@cotal-ai/core 0.12.0 → 0.13.0

package/dist/evict.d.ts

@@ -1,35 +1,3 @@
-/**
- * D5 slice 4 — BROKER-BACKED LIVE CONNECTION EVICTION.
- *
- * Revocation has two halves. DENY-NEW (ledger revoke, cred expiry, stripped signer, ACL removal)
- * stops the next exchange/connect — but a client that is ALREADY connected with a still-valid JWT
- * keeps its live core subscriptions until that JWT expires. KILL-LIVE closes that window now:
- * `$SYS.REQ.SERVER.<serverID>.KICK {cid}` disconnects one live client by connection id.
- *
- * This module is the kill-live primitive and its two credentials, kept deliberately small (the
- * simplicity-lane shape: one eviction path, not a parallel subsystem):
- *  - the OBSERVER read (account CONNZ, `auth:true`) projected to `{cid, serverId, principal}` — a
- *    DIFFERENT projection than the membership feed's channel-folding (it keeps cid+serverId, which
- *    the feed discards), so it is its own tiny scan, not duplicated filtering;
- *  - the kill: `evictPrincipal(observerConn, evictorConn, accountId, principal)` = scan → KICK each
- *    matching cid on the SERVER THE CID CAME FROM → re-scan to verify, bounded, structured.
- *
- * Two credentials by design (never one broad sys user that both enumerates and kills):
- *  - the existing `membership-observer` (CONNZ-read only) does discovery;
- *  - a NEW kick-only evictor (`$SYS.REQ.SERVER.*.KICK` and nothing else) does the kill.
- * Both are system-account users mintable ONLY at the `up` that provisions the account (the $SYS
- * signing seed is never persisted) — so the evictor is a standing, high-power, renewable credential,
- * classified with the observer, surfaced by the stale-auth diagnostics when absent.
- *
- * SEMANTICS, stated in the result (never inferred):
- *  - KICK has NO per-cid ack, so success is proven only by a re-scan showing the principal gone.
- *  - A PARTIAL/unavailable CONNZ read is `verifiedGone:false` with `scanComplete:false` — NEVER a
- *    silent success (the membership feed's truthium rule; a caller/flip gate stays blocked).
- *  - "principal not currently live" is a no-op SUCCESS (`kicked:0, remaining:0, verifiedGone:true`)
- *    — idempotent, so repair/doctor tooling never needs "already gone" special-casing.
- *  - This is ALWAYS paired with a committed deny-new by the caller: a kicked client reconnects with
- *    a fresh cid until its cred dies, so an evict-only loop would chase churn. The name says so.
- */
 import { type NatsConnection } from "@nats-io/transport-node";
 /** The structured outcome of an eviction attempt — every field a repair/flip gate reads to decide
  *  "done" vs "blocked". `verifiedGone` is the ONLY success signal; it is true only when a COMPLETE
@@ -71,6 +39,101 @@ export interface EvictOptions {
  * connects; without a committed deny-new a kicked client reconnects with a fresh cid.
  */
 export declare function evictDeniedPrincipal(observerConn: NatsConnection, evictorConn: NatsConnection, accountId: string, principal: string, options?: EvictOptions): Promise<EvictionResult>;
+/** One plane-owned connection's broker identity, captured at connect from the protocol INFO and
+ *  pinned in the auth plane's durable claim row. `serverId` is the broker RUN's ephemeral id (a
+ *  restart mints a new one), `cid` is that server's connection id, `userNkey` is the connection's
+ *  stable user public key (the self-minted authority identity). */
+export interface PlaneConnTuple {
+    serverId: string;
+    cid: number;
+    userNkey: string;
+}
+/** The closed plane-liveness query: exactly the TWO ownership-bearing sealed-scanner tuples out of
+ *  the plane claim row — never a generic CONNZ filter (the delivery daemon derives the allowed
+ *  connection labels from its own space; a caller cannot probe arbitrary connections). */
+export interface PlaneLivenessQuery {
+    ledger: PlaneConnTuple;
+    records: PlaneConnTuple;
+}
+/** Per-role verdict. `live` = the claimed identity (or its user nkey anywhere) is connected NOW;
+ *  `gone` = a COMPLETE sweep conclusively proves it absent; `unknown` = the observation cannot
+ *  decide (incomplete sweep) — a caller MUST treat unknown as "may still be live" (refuse
+ *  takeover), never as gone. */
+export type PlaneRoleLiveness = "live" | "gone" | "unknown";
+/** The oracle's bound reply: each queried tuple echoed with its verdict (a reply that does not
+ *  echo the caller's exact query never authorizes), plus `sweepComplete` — CONNZ OBSERVATION
+ *  completeness (every round replied, no truncation), NEVER any statement about a sealed scan
+ *  having finished (the critic's mid-scan-crash wedge; reclaim gates on liveness alone). */
+export interface PlaneLivenessResult {
+    ledger: {
+        tuple: PlaneConnTuple;
+        state: PlaneRoleLiveness;
+    };
+    records: {
+        tuple: PlaneConnTuple;
+        state: PlaneRoleLiveness;
+    };
+    sweepComplete: boolean;
+    note?: string;
+}
+/** Structural tuple validation (closed parse — the wire crosses a trust boundary in BOTH
+ *  directions: the daemon validates the query, the auth plane validates the echo). CLOSED schema:
+ *  an unknown field refuses (a v1 tuple is exactly these three keys). */
+export declare function isPlaneConnTuple(v: unknown): v is PlaneConnTuple;
+/** Closed parse of a wire-crossing {@link PlaneLivenessResult} (the auth plane validates the
+ *  delivery-admin rail's reply BEFORE reasoning over it): exactly the v1 keys, both role objects
+ *  exactly `{ tuple, state }`, states in the enum, tuples closed. Undefined on ANY violation — the
+ *  caller maps that to `unknown` (a garbled oracle must block takeover, never authorize it). */
+export declare function parsePlaneLivenessResult(v: unknown): PlaneLivenessResult | undefined;
+/**
+ * Answer a plane-liveness query over the account's live connections (the delivery daemon's
+ * read-only half of the #29 HIGH 3 reclaim protocol; observer cred only, no KICK). Verdict rules,
+ * fail-safe by construction:
+ *
+ *  - `live`: a connection carrying the claimed `userNkey` exists ANYWHERE (any server, any cid —
+ *    wider than the exact tuple on purpose: an identity that still holds ANY connection must block
+ *    takeover), or the exact `(serverId, cid)` pair is present.
+ *  - `gone`: the sweep is COMPLETE, the observation PROVES the single-server mode, and the claimed
+ *    `userNkey` appears nowhere. This includes the claimed `serverId` being absent from the
+ *    repliers entirely: `server_id` is per-broker-RUN, so after a broker restart the claimed
+ *    incarnation can never reply again while every connection it held is gone by definition —
+ *    requiring its reply forever would turn every whole-stack crash into a permanent reclaim
+ *    wedge (the inverted-lockout class).
+ *
+ *    THE SINGLE-SERVER PROOF (SPEC 13.13): CONNZ absence alone cannot distinguish a RESTARTED
+ *    claimed server (genuinely gone) from a PARTITIONED one (live, unreachable) — both present as
+ *    "the claimed serverId did not reply". The discriminator is the responding server's OWN
+ *    topology declaration, never an inference from who replied: `gone` additionally requires that
+ *    EVERY reply carried a server envelope declaring NO cluster membership (`server.cluster`
+ *    absent — nats-server sets it, config-named or dynamically generated, whenever clustering is
+ *    configured) and that exactly ONE distinct server replied. A standalone process cannot have a
+ *    silent same-cluster peer holding the claimed connection, so its complete reply is the whole
+ *    truth; a partitioned cluster member still DECLARES its cluster and reads `unknown`. NAMED
+ *    RESIDUALS: a leafnode/gateway-extended account is outside the cluster self-report (such
+ *    topologies are out of contract for the auth account until a multi-server incarnation
+ *    authority exists), and a backup-restore onto a fresh broker can present a still-running
+ *    foreign predecessor's `serverId` as dead.
+ *  - `unknown`: the sweep under-reported (no replies, truncation, an unroutable row) OR the
+ *    single-server mode is unproven (a cluster self-report, multiple repliers, or a reply without
+ *    the server envelope) — the caller refuses takeover.
+ *
+ *  Closed surface: the CONNZ request carries no caller-selected filter (account-wide sweep only)
+ *  and the reply exposes ONLY the two bound verdicts + sweep completeness — never a connection
+ *  listing. A row matching the claimed nkey under ANY connection name counts live (fail safe);
+ *  the residual "is this nkey connected" bit the verb leaks is strictly weaker than the kick
+ *  authority the same rail already carries.
+ */
+export declare function observePlaneLiveness(observerConn: NatsConnection, accountId: string, query: PlaneLivenessQuery, options?: EvictOptions): Promise<PlaneLivenessResult>;
+/** Creds-level wrapper for the delivery daemon's admin-rail plane-liveness verb: open the $SYS
+ *  observer PER CALL (the eviction seam's rule — never a standing $SYS connection), run
+ *  {@link observePlaneLiveness}, drain. Read-only: no evictor cred enters this path. */
+export declare function observePlaneLivenessWithCreds(opts: {
+    servers: string;
+    observerCreds: string;
+    accountId: string;
+    query: PlaneLivenessQuery;
+    options?: EvictOptions;
+}): Promise<PlaneLivenessResult>;
 /** Creds-level wrapper for composition roots that hold the two $SYS creds as FILES/strings (the
  *  delivery daemon's admin-rail executor): open the observer (under its granted inbox prefix) and
  *  the kick-only evictor PER CALL, run {@link evictDeniedPrincipal}, and drain both — eviction is a

package/dist/evict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evict.d.ts","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AA0B3F;;sDAEsD;AACtD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qGAAqG;IACrG,SAAS,EAAE,MAAM,CAAC;IAClB;0FACsF;IACtF,YAAY,EAAE,OAAO,CAAC;IACtB;sDACkD;IAClD,YAAY,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;6CAC6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4GD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,cAAc,EAC5B,WAAW,EAAE,cAAc,EAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAED;;;;qGAIqG;AACrG,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1B"}
+{"version":3,"file":"evict.d.ts","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAiCA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAgC3F;;sDAEsD;AACtD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qGAAqG;IACrG,SAAS,EAAE,MAAM,CAAC;IAClB;0FACsF;IACtF,YAAY,EAAE,OAAO,CAAC;IACtB;sDACkD;IAClD,YAAY,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;6CAC6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiHD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,cAAc,EAC5B,WAAW,EAAE,cAAc,EAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAID;;;mEAGmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;0FAE0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;gCAGgC;AAChC,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5D;;;4FAG4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC5D,OAAO,EAAE;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC7D,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;yEAEyE;AACzE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,cAAc,CAShE;AAED;;;gGAGgG;AAChG,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAkBpF;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,cAAc,EAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CA6E9B;AAED;;wFAEwF;AACxF,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAY/B;AAED;;;;qGAIqG;AACrG,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1B"}

package/dist/evict.js

@@ -30,6 +30,7 @@
  *  - This is ALWAYS paired with a committed deny-new by the caller: a kicked client reconnects with
  *    a fresh cid until its cred dies, so an evict-only loop would chase churn. The name says so.
  */
+import { randomUUID } from "node:crypto";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { connzRequestSubject, principalFromConnz, serverKickSubject, MEMBERSHIP_INBOX_PREFIX } from "./subjects.js";
 const enc = (s) => new TextEncoder().encode(s);
@@ -44,10 +45,11 @@ async function scanLive(observerConn, accountId, opts) {
     let gotAnyReply = false;
     let truncated = false;
     let unroutable = false; // a reply named no server id → its conns can't be KICKed → scan is not complete
+    const sweep = randomUUID(); // per-sweep reply-inbox nonce: concurrent sweeps must never cross-talk
     let seq = 0;
     for (let page = 0; page < MAX_PAGES; page++) {
         const offset = page * opts.pageLimit;
-        const replies = await connzRound(observerConn, accountId, offset, opts, seq++);
+        const replies = await connzRound(observerConn, accountId, offset, opts, sweep, seq++);
         if (replies.length)
             gotAnyReply = true;
         let fullPageSomewhere = false;
@@ -88,12 +90,15 @@ async function scanLive(observerConn, accountId, opts) {
     return { conns, complete: gotAnyReply && !truncated && !unroutable };
 }
 /** One CONNZ round: fan out the account request, collect every server's reply within the window. */
-function connzRound(observerConn, accountId, offset, opts, seq) {
+function connzRound(observerConn, accountId, offset, opts, sweep, seq) {
     return new Promise((resolve) => {
         // The reply inbox MUST sit under the prefix the observer cred (`membership-observer`) grants sub
         // on — its ACL allows only `${MEMBERSHIP_INBOX_PREFIX}.>`, so a distinct `_INBOX.cotal-evict.*`
         // subject is broker-denied and the scan gets ZERO replies (a fail-closed under-report).
-        const inbox = `${MEMBERSHIP_INBOX_PREFIX}.evict.${seq}`;
+        // `sweep` is a per-call collision-resistant nonce: concurrent sweeps (a plane reclaim next to an
+        // eviction verify) subscribe to DISJOINT inboxes, so one sweep's page reply can never satisfy —
+        // or falsely complete — another's round.
+        const inbox = `${MEMBERSHIP_INBOX_PREFIX}.evict.${sweep}.${seq}`;
         const out = [];
         let settle;
         let done = false;
@@ -198,6 +203,191 @@ export async function evictDeniedPrincipal(observerConn, evictorConn, accountId,
     // Unreachable (the loop returns), but satisfies the type checker.
     return { principal, kicked, remaining: 0, verifiedGone: false, scanComplete: true, note };
 }
+/** Structural tuple validation (closed parse — the wire crosses a trust boundary in BOTH
+ *  directions: the daemon validates the query, the auth plane validates the echo). CLOSED schema:
+ *  an unknown field refuses (a v1 tuple is exactly these three keys). */
+export function isPlaneConnTuple(v) {
+    if (v === null || typeof v !== "object")
+        return false;
+    for (const k of Object.keys(v))
+        if (k !== "serverId" && k !== "cid" && k !== "userNkey")
+            return false;
+    const t = v;
+    return (typeof t.serverId === "string" && t.serverId.length > 0 && t.serverId.length <= 128 &&
+        typeof t.cid === "number" && Number.isSafeInteger(t.cid) && t.cid > 0 &&
+        typeof t.userNkey === "string" && /^U[A-Z2-7]{55}$/.test(t.userNkey));
+}
+/** Closed parse of a wire-crossing {@link PlaneLivenessResult} (the auth plane validates the
+ *  delivery-admin rail's reply BEFORE reasoning over it): exactly the v1 keys, both role objects
+ *  exactly `{ tuple, state }`, states in the enum, tuples closed. Undefined on ANY violation — the
+ *  caller maps that to `unknown` (a garbled oracle must block takeover, never authorize it). */
+export function parsePlaneLivenessResult(v) {
+    if (v === null || typeof v !== "object")
+        return undefined;
+    for (const k of Object.keys(v))
+        if (!["ledger", "records", "sweepComplete", "note"].includes(k))
+            return undefined;
+    const r = v;
+    const role = (x) => {
+        if (x === null || typeof x !== "object")
+            return undefined;
+        for (const k of Object.keys(x))
+            if (k !== "tuple" && k !== "state")
+                return undefined;
+        const y = x;
+        if (!isPlaneConnTuple(y.tuple))
+            return undefined;
+        if (y.state !== "live" && y.state !== "gone" && y.state !== "unknown")
+            return undefined;
+        return { tuple: y.tuple, state: y.state };
+    };
+    const ledger = role(r.ledger);
+    const records = role(r.records);
+    if (ledger === undefined || records === undefined)
+        return undefined;
+    if (typeof r.sweepComplete !== "boolean")
+        return undefined;
+    if (r.note !== undefined && (typeof r.note !== "string" || r.note.length === 0 || r.note.length > 2048))
+        return undefined;
+    return { ledger, records, sweepComplete: r.sweepComplete, ...(r.note !== undefined ? { note: r.note } : {}) };
+}
+/**
+ * Answer a plane-liveness query over the account's live connections (the delivery daemon's
+ * read-only half of the #29 HIGH 3 reclaim protocol; observer cred only, no KICK). Verdict rules,
+ * fail-safe by construction:
+ *
+ *  - `live`: a connection carrying the claimed `userNkey` exists ANYWHERE (any server, any cid —
+ *    wider than the exact tuple on purpose: an identity that still holds ANY connection must block
+ *    takeover), or the exact `(serverId, cid)` pair is present.
+ *  - `gone`: the sweep is COMPLETE, the observation PROVES the single-server mode, and the claimed
+ *    `userNkey` appears nowhere. This includes the claimed `serverId` being absent from the
+ *    repliers entirely: `server_id` is per-broker-RUN, so after a broker restart the claimed
+ *    incarnation can never reply again while every connection it held is gone by definition —
+ *    requiring its reply forever would turn every whole-stack crash into a permanent reclaim
+ *    wedge (the inverted-lockout class).
+ *
+ *    THE SINGLE-SERVER PROOF (SPEC 13.13): CONNZ absence alone cannot distinguish a RESTARTED
+ *    claimed server (genuinely gone) from a PARTITIONED one (live, unreachable) — both present as
+ *    "the claimed serverId did not reply". The discriminator is the responding server's OWN
+ *    topology declaration, never an inference from who replied: `gone` additionally requires that
+ *    EVERY reply carried a server envelope declaring NO cluster membership (`server.cluster`
+ *    absent — nats-server sets it, config-named or dynamically generated, whenever clustering is
+ *    configured) and that exactly ONE distinct server replied. A standalone process cannot have a
+ *    silent same-cluster peer holding the claimed connection, so its complete reply is the whole
+ *    truth; a partitioned cluster member still DECLARES its cluster and reads `unknown`. NAMED
+ *    RESIDUALS: a leafnode/gateway-extended account is outside the cluster self-report (such
+ *    topologies are out of contract for the auth account until a multi-server incarnation
+ *    authority exists), and a backup-restore onto a fresh broker can present a still-running
+ *    foreign predecessor's `serverId` as dead.
+ *  - `unknown`: the sweep under-reported (no replies, truncation, an unroutable row) OR the
+ *    single-server mode is unproven (a cluster self-report, multiple repliers, or a reply without
+ *    the server envelope) — the caller refuses takeover.
+ *
+ *  Closed surface: the CONNZ request carries no caller-selected filter (account-wide sweep only)
+ *  and the reply exposes ONLY the two bound verdicts + sweep completeness — never a connection
+ *  listing. A row matching the claimed nkey under ANY connection name counts live (fail safe);
+ *  the residual "is this nkey connected" bit the verb leaks is strictly weaker than the kick
+ *  authority the same rail already carries.
+ */
+export async function observePlaneLiveness(observerConn, accountId, query, options = {}) {
+    const opts = {
+        settleMs: options.settleMs ?? 250,
+        maxWaitMs: options.maxWaitMs ?? 2000,
+        pageLimit: options.pageLimit ?? 1024,
+    };
+    const conns = [];
+    let gotAnyReply = false;
+    let truncated = false;
+    let malformed = false;
+    let clusterDeclared = false; // any responder DECLARED cluster membership — single-server unproven
+    const repliers = new Set();
+    const sweep = randomUUID(); // per-sweep reply-inbox nonce: concurrent sweeps must never cross-talk
+    let seq = 0;
+    for (let page = 0; page < MAX_PAGES; page++) {
+        const offset = page * opts.pageLimit;
+        const replies = await connzRound(observerConn, accountId, offset, opts, sweep, seq++);
+        if (replies.length)
+            gotAnyReply = true;
+        let fullPageSomewhere = false;
+        for (const r of replies) {
+            // FAIL-CLOSED reply validation: only a SUCCESSFUL, well-formed CONNZ page may count toward a
+            // reclaim-authorizing sweep. An API error, a missing/empty server envelope, a present but
+            // non-string (or empty-string) cluster declaration, an envelope/data server-id mismatch, or a
+            // structurally incomplete data page each mark the sweep malformed (=> every verdict unknown).
+            const envId = r.server?.id;
+            const cluster = r.server?.cluster;
+            if (r.error !== undefined ||
+                typeof envId !== "string" || envId.length === 0 ||
+                (cluster !== undefined && (typeof cluster !== "string" || cluster.length === 0)) ||
+                (r.data?.server_id !== undefined && r.data.server_id !== envId) ||
+                r.data === undefined || !Array.isArray(r.data.connections) ||
+                typeof r.data.total !== "number" || !Number.isSafeInteger(r.data.total) || r.data.total < 0 ||
+                (r.data.offset !== undefined && (typeof r.data.offset !== "number" || !Number.isSafeInteger(r.data.offset) || r.data.offset < 0))) {
+                malformed = true;
+                continue;
+            }
+            const serverId = envId;
+            repliers.add(serverId);
+            if (typeof cluster === "string")
+                clusterDeclared = true;
+            const cs = r.data.connections;
+            for (const c of cs) {
+                if (typeof c.cid !== "number") {
+                    malformed = true; // an id-less row could BE the claimed connection — fail safe
+                    continue;
+                }
+                conns.push({ serverId, cid: c.cid, ...(typeof c.authorized_user === "string" ? { userNkey: c.authorized_user } : {}) });
+            }
+            const total = r.data.total;
+            if (cs.length >= opts.pageLimit && offset + cs.length < total)
+                fullPageSomewhere = true;
+        }
+        if (!fullPageSomewhere)
+            break;
+        if (page === MAX_PAGES - 1)
+            truncated = true;
+    }
+    const sweepComplete = gotAnyReply && !truncated && !malformed;
+    // The single-server proof (see the doc): `gone` is sound ONLY when every responder declared
+    // standalone topology and exactly one server replied — a declaration, never a reply-count guess.
+    const singleServerProven = sweepComplete && !clusterDeclared && repliers.size === 1;
+    const verdict = (tuple) => {
+        const live = conns.some((c) => c.userNkey === tuple.userNkey || (c.serverId === tuple.serverId && c.cid === tuple.cid));
+        if (live)
+            return "live";
+        return singleServerProven ? "gone" : "unknown";
+    };
+    const note = !sweepComplete
+        ? "CONNZ sweep under-reported (no responder, truncation, an API error, or a malformed reply) - liveness UNKNOWN"
+        : !singleServerProven
+            ? clusterDeclared
+                ? "the broker DECLARES cluster membership - a partitioned member could still hold the claimed connections, so CONNZ liveness cannot adjudicate a plane reclaim outside the single-server mode (SPEC 13.13) - liveness UNKNOWN"
+                : `${repliers.size} distinct servers replied - the single-server mode the reclaim verdict requires is unproven (SPEC 13.13) - liveness UNKNOWN`
+            : undefined;
+    return {
+        ledger: { tuple: query.ledger, state: verdict(query.ledger) },
+        records: { tuple: query.records, state: verdict(query.records) },
+        sweepComplete,
+        ...(note === undefined ? {} : { note }),
+    };
+}
+/** Creds-level wrapper for the delivery daemon's admin-rail plane-liveness verb: open the $SYS
+ *  observer PER CALL (the eviction seam's rule — never a standing $SYS connection), run
+ *  {@link observePlaneLiveness}, drain. Read-only: no evictor cred enters this path. */
+export async function observePlaneLivenessWithCreds(opts) {
+    const observer = await connect({
+        servers: opts.servers,
+        authenticator: credsAuthenticator(enc(opts.observerCreds)),
+        inboxPrefix: MEMBERSHIP_INBOX_PREFIX,
+        maxReconnectAttempts: 0,
+    });
+    try {
+        return await observePlaneLiveness(observer, opts.accountId, opts.query, opts.options ?? {});
+    }
+    finally {
+        await observer.drain().catch(() => { });
+    }
+}
 /** Creds-level wrapper for composition roots that hold the two $SYS creds as FILES/strings (the
  *  delivery daemon's admin-rail executor): open the observer (under its granted inbox prefix) and
  *  the kick-only evictor PER CALL, run {@link evictDeniedPrincipal}, and drain both — eviction is a

package/dist/evict.js.map

@@ -1 +1 @@
-{"version":3,"file":"evict.js","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAEpH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gFAAgF;AAqDtG;;;;wBAIwB;AACxB,KAAK,UAAU,QAAQ,CACrB,YAA4B,EAC5B,SAAiB,EACjB,IAA0E;IAE1E,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,GAAG,KAAK,CAAC,CAAC,gFAAgF;IACxG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,6FAA6F;gBAC7F,0FAA0F;gBAC1F,mFAAmF;gBACnF,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,mFAAmF;gBACnF,sFAAsF;gBACtF,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,SAAS;oBAAE,SAAS,CAAC,mEAAmE;gBAC7F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9B,wFAAwF;oBACxF,0FAA0F;oBAC1F,wFAAwF;oBACxF,UAAU,GAAG,IAAI,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,KAAK;gBAAE,iBAAiB,GAAG,IAAI,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,MAAM,CAAC,yCAAyC;QACxE,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;AACvE,CAAC;AAED,oGAAoG;AACpG,SAAS,UAAU,CACjB,YAA4B,EAC5B,SAAiB,EACjB,MAAc,EACd,IAA0E,EAC1E,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,MAAM,KAAK,GAAG,GAAG,uBAAuB,UAAU,GAAG,EAAE,CAAC;QACxD,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,IAAI,MAAiD,CAAC;QACtD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE;YACxC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,IAAI,GAAG;oBAAE,OAAO;gBAChB,IAAI,CAAC;oBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAC1E,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,YAAY,CAAC,OAAO,CAClB,mBAAmB,CAAC,SAAS,CAAC,EAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;2EAE2E;AAC3E,KAAK,UAAU,IAAI,CAAC,WAA2B,EAAE,IAAc;IAC7D,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnI,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAwC,CAAC;IAC9D,IAAI,IAAI,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAA4B,EAC5B,WAA2B,EAC3B,SAAiB,EACjB,SAAiB,EACjB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,QAAQ;QACjB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,yFAAyF,EAAE,CAAC;IAE3L,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;IAEjJ,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,uFAAuF;IACvF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAClB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,kDAAkD,EAAE,CAAC;QACzJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3F,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAChH,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,GAAG,CAAC;YACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,mCAAmC,IAAI,CAAC,eAAe,yCAAyC,EAAE,CAAC;IAClO,CAAC;IACD,kEAAkE;IAClE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED;;;;qGAIqG;AACrG,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAOnD;IACC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzD,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"evict.js","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAEpH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gFAAgF;AA2DtG;;;;wBAIwB;AACxB,KAAK,UAAU,QAAQ,CACrB,YAA4B,EAC5B,SAAiB,EACjB,IAA0E;IAE1E,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,GAAG,KAAK,CAAC,CAAC,gFAAgF;IACxG,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,uEAAuE;IACnG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,6FAA6F;gBAC7F,0FAA0F;gBAC1F,mFAAmF;gBACnF,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,mFAAmF;gBACnF,sFAAsF;gBACtF,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,SAAS;oBAAE,SAAS,CAAC,mEAAmE;gBAC7F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9B,wFAAwF;oBACxF,0FAA0F;oBAC1F,wFAAwF;oBACxF,UAAU,GAAG,IAAI,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,KAAK;gBAAE,iBAAiB,GAAG,IAAI,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,MAAM,CAAC,yCAAyC;QACxE,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;AACvE,CAAC;AAED,oGAAoG;AACpG,SAAS,UAAU,CACjB,YAA4B,EAC5B,SAAiB,EACjB,MAAc,EACd,IAA0E,EAC1E,KAAa,EACb,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,iGAAiG;QACjG,gGAAgG;QAChG,yCAAyC;QACzC,MAAM,KAAK,GAAG,GAAG,uBAAuB,UAAU,KAAK,IAAI,GAAG,EAAE,CAAC;QACjE,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,IAAI,MAAiD,CAAC;QACtD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE;YACxC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,IAAI,GAAG;oBAAE,OAAO;gBAChB,IAAI,CAAC;oBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAC1E,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,YAAY,CAAC,OAAO,CAClB,mBAAmB,CAAC,SAAS,CAAC,EAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;2EAE2E;AAC3E,KAAK,UAAU,IAAI,CAAC,WAA2B,EAAE,IAAc;IAC7D,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnI,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAwC,CAAC;IAC9D,IAAI,IAAI,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAA4B,EAC5B,WAA2B,EAC3B,SAAiB,EACjB,SAAiB,EACjB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,QAAQ;QACjB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,yFAAyF,EAAE,CAAC;IAE3L,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;IAEjJ,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,uFAAuF;IACvF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAClB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,kDAAkD,EAAE,CAAC;QACzJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3F,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAChH,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,GAAG,CAAC;YACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,mCAAmC,IAAI,CAAC,eAAe,yCAAyC,EAAE,CAAC;IAClO,CAAC;IACD,kEAAkE;IAClE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAuCD;;yEAEyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;IACtG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;QACnF,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QACrE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CACrE,CAAC;AACJ,CAAC;AAED;;;gGAGgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAClH,MAAM,CAAC,GAAG,CAAiC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,CAAU,EAAmE,EAAE;QAC3F,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;QACrF,MAAM,CAAC,GAAG,CAAyC,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1H,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAA4B,EAC5B,SAAiB,EACjB,KAAyB,EACzB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;IACF,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,eAAe,GAAG,KAAK,CAAC,CAAC,qEAAqE;IAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,uEAAuE;IACnG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAI,CAAC,CAAC,MAA4C,EAAE,OAAO,CAAC;YACzE,IACE,CAAC,CAAC,KAAK,KAAK,SAAS;gBACrB,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC/C,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBAChF,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;gBAC/D,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;gBAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACjI,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,eAAe,GAAG,IAAI,CAAC;YACxD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAA+B,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9B,SAAS,GAAG,IAAI,CAAC,CAAC,6DAA6D;oBAC/E,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1H,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,KAAK;gBAAE,iBAAiB,GAAG,IAAI,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,MAAM;QAC9B,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC;IAC9D,4FAA4F;IAC5F,iGAAiG;IACjG,MAAM,kBAAkB,GAAG,aAAa,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,CAAC,KAAqB,EAAqB,EAAE;QAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxH,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC;QACxB,OAAO,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,aAAa;QACzB,CAAC,CAAC,8GAA8G;QAChH,CAAC,CAAC,CAAC,kBAAkB;YACnB,CAAC,CAAC,eAAe;gBACf,CAAC,CAAC,4NAA4N;gBAC9N,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,6HAA6H;YACjJ,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAC7D,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAChE,aAAa;QACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;wFAEwF;AACxF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAMnD;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;qGAIqG;AACrG,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAOnD;IACC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzD,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,27 @@
 export * from "./types.js";
 export * from "./subjects.js";
+export * from "./endpoint-subjects.js";
+export * from "./endpoint-grants.js";
+export * from "./endpoint-envelope.js";
+export * from "./endpoint-records.js";
+export * from "./endpoint-cluster.js";
+export * from "./endpoint-journal.js";
+export * from "./endpoint-binding.js";
+export * from "./endpoint-service.js";
+export * from "./endpoint-serve.js";
+export * from "./endpoint-verbs.js";
+export * from "./endpoint-work.js";
+export * from "./endpoint-action.js";
+export * from "./endpoint-checkpoint.js";
+export * from "./endpoint-contract-store.js";
+export * from "./endpoint-guard.js";
+export * from "./endpoint-handle.js";
+export * from "./endpoint-session.js";
+export * from "./endpoint-virtual.js";
+export * from "./endpoint-receipt.js";
+export * from "./endpoint-signing.js";
+export * from "./endpoint-traits.js";
+export * from "./safe-pattern.js";
 export * from "./resolve.js";
 export * from "./link.js";
 export * from "./identity.js";
@@ -28,4 +50,7 @@ export * from "./runtime.js";
 export * from "./terminal.js";
 export * from "./registry.js";
 export * from "./auth-provider.js";
+export * from "./canonical.js";
+export * from "./schema-profile.js";
+export * from "./broker-floor.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -1,5 +1,27 @@
 export * from "./types.js";
 export * from "./subjects.js";
+export * from "./endpoint-subjects.js";
+export * from "./endpoint-grants.js";
+export * from "./endpoint-envelope.js";
+export * from "./endpoint-records.js";
+export * from "./endpoint-cluster.js";
+export * from "./endpoint-journal.js";
+export * from "./endpoint-binding.js";
+export * from "./endpoint-service.js";
+export * from "./endpoint-serve.js";
+export * from "./endpoint-verbs.js";
+export * from "./endpoint-work.js";
+export * from "./endpoint-action.js";
+export * from "./endpoint-checkpoint.js";
+export * from "./endpoint-contract-store.js";
+export * from "./endpoint-guard.js";
+export * from "./endpoint-handle.js";
+export * from "./endpoint-session.js";
+export * from "./endpoint-virtual.js";
+export * from "./endpoint-receipt.js";
+export * from "./endpoint-signing.js";
+export * from "./endpoint-traits.js";
+export * from "./safe-pattern.js";
 export * from "./resolve.js";
 export * from "./link.js";
 export * from "./identity.js";
@@ -28,4 +50,7 @@ export * from "./runtime.js";
 export * from "./terminal.js";
 export * from "./registry.js";
 export * from "./auth-provider.js";
+export * from "./canonical.js";
+export * from "./schema-profile.js";
+export * from "./broker-floor.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/lease.d.ts

@@ -27,6 +27,10 @@ export interface DeliveryLeaseInfo {
  *  manager (no fallbacks); `pid` is a diagnostics + targeted-stop hint. Acquired by an ATOMIC CAS
  *  create — a second manager's create THROWS, a loud refusal-to-bind. */
 export interface ManagerLeaseInfo {
+    /** The manager endpoint id — `principalKey(owner, actor).key` dot-form (the endpoint card's
+     *  id), so it is DIRECTLY comparable to a control subject's `<owner>.<actor>` attribution:
+     *  the auth service's retirement rail (#29 piece 3) leader-reads this row and requires
+     *  holder == the subject-attributed requester principal, fresh per request. */
     holder: string;
     runtime: string;
     root: string;

package/dist/lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAI3C;;;;qEAIqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;yEAGyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;6GAC6G;AAC7G,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,EAAE,CAAC,CAEb;AAED;;;;8GAI8G;AAC9G,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BnB"}
+{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAI3C;;;;qEAIqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;yEAGyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B;;;mFAG+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;6GAC6G;AAC7G,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,EAAE,CAAC,CAEb;AAED;;;;8GAI8G;AAC9G,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BnB"}

package/dist/lease.js.map

@@ -1 +1 @@
-{"version":3,"file":"lease.js","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAyBzD;6GAC6G;AAC7G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAoD,EACpD,KAAa;IAEb,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;8GAI8G;AAC9G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAM1C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACvD,IAAI,EAAmD,CAAC;IACxD,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvE,WAAW,EAAE,UAAU,IAAI,CAAC,EAAE,EAAE;YAChC,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1D,2FAA2F;gBAC3F,IAAI,CAAC;oBAAC,IAAI,CAAC,CAAC,IAAI,EAAqB,CAAC,KAAK,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"lease.js","sourceRoot":"","sources":["../src/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA6BzD;6GAC6G;AAC7G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAoD,EACpD,KAAa;IAEb,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;8GAI8G;AAC9G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAM1C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACvD,IAAI,EAAmD,CAAC;IACxD,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvE,WAAW,EAAE,UAAU,IAAI,CAAC,EAAE,EAAE;YAChC,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1D,2FAA2F;gBAC3F,IAAI,CAAC;oBAAC,IAAI,CAAC,CAAC,IAAI,EAAqB,CAAC,KAAK,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/members.d.ts

@@ -27,7 +27,7 @@ export declare function openMembersRegistry(nc: import("@nats-io/transport-node"
 /** Read one membership record (incl. a tombstone — `leaveCursor` set), or undefined if no record /
  *  the key was deleted. The CAS revision is returned alongside so a caller can do its own
  *  read-modify-write; most callers use {@link commitMember}/{@link tombstoneMember} instead. */
-export declare function readMember(kv: KV, channel: string, owner: string): Promise<{
+export declare function readMember(kv: KV, channel: string, owner: string, lifecycleUid: string): Promise<{
     record: MembershipRecord;
     revision: number;
 } | undefined>;
@@ -47,7 +47,7 @@ export declare function commitMember(kv: KV, next: MembershipRecord): Promise<Me
  * generation than what's stored, e.g. the agent already rejoined) is rejected. A no-op if there is
  * no record (already gone) or it is already tombstoned at/below this cursor.
  */
-export declare function tombstoneMember(kv: KV, channel: string, owner: string, leaveCursor: number, writerIdentity: string, expectedGeneration?: number): Promise<MembershipRecord | undefined>;
+export declare function tombstoneMember(kv: KV, channel: string, owner: string, lifecycleUid: string, leaveCursor: number, writerIdentity: string, expectedGeneration?: number): Promise<MembershipRecord | undefined>;
 /**
  * Complete an activation: flip a pending join (generation `expectedGeneration`, `joinCursor` =
  * `expectedJoinCursor`, `activated:false`, open) to `activated:true`. ATOMIC via revision CAS, and
@@ -58,11 +58,11 @@ export declare function tombstoneMember(kv: KV, channel: string, owner: string,
  * reopen the SPEC §7 leave boundary. Idempotent: an already-activated open record at the same generation
  * is returned unchanged.
  */
-export declare function activateMember(kv: KV, channel: string, owner: string, expectedGeneration: number, expectedJoinCursor: number): Promise<MembershipRecord | undefined>;
+export declare function activateMember(kv: KV, channel: string, owner: string, lifecycleUid: string, expectedGeneration: number, expectedJoinCursor: number): Promise<MembershipRecord | undefined>;
 /** Permanently remove a membership record (GC / footprint deletion — revocation deletes the footprint
  *  AFTER invalidating creds). Distinct from {@link tombstoneMember}, which keeps the record so late
  *  durable entries are denied by the cursor; only call this past the retention horizon. */
-export declare function deleteMember(kv: KV, channel: string, owner: string): Promise<void>;
+export declare function deleteMember(kv: KV, channel: string, owner: string, lifecycleUid: string): Promise<void>;
 /**
  * Scan the registry, yielding every live (non-deleted) record matching the filter. `channel` →
  * that channel's members (fan-out's per-channel list); `owner` → that owner's memberships. With no

package/dist/members.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../src/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;oFACoF;AACpF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAM/E;AAED;mEACmE;AACnE,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED;;gGAEgG;AAChG,wBAAsB,UAAU,CAC9B,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAQrE;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5F;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAoBvC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,EAC1B,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAoBvC;AAED;;2FAE2F;AAC3F,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,EAAE,EACN,MAAM,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAc7B;AAED;;;;;;;;;;;;;gEAagE;AAChE,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI3E"}
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../src/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;oFACoF;AACpF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAM/E;AAED;mEACmE;AACnE,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED;;gGAEgG;AAChG,wBAAsB,UAAU,CAC9B,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAQrE;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5F;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAoBvC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,kBAAkB,EAAE,MAAM,EAC1B,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAoBvC;AAED;;2FAE2F;AAC3F,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9G;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,EAAE,EACN,MAAM,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAc7B;AAED;;;;;;;;;;;;;gEAagE;AAChE,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI3E"}