.
+ * Named accounts are untouched (their cookies were never given to agents).
+ * Best-effort: a write that fails returns 0, i.e. today's behaviour.
+ */
+export function bootstrapSessionsAfter(now) {
+    const f = path.join(os.homedir(), ".shadok-ai", "users", instanceKey() + ".bootstrap-after");
+    try {
+        const n = Number(fs.readFileSync(f, "utf8").trim());
+        if (Number.isFinite(n) && n > 0)
+            return n;
+    }
+    catch {
+        /* first boot of this version: record it below */
+    }
+    try {
+        fs.mkdirSync(path.dirname(f), { recursive: true });
+        fs.writeFileSync(f, String(now), { mode: 0o600 });
+        return now;
+    }
+    catch {
+        return 0;
+    }
+}
 /** `<user base64url>.<issuedAt>.<mfa>.<hmac>` — the name is encoded so a dot in
  *  it cannot shift the fields. The ROLE is deliberately absent: it is re-read
  *  from the account file at use time, so a demotion takes effect immediately

package/dist/accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA8CzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAKhC;IACC,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,eAAe;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,eAAe,yCAAyC,EAAE,CAAC;QAC5F,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;6EAK6E;AAC7E,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc,EAAE,GAAG,GAAG,KAAK;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,MAAc,EACd,GAAW,EACX,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,GAAG,GAAG,QAAQ,GAAG,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,GAAW,EAAE,QAAgB;IACtF,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACrE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAoC;IACjF,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC;AAC/D,CAAC;AAED;kEACkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA4B,EAC5B,KAAa,EACb,GAAW;IAEX,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iFAAiF,EAAE,CAAC;IACjH,IAAI,CAAC,OAAO,CAAC,MAAM;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACtF,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA0B,EAC1B,WAA+B,EAC/B,OAA2B,EAC3B,WAAgC;IAEhC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,EAAE,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,EAAE,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA8CzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAKhC;IACC,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,eAAe;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,eAAe,yCAAyC,EAAE,CAAC;QAC5F,8DAA8D;QAC9D,2EAA2E;QAC3E,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QACrG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;6EAK6E;AAC7E,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc,EAAE,GAAG,GAAG,KAAK;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,MAAc,EACd,GAAW,EACX,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,GAAG,GAAG,QAAQ,GAAG,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,GAAW,EAAE,QAAgB;IACtF,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACrE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAoC;IACjF,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC;AAC/D,CAAC;AAED;kEACkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA4B,EAC5B,KAAa,EACb,GAAW;IAEX,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iFAAiF,EAAE,CAAC;IACjH,IAAI,CAAC,OAAO,CAAC,MAAM;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACtF,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA0B,EAC1B,WAA+B,EAC/B,OAA2B,EAC3B,WAAgC;IAEhC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,EAAE,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,EAAE,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/agent-principal.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The AGENT as a principal of its own — not the bootstrap admin.
+ *
+ * Every agent carries `SHADOK_SESSION_KEY` (`src/accounts.ts`), and the server
+ * used to resolve a valid key to `{name: BOOTSTRAP_ADMIN, role: "admin"}`. That
+ * made every agent — including a multi-tenant agent running as an unprivileged
+ * OS user precisely so it could NOT reach other groups — a full admin of the
+ * API: mint an admin invitation, rewrite the model backend, restart every
+ * agent, see and drive every group's agents. The OS-user wall was moot.
+ *
+ * A key now resolves to THE AGENT: its session id, the group its channel was
+ * born into, its profile, the person it was created for, and the restricted
+ * peer it was spawned by, if any. As an account it is a `member` (never an
+ * admin), named `agent:<sessionId>` so it can never collide with a person's
+ * name, and its group membership is exactly its channel's group — nothing a
+ * frame or a body says. Pure, so the rules are tested without a server.
+ */
+import type { Role } from "./accounts.js";
+/** Who an agent is, as far as authorization goes. */
+export interface AgentPrincipal {
+    sessionId: string;
+    /** The group its channel was born into; null = the commons. */
+    group: string | null;
+    profile: string | null;
+    /** The person this agent ultimately works for (`Channel.createdBy`). */
+    createdBy: string | null;
+    /**
+     * The RESTRICTED peer whose box this agent lives in, when a restricted peer
+     * spawned it (directly or through an ancestor that carried the tag). Such an
+     * agent inherits the box: it sees and drives only that peer's agents. null
+     * for an agent no restricted peer owns.
+     */
+    peer: string | null;
+}
+/** The account-shaped view of an agent: a member, never an admin. */
+export interface AgentAccount {
+    name: string;
+    role: Role;
+    agent: AgentPrincipal;
+}
+/** Prefix of an agent's account name. Reserved: `userWriteVerdict` refuses a
+ *  person account named with it. Nothing authorizes on the NAME anyway — an
+ *  agent is recognised by the `agent` field, which only the key resolution sets. */
+export declare const AGENT_ACCOUNT_PREFIX = "agent:";
+export declare function agentAccountName(sessionId: string): string;
+/**
+ * Resolve the principal behind a VERIFIED session id (the caller has already
+ * checked the key's MAC and that it came from this machine). The channel
+ * registry is the authority (invariant 1): the group, profile and creator are
+ * read from the row, never from the request.
+ *
+ * `peerScope` answers the scope of a peer by name, or null when that peer is no
+ * longer listed. A `createdByPeer` tag on the channel puts the agent in that
+ * peer's box when the peer is restricted — AND when it has been revoked: an
+ * unknown peer can no longer be proven to be a member, and the box is the
+ * fail-closed direction.
+ */
+export declare function resolveAgentPrincipal(sessionId: string, channels: readonly {
+    sessionId: string;
+    group?: string | null;
+    profile?: string | null;
+    createdBy?: string | null;
+    createdByPeer?: string;
+}[], peerScope: (name: string) => "member" | "restricted" | null, liveProfile?: string | null): AgentPrincipal;
+export declare function agentAccount(p: AgentPrincipal): AgentAccount;
+/**
+ * Credentials that must NEVER reach an agent's environment.
+ *
+ * `SHADOK_AUTH` was the bootstrap admin's cookie, injected into every agent and
+ * valid from the network for a week. `SHADOK_GUI_PASSWORD` is the instance
+ * password, which IS the bootstrap admin: the supervisor hands it to the server
+ * through the env, and every child the server spawned inherited it — node-pty
+ * copies `process.env`, a tmux pane inherits the tmux SERVER's global
+ * environment (captured whenever that server first started, possibly by an
+ * older shadok), and `setpriv` keeps the env across the uid drop. Either one
+ * let an agent `POST /login` or present a cookie as the admin, from anywhere.
+ *
+ * The agent's own credential is `SHADOK_SESSION_KEY`, which proves "I am this
+ * agent" and nothing more.
+ */
+export declare const AGENT_CREDENTIAL_VARS: readonly string[];
+export declare function isAgentCredentialVar(name: string): boolean;
+/** A copy of `env` without the credential variables. */
+export declare function withoutAgentCredentials<T extends Record<string, string | undefined>>(env: T): T;
+/**
+ * Is this request a PERSON in a browser on our own origin — the only caller the
+ * "browser-only" routes (guardrails, accounts, shell mode, uploads…) accept?
+ *
+ * `Origin` alone proved nothing: any process can send `Origin: http://<host>`,
+ * so an agent's `curl -H Origin:…` passed every one of those gates. Now:
+ *  - a request carrying an agent's session key or a peer token is a MACHINE,
+ *    whatever else it carries — a browser never sends either header;
+ *  - with a password set, it must also carry a PERSON's session cookie;
+ *  - and the same-origin `Origin` check stays, as the CSRF layer it always was.
+ * With no password there is no cookie to ask for (local single-user default),
+ * so the Origin check and the machine-header refusal are what remain.
+ */
+export declare function isBrowserPerson(o: {
+    hasAgentKey: boolean;
+    hasPeerToken: boolean;
+    passwordSet: boolean;
+    personCookie: boolean;
+    sameOrigin: boolean;
+}): boolean;
+/** Was a header sent at all (any non-empty value)? Presence is what makes a
+ *  request a machine's — a browser never sets these, valid or not. */
+export declare function headerPresent(v: unknown): boolean;

package/dist/agent-principal.js

@@ -0,0 +1,105 @@
+/**
+ * The AGENT as a principal of its own — not the bootstrap admin.
+ *
+ * Every agent carries `SHADOK_SESSION_KEY` (`src/accounts.ts`), and the server
+ * used to resolve a valid key to `{name: BOOTSTRAP_ADMIN, role: "admin"}`. That
+ * made every agent — including a multi-tenant agent running as an unprivileged
+ * OS user precisely so it could NOT reach other groups — a full admin of the
+ * API: mint an admin invitation, rewrite the model backend, restart every
+ * agent, see and drive every group's agents. The OS-user wall was moot.
+ *
+ * A key now resolves to THE AGENT: its session id, the group its channel was
+ * born into, its profile, the person it was created for, and the restricted
+ * peer it was spawned by, if any. As an account it is a `member` (never an
+ * admin), named `agent:<sessionId>` so it can never collide with a person's
+ * name, and its group membership is exactly its channel's group — nothing a
+ * frame or a body says. Pure, so the rules are tested without a server.
+ */
+/** Prefix of an agent's account name. Reserved: `userWriteVerdict` refuses a
+ *  person account named with it. Nothing authorizes on the NAME anyway — an
+ *  agent is recognised by the `agent` field, which only the key resolution sets. */
+export const AGENT_ACCOUNT_PREFIX = "agent:";
+export function agentAccountName(sessionId) {
+    return `${AGENT_ACCOUNT_PREFIX}${sessionId}`;
+}
+/**
+ * Resolve the principal behind a VERIFIED session id (the caller has already
+ * checked the key's MAC and that it came from this machine). The channel
+ * registry is the authority (invariant 1): the group, profile and creator are
+ * read from the row, never from the request.
+ *
+ * `peerScope` answers the scope of a peer by name, or null when that peer is no
+ * longer listed. A `createdByPeer` tag on the channel puts the agent in that
+ * peer's box when the peer is restricted — AND when it has been revoked: an
+ * unknown peer can no longer be proven to be a member, and the box is the
+ * fail-closed direction.
+ */
+export function resolveAgentPrincipal(sessionId, channels, peerScope, liveProfile) {
+    const ch = channels.find((c) => c.sessionId === sessionId);
+    const tag = ch?.createdByPeer;
+    const peer = tag && peerScope(tag) !== "member" ? tag : null;
+    return {
+        sessionId,
+        group: ch?.group ?? null,
+        profile: liveProfile ?? ch?.profile ?? null,
+        createdBy: ch?.createdBy ?? null,
+        peer,
+    };
+}
+export function agentAccount(p) {
+    return { name: agentAccountName(p.sessionId), role: "member", agent: p };
+}
+/**
+ * Credentials that must NEVER reach an agent's environment.
+ *
+ * `SHADOK_AUTH` was the bootstrap admin's cookie, injected into every agent and
+ * valid from the network for a week. `SHADOK_GUI_PASSWORD` is the instance
+ * password, which IS the bootstrap admin: the supervisor hands it to the server
+ * through the env, and every child the server spawned inherited it — node-pty
+ * copies `process.env`, a tmux pane inherits the tmux SERVER's global
+ * environment (captured whenever that server first started, possibly by an
+ * older shadok), and `setpriv` keeps the env across the uid drop. Either one
+ * let an agent `POST /login` or present a cookie as the admin, from anywhere.
+ *
+ * The agent's own credential is `SHADOK_SESSION_KEY`, which proves "I am this
+ * agent" and nothing more.
+ */
+export const AGENT_CREDENTIAL_VARS = ["SHADOK_AUTH", "SHADOK_GUI_PASSWORD"];
+export function isAgentCredentialVar(name) {
+    return AGENT_CREDENTIAL_VARS.includes(name);
+}
+/** A copy of `env` without the credential variables. */
+export function withoutAgentCredentials(env) {
+    const out = { ...env };
+    for (const k of AGENT_CREDENTIAL_VARS)
+        delete out[k];
+    return out;
+}
+/**
+ * Is this request a PERSON in a browser on our own origin — the only caller the
+ * "browser-only" routes (guardrails, accounts, shell mode, uploads…) accept?
+ *
+ * `Origin` alone proved nothing: any process can send `Origin: http://<host>`,
+ * so an agent's `curl -H Origin:…` passed every one of those gates. Now:
+ *  - a request carrying an agent's session key or a peer token is a MACHINE,
+ *    whatever else it carries — a browser never sends either header;
+ *  - with a password set, it must also carry a PERSON's session cookie;
+ *  - and the same-origin `Origin` check stays, as the CSRF layer it always was.
+ * With no password there is no cookie to ask for (local single-user default),
+ * so the Origin check and the machine-header refusal are what remain.
+ */
+export function isBrowserPerson(o) {
+    if (o.hasAgentKey || o.hasPeerToken)
+        return false;
+    if (o.passwordSet && !o.personCookie)
+        return false;
+    return o.sameOrigin;
+}
+/** Was a header sent at all (any non-empty value)? Presence is what makes a
+ *  request a machine's — a browser never sets these, valid or not. */
+export function headerPresent(v) {
+    if (Array.isArray(v))
+        return v.some((x) => typeof x === "string" && x.length > 0);
+    return typeof v === "string" && v.length > 0;
+}
+//# sourceMappingURL=agent-principal.js.map

package/dist/agent-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-principal.js","sourceRoot":"","sources":["../src/agent-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA4BH;;oFAEoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,GAAG,oBAAoB,GAAG,SAAS,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,QAMG,EACH,SAA2D,EAC3D,WAA2B;IAE3B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,EAAE,EAAE,aAAa,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,OAAO;QACL,SAAS;QACT,KAAK,EAAE,EAAE,EAAE,KAAK,IAAI,IAAI;QACxB,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,OAAO,IAAI,IAAI;QAC3C,SAAS,EAAE,EAAE,EAAE,SAAS,IAAI,IAAI;QAChC,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAiB;IAC5C,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;AAE/F,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,uBAAuB,CAA+C,GAAM;IAC1F,MAAM,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,qBAAqB;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,CAM/B;IACC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,CAAC,CAAC,UAAU,CAAC;AACtB,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC"}