@cotal-ai/core 0.10.1 → 0.11.0

package/dist/subjects.d.ts

@@ -18,7 +18,10 @@ export declare function spacePrefix(space: string): string;
  *  Returns `undefined` for an empty result so the field is omitted rather than sent as `[]`.
  *  Presence-agnostic (no roster lookup) — validation lives in the connector. */
 export declare function normalizeMentions(mentions?: string[]): string[] | undefined;
-export declare function chatSubject(space: string, sender: string, channel: string): string;
+/** Multicast: `chat.<owner>.<actor>.<channel…>` — the publishing principal (owner+actor) precedes the
+ *  channel (owner+actor grammar, Shape A). Either identity slot may be `*` for subscribe/allow rules
+ *  (`chat.*.*.<ch>` = read a channel from any principal). */
+export declare function chatSubject(space: string, owner: string, actor: string, channel: string): string;
 /** True if a channel names a concrete sub-channel (no `*`/`>`) — i.e. it can be
  *  *published* to. Subscriptions may be wildcard; publishes must be concrete. */
 export declare function isConcreteChannel(channel: string): boolean;
@@ -38,41 +41,191 @@ export declare function subjectMatches(pattern: string, subject: string): boolea
  *  never named (and two distinct policy strings could collide on one token). Returns the channel
  *  unchanged when valid so callers can use it inline. */
 export declare function assertValidChannel(channel: string): string;
-/** Validate an **owner/actor token** — the broker-authenticated lane boundary that the owner+actor
- *  grammar adds to wire subjects and persisted principal-scoped keys. STRICTER than
- *  {@link assertValidChannel}: a principal segment is exactly ONE NATS-safe token — `[A-Za-z0-9_]+`,
- *  with NO dots, NO `*`, NO `>`, and NO `-` (reserved as the JetStream-name separator in
- *  {@link principalNameKey}). A separator or wildcard is lane breakout or aliasing (it would let one
- *  owner's grant span, or collide with, another's), so this FAILS LOUD rather than sanitizing.
- *  Do NOT substitute {@link token}/`routeToken` here: they silently rewrite illegal characters — safe
- *  for nkeys (already base32), unsafe for human-owner ids where a rewrite hides an aliasing attempt.
- *  Returns the token unchanged when valid so callers can use it inline. */
+/** Validate an **owner or actor token** of the owner+actor grammar (the per-user-auth cutover).
+ *  Defined AHEAD of use: today this has no call sites — persisted owner-bearing keys
+ *  ({@link memberKey}, {@link aclKey}, {@link dinboxSubject}, {@link dlvSubject}) still ride raw
+ *  nkeys through `token()`/`routeToken()` (a no-op on base32) — the cutover wires this in at every
+ *  mint/callout boundary and persisted owner/actor-bearing key. STRICTER than
+ *  {@link assertValidChannel}: a token is exactly ONE NATS-safe segment — `[A-Za-z0-9_]+`, with NO
+ *  dots, NO `*`, NO `>`, and NO `-`. Dots/wildcards in an id are lane breakout or aliasing (they would
+ *  let one owner's grant span, or collide with, another's); `-` is excluded because it is reserved as
+ *  the sole separator of {@link principalKey}'s JetStream-name form — a `-` *inside* a token would
+ *  make `<owner>-<actor>` ambiguous. The ASCII-only alphabet also makes NFC-normalization trivially
+ *  hold (any non-ASCII input fails). FAILS LOUD rather than sanitizing — do NOT substitute
+ *  {@link token}/`routeToken` here: they silently rewrite illegal characters, and a rewrite hides an
+ *  aliasing attempt. Returns the token unchanged when valid so callers can use it inline. */
 export declare function assertValidOwnerToken(owner: string): string;
-/** Principal key form for subjects and KV keys: dot separates owner and actor because NATS subjects use
- *  dot token boundaries. Use only in subject/KV namespaces, never as a JetStream durable/consumer name. */
+/** The canonical serialization of a **principal** (`owner`+`actor`) — the key every authority that
+ *  enforces per-agent grants checks against. It is TWO forms, not one, because the same principal
+ *  lands in two namespaces with incompatible rules:
+ *    - `key`  — the subject / KV-key dot-form `<owner>.<actor>`, for wire subjects and KV keys,
+ *      where `.` is the token boundary;
+ *    - `name` — the JetStream-name form `<owner>-<actor>`, for durable / consumer / stream and
+ *      chat-history names, where JetStream forbids `.` `*` `>` `/` and whitespace, so the dot-form
+ *      is illegal.
+ *  Both tokens are {@link assertValidOwnerToken}-validated, and `-` is banned *inside* tokens and
+ *  reserved as the sole name separator, so both forms are collision-free — distinct (owner, actor)
+ *  pairs can never serialize to the same string. All principal serialization goes through here: no
+ *  ad-hoc string joins, and never a `<owner>.<actor>` fed to a JetStream name. Defined ahead of the
+ *  owner+actor cutover — call sites (durables, member/acl keys, grants) arrive with the flip. */
+export declare function principalKey(owner: string, actor: string): {
+    key: string;
+    name: string;
+};
+/** Principal key form for subjects and KV keys. Alias for callers/tests that need one form explicitly. */
 export declare function principalSubjectKey(owner: string, actor: string): string;
-/** Principal key form for JetStream names (durables/consumers/streams): `.` is illegal there, so `-` is
- *  the reserved separator and is banned inside each owner/actor token by {@link assertValidOwnerToken}. */
+/** Principal key form for JetStream names. Alias for callers/tests that need one form explicitly. */
 export declare function principalNameKey(owner: string, actor: string): string;
+/** Inverse of {@link principalKey}'s dot-form `key`: split a principal `<owner>.<actor>` back into its
+ *  two tokens, or `null` if it isn't a valid one. Owner/actor tokens are `[A-Za-z0-9_]+` (dot-free), so a
+ *  single `.` separates them unambiguously — exactly two segments, both {@link assertValidOwnerToken}-valid.
+ *  Used where a stored principal (a member/from.id dot-form) must be re-split to feed the owner+actor
+ *  subject builders (e.g. fan-out → `dinboxSubject`). */
+/** Resolve a deprovision target: a full principal dot-form (`u_….<actor>`, user-mode agents) or a
+ *  bare static/dev actor id (an nkey pub — never contains a dot), keyed under {@link DEV_OWNER}.
+ *  Shared by the deprovisioner permission pin and the teardown helper so they can't diverge. */
+export declare function deprovisionTargetPrincipal(target: string): {
+    owner: string;
+    actor: string;
+};
+export declare function parsePrincipalKey(key: string): {
+    owner: string;
+    actor: string;
+} | null;
+/** Validate a connection's **connId** — the single token that fills `_INBOX_<connId>.>`, the private
+ *  reply-inbox grant. In dev/static mode connId is the agent's own nkey (56 uppercase base32 chars); in
+ *  user mode it is a client-CHOSEN random inbox nonce (the auth callout can't know the NATS-minted
+ *  per-connection nkey pre-connect, and the client can't either, so the client picks its own nonce and
+ *  passes it via the connection `name`). Because that nonce is untrusted client input, the grant builder
+ *  MUST reject any subject metacharacter here: a connId of `>` would mint `_INBOX_>.>` (every inbox) and a
+ *  `*`/`.` would widen it too. `[A-Za-z0-9_-]{8,120}` admits nkeys and high-entropy nonces while barring
+ *  `* > . space` — so `_INBOX_<connId>.>` can never escalate past one connection's own inbox. Fail-loud. */
+export declare function assertInboxConnId(connId: string): string;
+/** The `tags` prefix carrying a connection's principal dot-form in its minted user JWT. CONNZ
+ *  surfaces a JWT-authed connection's principal identity DIFFERENTLY by cred shape, proven live on
+ *  nats-server 2.10/2.14 (see {@link principalFromConnz}): a STATICALLY-minted user (`mintCreds`)
+ *  surfaces this `principal:` tag (`authorized_user` is the ephemeral connection nkey), while a
+ *  CALLOUT-minted user surfaces the JWT `name` (the principal NAME-form) as `authorized_user` and NO
+ *  tags at all. So this tag is the attribution field for STATIC connections only; callout connections
+ *  are attributed via `authorized_user`. NEVER reintroduce a tags-ONLY read — it silently misses every
+ *  user-mode connection. Always attribute through {@link principalFromConnz}, which handles both. */
+export declare const PRINCIPAL_TAG_PREFIX = "principal:";
+/** The identity `tags` stamped into every minted user JWT (dev mint AND the auth callout, via this one
+ *  helper) — recoverable from a STATIC connection's CONNZ record (a callout connection surfaces the
+ *  principal via `authorized_user` instead; see {@link PRINCIPAL_TAG_PREFIX}). `owner:`/`actor:` are
+ *  human/debug breadcrumbs; `principal:` (the dot-form {@link principalKey} `key`) is the one attribution
+ *  reads. Single source of the tag format — never hand-join these elsewhere. */
+export declare function principalTags(owner: string, actor: string): string[];
+/** Recover a connection's principal dot-form from its CONNZ `tags`, or `null` if absent/malformed. The
+ *  membership feed calls this to key a live connection by its principal and **fails closed** on `null`
+ *  (it drops the connection rather than fall back to the ephemeral nkey — a tagless connection is not a
+ *  principal we can attribute). Validates via {@link parsePrincipalKey} so a forged/garbled tag can't
+ *  smuggle a non-principal string into the feed. */
+export declare function principalFromTags(tags: readonly string[] | undefined): string | null;
+/** Inverse of {@link principalKey}'s `name` form (`<owner>-<actor>`): recover the principal dot-form
+ *  from a name-form string, or `null` if it isn't one. Owner tokens are `[A-Za-z0-9_]+` and actor
+ *  tokens too — `-` is reserved as the name-form separator — so the FIRST `-` splits owner from actor
+ *  unambiguously, and both halves must be {@link parsePrincipalKey}-valid with a real principal owner.
+ *  An nkey (no `-`) or any other non-name-form returns null. */
+export declare function principalFromName(name: string | undefined): string | null;
+/** Recover a connection's principal dot-form from a `$SYS` CONNZ record, across BOTH credential
+ *  shapes — the one place that knows nats-server surfaces principal identity differently for each:
+ *   - a STATICALLY-minted user (`mintCreds`) surfaces its `principal:` TAG (`authorized_user` is the
+ *     ephemeral connection nkey);
+ *   - a CALLOUT-minted user surfaces the JWT `name` (the principal NAME-form) as `authorized_user`,
+ *     and does NOT surface `tags` at all (proven live on nats-server 2.10.22 + 2.14.2).
+ *  So attribution must try the tag first, then the `authorized_user` name-form; anything else (an
+ *  un-tagged nkey, open mode, infra) is `null` — unattributable, dropped fail-closed by callers.
+ *  The membership feed and live eviction both key on this, so it lives here as the single source. */
+export declare function principalFromConnz(conn: {
+    tags?: readonly string[];
+    authorized_user?: string;
+}): string | null;
+/** The reserved owner token for the **no-login local/dev path** — the static-creds default when there
+ *  is no user identity (the plan's zero-login local default). A valid {@link assertValidOwnerToken}
+ *  token, and — being lowercase-alpha with no `u_` prefix — trivially distinct from both nkeys and
+ *  {@link assertDerivedOwnerToken} `u_…` owners, so a dev agent can never collide with a real owner
+ *  lane. In dev the actor is the connection id, so `local.<id>` is the agent's principal. */
+export declare const DEV_OWNER = "local";
+/** Prefix of every **derived owner token** — see {@link assertDerivedOwnerToken}. */
+export declare const DERIVED_OWNER_PREFIX = "u_";
+/** Validate the structural format of a **derived owner token** — the opaque, per-space, non-PII
+ *  token the auth callout derives server-side for a human owner: `u_` + 26 lowercase base32
+ *  (`[a-z2-7]`) chars (128 keyed-HMAC bits; the derivation lives in `@cotal-ai/auth`, this is the
+ *  format contract). The format is **structurally disjoint from nkeys by construction** — the
+ *  owner+actor flip's acceptance criterion 2: an nkey public key is 56 chars of UPPERCASE base32
+ *  (`[A-Z2-7]`), while a derived token is 28 chars, contains `_`, and its body is lowercase — three
+ *  independent properties an nkey can never satisfy. So a pre-flip agent id (an nkey) can NEVER
+ *  parse as a valid new owner, which closes the old-shape-aliases-new-read lane
+ *  (`chat.<nkey>.team.backend` matching `chat.*.*.backend` cannot yield a plausible owner). Every
+ *  derived token also trivially passes {@link assertValidOwnerToken} (subset alphabet, no `-`).
+ *  Defined ahead of use: enforced at the callout/mint boundary when the cutover lands. Returns the
+ *  token unchanged when valid so callers can use it inline. */
+export declare function assertDerivedOwnerToken(owner: string): string;
+/** Validate an owner token at a READ / persisted-owner TRUST boundary — STRICTER than
+ *  {@link assertValidOwnerToken}, which (by design) still accepts nkey-shaped uppercase tokens and so does
+ *  NOT by itself satisfy the flip's acceptance criterion 2. A *real* owner is EITHER a derived owner
+ *  ({@link assertDerivedOwnerToken}: `u_` + 26 lowercase base32, minted at the callout) OR — when
+ *  `allowLocal` — the reserved no-login dev owner {@link DEV_OWNER} (`"local"`). An nkey (56-char UPPERCASE
+ *  base32) satisfies neither, so a stray old-shape frame `chat.<nkey>.team.backend` can never be TRUSTED as
+ *  a valid owner even if it structurally parses — the belt to the from.id≠sender guard's braces and cred
+ *  death. Use at every boundary that reads an owner from a wire subject / persisted key and then trusts it
+ *  for keying, surfacing, or authorization (membership feed re-key, history surfacing). Actors stay on
+ *  {@link assertValidOwnerToken} — they are server-derived from the ledger, not disjointness-constrained.
+ *  User-mode MINT boundaries (callout/bridge) use {@link assertDerivedOwnerToken} directly (no `local`). */
+export declare function assertPrincipalOwnerToken(owner: string, opts?: {
+    allowLocal?: boolean;
+}): string;
+/** Non-throwing {@link assertPrincipalOwnerToken} for hot per-message drop guards — true iff `owner` is a
+ *  real principal owner (a derived `u_…`, or `local` when `allowLocal`). The message-surfacing paths call
+ *  this on `parsed.owner` alongside the `from.id === parsed.sender` check, so a structurally-valid old-shape
+ *  alias (`chat.<nkey>.team.backend`, owner = an nkey) is DROPPED at read time — belt to cred death, not a
+ *  dependency on it. `allowLocal` defaults true: the dev/static path is a legitimate live sender. */
+export declare function isPrincipalOwnerToken(owner: string, opts?: {
+    allowLocal?: boolean;
+}): boolean;
 /** Is `channel` within a read/post ACL `allow` (a list of channel patterns)? True when some
  *  entry covers it — exact, or a wildcard subtree (`team.>` covers `team.backend`). Channels are
  *  dotted token strings, so this rides {@link subjectMatches}. The single covering rule shared by
  *  the load-time invariant (`subscribe ⊆ allowSubscribe`), the connector subset check, and the
  *  manager's mediated-join validation (`channel ∈ allowSubscribe`) so they can't drift. */
 export declare function channelInAllow(allow: string[], channel: string): boolean;
+/** Does policy pattern `cap` COVER policy pattern `pattern` — i.e. is every channel matched by
+ *  `pattern` also matched by `cap`? Both sides use the {@link assertValidChannel} grammar
+ *  (`*` = one token, `>` = one-or-more trailing). This is the DELEGATION primitive
+ *  ({@link patternInAllow}): where {@link channelInAllow} asks "is this concrete channel readable
+ *  under this ACL", this asks "is this ACL *entry* grantable under this ACL" — pattern vs pattern,
+ *  so `review.>` is within `review.>` but exceeds `review.pua`. */
+export declare function patternCovers(cap: string, pattern: string): boolean;
+/** Is ACL entry `pattern` within capability list `allow` — covered by SOME single entry? A union of
+ *  entries is deliberately NOT considered (`[a.b, a.c]` does not admit `a.*`): per-entry containment
+ *  is conservative — it can refuse a technically-covered pattern, never admit an uncovered one —
+ *  and keeps the refusal explainable ("name the entry that covers it, or widen the grant"). */
+export declare function patternInAllow(allow: string[], pattern: string): boolean;
 /** Drop exact duplicates and any subject subsumed by a more-general one — JetStream
  *  rejects a consumer whose `filter_subjects` overlap, so `[team.>, team.backend]`
  *  must collapse to `[team.>]` before binding the chat consumer. A parent and its subtree
  *  (`[review, review.>]`) are disjoint in NATS (`review.>` never matches bare `review`), so
  *  both are kept — that's how a peer subscribes to a channel *and* everything under it. */
 export declare function collapseFilterSubjects(subjects: string[]): string[];
-/** Unicast: a specific instance's inbox, tagged with the sender. (Either position may be
- *  `*` for subscribe/allow rules: `inst.<myId>.*` to receive, `inst.*.<myId>` to send as me.) */
-export declare function unicastSubject(space: string, target: string, sender: string): string;
-/** Anycast: a service (role), tagged with the sender. Subscribers join a queue group so one instance receives. */
-export declare function anycastSubject(space: string, service: string, sender: string): string;
-/** Control request/reply to a service (e.g. the manager), tagged with the sender; anycast via queue group. */
-export declare function controlServiceSubject(space: string, service: string, sender: string): string;
+/** Unicast: `inst.<recipOwner>.<recipActor>.<sndOwner>.<sndActor>` — the recipient principal, then the
+ *  sender principal (owner+actor grammar). The 4-token form is deliberate: it lets a native publish grant
+ *  forge-lock the sender suffix (`inst.*.*.<myOwner>.<myActor>`), so the daemon needn't re-verify a
+ *  payload sender claim. Any slot may be `*` for allow rules (`inst.*.*.<o>.<a>` to send as me;
+ *  {@link unicastRecvFilter} for the receive side). */
+export declare function unicastSubject(space: string, recipOwner: string, recipActor: string, sndOwner: string, sndActor: string): string;
+/** The receive-side DM filter/grant for a recipient principal: `inst.<owner>.<actor>.>` — every DM
+ *  addressed to me, from any sender. (The send side is the 4-token {@link unicastSubject}.) */
+export declare function unicastRecvFilter(space: string, owner: string, actor: string): string;
+/** Anycast: `svc.<service>.<owner>.<actor>` — a service (role), tagged with the sender principal.
+ *  Subscribers join a queue group so one instance receives. Identity slots accept `*`. */
+export declare function anycastSubject(space: string, service: string, owner: string, actor: string): string;
+/** The serve-side TASK filter/grant for a role: `svc.<role>.>` — every anycast to the role, from any
+ *  sender principal (the sender slot widened from one token to two, so the tail is `.>`). */
+export declare function anycastServeFilter(space: string, service: string): string;
+/** Control request/reply to a service (e.g. the manager): `ctl.<service>.<owner>.<actor>` — tagged with
+ *  the caller principal; anycast via queue group. Identity slots accept `*` (serve side: `ctl.<tier>.*.*`). */
+export declare function controlServiceSubject(space: string, service: string, owner: string, actor: string): string;
 /** Control-plane service names — the three-tier split (P2a). The manager subscribes to ALL
  *  three; the cred layer grants {@link CONTROL_SELF_SERVICE} to every agent and
  *  {@link CONTROL_PRIVILEGED} only to spawn-capable agents (default-deny otherwise), while
@@ -94,6 +247,13 @@ export declare const CONTROL_ADMIN: "admin";
  *  agent (only the allow-all manager could reply into the per-id `_INBOX_<id>` prefix). Lifecycle ops
  *  (spawn/stop/despawn) stay on the manager's tiers; durable membership is the daemon's. */
 export declare const CONTROL_DELIVERY: "delivery";
+/** The delivery daemon's PRIVILEGED admin rail (the D5 rail-split): control-plane ops the daemon
+ *  EXECUTES for the mesh's renewal/repair owner — credential reload (`reloadCreds`, the class-2
+ *  standing-renewal adoption step) now; the live-eviction executor rides here next. Cred-enforced
+ *  caller set: only the manager's `supervisor` profile holds the request-publish grant (every agent
+ *  cred is default-denied — nats-server is the boundary, same pattern as {@link CONTROL_ADMIN});
+ *  the `delivery` cred holds the serve + bounded-reply side. */
+export declare const CONTROL_DELIVERY_ADMIN: "delivery-admin";
 /** The three control-plane tiers the manager serves — values tie to the `CONTROL_*` service
  *  names so handler routing can't drift from the subject names. */
 export type ControlTier = typeof CONTROL_PRIVILEGED | typeof CONTROL_SELF_SERVICE | typeof CONTROL_ADMIN;
@@ -106,23 +266,30 @@ export declare function spaceWildcard(space: string): string;
 export declare function chatWildcard(space: string): string;
 /** The three peer-message delivery modes (control/trace/presence are not deliveries). */
 export type DeliveryMode = "chat" | "anycast" | "unicast";
-/** A subject parsed into its routing parts. `sender` is the publishing agent's id;
- *  `rest` is the channel (chat) or the routed target/role/service (inst/svc/ctl). */
+/** A subject parsed into its routing parts (owner+actor grammar, Shape A). `owner`/`actor` are the
+ *  publishing principal's two tokens; `sender` is their canonical dot-form `<owner>.<actor>` (=
+ *  {@link principalKey}`.key`), so guards that compare `msg.from.id === parsed.sender` keep working
+ *  verbatim once `from.id` carries the principal dot-form. `rest` is the channel (chat) or the routed
+ *  target/role/service (inst → recipient principal dot-form; svc → role; ctl → service). */
 export interface ParsedSubject {
     kind: "chat" | "inst" | "svc" | "ctl";
+    owner: string;
+    actor: string;
+    /** The sender principal in canonical dot-form `<owner>.<actor>`. */
     sender: string;
-    /** chat → channel (possibly hierarchical); inst → target; svc → role; ctl → service. */
+    /** chat → channel (possibly hierarchical); inst → recipient principal `<owner>.<actor>`; svc → role; ctl → service. */
     rest: string;
 }
 /**
- * The single authority on the subject layout — every reader of a wire subject goes
- * through this, so the sender-position asymmetry lives in exactly one place:
- *   chat.<sender>.<channel…>   sender at [3], channel is everything after
- *   inst.<target>.<sender>     sender at [4]
- *   svc.<role>.<sender>        sender at [4]
- *   ctl.<service>.<sender>     sender at [4]
- * Validates the prefix and per-kind shape first and returns `null` on anything else,
- * so a malformed subject can never be read as if it carried a sender.
+ * The single authority on the subject layout — every reader of a wire subject goes through this, so the
+ * owner+actor sender positions live in exactly one place (`kind` stays at [2]):
+ *   chat.<owner>.<actor>.<channel…>              sender owner[3] actor[4], channel is everything after
+ *   inst.<recipOwner>.<recipActor>.<sndOwner>.<sndActor>   sender owner[5] actor[6], recipient = [3].[4]
+ *   svc.<role>.<owner>.<actor>                   sender owner[4] actor[5], role = [3]
+ *   ctl.<service>.<owner>.<actor>                sender owner[4] actor[5], service = [3]
+ * Validates the prefix and per-kind arity first and returns `null` on anything else, so a malformed
+ * subject can never be read as if it carried a principal. This SPLITS ONLY (no owner-token validation)
+ * — the broker already forge-locked the identity slots via the minted grant; a reader recovers them.
  */
 export declare function parseSubject(subject: string): ParsedSubject | null;
 /**
@@ -144,17 +311,19 @@ export declare const CHANNEL_DEFAULTS_KEY = "=defaults";
  *  owner) under {@link memberKey}; the source of truth for `channelMembers()` and the fan-out's
  *  member list, moved off JetStream consumer topology (which core-sub joins don't create). */
 export declare function membersBucket(space: string): string;
-/** KV key for one membership record: `<channel>/<owner>`. The channel is concrete (no `*`/`>`,
- *  validated at the write path) so it is dotted-but-`/`-free, and an owner id is an nkey
- *  (`[A-Z0-9]`, also `/`-free), so the single `/` separates them unambiguously — both halves
- *  recover via {@link parseMemberKey}. `/`, `.`, and `[A-Za-z0-9_-]` are all legal KV-key chars
- *  (`/^[-/=.\w]+$/`), so no encoding is needed. */
-export declare function memberKey(channel: string, owner: string): string;
-/** Inverse of {@link memberKey}: split a member key back into `{ channel, owner }`, or `null` if
- *  it isn't one (no `/`). Splits on the single separator — channels and owner ids are both `/`-free. */
+/** KV key for one membership record: `<channel>/<principal>`, where `principal` is the member's
+ *  owner+actor dot-form (`<owner>.<actor>` = {@link principalKey}`.key`) — membership is per-agent
+ *  (owner+actor), not per-owner-shared. The channel is concrete (no `*`/`>`, validated at the write
+ *  path) so it is dotted-but-`/`-free, and a principal dot-form is `[A-Za-z0-9_.]` (also `/`-free), so
+ *  the single `/` separates them unambiguously — both halves recover via {@link parseMemberKey}. `/`,
+ *  `.`, and `[A-Za-z0-9_]` are all legal KV-key chars (`/^[-/=.\w]+$/`), so no encoding is needed. */
+export declare function memberKey(channel: string, principal: string): string;
+/** Inverse of {@link memberKey}: split a member key back into `{ channel, principal }`, or `null` if
+ *  it isn't one (no `/`). Splits on the single separator — channels and principal dot-forms are both
+ *  `/`-free (the `.` inside a principal is not a `/`). */
 export declare function parseMemberKey(key: string): {
     channel: string;
-    owner: string;
+    principal: string;
 } | null;
 /** Name of the KV bucket holding the durable read-ACL registry (Plane-3) for a space — a
  *  privileged-write sibling of the members/channels buckets. One record per OWNER (key = owner id),
@@ -163,18 +332,23 @@ export declare function parseMemberKey(key: string): {
  *  stateless, server-side daemon re-reads it on boot (fixes the restart-fragility nak-loop). It is
  *  ALSO what the daemon validates a runtime durable-join against (channel ∈ the owner's ACL). */
 export declare function aclBucket(space: string): string;
-/** KV key for one owner's read-ACL record: the owner id (an nkey — `[A-Z0-9]`, `/`-free, a `token()`
- *  no-op; keyed like presence, which uses the bare id). */
-export declare function aclKey(owner: string): string;
+/** KV key for one principal's read-ACL record: the member's owner+actor dot-form (`<owner>.<actor>` =
+ *  {@link principalKey}`.key`) — the read ACL is per-agent (owner+actor), like membership. The dot-form
+ *  is a legal KV key (`/^[-/=.\w]+$/`); pass it through UNCHANGED — do NOT run it through `token()`,
+ *  which rewrites `.`→`_` and would alias distinct principals onto one key. */
+export declare function aclKey(principal: string): string;
 /** Name of the KV bucket holding the derived channel-membership feed for a space (data-account, derived
  *  from CONNZ ∪ the members registry). One entry per AGENT (key = the agent nkey / `card.id`); value is a
  *  {@link import("./types.js").ChannelMembership}. Per-agent keying (not per-channel) keeps keys dot-free
  *  and each value tiny — cap-safe under `max_payload`. Privileged-write (the `membership-rw` cred), read
  *  by the admin/observer dashboard only (exposing the silent-reader set is a trust shift). */
 export declare function membershipBucket(space: string): string;
-/** KV key for one agent's membership record: the agent id (an nkey — `[A-Z0-9]`, dot-free, a `token()`
- *  no-op; keyed like presence/acl, which use the bare id). */
-export declare function membershipKey(id: string): string;
+/** KV key for one agent's membership-feed record: the agent's owner+actor dot-form (`<owner>.<actor>` =
+ *  {@link principalKey}`.key`) — one record per agent (owner+actor), keyed like acl/members. Pass the
+ *  dot-form through UNCHANGED — do NOT run it through `token()` (which rewrites `.`→`_` and would alias
+ *  distinct principals). Both feed sources (the CONNZ live side and the durable members side) must
+ *  resolve to this same dot-form so the union does not double-key one agent. */
+export declare function membershipKey(principal: string): string;
 /** Reserved membership-bucket key for the feed's freshness heartbeat — the daemon re-stamps it every
  *  successful poll (even when no membership changed), so the dashboard can tell "feed is live" from "feed
  *  is stale/dead" WITHOUT the per-agent diff-before-put suppressing the signal. `=` is a valid KV-key char
@@ -197,18 +371,28 @@ export declare function connzRequestSubject(accountId: string): string;
  *  account id, never `$SYS.ACCOUNT.*` (every tenant's events the moment two spaces share a broker). */
 export declare function accountConnectSubject(accountId: string): string;
 export declare function accountDisconnectSubject(accountId: string): string;
+/** The per-server client-KICK request subject (`$SYS.REQ.SERVER.<serverID>.KICK`, nats-server
+ *  `events.go` `clientKickReqSubj`). Payload `{cid}` → the server disconnects that live client by
+ *  connection id. PER-SERVER: `serverID` MUST come from the SAME CONNZ reply that yielded the cid
+ *  (KICK is not fan-out; a cid is only meaningful on its own server). System-account only. There is
+ *  no per-cid success ack — the caller re-scans CONNZ to confirm the connection is gone. This is the
+ *  kill-live half of revocation; it is ALWAYS paired with a deny-new (ledger revoke / cred expiry /
+ *  signer strip / ACL removal), since a kicked client reconnects with a fresh cid until its cred dies. */
+export declare function serverKickSubject(serverId: string): string;
 /** Extract the channel pattern from a live chat SUBSCRIPTION subject in this space, or `null` if it
- *  isn't one. A subscription's sender slot is `*` (an agent's `sub.allow` is `chat.*.<channel>`), so the
- *  channel portion (wildcards preserved, e.g. `team.>`) is everything after. This is the ALLOWLIST the
- *  membership daemon uses to turn a connection's subscription list into its channel-subscription set —
- *  matched against the chat grammar (not a denylist of known plumbing, which rots when a new plumbing
- *  subject is added). Drops `_INBOX`, JetStream API, other-space, and non-chat subjects. The whole-chat
- *  god-view (`chat.*.>` → rest `">"`) IS returned here; the caller excludes such taps separately.
+ *  isn't one. A subscription's sender slots are `*` (an agent's `sub.allow` is `chat.*.*.<channel>`), so
+ *  the channel portion (wildcards preserved, e.g. `team.>`) is everything after the two identity tokens.
+ *  This is the ALLOWLIST the membership daemon uses to turn a connection's subscription list into its
+ *  channel-subscription set — matched against the chat grammar (not a denylist of known plumbing, which
+ *  rots when a new plumbing subject is added). Drops `_INBOX`, JetStream API, other-space, and non-chat
+ *  subjects. The whole-chat god-view (`chat.*.*.>` → rest `">"`) IS returned here; the SHORT-wildcard
+ *  taps (`chat.>`, `chat.*.>`) fail the ≥6-token arity and return `null` — the caller's god-tap detector
+ *  must surface those as reads-all separately (a length-checking parse must not let them vanish).
  *
  *  COUPLING (mitnick): both this extraction AND the membership daemon's god-tap detection ride
- *  {@link parseSubject}'s sender-at-[3] chat layout. The deferred read-containment grammar reorder
- *  (sender out of the subject) would move where the channel portion begins and silently break both —
- *  revisit this + the daemon's exclusion (and their tests) if that grammar ships. */
+ *  {@link parseSubject}'s owner+actor chat layout (channel after [4]). A future grammar reorder would move
+ *  where the channel portion begins and silently break both — revisit this + the daemon's exclusion
+ *  (and their tests) together. */
 export declare function channelFromChatSubscription(space: string, subject: string): string | null;
 /** Name of the KV bucket holding the delivery daemon's single-flight lease + readiness signal for a
  *  space. One key per shard ({@link leaseKey}); writable only by the `delivery` cred, world-readable
@@ -243,16 +427,23 @@ export declare function taskStream(space: string): string;
 export declare function inboxStream(space: string): string;
 /** Stream capturing `dlv.>` — the per-member post-auth delivery store (agent binds + acks). */
 export declare function dlvStream(space: string): string;
-/** Subject of an owner's mixed durable inbox: `cotal.<space>.dinbox.<owner>` (one per owner). */
-export declare function dinboxSubject(space: string, owner: string): string;
-/** Subject of an owner's post-auth delivery: `cotal.<space>.dlv.<owner>` (one per owner). */
-export declare function dlvSubject(space: string, owner: string): string;
-/** Parse the owner id out of an owner's mixed-inbox subject `cotal.<space>.dinbox.<owner>`, or null.
- *  The trusted reader is a SINGLE consumer over `dinbox.>` (all owners), so it recovers the per-message
- *  owner from the subject (the routing token is `routeToken(owner)` — an nkey, a `token()` no-op). */
-export declare function parseDinboxOwner(subject: string): string | null;
-/** An agent's bind-only per-owner consumer on {@link dlvStream} (filter `dlv.<owner>`). */
-export declare function dlvDurable(owner: string): string;
+/** Subject of a principal's mixed durable inbox: `cotal.<space>.dinbox.<owner>.<actor>` (one per agent —
+ *  the fan-out delivers a per-member copy, and a member is a principal). Either identity slot accepts `*`
+ *  for the daemon's fan-out write grant (`dinbox.*.*`). */
+export declare function dinboxSubject(space: string, owner: string, actor: string): string;
+/** Subject of a principal's post-auth delivery: `cotal.<space>.dlv.<owner>.<actor>` (one per agent). */
+export declare function dlvSubject(space: string, owner: string, actor: string): string;
+/** Parse the principal out of a mixed-inbox subject `cotal.<space>.dinbox.<owner>.<actor>`, or null.
+ *  The trusted reader is a SINGLE consumer over `dinbox.>` (all principals), so it recovers the
+ *  per-message owner+actor from the subject (split only — the broker forge-locked the slots at write). */
+export declare function parseDinboxPrincipal(subject: string): {
+    owner: string;
+    actor: string;
+} | null;
+/** An agent's bind-only per-member consumer on {@link dlvStream} (filter `dlv.<owner>.<actor>`). The
+ *  durable NAME is the principal's JetStream-safe dash-form (`dlv_<owner>-<actor>`) — a `.` is illegal
+ *  in a durable name, so this uses {@link principalKey}`.name`, never the dot-form. */
+export declare function dlvDurable(owner: string, actor: string): string;
 /** The single privileged fan-out consumer on the CHAT stream (delivery-daemon-pumped; routing, not
  *  auth). N=1 keeps this exact name (see {@link fanoutDurable}). */
 export declare const FANOUT_DURABLE: "fanout";
@@ -268,15 +459,16 @@ export declare function fanoutDurable(shard?: number, shards?: number): string;
 export declare function readerDurable(shard?: number, shards?: number): string;
 /** Name of the REMOVED per-instance chat live-tail durable. Retained only as the canonical name the
  *  read-ACL conformance test asserts an agent can NOT create — it has no live callers, the live read is
- *  now a native core subscription. */
-export declare function chatDurable(instance: string): string;
-/** Consumer name for an instance's short-lived chat **history** reads (join-backfill, focus-recall,
- *  drop-marker). A single per-instance name, scoped to the agent's own id so its create/info/fetch/
- *  delete grants name-scope to that id — a peer can never bind it — while the per-read single
- *  `filter_subject` is what the create-time ACL pins to `allowSubscribe`. */
-export declare function chatHistDurable(instance: string): string;
-/** Durable consumer name for an instance's private DM inbox. */
-export declare function dmDurable(instance: string): string;
+ *  now a native core subscription. Principal name-form (`chat_<owner>-<actor>`) for namespace consistency. */
+export declare function chatDurable(owner: string, actor: string): string;
+/** Consumer name for an agent's short-lived chat **history** reads (join-backfill, focus-recall,
+ *  drop-marker). A single per-agent name in the principal's JetStream-safe dash-form
+ *  (`chathist_<owner>-<actor>`) so its create/info/fetch/delete grants name-scope to that principal —
+ *  a peer can never bind it — while the per-read single `filter_subject` is what the create-time ACL
+ *  pins to `allowSubscribe`. */
+export declare function chatHistDurable(owner: string, actor: string): string;
+/** Durable consumer name for an agent's private DM inbox — the principal's dash-form (`dm_<owner>-<actor>`). */
+export declare function dmDurable(owner: string, actor: string): string;
 /** Durable consumer name (shared across instances of a role) for the task queue. */
 export declare function taskDurable(service: string): string;
 //# sourceMappingURL=subjects.d.ts.map

package/dist/subjects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subjects.d.ts","sourceRoot":"","sources":["../src/subjects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,gEAAgE;AAChE,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGvC;AAED,eAAO,MAAM,IAAI,UAAU,CAAC;AAE5B,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;gFAEgF;AAChF,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,CAI3E;AAgCD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;iFACiF;AACjF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;iCAEiC;AACjC,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAUxE;AAED;;;;;;;;;;yDAUyD;AACzD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB1D;AAED;;;;;;;;2EAQ2E;AAC3E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ3D;AAED;2GAC2G;AAC3G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;2GAC2G;AAC3G,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;2FAI2F;AAC3F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;2FAI2F;AAC3F,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAGnE;AAED;iGACiG;AACjG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,kHAAkH;AAClH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAErF;AAED,8GAA8G;AAC9G,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED;;;;;;;;8DAQ8D;AAC9D,eAAO,MAAM,kBAAkB,EAAG,SAAkB,CAAC;AACrD,eAAO,MAAM,oBAAoB,EAAG,MAAe,CAAC;AACpD,eAAO,MAAM,aAAa,EAAG,OAAgB,CAAC;AAC9C;;;;;;;4FAO4F;AAC5F,eAAO,MAAM,gBAAgB,EAAG,UAAmB,CAAC;AACpD;mEACmE;AACnE,MAAM,MAAM,WAAW,GAAG,OAAO,kBAAkB,GAAG,OAAO,oBAAoB,GAAG,OAAO,aAAa,CAAC;AAEzG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;0DAC0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,yFAAyF;AACzF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1D;qFACqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAalE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAI/D;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;wFACwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;0FAE0F;AAC1F,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD;;;8FAG8F;AAC9F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;mDAImD;AACnD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;wGACwG;AACxG,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIrF;AAED;;;;;iGAKiG;AACjG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;2DAC2D;AAC3D,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AASD;;;;8FAI8F;AAC9F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;8DAC8D;AAC9D,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;qCAIqC;AACrC,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C;;;aAGa;AACb,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;0GAG0G;AAC1G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;uGAGuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AACD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;;;;;qFAWqF;AACrF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIzF;AAED;;;;;0GAK0G;AAC1G,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;0GAG0G;AAC1G,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AACD,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;kBAKkB;AAClB,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQxD;AAID,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAWD,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;sGAEsG;AACtG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI/D;AAED,2FAA2F;AAC3F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;oEACoE;AACpE,eAAO,MAAM,cAAc,EAAG,QAAiB,CAAC;AAEhD;;4EAE4E;AAC5E,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AAEtD;;kDAEkD;AAClD,wBAAgB,aAAa,CAAC,KAAK,SAAI,EAAE,MAAM,SAAI,GAAG,MAAM,CAE3D;AAED,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,KAAK,SAAI,EAAE,MAAM,SAAI,GAAG,MAAM,CAE3D;AAED;;sCAEsC;AACtC,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;6EAG6E;AAC7E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"subjects.d.ts","sourceRoot":"","sources":["../src/subjects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,gEAAgE;AAChE,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGvC;AAED,eAAO,MAAM,IAAI,UAAU,CAAC;AAE5B,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;gFAEgF;AAChF,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,CAI3E;AAyCD;;6DAE6D;AAC7D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;iFACiF;AACjF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;iCAEiC;AACjC,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAUxE;AAED;;;;;;;;;;yDAUyD;AACzD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB1D;AAED;;;;;;;;;;;;6FAY6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW3D;AAED;;;;;;;;;;;;iGAYiG;AACjG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAIxF;AAED,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,qGAAqG;AACrG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;yDAIyD;AACzD;;gGAEgG;AAChG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAE3F;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQtF;AAED;;;;;;;4GAO4G;AAC5G,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED;;;;;;;qGAOqG;AACrG,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD;;;;gFAIgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpE;AAED;;;;oDAIoD;AACpD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAWpF;AAED;;;;gEAIgE;AAChE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAOzE;AAED;;;;;;;;qGAQqG;AACrG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAE9G;AAED;;;;6FAI6F;AAC7F,eAAO,MAAM,SAAS,UAAU,CAAC;AAEjC,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;;;;;;;+DAW+D;AAC/D,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED;;;;;;;;;;4GAU4G;AAC5G,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAWpG;AAED;;;;qGAIqG;AACrG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAyB,GAAG,OAAO,CAOnH;AAED;;;;2FAI2F;AAC3F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;mEAKmE;AACnE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAgBnE;AAED;;;+FAG+F;AAC/F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;2FAI2F;AAC3F,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAGnE;AAED;;;;uDAIuD;AACvD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED;+FAC+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAErF;AAED;0FAC0F;AAC1F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnG;AAED;6FAC6F;AAC7F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;+GAC+G;AAC/G,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1G;AAED;;;;;;;;8DAQ8D;AAC9D,eAAO,MAAM,kBAAkB,EAAG,SAAkB,CAAC;AACrD,eAAO,MAAM,oBAAoB,EAAG,MAAe,CAAC;AACpD,eAAO,MAAM,aAAa,EAAG,OAAgB,CAAC;AAC9C;;;;;;;4FAO4F;AAC5F,eAAO,MAAM,gBAAgB,EAAG,UAAmB,CAAC;AACpD;;;;;gEAKgE;AAChE,eAAO,MAAM,sBAAsB,EAAG,gBAAyB,CAAC;AAChE;mEACmE;AACnE,MAAM,MAAM,WAAW,GAAG,OAAO,kBAAkB,GAAG,OAAO,oBAAoB,GAAG,OAAO,aAAa,CAAC;AAEzG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;0DAC0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,yFAAyF;AACzF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1D;;;;4FAI4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,uHAAuH;IACvH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAmBlE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAI/D;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;wFACwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;0FAE0F;AAC1F,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD;;;8FAG8F;AAC9F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;sGAKsG;AACtG,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;0DAE0D;AAC1D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIzF;AAED;;;;;iGAKiG;AACjG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;+EAG+E;AAC/E,wBAAgB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhD;AASD;;;;8FAI8F;AAC9F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;gFAIgF;AAChF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;qCAIqC;AACrC,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C;;;aAGa;AACb,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;0GAG0G;AAC1G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;uGAGuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AACD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;0GAM0G;AAC1G,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;;;;;;;kCAakC;AAClC,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIzF;AAED;;;;;0GAK0G;AAC1G,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;0GAG0G;AAC1G,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AACD,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;kBAKkB;AAClB,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQxD;AAID,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAWD,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;2DAE2D;AAC3D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;0GAE0G;AAC1G,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM7F;AAED;;uFAEuF;AACvF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;oEACoE;AACpE,eAAO,MAAM,cAAc,EAAG,QAAiB,CAAC;AAEhD;;4EAE4E;AAC5E,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AAEtD;;kDAEkD;AAClD,wBAAgB,aAAa,CAAC,KAAK,SAAI,EAAE,MAAM,SAAI,GAAG,MAAM,CAE3D;AAED,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,KAAK,SAAI,EAAE,MAAM,SAAI,GAAG,MAAM,CAE3D;AAED;;8GAE8G;AAC9G,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;gCAIgC;AAChC,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,gHAAgH;AAChH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD"}