@cotal-ai/auth 0.12.0 → 0.13.0

package/dist/retirement-barrier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retirement-barrier.js","sourceRoot":"","sources":["../src/retirement-barrier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,SAAS,EAA+C,MAAM,oBAAoB,CAAC;AAE5F,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,UAAU,EACV,6BAA6B,EAC7B,gCAAgC,EAChC,mCAAmC,GAEpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,GAEf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrH,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AA2BrG,SAAS,qBAAqB,CAAC,CAAU,EAAE,IAAY,EAAE,KAAa;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7E,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,IAAI,yDAAyD,CAAC,CAAC;IACrH,gGAAgG;IAChG,6FAA6F;IAC7F,kGAAkG;IAClG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,CAAa;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,oFAAoF,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5N,OAAO,CAAa,CAAC;AACvB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAe,EAAE,GAAW,EAAE,KAAa;IACxE,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,GAAG,0BAA0B,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,GAAG,mBAAmB,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,GAAG,+BAA+B,CAAC,8BAA8B,CAAC,CAAC;IACtL,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACpH,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC;QACxG,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,GAAG,uDAAuD,CAAC,CAAC;IAC5H,IAAI,CAAC;QACH,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACrC,qBAAqB,CAAC,CAAC,CAAC,eAAe,EAAE,UAAU,GAAG,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,GAAG,mCAAoC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,CAAgC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAU,EAAE,IAAY,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAC3B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,wBAAwB,GAAG,cAAc,KAAK,CAAC,SAAS,8EAA8E,CAAC,CAAC;IAC3L,OAAO,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AA+ED;;+FAE+F;AAC/F,SAAS,SAAS,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAY,EAAE,OAAe;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvH,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,8BAA8B,OAAO,gDAAiD,CAAW,CAAC,OAAO,cAAc,CAAC,CAAC;IACjK,CAAC;IACD,IAAI,OAAO,KAAK,OAAO;QACrB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,8BAA8B,OAAO,sDAAsD,OAAO,sEAAsE,CAAC,CAAC;IAClN,OAAO,GAAG,CAAC;AACb,CAAC;AAED;4CAC4C;AAC5C,KAAK,UAAU,OAAO,CAAC,CAAqC,EAAE,OAAe;IAC3E,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI;QAC7B,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,yBAAyB,OAAO,mHAAmH,CAAC,CAAC;AAClM,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAqB,EACrB,IAQC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC;IAC/C,IAAI,SAAS,GAAG,KAAK;QACnB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,kBAAkB,SAAS,oFAAoF,CAAC,CAAC;IACpK,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAE/C,yFAAyF;IACzF,4FAA4F;IAC5F,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,wDAAwD,OAAO,OAAO,MAAM,6FAA8F,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClQ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC9C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oBAAoB,OAAO,YAAY,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,oDAAoD,CAAC,CAAC;IACxN,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,GAAG,CAAC,eAAe,KAAK,EAAE;QACjE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oBAAoB,OAAO,mEAAmE,CAAC,CAAC;IACnJ,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,QAAQ;QACvC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oBAAoB,OAAO,mBAAmB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,mEAAmE,CAAC,CAAC;IAC5L,IAAI,GAAG,CAAC,WAAW,KAAK,CAAC,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oBAAoB,OAAO,qBAAqB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,6GAA6G,CAAC,CAAC;IAEzO,MAAM,MAAM,GAAoB,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IAC3F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,sCAAsC;IACrF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,SAAS,CAAC;QACR,0FAA0F;QAC1F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC,IAAI,IAAI,CAAC,eAAe,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACxE,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;YACjF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,6CAA6C;gBAChG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM,CAAC,aAAa,EAAE,CAAC;gBAAC,UAAU,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,sFAAsF;YACtF,yFAAyF;YACzF,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3I,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;YAC9E,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,OAAO,iHAAiH,CAAC,CAAC;YACrL,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU;gBAC9B,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,OAAO,+GAA+G,CAAC,CAAC;YACnL,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC/B,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,OAAO,+IAA+I,CAAC,CAAC;YACnN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1F,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;gBACpF,IAAI,WAAW,KAAK,SAAS;oBAC3B,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC,OAAO,oBAAoB,WAAW,yEAAyE,CAAC,CAAC;gBACnL,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;gBACtE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBACtD,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,gBAAgB,WAAW,sGAAsG,CAAC,CAAC;gBAC3K,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;oBAAE,MAAM,CAAC,cAAc,EAAE,CAAC;qBAC3D,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;oBAAE,MAAM,CAAC,cAAc,EAAE,CAAC;;oBAChE,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC5B,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1F,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;gBACpF,IAAI,WAAW,KAAK,SAAS;oBAC3B,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC,OAAO,oBAAoB,WAAW,yEAAyE,CAAC,CAAC;gBACnL,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;gBACtE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBACtD,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,gBAAgB,WAAW,sGAAsG,CAAC,CAAC;gBAC3K,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;oBAAE,MAAM,CAAC,cAAc,EAAE,CAAC;qBAC3D,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;oBAAE,MAAM,CAAC,cAAc,EAAE,CAAC;;oBAChE,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC5B,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,0FAA0F;YAC1F,sFAAsF;YACtF,4CAA4C;YAC5C,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,OAAO,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1F,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,YAAY,OAAO,0CAA0C,KAAK,CAAC,WAAW,iBAAiB,KAAK,CAAC,eAAe,UAAU,UAAU,mBAAmB,QAAQ,CAAC,CAAC,CAAC,kEAAkE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,0EAA0E,CAAC,CAAC;QAC9W,CAAC;IACH,CAAC;AACH,CAAC;AAUD,SAAS,aAAa,CAAC,GAAY,EAAE,GAAW;IAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,uBAAuB,GAAG,+BAA+B,CAAC,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,uBAAuB,GAAG,+BAA+B,CAAC,8BAA8B,CAAC,CAAC;IACvL,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3F,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,uBAAuB,GAAG,gCAAgC,CAAC,CAAC;IACpG,OAAO,GAAgC,CAAC;AAC1C,CAAC;AAmBD;;;;;;;gBAOgB;AAChB,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,MAAwB,EACxB,IAAwB,EACxB,KAAa,EACb,IAAY,EACZ,GAAiB;IAEjB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAC/D,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,+BAA+B,IAAI,CAAC,QAAQ,iBAAiB,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,2GAA2G,CAAC,CAAC;QACnP,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/I,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9E,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,4DAA4D,UAAU,uEAAuE,CAAC,CAAC;QACvL,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YACpG,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mCAAmC,UAAU,gDAAgD,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC;QAC3K,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;QACpB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU;gBACzB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,uDAAuD,UAAU,+BAA+B,IAAI,CAAC,UAAU,oBAAoB,KAAK,GAAG,CAAC,CAAC;YAC9L,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3G,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC;gBACtB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,qCAAqC,UAAU,+BAA+B,OAAO,CAAC,KAAK,4CAA4C,CAAC,CAAC;YACjL,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACvI,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6CAA6C,UAAU,kFAAkF,CAAC,CAAC;QAC5L,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE;YACjC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK;SACnF,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;4FAU4F;AAC5F,KAAK,UAAU,kBAAkB,CAAC,IAAoB,EAAE,KAAqB;IAC3E,MAAM,cAAc,GAA2C,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI;gBAC3B,aAAa,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,2DAA2D,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,kBAAkB,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,yCAAyC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;QAC1U,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,SAAS,sNAAuN,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7U,CAAC;AACH,CAAC;AAED;;;;gDAIgD;AAChD,KAAK,UAAU,kBAAkB,CAC/B,MAAwB,EACxB,IAAwB,EACxB,KAAa,EACb,IAAY,EACZ,IAAoB,EACpB,OAAwC;IAExC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,MAAM,WAAW,GAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;IACnI,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sFAAsF;QACtF,yFAAyF;QACzF,MAAM,kBAAkB,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACvF,IAAI,YAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE;gBACpE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY;gBAChF,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB;aAC9G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAY,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,kBAAkB,CAAC,IAAI,EAAE;QAC7B,WAAW;QACX,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE;KACnG,CAAC,CAAC;IACH,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,YAAY,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAsB,EACtB,IAGC,EACD,IAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,eAAe,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAE9E,uFAAuF;IACvF,oFAAoF;IACpF,IAAI,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;YACzG,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,wBAAwB,cAAc,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,YAAY,MAAM,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,WAAW,IAAI,CAAC,YAAY,MAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,wDAAwD,CAAC,CAAC;IACjS,CAAC;SAAM,CAAC;QACN,qBAAqB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YAC1G,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,oCAAoC,IAAI,CAAC,YAAY,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACtQ,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,aAAa,IAAI,CAAC,YAAY,sDAAsD,CAAC,CAAC;QACzI,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC;YACxD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yBAAyB,IAAI,CAAC,YAAY,QAAQ,KAAK,CAAC,GAAG,CAAC,KAAK,mBAAmB,KAAK,CAAC,GAAG,CAAC,UAAU,gGAAgG,CAAC,CAAC;QAC7P,MAAM,KAAK,GAAqB;YAC9B,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;YACzF,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe;SAC5E,CAAC;QACF,MAAM,uBAAuB,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,cAAc,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzJ,CAAC;IAED,wFAAwF;IACxF,wFAAwF;IACxF,6EAA6E;IAC7E,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,SAAS;YACpB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,yBAAyB,MAAM,CAAC,YAAY,2EAA2E,CAAC,CAAC;QACjK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,IAAI;gBAC5B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yBAAyB,MAAM,CAAC,YAAY,2BAA2B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,QAAQ,SAAS,IAAI,qCAAqC,CAAC,CAAC;YAC3M,MAAM,CAAC,2DAA2D;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,IAAI;gBAC5B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yBAAyB,MAAM,CAAC,YAAY,kCAAkC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,QAAQ,SAAS,IAAI,cAAc,CAAC,CAAC;YACzL,mFAAmF;YACnF,qFAAqF;YACrF,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,KAAK,KAAK;gBAC/B,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,gBAAgB,MAAM,CAAC,YAAY,kBAAkB,IAAI,4BAA4B,WAAW,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,SAAS,mEAAmE,CAAC,CAAC;YAC/P,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBACzE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,uBAAuB,WAAW,yBAAyB,QAAQ,CAAC,IAAI,SAAS,IAAI,0BAA0B,CAAC,CAAC;YACzJ,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAClF,IAAI,IAAI,KAAK,SAAS;gBACpB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iBAAiB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,6DAA6D,CAAC,CAAC;YACpJ,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBACnD,MAAM,mCAAmC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxI,sFAAsF;YACtF,sDAAsD;YACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC5J,CAAC;QACD,OAAO;QACP,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,cAAc;YAC/C,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,yBAAyB,MAAM,CAAC,YAAY,0BAA0B,IAAI,CAAC,GAAG,CAAC,UAAU,+CAA+C,MAAM,CAAC,cAAc,kHAAkH,CAAC,CAAC;QACzT,yFAAyF;QACzF,uCAAuC;QACvC,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACrH,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iBAAiB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,QAAQ,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,OAAO,CAAC,OAAO,CAAC,YAAY,GAAG,mGAAmG,CAAC,CAAC;QACnS,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACxH,MAAM;QACR,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC;gBAAE,SAAS;YACnF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,MAAM,gCAAgC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAEnI,6FAA6F;IAC7F,kDAAkD;IAClD,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,sBAAsB,CACrE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,CAClH,CAAC;IAEF,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,mDAAmD;IACnD,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,iFAAiF;IACjF,4FAA4F;IAC5F,8FAA8F;IAC9F,6FAA6F;IAC7F,6DAA6D;IAC7D,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAC1G,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;QACpG,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7J,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,6EAA6E;QACnH,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,IAAI,IAAI,GAAG,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,4BAA4B,MAAM,CAAC,YAAY,gCAAgC,IAAI,GAAG,CAAC,YAAY,YAAY,CAAC,MAAM,sCAAsC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,4CAA4C,CAAC,CAAC;QACzQ,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,CAAC,IAAI,WAAW;gBACzB,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK;oBACtF,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,0FAA0F;IAC1F,2FAA2F;IAC3F,sFAAsF;IACtF,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,yFAAyF;IACzF,6FAA6F;IAC7F,8FAA8F;IAC9F,kGAAkG;IAClG,4FAA4F;IAC5F,6FAA6F;IAC7F,8FAA8F;IAC9F,6FAA6F;IAC7F,2BAA2B;IAC3B,MAAM,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KAC7D,CAAC,CAAC,CAAC,CAAC;IAEL,iGAAiG;IACjG,gGAAgG;IAChG,oGAAoG;IACpG,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,oGAAoG;IACpG,oGAAoG;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,qFAAqF;IACrF,kGAAkG;IAClG,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAQ,EAAE;QACvD,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,uBAAuB,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7G,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,gBAAgB,GAAyB,CAAC,GAAG,YAAY,CAAC;SAC7D,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACpE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExD,4FAA4F;IAC5F,2FAA2F;IAC3F,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,yFAAyF;IACzF,wEAAwE;IACxE,IAAI,SAAiC,CAAC;IACtC,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAChE,IAAI,gBAAgB,CAAC,SAAS,KAAK,KAAK;YACtC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,uBAAuB,WAAW,cAAc,gBAAgB,CAAC,SAAS,+DAA+D,CAAC,CAAC;QAC9L,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACrE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,uBAAuB,WAAW,yBAAyB,MAAM,CAAC,IAAI,iEAAiE,CAAC,CAAC;QAC1L,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4CAA4C,MAAM,yFAA0F,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpO,CAAC;YACD,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAmB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC/F,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kFAAkF;YAClF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;gBAAE,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBACrE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,uBAAuB,WAAW,6BAA6B,MAAM,CAAC,IAAI,iEAAiE,CAAC,CAAC;YAC9L,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,SAAS;QACvB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,yBAAyB,MAAM,CAAC,YAAY,wDAAwD,CAAC,CAAC;IAC9I,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/F,6FAA6F;IAC7F,4DAA4D;IAC5D,MAAM,mCAAmC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtI,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC3H,CAAC;AAED;;8BAE8B;AAC9B,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAsB,EAAE,IAAY,EAAE,IAAoB;IACpG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACrF,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,iCAAiC,cAAc,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1I,OAAO,yBAAyB,CAAC,GAAG,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI;QACjF,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,EAAE,IAAI,CAAC,CAAC;AACX,CAAC"}

package/dist/retirement-cleaner.d.ts

@@ -0,0 +1,54 @@
+import type { PoolCleanerBind, RetirementExecutorBind } from "./retirement-barrier.js";
+/**
+ * The op-bounded SETTLEMENT EXECUTOR client's grant (SPEC 13.9 "Retirement settlement" row):
+ * {@link barrierExecutorSettlementGrants} (per effective-inventory pool: the `lease.` CAS write and the
+ * `epf.<e>.wrk.<pool>.>` create-only publish, plus the leader-served EPF fencing read) + the
+ * reads the settlement's own code path performs on its own connection, derived from the code:
+ *  - `STREAM.MSG.GET.KV_cotal_records_<space>`: the lease re-reads (`kv.get` on the no-direct
+ *    records bucket is a leader-served MSG.GET).
+ *  - `STREAM.INFO.KV_cotal_records_<space>`: the `workPoolContext` bind probe (`Kvm.open`
+ *    reads the stream config to bind the bucket).
+ *  - `$JS.API.INFO` (the `jetstreamManager` handshake) + the connection-scoped inbox.
+ * NO `STREAM.MSG.GET.EPW_<space>` (security/distsys/engineer, b8803b2 re-verify): the EPW
+ * live-entry read (`liveEntryExists`) is UNREACHABLE from this composition. `settlementForIntent`
+ * only ever calls `reconcileWorkItem` after proving `clock >= workExpiry`, so reconcile always
+ * returns through the terminal/settled-lease/`now >= workExpiry` branches BEFORE the
+ * `liveEntryExists` probe; `retireWorkItem` uses the lease key + EPF terminal alone. A space-wide
+ * EPW body read plus its caller-selected-reply injection class is therefore dead authority, not a
+ * read this code performs, so it is not granted. NOT the barrier's standing profile: the executor
+ * client carries the settlement forge residual op-bounded (the D14/13.9 residual notes on
+ * {@link barrierExecutorSettlementGrants}), and the barrier's auth-store write authority never
+ * rides this connection. The `epw.>` ENQUEUE row is likewise absent (the settlement seam refuses
+ * `expired` before the horizon, so the re-enqueue repair branch is structurally unreachable).
+ */
+export declare function retirementExecutorClientGrants(space: string, endpoint: string, pools: string[], connId: string): {
+    publish: string[];
+    subscribe: string[];
+};
+/**
+ * Build the retirement credential seams over the data-account seed (the same self-mint
+ * substrate as the barrier evictor). Returns all four seams for a {@link RetirementDeps}.
+ */
+export declare function makeRetirementCleaners(opts: {
+    server: string;
+    space: string;
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+    log: (line: string) => void;
+}): {
+    openCleaner: (args: {
+        opId: string;
+        endpoint: string;
+        pools: string[];
+    }) => Promise<PoolCleanerBind>;
+    retireCleanerCredential: (bind: PoolCleanerBind) => Promise<void>;
+    openExecutor: (args: {
+        opId: string;
+        endpoint: string;
+        pools: string[];
+    }) => Promise<RetirementExecutorBind>;
+    retireExecutorCredential: (bind: RetirementExecutorBind) => Promise<void>;
+};
+//# sourceMappingURL=retirement-cleaner.d.ts.map

package/dist/retirement-cleaner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retirement-cleaner.d.ts","sourceRoot":"","sources":["../src/retirement-cleaner.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAevF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAW3J;AAyCD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG;IACF,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACrG,uBAAuB,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC7G,wBAAwB,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E,CA0CA"}

package/dist/retirement-cleaner.js

@@ -0,0 +1,158 @@
+/**
+ * The per-op EXACT-POOL CLEANER and RETIREMENT SETTLEMENT EXECUTOR credential lifecycles
+ * (SPEC 13.9 "Terminal pool cleanup" + "Retirement settlement"; #29 piece 2, the credential
+ * split the piece-1 union deferred). The retirement barrier's {@link RetirementDeps} needs four
+ * credential seams (`openCleaner`/`retireCleanerCredential` and `openExecutor`/
+ * `retireExecutorCredential`) wired to REAL bounded credentials, not the static-conf users the
+ * smokes fake.
+ *
+ * TWO clients per (op x endpoint), never one. SPEC 13.9 SPLITS the authority: the cleaner holds
+ * NO write grant at all (its explicit residual is terminal-free ACK suppression), while the
+ * op-bounded settlement executor owns the lease-record CAS and the lease-derived `wrk` terminal
+ * publish (the relocated, effective-inventory-confined forge residual). Piece 1 unioned both grant sets onto
+ * the one cleaner credential, which (a) collapsed the split's confinement, a compromised
+ * cleaner could both suppress ACKs and forge terminals, and (b) left the settlement CODE
+ * running on the barrier's STANDING connection, which holds no settlement grant at all (masked
+ * by the super-user smoke broker). This module mints them separately and hands the barrier an
+ * executor-owned {@link WorkPoolContext}, so the rights and the code sit on the SAME connection.
+ *
+ * The panel-agreed shape (distsys #29 piece-1 vote (2)), now per CLIENT:
+ *  - ONE distinct principal PER OP per role: `local.epcln_<opId-hash>` (cleaner) and
+ *    `local.epexe_<opId-hash>` (executor). Kill-live is by CONNZ principal TAG, so a shared
+ *    principal would let one op's evict collateral-kill another's client; and the barrier
+ *    verified-evicts BOTH principals at the fence, so the two roles must be two principals.
+ *  - grants from the DURABLE INTENT's (endpoint, pools) only: the cleaner gets exactly
+ *    `retirementCleanerGrants` (bind-only pool reads + the EPF fencing read + scoped inbox,
+ *    ZERO writes); the executor gets exactly {@link retirementExecutorClientGrants}. Nothing
+ *    standing, short-lived, both CONNZ principal-tagged so the barrier can verified-evict them.
+ *  - acquisition is ATOMIC and failure-transactional (the a559d9c freelance round): the
+ *    principal is reserved SYNCHRONOUSLY before the first await (two concurrent same-op opens
+ *    cannot both pass a check-then-await gap), the handles are built INSIDE the transaction,
+ *    the client is published to the live map only on full success, and every post-connect
+ *    failure closes the connection and releases the reservation (no infinite-reconnect leak,
+ *    no poisoned entry).
+ *  - `retire*Credential` closes the connection (the deny-new half). The barrier then runs its
+ *    OWN `evictPrincipal` (the kill-live half); this module never evicts, so the delivery-admin
+ *    KICK authority stays out of this seam.
+ *  - fail-closed: a mint failure throws, so the barrier leaves the gate frozen (no frontiers,
+ *    no head terminal) rather than proceeding without a credential.
+ */
+import { createHash } from "node:crypto";
+import { jetstream, jetstreamManager } from "@nats-io/jetstream";
+import { barrierExecutorSettlementGrants, openAuthorityClient } from "./authority-client.js";
+import { EpEnvelopeError, assertInboxConnId, principalKey, recordsKvStreamName, retirementCleanerGrants, workPoolContext, } from "@cotal-ai/core";
+/** The infra owner for cleaner/executor principals: CONNZ-attributable (`local` passes the
+ *  delivery daemon's owner check, evict-exec.ts), reserved so it never collides with an agent
+ *  principal. */
+const INFRA_OWNER = "local";
+/** `epcln_<16-hex-of-sha256(opId)>` / `epexe_<...>`: single `[a-z0-9_]` actor tokens (no `-`,
+ *  bounded), UNIQUE per (op, role). Same digest, distinct prefixes, so the two roles are two
+ *  CONNZ principals and an evict of one never touches the other. 64 bits of digest is
+ *  collision-resistant across any realistic set of concurrent ops. */
+function opActor(prefix, opId) {
+    return `${prefix}_${createHash("sha256").update(opId).digest("hex").slice(0, 16)}`;
+}
+/**
+ * The op-bounded SETTLEMENT EXECUTOR client's grant (SPEC 13.9 "Retirement settlement" row):
+ * {@link barrierExecutorSettlementGrants} (per effective-inventory pool: the `lease.` CAS write and the
+ * `epf.<e>.wrk.<pool>.>` create-only publish, plus the leader-served EPF fencing read) + the
+ * reads the settlement's own code path performs on its own connection, derived from the code:
+ *  - `STREAM.MSG.GET.KV_cotal_records_<space>`: the lease re-reads (`kv.get` on the no-direct
+ *    records bucket is a leader-served MSG.GET).
+ *  - `STREAM.INFO.KV_cotal_records_<space>`: the `workPoolContext` bind probe (`Kvm.open`
+ *    reads the stream config to bind the bucket).
+ *  - `$JS.API.INFO` (the `jetstreamManager` handshake) + the connection-scoped inbox.
+ * NO `STREAM.MSG.GET.EPW_<space>` (security/distsys/engineer, b8803b2 re-verify): the EPW
+ * live-entry read (`liveEntryExists`) is UNREACHABLE from this composition. `settlementForIntent`
+ * only ever calls `reconcileWorkItem` after proving `clock >= workExpiry`, so reconcile always
+ * returns through the terminal/settled-lease/`now >= workExpiry` branches BEFORE the
+ * `liveEntryExists` probe; `retireWorkItem` uses the lease key + EPF terminal alone. A space-wide
+ * EPW body read plus its caller-selected-reply injection class is therefore dead authority, not a
+ * read this code performs, so it is not granted. NOT the barrier's standing profile: the executor
+ * client carries the settlement forge residual op-bounded (the D14/13.9 residual notes on
+ * {@link barrierExecutorSettlementGrants}), and the barrier's auth-store write authority never
+ * rides this connection. The `epw.>` ENQUEUE row is likewise absent (the settlement seam refuses
+ * `expired` before the horizon, so the re-enqueue repair branch is structurally unreachable).
+ */
+export function retirementExecutorClientGrants(space, endpoint, pools, connId) {
+    const settlement = barrierExecutorSettlementGrants(space, endpoint, pools);
+    return {
+        publish: [
+            "$JS.API.INFO",
+            `$JS.API.STREAM.INFO.${recordsKvStreamName(space)}`,
+            `$JS.API.STREAM.MSG.GET.${recordsKvStreamName(space)}`,
+            ...settlement.publish,
+        ],
+        subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`],
+    };
+}
+/** ATOMIC acquire: reserve the principal key SYNCHRONOUSLY (before any await), build the client
+ *  and its handles transactionally, publish to the live map only on success. On ANY failure the
+ *  reservation is released and a connected client is closed (never leaked, never poisoned). */
+async function acquire(clients, key, what, openClient, makeBind) {
+    if (clients.has(key))
+        throw new EpEnvelopeError("failed-precondition", `${what} already open (or opening) for ${key}; retire it before re-opening`);
+    clients.set(key, "opening"); // the SYNCHRONOUS reservation: a concurrent same-op open throws above
+    let client;
+    try {
+        client = await openClient();
+        const bind = await makeBind(client);
+        clients.set(key, client);
+        return bind;
+    }
+    catch (e) {
+        clients.delete(key);
+        if (client !== undefined)
+            await client.close().catch(() => { });
+        throw e;
+    }
+}
+/** Release: close the tracked client for the principal (the deny-new half). A still-opening
+ *  reservation refuses (a retire never closes a half-built client under a concurrent open);
+ *  an untracked principal is a no-op (a crash-resume retires what a dead process never held). */
+async function release(clients, key, what) {
+    const tracked = clients.get(key);
+    if (tracked === "opening")
+        throw new EpEnvelopeError("failed-precondition", `${what} for ${key} is still opening; a retire never closes a half-built client`);
+    if (tracked !== undefined) {
+        clients.delete(key);
+        await tracked.close();
+    }
+}
+/**
+ * Build the retirement credential seams over the data-account seed (the same self-mint
+ * substrate as the barrier evictor). Returns all four seams for a {@link RetirementDeps}.
+ */
+export function makeRetirementCleaners(opts) {
+    // principal -> the open (or opening) client, both roles in ONE map (the keys are disjoint by
+    // the actor prefix), so retire closes exactly this op's connection for that role.
+    const clients = new Map();
+    const openRole = (role, what, label, args, grants, makeBind) => {
+        const actor = opActor(role, args.opId);
+        const principal = principalKey(INFRA_OWNER, actor).key;
+        return acquire(clients, principal, what, () => openAuthorityClient({
+            server: opts.server,
+            space: opts.space,
+            dataAccount: opts.dataAccount,
+            label: `cotal:ep-${label}:${opts.space}:${args.opId}`,
+            principal: { owner: INFRA_OWNER, actor },
+            grants,
+            log: opts.log,
+        }), (client) => makeBind(client, principal));
+    };
+    return {
+        openCleaner: ({ opId, endpoint, pools }) => openRole("epcln", "retirement cleaner", "cleaner", { opId, endpoint, pools }, (connId) => retirementCleanerGrants(opts.space, endpoint, pools, connId), 
+        // Both JS handles are built INSIDE the transaction: `jetstreamManager` performs a
+        // `$JS.API.INFO` that can reject AFTER the credential connected; a failure there closes
+        // the connection instead of stranding a live, never-retired tracked client.
+        async (client, principal) => ({ jsm: await jetstreamManager(client.nc), js: jetstream(client.nc), principal })),
+        retireCleanerCredential: (bind) => release(clients, bind.principal, "retirement cleaner"),
+        openExecutor: ({ opId, endpoint, pools }) => openRole("epexe", "retirement settlement executor", "executor", { opId, endpoint, pools }, (connId) => retirementExecutorClientGrants(opts.space, endpoint, pools, connId), 
+        // The executor-owned, space-bonded work context: the settlement seam's rights and code
+        // sit on this ONE connection (the constructor derives kv/js/jsm from it, brands the
+        // context, and probes the records bucket, all inside the transaction).
+        async (client, principal) => ({ work: await workPoolContext(client.nc, opts.space), principal })),
+        retireExecutorCredential: (bind) => release(clients, bind.principal, "retirement settlement executor"),
+    };
+}
+//# sourceMappingURL=retirement-cleaner.js.map

package/dist/retirement-cleaner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retirement-cleaner.js","sourceRoot":"","sources":["../src/retirement-cleaner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AACnH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB;;iBAEiB;AACjB,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B;;;sEAGsE;AACtE,SAAS,OAAO,CAAC,MAAyB,EAAE,IAAY;IACtD,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe,EAAE,MAAc;IAC7G,MAAM,UAAU,GAAG,+BAA+B,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,mBAAmB,CAAC,KAAK,CAAC,EAAE;YACnD,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;YACtD,GAAG,UAAU,CAAC,OAAO;SACtB;QACD,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;;+FAE+F;AAC/F,KAAK,UAAU,OAAO,CACpB,OAAiD,EACjD,GAAW,EACX,IAAY,EACZ,UAA0C,EAC1C,QAAiD;IAEjD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,IAAI,kCAAkC,GAAG,+BAA+B,CAAC,CAAC;IAChI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,sEAAsE;IACnG,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;iGAEiG;AACjG,KAAK,UAAU,OAAO,CAAC,OAAiD,EAAE,GAAW,EAAE,IAAY;IACjG,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS;QACvB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,IAAI,QAAQ,GAAG,8DAA8D,CAAC,CAAC;IACrI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IAMC,6FAA6F;IAC7F,kFAAkF;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC/D,MAAM,QAAQ,GAAG,CACf,IAAuB,EACvB,IAAY,EACZ,KAAa,EACb,IAAyD,EACzD,MAAsE,EACtE,QAAoE,EACxD,EAAE;QACd,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC;QACvD,OAAO,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,YAAY,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE;YACrD,SAAS,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;YACxC,MAAM;YACN,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IACF,OAAO;QACL,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CACzC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAC1E,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;QACxE,kFAAkF;QAClF,wFAAwF;QACxF,4EAA4E;QAC5E,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACnH,uBAAuB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC;QACzF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAC1C,QAAQ,CAAC,OAAO,EAAE,gCAAgC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EACvF,CAAC,MAAM,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;QAC/E,uFAAuF;QACvF,oFAAoF;QACpF,uEAAuE;QACvE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,wBAAwB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,gCAAgC,CAAC;KACvG,CAAC;AACJ,CAAC"}

package/dist/root-credential.d.ts

@@ -0,0 +1,26 @@
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+/** Root-credential row lifetime (ms — ledger-row `exp` rides milliseconds). LONG by design: a
+ *  root credential lives with its incarnation, and its ROTATION is a family-revoke barrier
+ *  (takeover/retirement) that production issuance does not run in R1 — an expired root refuses
+ *  every new exchange/connect until the actor is re-granted (a fresh incarnation). Named
+ *  residual: rotation wiring is the takeover slice's job, not a TTL policy knob here. */
+export declare const ROOT_CREDENTIAL_TTL_MS: number;
+/**
+ * Ensure the incarnation `(owner, actor, lifecycleUid)` has its ACTIVE root credential and return
+ * its id for the bearer's `act.credentialId` claim. Idempotent and race-converging: concurrent
+ * exchanges for the same virgin alias converge on ONE winning credential (the loser's staged row
+ * is revoked before it was ever exported). Refuses loudly (=> the exchange is denied):
+ *
+ *  - a live predecessor incarnation at a different uid (the R1 takeover gap),
+ *  - a retiring alias / a terminally burned uid / a foreign uid reservation,
+ *  - a revoked or expired current root credential (rotation is a barrier, not a re-mint),
+ *  - any garbled trusted-path state.
+ */
+export declare function ensureRootCredential(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    managerInstance: string;
+    now?: () => number;
+}): Promise<string>;
+//# sourceMappingURL=root-credential.d.ts.map

package/dist/root-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-credential.d.ts","sourceRoot":"","sources":["../src/root-credential.ts"],"names":[],"mappings":"AAmCA,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAUjC;;;;yFAIyF;AACzF,eAAO,MAAM,sBAAsB,QAA2B,CAAC;AAe/D;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GACxG,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/root-credential.js

@@ -0,0 +1,116 @@
+/**
+ * The exchange-time ROOT-credential ensure (R1 i3) — the production issuance seam that makes the
+ * connect arm's deny-new enforceable. Every bearer must carry `act.credentialId` naming a LIVE
+ * `cred.<uid>.<credid>` row, so the EXCHANGE (the only place bearer bytes are signed) is where the
+ * incarnation's root credential is activated and minted, RELEASE-LAST (SPEC 13.1 mint protocol):
+ *
+ *   activate (head + open gate, at the GRANT's uid) → write the ACTIVE `cred.` row (durable
+ *   FIRST) → gate finalize CAS → head `currentCredentialId` CAS LAST → only then does the caller
+ *   sign/release the bearer bytes.
+ *
+ * Crash recovery splits on WHERE the crash landed (the single norm, detailed under INCARNATION-WIDE
+ * below): a PRE-head crash (an active `cred.` row the head never stamped) was carried by no bearer
+ * — root connects check head equality — so the retry mints a FRESH id and the orphan row is never
+ * exported; a POST-head crash re-exports the SAME already-stamped id, which is correct because that
+ * id IS the incarnation's live root. There is exactly one root credential per incarnation.
+ *
+ * NO ROTATION LIVES HERE: an existing head stamp is returned (after proving its row still active
+ * and unexpired) or refused loudly — flipping a head's root credential without the full
+ * family-revoke barrier would leave the old root's descendants connectable under the leaf check,
+ * so a revoked/expired root credential and a uid transition (same-alias re-grant/respawn while
+ * the predecessor incarnation is live) both REFUSE the exchange and name the barrier gap (R1:
+ * production issuance runs no takeover/retirement barrier).
+ *
+ * ROOT IS INCARNATION-WIDE (SPEC 13.1, ratified 2026-07-16): ONE root credential per incarnation,
+ * re-stamped (the same id returned) on every exchange for the incarnation's whole 90d life — NOT
+ * a fresh id per exchange. This is deliberate and is what makes revocation total: one
+ * `cred.<uid>.<credid>` row revoke denies EVERY bearer of the incarnation at once (they all carry
+ * that id). It also removes the "unobserved fresh-credential release" ambiguity a per-exchange
+ * model had: a crash after the head CAS (with the bearer bytes possibly released) re-exports the
+ * SAME id on the next exchange, which is CORRECT — that id genuinely IS the incarnation's live
+ * root, so there is nothing loose to revoke-and-evict. The only crash pin left is the PRE-head
+ * one (an active-but-unstamped row is denied by head equality; the head-CAS loser revokes its
+ * never-exported row). Rotation of the incarnation's root remains exclusively a barrier's job.
+ */
+import { EpEnvelopeError, mintLifecycleUid } from "@cotal-ai/core";
+import { activateLifecycleAtUid, readLifecycleHeadForOperation, registryStores, setCurrentRootCredential, } from "./lifecycle-registry.js";
+import { credRowKey, finalizeAgentMint, markLedgerRowRevoked, parseLedgerRow, stageAgentMint, } from "./credential-ledger.js";
+/** Root-credential row lifetime (ms — ledger-row `exp` rides milliseconds). LONG by design: a
+ *  root credential lives with its incarnation, and its ROTATION is a family-revoke barrier
+ *  (takeover/retirement) that production issuance does not run in R1 — an expired root refuses
+ *  every new exchange/connect until the actor is re-granted (a fresh incarnation). Named
+ *  residual: rotation wiring is the takeover slice's job, not a TTL policy knob here. */
+export const ROOT_CREDENTIAL_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+/** Leader-semantics single-row read on the auth store (the bucket is `allow_direct=false` by
+ *  shape, so `kv.get` is leader-served). A DEL/PURGE marker refuses loudly — a revoked
+ *  credential is a row with `state:"revoked"`, never a tombstone. */
+async function readCredRow(reg, lifecycleUid, credentialId) {
+    const { authKv } = registryStores(reg);
+    const key = credRowKey(lifecycleUid, credentialId);
+    const entry = await authKv.get(key);
+    if (!entry)
+        return undefined;
+    if (entry.operation !== "PUT")
+        throw new EpEnvelopeError("failed-precondition", `the credential row ${key} carries a ${entry.operation} marker; a deletion is never absence (corruption, SPEC 13.12)`);
+    return parseLedgerRow(entry.value, key);
+}
+/**
+ * Ensure the incarnation `(owner, actor, lifecycleUid)` has its ACTIVE root credential and return
+ * its id for the bearer's `act.credentialId` claim. Idempotent and race-converging: concurrent
+ * exchanges for the same virgin alias converge on ONE winning credential (the loser's staged row
+ * is revoked before it was ever exported). Refuses loudly (=> the exchange is denied):
+ *
+ *  - a live predecessor incarnation at a different uid (the R1 takeover gap),
+ *  - a retiring alias / a terminally burned uid / a foreign uid reservation,
+ *  - a revoked or expired current root credential (rotation is a barrier, not a re-mint),
+ *  - any garbled trusted-path state.
+ */
+export async function ensureRootCredential(reg, args) {
+    const now = args.now ?? Date.now;
+    const { owner, actor, lifecycleUid } = args;
+    const holder = `${owner}.${actor}`;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const head = await readLifecycleHeadForOperation(reg, owner, actor);
+        if (head !== undefined && head.mapping.state === "active" && head.mapping.lifecycleUid === lifecycleUid && head.mapping.currentCredentialId !== undefined) {
+            // Fast path: the incarnation already carries its root stamp — prove the row still lives.
+            const credid = head.mapping.currentCredentialId;
+            const row = await readCredRow(reg, lifecycleUid, credid);
+            if (row === undefined)
+                throw new EpEnvelopeError("internal", `the head for "${owner}/${actor}" names root credential ${credid} but cred.${lifecycleUid}.${credid} is absent; the row is durable BEFORE the head stamp, so this is corruption (SPEC 13.1)`);
+            if (row.state !== "active")
+                throw new EpEnvelopeError("permission-denied", `the root credential for "${owner}/${actor}" (${credid}) is ${row.state}; rotating a root credential is the family-revoke barrier's job, never a re-mint - re-grant (respawn) the actor for a fresh incarnation (SPEC 13.1)`);
+            if (row.holderPrincipal !== holder || row.lifecycleUid !== lifecycleUid)
+                throw new EpEnvelopeError("internal", `the root credential row for "${owner}/${actor}" binds "${row.holderPrincipal}"/${row.lifecycleUid}, not this incarnation; garbled trusted-path state never authorizes (SPEC 13.1)`);
+            if (row.exp <= now())
+                throw new EpEnvelopeError("permission-denied", `the root credential for "${owner}/${actor}" expired at ${row.exp}; rotation is the barrier's job - re-grant (respawn) the actor (SPEC 13.1)`);
+            return credid;
+        }
+        // Activation (idempotent; refuses the R1 takeover-gap and every foreign/retiring state).
+        await activateLifecycleAtUid(reg, { owner, actor, lifecycleUid, managerInstance: args.managerInstance });
+        // Mint RELEASE-LAST under the open gate: active row durable FIRST, gate finalize, head CAS.
+        const credentialId = mintLifecycleUid();
+        const staged = await stageAgentMint(reg, {
+            lifecycleUid,
+            credentialId,
+            holderPrincipal: holder,
+            sourceChain: ["root"],
+            exp: now() + ROOT_CREDENTIAL_TTL_MS,
+        });
+        await finalizeAgentMint(reg, staged);
+        try {
+            await setCurrentRootCredential(reg, { owner, actor, lifecycleUid, credentialId });
+            return credentialId;
+        }
+        catch (e) {
+            // The stamp lost (a sibling exchange won the head CAS, or the head moved). Our finalized
+            // row was NEVER exported (release-last), so revoke it — the family carries no live orphan —
+            // and converge on the winner's stamp via the retry read.
+            await markLedgerRowRevoked(registryStores(reg).authKv, staged.rowKey);
+            if (e instanceof EpEnvelopeError && (e.code === "permission-denied" || e.code === "conflict" || e.code === "failed-precondition"))
+                continue;
+            throw e;
+        }
+    }
+    throw new EpEnvelopeError("unavailable", `the root-credential ensure for "${owner}/${actor}" at uid ${lifecycleUid} keeps losing its head stamp to concurrent movement; re-exchange (SPEC 13.1)`);
+}
+//# sourceMappingURL=root-credential.js.map

package/dist/root-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-credential.js","sourceRoot":"","sources":["../src/root-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,cAAc,EACd,wBAAwB,GAEzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,cAAc,GAEf,MAAM,wBAAwB,CAAC;AAEhC;;;;yFAIyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D;;qEAEqE;AACrE,KAAK,UAAU,WAAW,CAAC,GAAsB,EAAE,YAAoB,EAAE,YAAoB;IAC3F,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAC3B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,sBAAsB,GAAG,cAAc,KAAK,CAAC,SAAS,+DAA+D,CAAC,CAAC;IAC1K,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAsB,EACtB,IAAyG;IAEzG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;IACnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC1J,yFAAyF;YACzF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACzD,IAAI,GAAG,KAAK,SAAS;gBACnB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,KAAK,2BAA2B,MAAM,aAAa,YAAY,IAAI,MAAM,yFAAyF,CAAC,CAAC;YACtO,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBACxB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,4BAA4B,KAAK,IAAI,KAAK,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,qJAAqJ,CAAC,CAAC;YAC/Q,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,IAAI,GAAG,CAAC,YAAY,KAAK,YAAY;gBACrE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,gCAAgC,KAAK,IAAI,KAAK,YAAY,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,YAAY,iFAAiF,CAAC,CAAC;YAC7N,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE;gBAClB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,4BAA4B,KAAK,IAAI,KAAK,gBAAgB,GAAG,CAAC,GAAG,4EAA4E,CAAC,CAAC;YAChM,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yFAAyF;QACzF,MAAM,sBAAsB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAEzG,4FAA4F;QAC5F,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;YACvC,YAAY;YACZ,YAAY;YACZ,eAAe,EAAE,MAAM;YACvB,WAAW,EAAE,CAAC,MAAM,CAAC;YACrB,GAAG,EAAE,GAAG,EAAE,GAAG,sBAAsB;SACpC,CAAC,CAAC;QACH,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,wBAAwB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;YAClF,OAAO,YAAY,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yFAAyF;YACzF,4FAA4F;YAC5F,yDAAyD;YACzD,MAAM,oBAAoB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC;gBAAE,SAAS;YAC5I,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,mCAAmC,KAAK,IAAI,KAAK,YAAY,YAAY,8EAA8E,CAAC,CAAC;AACpM,CAAC"}

package/dist/service.d.ts

@@ -1,7 +1,67 @@
 import { type ParsedArgs, type SecretStore } from "@cotal-ai/core";
+import type { ValidatedUserToken } from "./token.js";
+import { type PlaneLivenessOracle } from "./plane-claim.js";
+import { type EvictPrincipal } from "./credential-ledger.js";
 /** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
  *  retire floor (max-age + max bearer TTL) from it. */
 export declare const JWKS_MAX_AGE_SEC = 300;
+/** The service's AUTHORITY PLANE (R1, SPEC 13.1): the two self-minted data-account connections
+ *  behind (a) the composed connect authorizer — the file-ledger arm PLUS the credential deny-new
+ *  arm through the supervised, shape-proved reader — and (b) the exchange-time root-credential
+ *  ensure both exchange arms stamp `act.credentialId` from. */
+export interface AuthAuthorityPlane {
+    authorizeConnect: (t: ValidatedUserToken) => Promise<void>;
+    mintConnectCredential: (args: {
+        owner: string;
+        actor: string;
+        lifecycleUid: string;
+    }) => Promise<string>;
+    /** Resolves with the state-3 copy when a mid-life scanner death FENCES the plane (SPEC 13.13):
+     *  the plane is no longer whole, `authorizeConnect`/`mintConnectCredential` refuse from that
+     *  moment, and the composition root must take the whole service DOWN loud (a fenced plane that
+     *  kept minting would look healthy while a successor reclaims its scanners). Never resolves on a
+     *  clean close. */
+    fenced: Promise<string>;
+    close(): Promise<void>;
+}
+/**
+ * Open the authority plane — the PRODUCTION connect/exchange composition (exported so the live
+ * deny-new smoke exercises exactly what the daemon runs). Boot order is the readiness contract:
+ * the MINT WRITER connects first and ensures both authority stores exist with their normative
+ * shape ({@link ensureAuthorityStores}; the reader's bind proof requires them), then the
+ * lifecycle registry binds (its own §13.12 shape proof), then the supervised CONNECT READER
+ * binds + proves. Any failure throws — the daemon refuses to come up rather than serving
+ * connects it cannot credential-check (no file-only fallback).
+ *
+ * These are STATIC data-account users (signed by the data-account signing key), so they never
+ * transit the auth callout — the callout cannot deadlock on its own reader.
+ */
+export declare function openAuthAuthorityPlane(opts: {
+    server: string;
+    space: string;
+    /** The provider state dir — the file-ledger connect arm reads it fresh per connect. */
+    dir: string;
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+    log: (line: string) => void;
+    /** SMOKE-ONLY eviction override for the barrier executor's boot resume. Production
+     *  compositions never set this: the real capability is the delivery daemon's
+     *  `ctl.delivery-admin` rail ({@link makeDeliveryAdminEvictor}). */
+    probeEvictor?: EvictPrincipal;
+    /** SMOKE-ONLY plane-liveness override for the plane claim's stale-reclaim adjudication.
+     *  Production compositions never set this: the real oracle is the delivery daemon's
+     *  `ctl.delivery-admin` rail ({@link makeDeliveryAdminPlaneOracle}). */
+    probePlaneOracle?: PlaneLivenessOracle;
+    /** SMOKE-ONLY scanner-death injector: receives kill switches for the two plane-owned scanner
+     *  connections so a test can force the mid-life fencing path (a non-reconnecting connection has
+     *  no natural failure to inject). Production compositions never set this. */
+    probePlaneDeath?: (kill: {
+        ledger: () => Promise<void>;
+        records: () => Promise<void>;
+    }) => void;
+}): Promise<AuthAuthorityPlane>;
 /** Run the auth service. Flags: `--space` (required), `--server` (broker URL, required), `--port`
  *  (loopback HTTP port; default ephemeral). All persisted material must already exist (the
  *  provider's `prepareServer` ran at `cotal up`) — a missing piece is a fail-loud config error

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAe,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA0BhF;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAapC;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwGzF"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAgF,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAKjJ,OAAO,KAAK,EAAiB,kBAAkB,EAAE,MAAM,YAAY,CAAC;AASpE,OAAO,EAA0F,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpJ,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAyB7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAapC;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;CACjG,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8M9B;AAiCD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8HzF"}