@cotal-ai/core 0.13.1 → 0.13.2

package/dist/identity.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { createUser, fromSeed } from "@nats-io/nkeys";
 /** Generate a fresh user nkey identity locally. The seed is derived here and never
  *  leaves the generating process except as a creds file handed to its own agent. */
@@ -15,13 +16,35 @@ export function newIdentity() {
 export function idFromCreds(creds) {
     return identityFromCreds(creds).id;
 }
+/** The compact USER JWT carried by a creds file — ONE extraction, shared by every reader that
+ *  needs the token rather than the whole envelope. Returns undefined when there is no JWT block;
+ *  callers decide whether that is fatal. */
+export function jwtFromCreds(creds) {
+    return creds.match(/BEGIN NATS USER JWT-----\s*([\s\S]*?)\s*------END NATS USER JWT/)?.[1].trim();
+}
+/** A non-secret GENERATION token for a credential: SHA-256 of its compact USER JWT.
+ *
+ *  The JWT, not the whole creds envelope, on purpose. The JWT is exactly what the broker is
+ *  presented with, so hashing it binds the claims, permissions, and signature of the generation
+ *  being adopted. The envelope additionally carries the nkey SEED, so hashing that would put a
+ *  stable secret-derived token on a control rail and make the value sensitive to envelope
+ *  formatting, without proving anything more about broker authorization. The seed stays bound
+ *  separately: {@link identityFromCreds} rejects a seed whose public key is not the JWT subject.
+ *
+ *  Safe to send on the privileged rail as an EXPECTED-generation token; the credential itself is
+ *  never sent. Ephemeral by contract — it must not be persisted (see the renewal record). */
+export function credsFingerprint(creds) {
+    const jwt = jwtFromCreds(creds);
+    if (!jwt)
+        throw new Error("creds: no NATS user JWT block found - cannot fingerprint");
+    return createHash("sha256").update(jwt).digest("hex");
+}
 /** The decoded (UNVERIFIED) claims of a creds file's user JWT — shared parse for every local
  *  inspector (credential health, renewal scheduling, identity checks). Unverified is correct here:
  *  the broker is the enforcement boundary; local readers only need the claims to schedule and
  *  diagnose. Throws on a structurally-unusable file (no JWT block / undecodable payload). */
 export function credsClaims(creds) {
-    const jwtM = creds.match(/BEGIN NATS USER JWT-----\s*([\s\S]*?)\s*------END NATS USER JWT/);
-    const payload = jwtM?.[1].trim().split(".")[1];
+    const payload = jwtFromCreds(creds)?.split(".")[1];
     if (!payload)
         throw new Error("creds: no NATS user JWT block found");
     try {
@@ -31,6 +54,20 @@ export function credsClaims(creds) {
         throw new Error("creds: undecodable user JWT payload");
     }
 }
+/** Ms until a source-fed cred's RENEWAL point — 75% of its iat→exp lifetime (the cert-manager-style
+ *  renew-early convention: the remaining 25% is the loud-failure window, wide for day-scale standing
+ *  creds). Negative when already past it. A source-fed cred WITHOUT a numeric `exp` is fail-loud: the
+ *  renewal seam exists precisely for bounded creds, so an unbounded one signals a matrix/caller
+ *  mismatch, not a cred to keep silently forever. Shared by the endpoint's `delivery.creds` renewal
+ *  and the membership feed's rw-cred renewal so the 75% convention is defined once. */
+export function credsRenewalDelayMs(creds) {
+    const claims = credsClaims(creds); // throws on a structurally-unusable file (fail-loud)
+    if (typeof claims.exp !== "number")
+        throw new Error("creds source returned a cred without a numeric exp - a standing-renewal endpoint requires bounded creds (mint with a lifetime, or pass a static string instead of a source)");
+    const iatMs = (typeof claims.iat === "number" ? claims.iat : Date.now() / 1000) * 1000;
+    const expMs = claims.exp * 1000;
+    return iatMs + 0.75 * (expMs - iatMs) - Date.now();
+}
 /** The full identity (id + seed) carried by a creds file — what a standing-renewal REMINTER needs:
  *  re-signing a fresh JWT for the file's EXISTING nkey (never a new one) is what lets the renewed
  *  cred pass the endpoint's identity pin, so renewal can never silently swap who a daemon is. Same
@@ -41,8 +78,7 @@ export function identityFromCreds(creds) {
         throw new Error("creds: no user nkey seed block found");
     const seed = seedM[1].trim();
     const id = fromSeed(new TextEncoder().encode(seed)).getPublicKey();
-    const jwtM = creds.match(/BEGIN NATS USER JWT-----\s*([\s\S]*?)\s*------END NATS USER JWT/);
-    const payload = jwtM?.[1].trim().split(".")[1];
+    const payload = jwtFromCreds(creds)?.split(".")[1];
     const sub = payload
         ? JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).sub
         : undefined;

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgE,CAAC;IACvI,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;;6FAU6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgE,CAAC;IACvI,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;uFAKuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,qDAAqD;IACxF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAChC,MAAM,IAAI,KAAK,CAAC,6KAA6K,CAAC,CAAC;IACjM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/membership-feed.d.ts

@@ -7,12 +7,15 @@ export interface MembershipFeedOpts {
      *  `rotation-renewed` ($SYS seed dies at `up`), so its only renewal is a system-account rotation +
      *  broker restart — a new process, never a live reload. */
     observerCreds: string;
-    /** Scoped DATA-account read/write creds (conn B — members read + feed write), or a SOURCE that
-     *  re-reads them (D5 slice 5 class 2: the manager re-signs the creds file for the SAME nkey; the
-     *  getter is re-evaluated per (re)connect attempt, so the broker's expiry-close renews the
-     *  connection from the refreshed file). A read that swaps the nkey fails loud — the feed's identity
-     *  (inbox scope + self-presence check) is pinned to the first read. */
-    rwCreds: string | (() => string);
+    /** Scoped DATA-account read/write creds (conn B — members read + feed write): a literal string, or
+     *  a SOURCE (D5 slice 5 class 2) that reads them through the {@link SecretStore} seam — the manager
+     *  re-signs the SAME nkey into the store and the feed adopts it. May be async (a hosted `store.get`)
+     *  or sync (a local FS read / literal). A source-fed cred is renewed on a 75% timer that PROVES each
+     *  candidate on a disposable preflight before conn B ever presents it; conn B's authenticator only
+     *  ever presents the last BROKER-PROVEN generation, so an incidental reconnect can never carry an
+     *  unproven cred. A read that swaps the nkey fails loud — the feed's identity (inbox scope +
+     *  self-presence check) is pinned to the first read. */
+    rwCreds: string | (() => string | Promise<string>);
     /** Safety reconcile interval (ms) — primary signal (no SUB/UNSUB event exists). Default 15000. */
     intervalMs?: number;
     /** Connect/disconnect-event → re-poll debounce (ms); coalesces connect storms. Default 400. */
@@ -29,10 +32,15 @@ export interface MembershipFeedOpts {
 export interface MembershipFeedHandle {
     /** Force an immediate reconcile (also used by tests). Never throws — errors are logged. */
     poll(): Promise<void>;
-    /** Explicitly adopt a re-signed rw creds file on conn B (D5 class-2 renewal): validated re-read
-     *  (pinned nkey) + forced reconnect, returning the adopted JWT window as proof. THROWS when the
-     *  re-read fails (missing/swapped file) — adoption must never be assumed. */
-    reloadRwCreds(): Promise<{
+    /** Explicitly adopt a re-signed rw cred on conn B (D5 class-2 renewal): fetch from the source
+     *  (deadline-bounded), validate the identity pin, optional fingerprint match against the renewal
+     *  owner's `expected` generation, a DISPOSABLE PREFLIGHT proving the broker accepts the bytes, then
+     *  commit the proven cache and best-effort reconnect — returning the BROKER-ACCEPTED generation's
+     *  window (the resident conn-B swap is best-effort, not witnessed). Runs under the same single-flight
+     *  as the 75% timer, so the two can never interleave. THROWS when the source fetch fails
+     *  (missing/swapped cred), the fingerprint does not match `expected`, the broker refuses the
+     *  preflight, or the deadline elapses. Symmetric with the endpoint's {@link CotalEndpoint.reloadCreds}. */
+    reloadRwCreds(expected?: string): Promise<{
         identity: string;
         iat?: number;
         exp?: number;

package/dist/membership-feed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership-feed.d.ts","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,wGAAwG;IACxG,SAAS,EAAE,MAAM,CAAC;IAClB;;+DAE2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;2EAIuE;IACvE,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACjC,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;iFAE6E;IAC7E,aAAa,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAKD,sFAAsF;AACtF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA4OjG"}
+{"version":3,"file":"membership-feed.d.ts","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,wGAAwG;IACxG,SAAS,EAAE,MAAM,CAAC;IAClB;;+DAE2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;4DAOwD;IACxD,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;;;+GAO2G;IAC3G,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAgCD,sFAAsF;AACtF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsVjG"}

package/dist/membership-feed.js

@@ -31,8 +31,32 @@ import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { Kvm } from "@nats-io/kv";
 import { membershipBucket, membershipKey, MEMBERSHIP_FEED_KEY, MEMBERSHIP_INBOX_PREFIX, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, channelFromChatSubscription, principalFromConnz, } from "./subjects.js";
 import { openMembersRegistry, listMembers } from "./members.js";
-import { credsClaims, idFromCreds } from "./identity.js";
+import { credsClaims, credsFingerprint, credsRenewalDelayMs, idFromCreds } from "./identity.js";
 const enc = (s) => new TextEncoder().encode(s);
+/** The disposable-preflight connect bound for the rw-cred adoption proof — mirrors the endpoint's: a
+ *  rogue/unreachable candidate must resolve fast, well under the manager's delivery-admin request bound. */
+const MEMBERSHIP_PREFLIGHT_MS = 4_000;
+/** The daemon-side deadline for the WHOLE rw prove-then-adopt transaction (source fetch + preflight +
+ *  commit), kept strictly BELOW the manager's delivery-admin request bound (15s) so a slow/hung hosted
+ *  store returns a structured component failure rather than an ambiguous client timeout, and a late
+ *  fetch can never commit after the caller gave up. Mirrors {@link CotalEndpoint}'s RELOAD_DEADLINE_MS. */
+const MEMBERSHIP_RELOAD_DEADLINE_MS = 12_000;
+/** How soon a FAILED 75% rw renewal retries (the old cred stays live to its expiry meanwhile). */
+const MEMBERSHIP_CREDS_RETRY_MS = 60_000;
+/** Prove the broker ACCEPTS these creds on a throwaway connection — the D5 class-2 adoption
+ *  proof-of-record for conn B. `reconnect:false` + `maxReconnectAttempts:0` so a refused cred
+ *  REJECTS fast instead of entering a retry loop; a genuine accept returns true. Presents exactly
+ *  the candidate, so the proof is unambiguous. */
+async function brokerAcceptsCreds(servers, creds, timeoutMs) {
+    try {
+        const probe = await connect({ servers, timeout: timeoutMs, reconnect: false, maxReconnectAttempts: 0, authenticator: credsAuthenticator(enc(creds)) });
+        await probe.close();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 const MAX_PAGES = 64; // fan-out pagination guard (64 × 1024 = 65k conns/server before a loud under-report)
 /** Connect, wire the triggers + safety poll, and run an immediate first reconcile. */
 export async function startMembershipFeed(opts) {
@@ -52,22 +76,35 @@ export async function startMembershipFeed(opts) {
     });
     connA.closed().then((err) => { if (err)
         log(`conn A (system) closed: ${err.message}`); });
-    const readRw = typeof opts.rwCreds === "function" ? opts.rwCreds : () => opts.rwCreds;
-    const rwSelfId = idFromCreds(readRw()); // conn B's own nkey — the data-account self-presence check below
-    // Pin every re-read to the first read's nkey: a renewal (manager re-signs the file) keeps the
-    // identity; a swapped file would silently break the inbox scope + self-presence check, so it throws
-    // inside the authenticator instead (the connect attempt fails loud and retries).
-    const rwCredsPinned = () => {
-        const creds = readRw();
+    // The rw source: async-capable (a hosted `store.get`) or sync (a local FS read / literal). Read ONCE
+    // up front to pin conn B's identity and seed the proven cache; thereafter the source is re-read only
+    // by a preflight-proven adoption (the 75% timer or the explicit reload), never inside the sync
+    // authenticator (nats-core's Authenticator is synchronous and a `store.get` cannot live there).
+    const rwIsSource = typeof opts.rwCreds === "function";
+    const readRw = rwIsSource ? opts.rwCreds : () => opts.rwCreds;
+    const initialRw = await Promise.resolve(readRw());
+    const rwSelfId = idFromCreds(initialRw); // conn B's own nkey — the data-account self-presence check below
+    // Pin every candidate to the first read's nkey: a renewal (manager re-signs the cred) keeps the
+    // identity; a swapped cred would silently break the inbox scope + self-presence check, so it throws
+    // (the adoption fails structured and nothing is committed).
+    const pinRwIdentity = (creds) => {
         const id = idFromCreds(creds);
         if (id !== rwSelfId)
             throw new Error(`membership rw creds re-read returned identity ${id}, expected ${rwSelfId} - a renewal may not swap the feed's nkey`);
         return creds;
     };
+    // The LAST BROKER-PROVEN rw cred — the ONLY value conn B's synchronous authenticator ever presents.
+    // Seeded from the initial fetch (that first connect is its own proof, like the endpoint's initial
+    // connect); advanced ONLY by a preflight-proven adoption (the 75% timer or an explicit reload). So an
+    // incidental reconnect (broker expiry-close, a network blip) can never present an unproven or
+    // broker-refused generation and strand conn B — closing the membership half of the D5 blocker.
+    let currentRwCreds = initialRw;
     const connB = await connect({
         servers: opts.servers,
-        // Re-wrapped per (re)connect attempt so each attempt signs with the freshest (pinned) file read.
-        authenticator: (nonce) => credsAuthenticator(enc(rwCredsPinned()))(nonce),
+        // Synchronous per (re)connect attempt: presents the last BROKER-PROVEN cred, never a fresh
+        // un-preflighted source read. The 75% timer / explicit reload advance `currentRwCreds` only AFTER a
+        // disposable preflight proves the broker accepts the candidate.
+        authenticator: (nonce) => credsAuthenticator(enc(currentRwCreds))(nonce),
         name: "cotal-membership-rw",
         // The rw cred's sub.allow is `_INBOX_<id>.>`, so the connection's inbox prefix MUST match it — else
         // every KV reply / ordered-consumer delivery (kv.get/keys/watch) lands on a subject it can't subscribe.
@@ -79,6 +116,100 @@ export async function startMembershipFeed(opts) {
     const kvm = new Kvm(connB);
     const feedKv = await kvm.open(membershipBucket(space));
     const membersKv = await openMembersRegistry(connB, space);
+    // ---- conn B standing renewal (D5 class-2): the 75% timer + the explicit reload, both proven ----
+    // Mirrors the endpoint's delivery.creds renewal (adoptFreshCreds / renewCredsOnTimer / runCredsTxn).
+    // The feed previously had NO credential-refresh timer — only the poll loop and a per-reconnect source
+    // re-read; that re-read was the sole self-heal and it presented UNPROVEN bytes. Replaced by a proven
+    // cache advanced under a single-flight transaction, plus this timer as the active self-heal.
+    let rwStopped = false;
+    let rwTimer;
+    const armRwRefresh = (delayMs) => {
+        if (rwStopped)
+            return;
+        if (rwTimer)
+            clearTimeout(rwTimer);
+        rwTimer = setTimeout(() => void renewRwOnTimer(), Math.max(1_000, delayMs)); // 1s floor: second-scale test TTLs
+        rwTimer.unref?.();
+    };
+    // Single-flight: serialize the 75% timer and the explicit reload over the WHOLE prove-then-adopt
+    // transaction (fetch → preflight → commit), so a timer tick can never overwrite the cache with C while
+    // an explicit reload is proving B and then reporting B adopted. Runs `fn` after any in-flight txn
+    // settles, whatever its outcome; the internal chain never rejects.
+    let rwTxn = Promise.resolve();
+    const runRwTxn = (fn) => {
+        const next = rwTxn.then(fn, fn);
+        rwTxn = next.then(() => undefined, () => undefined);
+        return next;
+    };
+    // Race a slow/hung source fetch or preflight against the transaction deadline; the underlying promise
+    // is not cancellable, so a late commit is also fenced by re-checking the deadline before mutating the
+    // cache (mirrors {@link CotalEndpoint.withDeadline}).
+    const withRwDeadline = async (p, ms, msg) => {
+        let t;
+        const timeout = new Promise((_, rej) => { t = setTimeout(() => rej(new Error(msg)), Math.max(1, ms)); });
+        try {
+            return await Promise.race([p, timeout]);
+        }
+        finally {
+            if (t)
+                clearTimeout(t);
+        }
+    };
+    // The one PROVE-then-adopt transaction (run under runRwTxn), shared by the 75% timer and the explicit
+    // reload. Fetch (deadline-bounded) → identity-pin → optional expected-generation match → disposable
+    // preflight → late-commit fence → advance the proven cache → arm the next 75% timer. `currentRwCreds`
+    // is written ONLY after the preflight proves broker acceptance, so a rejected candidate leaves conn B
+    // on the last-proven cred. THROWS (structured) on any failure.
+    const adoptRwCreds = async (a) => {
+        // Fence BEFORE any source I/O: a reload queued behind a hung-store timer tick that already burned the
+        // budget fails structured now — it never re-reads the source, preflights, or commits (the absolute
+        // deadline was captured at the CALLER's entry, so the queue wait counts against it).
+        if (Date.now() > a.deadline)
+            throw new Error("reloadRwCreds: the request deadline elapsed while queued behind another credential transaction; nothing adopted");
+        const candidate = pinRwIdentity(await withRwDeadline(Promise.resolve(readRw()), a.deadline - Date.now(), "reloadRwCreds: the rw creds source did not return before the daemon deadline; nothing adopted"));
+        // Non-material message ON PURPOSE: this text flows to the manager's persisted
+        // `RenewalRecord.adoption.error`, so neither the observed nor the expected digest may appear.
+        if (a.expected !== undefined && credsFingerprint(candidate) !== a.expected)
+            throw new Error("reloadRwCreds: re-read credential generation did not match the expected re-signed generation; nothing adopted");
+        // Compute the bounded-window renewal delay BEFORE any commit or preflight: credsRenewalDelayMs throws
+        // on a cred lacking a numeric `exp`, and that throw must NOT leave `currentRwCreds` flipped to a
+        // candidate the authenticator would then present on the next reconnect (a post-preflight validation
+        // failure must be a true no-op on the cache).
+        const delay = credsRenewalDelayMs(candidate);
+        // An UNCHANGED generation past its own renewal point is a MISSED remint (the renewal owner has not
+        // re-signed yet), not a candidate to adopt. Adopting it would recommit the same cred, floor the next
+        // timer to 1s (delay <= 0), and reconnect EVERY second for the JWT's remaining 25% of life. Fail it
+        // like a renewal error so `renewRwOnTimer` retries at 60s with NO resident reconnect. The explicit
+        // reload's `expected` already rejects a stale read; this covers the timer path (no expectation sent).
+        if (candidate === currentRwCreds && delay <= 0)
+            throw new Error("reloadRwCreds: the rw source still holds the previous generation past its renewal point (the renewal owner has not re-signed it - run `cotal doctor auth --fix` or restart the manager); nothing adopted");
+        if (!(await brokerAcceptsCreds(opts.servers, candidate, Math.max(500, Math.min(MEMBERSHIP_PREFLIGHT_MS, a.deadline - Date.now())))))
+            throw new Error("reloadRwCreds: the broker did not accept the re-signed rw credential; nothing adopted");
+        if (Date.now() > a.deadline)
+            throw new Error("reloadRwCreds: the proof exceeded the daemon deadline; nothing adopted"); // fence a late commit
+        currentRwCreds = candidate; // commit ONLY after identity pin + fingerprint + delay/claims validation + preflight
+        armRwRefresh(delay);
+        return credsClaims(candidate);
+    };
+    // The 75%-of-lifetime renewal tick: prove + adopt + swap conn B onto the fresh cred. conn B is NOT the
+    // delivery-admin rail (that reply rides the delivery endpoint's connection), so the reconnect is inline
+    // and a failure just logs + retries while the last-proven cred stays live to its expiry.
+    async function renewRwOnTimer() {
+        const deadline = Date.now() + MEMBERSHIP_RELOAD_DEADLINE_MS; // captured before the enqueue, like the reload
+        try {
+            await runRwTxn(() => adoptRwCreds({ deadline }));
+            await connB.reconnect().catch(() => { });
+        }
+        catch (e) {
+            log(`rw creds refresh failed (graph feed writer; delivery unaffected): ${e.message} - retrying; conn B dies at the current JWT's expiry if renewal keeps failing`);
+            armRwRefresh(MEMBERSHIP_CREDS_RETRY_MS);
+        }
+    }
+    // Arm the FIRST 75% timer, but ONLY for a source-fed cred — a literal `rwCreds` string has no renewal
+    // seam (nothing re-reads it). A source-fed cred must be bounded (credsRenewalDelayMs is fail-loud on a
+    // missing `exp`), which surfaces a misconfigured source at startup rather than silently never renewing.
+    if (rwIsSource)
+        armRwRefresh(credsRenewalDelayMs(currentRwCreds));
     let stopped = false;
     let polling = false;
     let rerun = false; // a trigger fired mid-poll → run once more after
@@ -276,18 +407,26 @@ export async function startMembershipFeed(opts) {
     await poll(); // first reconcile now
     return {
         poll,
-        async reloadRwCreds() {
-            // Explicit class-2 adoption for conn B (D5 slice 5): validate the re-read (the pinned getter
-            // throws on a swapped nkey or a missing file) and force a reconnect so the fresh cred is on
-            // the wire NOW — never waiting for the broker's expiry-close. The observer conn (A) is
-            // rotation-renewed and deliberately not reloadable.
-            const { exp, iat } = credsClaims(rwCredsPinned());
-            await connB.reconnect().catch(() => { }); // already-reconnecting is a no-op; its loop re-reads the getter
+        async reloadRwCreds(expected) {
+            // Explicit class-2 adoption for conn B (D5 slice 5). Capture the ABSOLUTE deadline at ENTRY,
+            // before the single-flight enqueue, so a reload queued behind a hung-store 75% tick is bounded by
+            // the SAME window (the queue wait counts) and can never commit/swap after the renewal owner's
+            // request bound has already elapsed. The prove-then-adopt transaction runs under runRwTxn so it
+            // cannot interleave with the timer; the observer conn (A) is rotation-renewed and not reloadable.
+            const deadline = Date.now() + MEMBERSHIP_RELOAD_DEADLINE_MS;
+            const { iat, exp } = await runRwTxn(() => adoptRwCreds({ expected, deadline }));
+            // Best-effort resident swap: the preflight was the proof, and conn B is not the reply rail, so the
+            // reconnect is inline (no strand risk) and a transient failure self-heals — the 75% timer and the
+            // broker's expiry-close both present the now-proven `currentRwCreds`.
+            await connB.reconnect().catch(() => { });
             return { identity: rwSelfId, iat, exp };
         },
         async stop() {
             stopped = true;
+            rwStopped = true;
             clearInterval(timer);
+            if (rwTimer)
+                clearTimeout(rwTimer);
             if (debounce)
                 clearTimeout(debounce);
             try {

package/dist/membership-feed.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership-feed.js","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA0CzD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,qFAAqF;AAE3G,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAElC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,uBAAuB,EAAE,2DAA2D;QACjG,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAiB,CAAC;IAChG,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iEAAiE;IACzG,8FAA8F;IAC9F,oGAAoG;IACpG,iFAAiF;IACjF,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,cAAc,QAAQ,2CAA2C,CAAC,CAAC;QAC3J,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iGAAiG;QACjG,aAAa,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAClF,IAAI,EAAE,qBAAqB;QAC3B,oGAAoG;QACpG,wGAAwG;QACxG,WAAW,EAAE,UAAU,QAAQ,EAAE;QACjC,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAO,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAO,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,iDAAiD;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,aAAa,GAAG,KAAK,CAAC,CAAC,4EAA4E;IAEvG,oGAAoG;IACpG,KAAK,UAAU,UAAU,CAAC,MAAc;QACtC,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,GAAG,uBAAuB,IAAI,MAAM,EAAE,EAAE,CAAC;YACvD,MAAM,GAAG,GAAiB,EAAE,CAAC;YAC7B,IAAI,MAAiD,CAAC;YACtD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC;oBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;gBACjC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACrB,IAAI,GAAG;wBAAE,OAAO;oBAChB,IAAI,CAAC;wBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;oBAC1E,IAAI,MAAM;wBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;oBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;yDAIqD;IACrD,KAAK,UAAU,aAAa;QAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,oDAAoD;QAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,6CAA6C;QACpF,IAAI,QAAQ,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAC;QAC1D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC;oBAAE,GAAG,CAAC,6GAA6G,CAAC,CAAC;gBACnI,MAAM;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,GAAG,CAAC;gBACrD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC,eAAe,KAAK,QAAQ;wBAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,4CAA4C;oBACjG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5C,gGAAgG;gBAChG,6FAA6F;gBAC7F,2FAA2F;gBAC3F,mGAAmG;gBACnG,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK;oBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YACvD,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;gBACxB,GAAG,CAAC,gCAAgC,SAAS,mBAAmB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACzI,CAAC;QACD,mGAAmG;QACnG,qGAAqG;QACrG,uGAAuG;QACvG,qGAAqG;QACrG,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,+EAA+E;QAC/E,IAAI,QAAQ,IAAI,SAAS,IAAI,CAAC,QAAQ;YACpC,GAAG,CAAC,8FAA8F,CAAC,CAAC;QACtG,uGAAuG;QACvG,sGAAsG;QACtG,yGAAyG;QACzG,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,aAAa,GAAG,IAAI,CAAC;YACrB,GAAG,CAAC,kCAAkC,WAAW,CAAC,IAAI,qKAAqK,CAAC,CAAC;QAC/N,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAED;2FACuF;IACvF,KAAK,UAAU,kBAAkB;QAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBAAE,SAAS;YAClE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjD,qGAAqG;QACrG,sGAAsG;QACtG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,sGAAsG;QACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,uGAAuG;QACvG,wGAAwG;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,mBAAmB;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAChE,IAAI,CAAC;oBAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAqB,EAAE,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEzD,oGAAoG;QACpG,mGAAmG;QACnG,8DAA8D;QAC9D,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,OAAO,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC,CAAC,yDAAyD;QAChG,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC;gBACd,MAAM,SAAS,EAAE,CAAC;YACpB,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,iEAAkE,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,kGAAkG;IAClG,IAAI,QAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE1G,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,EAAE,CAAC,CAAC,sBAAsB;IAEpC,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,aAAa;YACjB,6FAA6F;YAC7F,4FAA4F;YAC5F,uFAAuF;YACvF,oDAAoD;YACpD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,gEAAgE;YACzG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAAC,aAAa,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACvF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;;;0DAkB0D;AAC1D,SAAS,OAAO,CAAC,KAAa,EAAE,IAA8B,EAAE,CAAkB;IAChF,MAAM,IAAI,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,sEAAsE;IACxG,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,6EAA6E;IAC9F,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,6DAA6D;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,CAAoB,EAAE,CAAoB;IAChE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,KAAK,CAAC,CAAW,EAAE,CAAW;IACrC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"membership-feed.js","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAkDhG,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEvD;4GAC4G;AAC5G,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC;;;2GAG2G;AAC3G,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAE7C,kGAAkG;AAClG,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;kDAGkD;AAClD,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa,EAAE,SAAiB;IACjF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACvJ,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,qFAAqF;AAE3G,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAElC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,uBAAuB,EAAE,2DAA2D;QACjG,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,qGAAqG;IACrG,qGAAqG;IACrG,+FAA+F;IAC/F,gGAAgG;IAChG,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,OAA0C,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAiB,CAAC;IAC5G,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,iEAAiE;IAC1G,gGAAgG;IAChG,oGAAoG;IACpG,4DAA4D;IAC5D,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;QAC9C,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,cAAc,QAAQ,2CAA2C,CAAC,CAAC;QAC3J,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,8FAA8F;IAC9F,+FAA+F;IAC/F,IAAI,cAAc,GAAG,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,2FAA2F;QAC3F,oGAAoG;QACpG,gEAAgE;QAChE,aAAa,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,IAAI,EAAE,qBAAqB;QAC3B,oGAAoG;QACpG,wGAAwG;QACxG,WAAW,EAAE,UAAU,QAAQ,EAAE;QACjC,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAO,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAO,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9D,mGAAmG;IACnG,qGAAqG;IACrG,sGAAsG;IACtG,qGAAqG;IACrG,6FAA6F;IAC7F,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAkD,CAAC;IACvD,MAAM,YAAY,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC7C,IAAI,SAAS;YAAE,OAAO;QACtB,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,cAAc,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mCAAmC;QAChH,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,iGAAiG;IACjG,uGAAuG;IACvG,kGAAkG;IAClG,mEAAmE;IACnE,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,CAAK,EAAoB,EAAc,EAAE;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,sGAAsG;IACtG,sGAAsG;IACtG,sDAAsD;IACtD,MAAM,cAAc,GAAG,KAAK,EAAM,CAAa,EAAE,EAAU,EAAE,GAAW,EAAc,EAAE;QACtF,IAAI,CAA4C,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;gBACxC,CAAC;YAAC,IAAI,CAAC;gBAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC;IACF,sGAAsG;IACtG,oGAAoG;IACpG,sGAAsG;IACtG,sGAAsG;IACtG,+DAA+D;IAC/D,MAAM,YAAY,GAAG,KAAK,EAAE,CAA0C,EAA2C,EAAE;QACjH,sGAAsG;QACtG,mGAAmG;QACnG,qFAAqF;QACrF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ;YACzB,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;QACrI,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,+FAA+F,CAAC,CAAC,CAAC;QAC3M,8EAA8E;QAC9E,8FAA8F;QAC9F,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ;YACxE,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC,CAAC;QACnI,sGAAsG;QACtG,iGAAiG;QACjG,oGAAoG;QACpG,8CAA8C;QAC9C,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7C,mGAAmG;QACnG,qGAAqG;QACrG,oGAAoG;QACpG,mGAAmG;QACnG,sGAAsG;QACtG,IAAI,SAAS,KAAK,cAAc,IAAI,KAAK,IAAI,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,0MAA0M,CAAC,CAAC;QAC9N,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAC3G,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ;YACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC,CAAC,sBAAsB;QACnH,cAAc,GAAG,SAAS,CAAC,CAAC,qFAAqF;QACjH,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,uGAAuG;IACvG,wGAAwG;IACxG,yFAAyF;IACzF,KAAK,UAAU,cAAc;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC,CAAC,+CAA+C;QAC5G,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,qEAAsE,CAAW,CAAC,OAAO,+EAA+E,CAAC,CAAC;YAC9K,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,sGAAsG;IACtG,uGAAuG;IACvG,wGAAwG;IACxG,IAAI,UAAU;QAAE,YAAY,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC;IAElE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,iDAAiD;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,aAAa,GAAG,KAAK,CAAC,CAAC,4EAA4E;IAEvG,oGAAoG;IACpG,KAAK,UAAU,UAAU,CAAC,MAAc;QACtC,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,GAAG,uBAAuB,IAAI,MAAM,EAAE,EAAE,CAAC;YACvD,MAAM,GAAG,GAAiB,EAAE,CAAC;YAC7B,IAAI,MAAiD,CAAC;YACtD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC;oBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;gBACjC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACrB,IAAI,GAAG;wBAAE,OAAO;oBAChB,IAAI,CAAC;wBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;oBAC1E,IAAI,MAAM;wBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;oBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;yDAIqD;IACrD,KAAK,UAAU,aAAa;QAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,oDAAoD;QAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,6CAA6C;QACpF,IAAI,QAAQ,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAC;QAC1D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC;oBAAE,GAAG,CAAC,6GAA6G,CAAC,CAAC;gBACnI,MAAM;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,GAAG,CAAC;gBACrD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC,eAAe,KAAK,QAAQ;wBAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,4CAA4C;oBACjG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5C,gGAAgG;gBAChG,6FAA6F;gBAC7F,2FAA2F;gBAC3F,mGAAmG;gBACnG,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK;oBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YACvD,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;gBACxB,GAAG,CAAC,gCAAgC,SAAS,mBAAmB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACzI,CAAC;QACD,mGAAmG;QACnG,qGAAqG;QACrG,uGAAuG;QACvG,qGAAqG;QACrG,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,+EAA+E;QAC/E,IAAI,QAAQ,IAAI,SAAS,IAAI,CAAC,QAAQ;YACpC,GAAG,CAAC,8FAA8F,CAAC,CAAC;QACtG,uGAAuG;QACvG,sGAAsG;QACtG,yGAAyG;QACzG,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,aAAa,GAAG,IAAI,CAAC;YACrB,GAAG,CAAC,kCAAkC,WAAW,CAAC,IAAI,qKAAqK,CAAC,CAAC;QAC/N,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAED;2FACuF;IACvF,KAAK,UAAU,kBAAkB;QAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBAAE,SAAS;YAClE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjD,qGAAqG;QACrG,sGAAsG;QACtG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,sGAAsG;QACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,uGAAuG;QACvG,wGAAwG;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,mBAAmB;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAChE,IAAI,CAAC;oBAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAqB,EAAE,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEzD,oGAAoG;QACpG,mGAAmG;QACnG,8DAA8D;QAC9D,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,OAAO,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC,CAAC,yDAAyD;QAChG,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC;gBACd,MAAM,SAAS,EAAE,CAAC;YACpB,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,iEAAkE,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,kGAAkG;IAClG,IAAI,QAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE1G,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,EAAE,CAAC,CAAC,sBAAsB;IAEpC,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,aAAa,CAAC,QAAiB;YACnC,6FAA6F;YAC7F,kGAAkG;YAClG,8FAA8F;YAC9F,gGAAgG;YAChG,kGAAkG;YAClG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;YAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChF,mGAAmG;YACnG,kGAAkG;YAClG,sEAAsE;YACtE,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,SAAS,GAAG,IAAI,CAAC;YACjB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,OAAO;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAAC,aAAa,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACvF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;;;0DAkB0D;AAC1D,SAAS,OAAO,CAAC,KAAa,EAAE,IAA8B,EAAE,CAAkB;IAChF,MAAM,IAAI,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,sEAAsE;IACxG,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,6EAA6E;IAC9F,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,6DAA6D;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,CAAoB,EAAE,CAAoB;IAChE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,KAAK,CAAC,CAAW,EAAE,CAAW;IACrC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/provision.js

@@ -45,7 +45,7 @@ export const CREDENTIAL_LIFETIMES = {
     admin: { class: "static-operator-managed", note: "out-of-band elevated dashboard/audit credential from cotal mint" },
     supervisor: { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "manager", note: "manager's always-on endpoint; the manager holds the DATA seed and self-remints via the endpoint creds source (D5 slice 5 class 1)" },
     delivery: { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "manager", note: "server-side Plane-3 daemon; seed-less - the manager re-signs .cotal/delivery.creds for the SAME nkey, requests delivery-admin reloadCreds for explicit adoption, and the endpoint source re-read is only a backstop (D5 slice 5 class 2)" },
-    "membership-rw": { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "manager", note: "membership feed writer; seed-less - the manager re-signs .cotal/membership-rw.creds for the SAME nkey, delivery-admin reloadCreds reconnects the rw feed explicitly, and source re-read is only a backstop (D5 slice 5 class 2)" },
+    "membership-rw": { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "manager", note: "membership feed writer; seed-less - the manager re-signs the membership-rw.creds store key for the SAME nkey, the feed adopts it on a 75% preflight-proven renewal timer (its active self-heal), and delivery-admin reloadCreds is the explicit adoption on top (D5 slice 5 class 2)" },
     provisioner: { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "setup/spawn provisioning window only" },
     deprovisioner: { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "target-pinned teardown window only" },
     "retirement-requester": { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "one despawn's retirement request window; request+reply only" },