@cotal-ai/core 0.13.1 → 0.14.0

package/dist/identity.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { createUser, fromSeed } from "@nats-io/nkeys";
 /** Generate a fresh user nkey identity locally. The seed is derived here and never
  *  leaves the generating process except as a creds file handed to its own agent. */
@@ -15,13 +16,35 @@ export function newIdentity() {
 export function idFromCreds(creds) {
     return identityFromCreds(creds).id;
 }
+/** The compact USER JWT carried by a creds file — ONE extraction, shared by every reader that
+ *  needs the token rather than the whole envelope. Returns undefined when there is no JWT block;
+ *  callers decide whether that is fatal. */
+export function jwtFromCreds(creds) {
+    return creds.match(/BEGIN NATS USER JWT-----\s*([\s\S]*?)\s*------END NATS USER JWT/)?.[1].trim();
+}
+/** A non-secret GENERATION token for a credential: SHA-256 of its compact USER JWT.
+ *
+ *  The JWT, not the whole creds envelope, on purpose. The JWT is exactly what the broker is
+ *  presented with, so hashing it binds the claims, permissions, and signature of the generation
+ *  being adopted. The envelope additionally carries the nkey SEED, so hashing that would put a
+ *  stable secret-derived token on a control rail and make the value sensitive to envelope
+ *  formatting, without proving anything more about broker authorization. The seed stays bound
+ *  separately: {@link identityFromCreds} rejects a seed whose public key is not the JWT subject.
+ *
+ *  Safe to send on the privileged rail as an EXPECTED-generation token; the credential itself is
+ *  never sent. Ephemeral by contract — it must not be persisted (see the renewal record). */
+export function credsFingerprint(creds) {
+    const jwt = jwtFromCreds(creds);
+    if (!jwt)
+        throw new Error("creds: no NATS user JWT block found - cannot fingerprint");
+    return createHash("sha256").update(jwt).digest("hex");
+}
 /** The decoded (UNVERIFIED) claims of a creds file's user JWT — shared parse for every local
  *  inspector (credential health, renewal scheduling, identity checks). Unverified is correct here:
  *  the broker is the enforcement boundary; local readers only need the claims to schedule and
  *  diagnose. Throws on a structurally-unusable file (no JWT block / undecodable payload). */
 export function credsClaims(creds) {
-    const jwtM = creds.match(/BEGIN NATS USER JWT-----\s*([\s\S]*?)\s*------END NATS USER JWT/);
-    const payload = jwtM?.[1].trim().split(".")[1];
+    const payload = jwtFromCreds(creds)?.split(".")[1];
     if (!payload)
         throw new Error("creds: no NATS user JWT block found");
     try {
@@ -31,6 +54,20 @@ export function credsClaims(creds) {
         throw new Error("creds: undecodable user JWT payload");
     }
 }
+/** Ms until a source-fed cred's RENEWAL point — 75% of its iat→exp lifetime (the cert-manager-style
+ *  renew-early convention: the remaining 25% is the loud-failure window, wide for day-scale standing
+ *  creds). Negative when already past it. A source-fed cred WITHOUT a numeric `exp` is fail-loud: the
+ *  renewal seam exists precisely for bounded creds, so an unbounded one signals a matrix/caller
+ *  mismatch, not a cred to keep silently forever. Shared by the endpoint's `delivery.creds` renewal
+ *  and the membership feed's rw-cred renewal so the 75% convention is defined once. */
+export function credsRenewalDelayMs(creds) {
+    const claims = credsClaims(creds); // throws on a structurally-unusable file (fail-loud)
+    if (typeof claims.exp !== "number")
+        throw new Error("creds source returned a cred without a numeric exp - a standing-renewal endpoint requires bounded creds (mint with a lifetime, or pass a static string instead of a source)");
+    const iatMs = (typeof claims.iat === "number" ? claims.iat : Date.now() / 1000) * 1000;
+    const expMs = claims.exp * 1000;
+    return iatMs + 0.75 * (expMs - iatMs) - Date.now();
+}
 /** The full identity (id + seed) carried by a creds file — what a standing-renewal REMINTER needs:
  *  re-signing a fresh JWT for the file's EXISTING nkey (never a new one) is what lets the renewed
  *  cred pass the endpoint's identity pin, so renewal can never silently swap who a daemon is. Same
@@ -41,8 +78,7 @@ export function identityFromCreds(creds) {
         throw new Error("creds: no user nkey seed block found");
     const seed = seedM[1].trim();
     const id = fromSeed(new TextEncoder().encode(seed)).getPublicKey();
-    const jwtM = creds.match(/BEGIN NATS USER JWT-----\s*([\s\S]*?)\s*------END NATS USER JWT/);
-    const payload = jwtM?.[1].trim().split(".")[1];
+    const payload = jwtFromCreds(creds)?.split(".")[1];
     const sub = payload
         ? JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).sub
         : undefined;

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgE,CAAC;IACvI,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;;6FAU6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8E,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;uFAKuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,qDAAqD;IACxF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAChC,MAAM,IAAI,KAAK,CAAC,6KAA6K,CAAC,CAAC;IACjM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/membership-feed.d.ts

@@ -7,12 +7,15 @@ export interface MembershipFeedOpts {
      *  `rotation-renewed` ($SYS seed dies at `up`), so its only renewal is a system-account rotation +
      *  broker restart — a new process, never a live reload. */
     observerCreds: string;
-    /** Scoped DATA-account read/write creds (conn B — members read + feed write), or a SOURCE that
-     *  re-reads them (D5 slice 5 class 2: the manager re-signs the creds file for the SAME nkey; the
-     *  getter is re-evaluated per (re)connect attempt, so the broker's expiry-close renews the
-     *  connection from the refreshed file). A read that swaps the nkey fails loud — the feed's identity
-     *  (inbox scope + self-presence check) is pinned to the first read. */
-    rwCreds: string | (() => string);
+    /** Scoped DATA-account read/write creds (conn B — members read + feed write): a literal string, or
+     *  a SOURCE (D5 slice 5 class 2) that reads them through the {@link SecretStore} seam — the manager
+     *  re-signs the SAME nkey into the store and the feed adopts it. May be async (a hosted `store.get`)
+     *  or sync (a local FS read / literal). A source-fed cred is renewed on a 75% timer that PROVES each
+     *  candidate on a disposable preflight before conn B ever presents it; conn B's authenticator only
+     *  ever presents the last BROKER-PROVEN generation, so an incidental reconnect can never carry an
+     *  unproven cred. A read that swaps the nkey fails loud — the feed's identity (inbox scope +
+     *  self-presence check) is pinned to the first read. */
+    rwCreds: string | (() => string | Promise<string>);
     /** Safety reconcile interval (ms) — primary signal (no SUB/UNSUB event exists). Default 15000. */
     intervalMs?: number;
     /** Connect/disconnect-event → re-poll debounce (ms); coalesces connect storms. Default 400. */
@@ -29,10 +32,15 @@ export interface MembershipFeedOpts {
 export interface MembershipFeedHandle {
     /** Force an immediate reconcile (also used by tests). Never throws — errors are logged. */
     poll(): Promise<void>;
-    /** Explicitly adopt a re-signed rw creds file on conn B (D5 class-2 renewal): validated re-read
-     *  (pinned nkey) + forced reconnect, returning the adopted JWT window as proof. THROWS when the
-     *  re-read fails (missing/swapped file) — adoption must never be assumed. */
-    reloadRwCreds(): Promise<{
+    /** Explicitly adopt a re-signed rw cred on conn B (D5 class-2 renewal): fetch from the source
+     *  (deadline-bounded), validate the identity pin, optional fingerprint match against the renewal
+     *  owner's `expected` generation, a DISPOSABLE PREFLIGHT proving the broker accepts the bytes, then
+     *  commit the proven cache and best-effort reconnect — returning the BROKER-ACCEPTED generation's
+     *  window (the resident conn-B swap is best-effort, not witnessed). Runs under the same single-flight
+     *  as the 75% timer, so the two can never interleave. THROWS when the source fetch fails
+     *  (missing/swapped cred), the fingerprint does not match `expected`, the broker refuses the
+     *  preflight, or the deadline elapses. Symmetric with the endpoint's {@link CotalEndpoint.reloadCreds}. */
+    reloadRwCreds(expected?: string): Promise<{
         identity: string;
         iat?: number;
         exp?: number;

package/dist/membership-feed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership-feed.d.ts","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,wGAAwG;IACxG,SAAS,EAAE,MAAM,CAAC;IAClB;;+DAE2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;2EAIuE;IACvE,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACjC,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;iFAE6E;IAC7E,aAAa,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAKD,sFAAsF;AACtF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA4OjG"}
+{"version":3,"file":"membership-feed.d.ts","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,wGAAwG;IACxG,SAAS,EAAE,MAAM,CAAC;IAClB;;+DAE2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;4DAOwD;IACxD,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;;;+GAO2G;IAC3G,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAgCD,sFAAsF;AACtF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsVjG"}

package/dist/membership-feed.js

@@ -31,8 +31,32 @@ import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { Kvm } from "@nats-io/kv";
 import { membershipBucket, membershipKey, MEMBERSHIP_FEED_KEY, MEMBERSHIP_INBOX_PREFIX, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, channelFromChatSubscription, principalFromConnz, } from "./subjects.js";
 import { openMembersRegistry, listMembers } from "./members.js";
-import { credsClaims, idFromCreds } from "./identity.js";
+import { credsClaims, credsFingerprint, credsRenewalDelayMs, idFromCreds } from "./identity.js";
 const enc = (s) => new TextEncoder().encode(s);
+/** The disposable-preflight connect bound for the rw-cred adoption proof — mirrors the endpoint's: a
+ *  rogue/unreachable candidate must resolve fast, well under the manager's delivery-admin request bound. */
+const MEMBERSHIP_PREFLIGHT_MS = 4_000;
+/** The daemon-side deadline for the WHOLE rw prove-then-adopt transaction (source fetch + preflight +
+ *  commit), kept strictly BELOW the manager's delivery-admin request bound (15s) so a slow/hung hosted
+ *  store returns a structured component failure rather than an ambiguous client timeout, and a late
+ *  fetch can never commit after the caller gave up. Mirrors {@link CotalEndpoint}'s RELOAD_DEADLINE_MS. */
+const MEMBERSHIP_RELOAD_DEADLINE_MS = 12_000;
+/** How soon a FAILED 75% rw renewal retries (the old cred stays live to its expiry meanwhile). */
+const MEMBERSHIP_CREDS_RETRY_MS = 60_000;
+/** Prove the broker ACCEPTS these creds on a throwaway connection — the D5 class-2 adoption
+ *  proof-of-record for conn B. `reconnect:false` + `maxReconnectAttempts:0` so a refused cred
+ *  REJECTS fast instead of entering a retry loop; a genuine accept returns true. Presents exactly
+ *  the candidate, so the proof is unambiguous. */
+async function brokerAcceptsCreds(servers, creds, timeoutMs) {
+    try {
+        const probe = await connect({ servers, timeout: timeoutMs, reconnect: false, maxReconnectAttempts: 0, authenticator: credsAuthenticator(enc(creds)) });
+        await probe.close();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 const MAX_PAGES = 64; // fan-out pagination guard (64 × 1024 = 65k conns/server before a loud under-report)
 /** Connect, wire the triggers + safety poll, and run an immediate first reconcile. */
 export async function startMembershipFeed(opts) {
@@ -52,22 +76,35 @@ export async function startMembershipFeed(opts) {
     });
     connA.closed().then((err) => { if (err)
         log(`conn A (system) closed: ${err.message}`); });
-    const readRw = typeof opts.rwCreds === "function" ? opts.rwCreds : () => opts.rwCreds;
-    const rwSelfId = idFromCreds(readRw()); // conn B's own nkey — the data-account self-presence check below
-    // Pin every re-read to the first read's nkey: a renewal (manager re-signs the file) keeps the
-    // identity; a swapped file would silently break the inbox scope + self-presence check, so it throws
-    // inside the authenticator instead (the connect attempt fails loud and retries).
-    const rwCredsPinned = () => {
-        const creds = readRw();
+    // The rw source: async-capable (a hosted `store.get`) or sync (a local FS read / literal). Read ONCE
+    // up front to pin conn B's identity and seed the proven cache; thereafter the source is re-read only
+    // by a preflight-proven adoption (the 75% timer or the explicit reload), never inside the sync
+    // authenticator (nats-core's Authenticator is synchronous and a `store.get` cannot live there).
+    const rwIsSource = typeof opts.rwCreds === "function";
+    const readRw = rwIsSource ? opts.rwCreds : () => opts.rwCreds;
+    const initialRw = await Promise.resolve(readRw());
+    const rwSelfId = idFromCreds(initialRw); // conn B's own nkey — the data-account self-presence check below
+    // Pin every candidate to the first read's nkey: a renewal (manager re-signs the cred) keeps the
+    // identity; a swapped cred would silently break the inbox scope + self-presence check, so it throws
+    // (the adoption fails structured and nothing is committed).
+    const pinRwIdentity = (creds) => {
         const id = idFromCreds(creds);
         if (id !== rwSelfId)
             throw new Error(`membership rw creds re-read returned identity ${id}, expected ${rwSelfId} - a renewal may not swap the feed's nkey`);
         return creds;
     };
+    // The LAST BROKER-PROVEN rw cred — the ONLY value conn B's synchronous authenticator ever presents.
+    // Seeded from the initial fetch (that first connect is its own proof, like the endpoint's initial
+    // connect); advanced ONLY by a preflight-proven adoption (the 75% timer or an explicit reload). So an
+    // incidental reconnect (broker expiry-close, a network blip) can never present an unproven or
+    // broker-refused generation and strand conn B — closing the membership half of the D5 blocker.
+    let currentRwCreds = initialRw;
     const connB = await connect({
         servers: opts.servers,
-        // Re-wrapped per (re)connect attempt so each attempt signs with the freshest (pinned) file read.
-        authenticator: (nonce) => credsAuthenticator(enc(rwCredsPinned()))(nonce),
+        // Synchronous per (re)connect attempt: presents the last BROKER-PROVEN cred, never a fresh
+        // un-preflighted source read. The 75% timer / explicit reload advance `currentRwCreds` only AFTER a
+        // disposable preflight proves the broker accepts the candidate.
+        authenticator: (nonce) => credsAuthenticator(enc(currentRwCreds))(nonce),
         name: "cotal-membership-rw",
         // The rw cred's sub.allow is `_INBOX_<id>.>`, so the connection's inbox prefix MUST match it — else
         // every KV reply / ordered-consumer delivery (kv.get/keys/watch) lands on a subject it can't subscribe.
@@ -79,6 +116,100 @@ export async function startMembershipFeed(opts) {
     const kvm = new Kvm(connB);
     const feedKv = await kvm.open(membershipBucket(space));
     const membersKv = await openMembersRegistry(connB, space);
+    // ---- conn B standing renewal (D5 class-2): the 75% timer + the explicit reload, both proven ----
+    // Mirrors the endpoint's delivery.creds renewal (adoptFreshCreds / renewCredsOnTimer / runCredsTxn).
+    // The feed previously had NO credential-refresh timer — only the poll loop and a per-reconnect source
+    // re-read; that re-read was the sole self-heal and it presented UNPROVEN bytes. Replaced by a proven
+    // cache advanced under a single-flight transaction, plus this timer as the active self-heal.
+    let rwStopped = false;
+    let rwTimer;
+    const armRwRefresh = (delayMs) => {
+        if (rwStopped)
+            return;
+        if (rwTimer)
+            clearTimeout(rwTimer);
+        rwTimer = setTimeout(() => void renewRwOnTimer(), Math.max(1_000, delayMs)); // 1s floor: second-scale test TTLs
+        rwTimer.unref?.();
+    };
+    // Single-flight: serialize the 75% timer and the explicit reload over the WHOLE prove-then-adopt
+    // transaction (fetch → preflight → commit), so a timer tick can never overwrite the cache with C while
+    // an explicit reload is proving B and then reporting B adopted. Runs `fn` after any in-flight txn
+    // settles, whatever its outcome; the internal chain never rejects.
+    let rwTxn = Promise.resolve();
+    const runRwTxn = (fn) => {
+        const next = rwTxn.then(fn, fn);
+        rwTxn = next.then(() => undefined, () => undefined);
+        return next;
+    };
+    // Race a slow/hung source fetch or preflight against the transaction deadline; the underlying promise
+    // is not cancellable, so a late commit is also fenced by re-checking the deadline before mutating the
+    // cache (mirrors {@link CotalEndpoint.withDeadline}).
+    const withRwDeadline = async (p, ms, msg) => {
+        let t;
+        const timeout = new Promise((_, rej) => { t = setTimeout(() => rej(new Error(msg)), Math.max(1, ms)); });
+        try {
+            return await Promise.race([p, timeout]);
+        }
+        finally {
+            if (t)
+                clearTimeout(t);
+        }
+    };
+    // The one PROVE-then-adopt transaction (run under runRwTxn), shared by the 75% timer and the explicit
+    // reload. Fetch (deadline-bounded) → identity-pin → optional expected-generation match → disposable
+    // preflight → late-commit fence → advance the proven cache → arm the next 75% timer. `currentRwCreds`
+    // is written ONLY after the preflight proves broker acceptance, so a rejected candidate leaves conn B
+    // on the last-proven cred. THROWS (structured) on any failure.
+    const adoptRwCreds = async (a) => {
+        // Fence BEFORE any source I/O: a reload queued behind a hung-store timer tick that already burned the
+        // budget fails structured now — it never re-reads the source, preflights, or commits (the absolute
+        // deadline was captured at the CALLER's entry, so the queue wait counts against it).
+        if (Date.now() > a.deadline)
+            throw new Error("reloadRwCreds: the request deadline elapsed while queued behind another credential transaction; nothing adopted");
+        const candidate = pinRwIdentity(await withRwDeadline(Promise.resolve(readRw()), a.deadline - Date.now(), "reloadRwCreds: the rw creds source did not return before the daemon deadline; nothing adopted"));
+        // Non-material message ON PURPOSE: this text flows to the manager's persisted
+        // `RenewalRecord.adoption.error`, so neither the observed nor the expected digest may appear.
+        if (a.expected !== undefined && credsFingerprint(candidate) !== a.expected)
+            throw new Error("reloadRwCreds: re-read credential generation did not match the expected re-signed generation; nothing adopted");
+        // Compute the bounded-window renewal delay BEFORE any commit or preflight: credsRenewalDelayMs throws
+        // on a cred lacking a numeric `exp`, and that throw must NOT leave `currentRwCreds` flipped to a
+        // candidate the authenticator would then present on the next reconnect (a post-preflight validation
+        // failure must be a true no-op on the cache).
+        const delay = credsRenewalDelayMs(candidate);
+        // An UNCHANGED generation past its own renewal point is a MISSED remint (the renewal owner has not
+        // re-signed yet), not a candidate to adopt. Adopting it would recommit the same cred, floor the next
+        // timer to 1s (delay <= 0), and reconnect EVERY second for the JWT's remaining 25% of life. Fail it
+        // like a renewal error so `renewRwOnTimer` retries at 60s with NO resident reconnect. The explicit
+        // reload's `expected` already rejects a stale read; this covers the timer path (no expectation sent).
+        if (candidate === currentRwCreds && delay <= 0)
+            throw new Error("reloadRwCreds: the rw source still holds the previous generation past its renewal point (the renewal owner has not re-signed it - run `cotal doctor auth --fix` or restart the manager); nothing adopted");
+        if (!(await brokerAcceptsCreds(opts.servers, candidate, Math.max(500, Math.min(MEMBERSHIP_PREFLIGHT_MS, a.deadline - Date.now())))))
+            throw new Error("reloadRwCreds: the broker did not accept the re-signed rw credential; nothing adopted");
+        if (Date.now() > a.deadline)
+            throw new Error("reloadRwCreds: the proof exceeded the daemon deadline; nothing adopted"); // fence a late commit
+        currentRwCreds = candidate; // commit ONLY after identity pin + fingerprint + delay/claims validation + preflight
+        armRwRefresh(delay);
+        return credsClaims(candidate);
+    };
+    // The 75%-of-lifetime renewal tick: prove + adopt + swap conn B onto the fresh cred. conn B is NOT the
+    // delivery-admin rail (that reply rides the delivery endpoint's connection), so the reconnect is inline
+    // and a failure just logs + retries while the last-proven cred stays live to its expiry.
+    async function renewRwOnTimer() {
+        const deadline = Date.now() + MEMBERSHIP_RELOAD_DEADLINE_MS; // captured before the enqueue, like the reload
+        try {
+            await runRwTxn(() => adoptRwCreds({ deadline }));
+            await connB.reconnect().catch(() => { });
+        }
+        catch (e) {
+            log(`rw creds refresh failed (graph feed writer; delivery unaffected): ${e.message} - retrying; conn B dies at the current JWT's expiry if renewal keeps failing`);
+            armRwRefresh(MEMBERSHIP_CREDS_RETRY_MS);
+        }
+    }
+    // Arm the FIRST 75% timer, but ONLY for a source-fed cred — a literal `rwCreds` string has no renewal
+    // seam (nothing re-reads it). A source-fed cred must be bounded (credsRenewalDelayMs is fail-loud on a
+    // missing `exp`), which surfaces a misconfigured source at startup rather than silently never renewing.
+    if (rwIsSource)
+        armRwRefresh(credsRenewalDelayMs(currentRwCreds));
     let stopped = false;
     let polling = false;
     let rerun = false; // a trigger fired mid-poll → run once more after
@@ -276,18 +407,26 @@ export async function startMembershipFeed(opts) {
     await poll(); // first reconcile now
     return {
         poll,
-        async reloadRwCreds() {
-            // Explicit class-2 adoption for conn B (D5 slice 5): validate the re-read (the pinned getter
-            // throws on a swapped nkey or a missing file) and force a reconnect so the fresh cred is on
-            // the wire NOW — never waiting for the broker's expiry-close. The observer conn (A) is
-            // rotation-renewed and deliberately not reloadable.
-            const { exp, iat } = credsClaims(rwCredsPinned());
-            await connB.reconnect().catch(() => { }); // already-reconnecting is a no-op; its loop re-reads the getter
+        async reloadRwCreds(expected) {
+            // Explicit class-2 adoption for conn B (D5 slice 5). Capture the ABSOLUTE deadline at ENTRY,
+            // before the single-flight enqueue, so a reload queued behind a hung-store 75% tick is bounded by
+            // the SAME window (the queue wait counts) and can never commit/swap after the renewal owner's
+            // request bound has already elapsed. The prove-then-adopt transaction runs under runRwTxn so it
+            // cannot interleave with the timer; the observer conn (A) is rotation-renewed and not reloadable.
+            const deadline = Date.now() + MEMBERSHIP_RELOAD_DEADLINE_MS;
+            const { iat, exp } = await runRwTxn(() => adoptRwCreds({ expected, deadline }));
+            // Best-effort resident swap: the preflight was the proof, and conn B is not the reply rail, so the
+            // reconnect is inline (no strand risk) and a transient failure self-heals — the 75% timer and the
+            // broker's expiry-close both present the now-proven `currentRwCreds`.
+            await connB.reconnect().catch(() => { });
             return { identity: rwSelfId, iat, exp };
         },
         async stop() {
             stopped = true;
+            rwStopped = true;
             clearInterval(timer);
+            if (rwTimer)
+                clearTimeout(rwTimer);
             if (debounce)
                 clearTimeout(debounce);
             try {

package/dist/membership-feed.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership-feed.js","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA0CzD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,qFAAqF;AAE3G,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAElC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,uBAAuB,EAAE,2DAA2D;QACjG,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAiB,CAAC;IAChG,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iEAAiE;IACzG,8FAA8F;IAC9F,oGAAoG;IACpG,iFAAiF;IACjF,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,cAAc,QAAQ,2CAA2C,CAAC,CAAC;QAC3J,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iGAAiG;QACjG,aAAa,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAClF,IAAI,EAAE,qBAAqB;QAC3B,oGAAoG;QACpG,wGAAwG;QACxG,WAAW,EAAE,UAAU,QAAQ,EAAE;QACjC,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAO,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAO,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,iDAAiD;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,aAAa,GAAG,KAAK,CAAC,CAAC,4EAA4E;IAEvG,oGAAoG;IACpG,KAAK,UAAU,UAAU,CAAC,MAAc;QACtC,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,GAAG,uBAAuB,IAAI,MAAM,EAAE,EAAE,CAAC;YACvD,MAAM,GAAG,GAAiB,EAAE,CAAC;YAC7B,IAAI,MAAiD,CAAC;YACtD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC;oBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;gBACjC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACrB,IAAI,GAAG;wBAAE,OAAO;oBAChB,IAAI,CAAC;wBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;oBAC1E,IAAI,MAAM;wBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;oBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;yDAIqD;IACrD,KAAK,UAAU,aAAa;QAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,oDAAoD;QAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,6CAA6C;QACpF,IAAI,QAAQ,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAC;QAC1D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC;oBAAE,GAAG,CAAC,6GAA6G,CAAC,CAAC;gBACnI,MAAM;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,GAAG,CAAC;gBACrD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC,eAAe,KAAK,QAAQ;wBAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,4CAA4C;oBACjG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5C,gGAAgG;gBAChG,6FAA6F;gBAC7F,2FAA2F;gBAC3F,mGAAmG;gBACnG,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK;oBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YACvD,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;gBACxB,GAAG,CAAC,gCAAgC,SAAS,mBAAmB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACzI,CAAC;QACD,mGAAmG;QACnG,qGAAqG;QACrG,uGAAuG;QACvG,qGAAqG;QACrG,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,+EAA+E;QAC/E,IAAI,QAAQ,IAAI,SAAS,IAAI,CAAC,QAAQ;YACpC,GAAG,CAAC,8FAA8F,CAAC,CAAC;QACtG,uGAAuG;QACvG,sGAAsG;QACtG,yGAAyG;QACzG,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,aAAa,GAAG,IAAI,CAAC;YACrB,GAAG,CAAC,kCAAkC,WAAW,CAAC,IAAI,qKAAqK,CAAC,CAAC;QAC/N,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAED;2FACuF;IACvF,KAAK,UAAU,kBAAkB;QAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBAAE,SAAS;YAClE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjD,qGAAqG;QACrG,sGAAsG;QACtG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,sGAAsG;QACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,uGAAuG;QACvG,wGAAwG;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,mBAAmB;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAChE,IAAI,CAAC;oBAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAqB,EAAE,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEzD,oGAAoG;QACpG,mGAAmG;QACnG,8DAA8D;QAC9D,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,OAAO,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC,CAAC,yDAAyD;QAChG,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC;gBACd,MAAM,SAAS,EAAE,CAAC;YACpB,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,iEAAkE,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,kGAAkG;IAClG,IAAI,QAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE1G,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,EAAE,CAAC,CAAC,sBAAsB;IAEpC,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,aAAa;YACjB,6FAA6F;YAC7F,4FAA4F;YAC5F,uFAAuF;YACvF,oDAAoD;YACpD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,gEAAgE;YACzG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAAC,aAAa,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACvF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;;;0DAkB0D;AAC1D,SAAS,OAAO,CAAC,KAAa,EAAE,IAA8B,EAAE,CAAkB;IAChF,MAAM,IAAI,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,sEAAsE;IACxG,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,6EAA6E;IAC9F,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,6DAA6D;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,CAAoB,EAAE,CAAoB;IAChE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,KAAK,CAAC,CAAW,EAAE,CAAW;IACrC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"membership-feed.js","sourceRoot":"","sources":["../src/membership-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAkDhG,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEvD;4GAC4G;AAC5G,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC;;;2GAG2G;AAC3G,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAE7C,kGAAkG;AAClG,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;kDAGkD;AAClD,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa,EAAE,SAAiB;IACjF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACvJ,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,qFAAqF;AAE3G,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAElC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,uBAAuB,EAAE,2DAA2D;QACjG,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,qGAAqG;IACrG,qGAAqG;IACrG,+FAA+F;IAC/F,gGAAgG;IAChG,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,OAA0C,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAiB,CAAC;IAC5G,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,iEAAiE;IAC1G,gGAAgG;IAChG,oGAAoG;IACpG,4DAA4D;IAC5D,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;QAC9C,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,cAAc,QAAQ,2CAA2C,CAAC,CAAC;QAC3J,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,8FAA8F;IAC9F,+FAA+F;IAC/F,IAAI,cAAc,GAAG,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,2FAA2F;QAC3F,oGAAoG;QACpG,gEAAgE;QAChE,aAAa,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,IAAI,EAAE,qBAAqB;QAC3B,oGAAoG;QACpG,wGAAwG;QACxG,WAAW,EAAE,UAAU,QAAQ,EAAE;QACjC,oBAAoB,EAAE,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAO,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAO,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9D,mGAAmG;IACnG,qGAAqG;IACrG,sGAAsG;IACtG,qGAAqG;IACrG,6FAA6F;IAC7F,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAkD,CAAC;IACvD,MAAM,YAAY,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC7C,IAAI,SAAS;YAAE,OAAO;QACtB,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,cAAc,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mCAAmC;QAChH,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,iGAAiG;IACjG,uGAAuG;IACvG,kGAAkG;IAClG,mEAAmE;IACnE,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,CAAK,EAAoB,EAAc,EAAE;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,sGAAsG;IACtG,sGAAsG;IACtG,sDAAsD;IACtD,MAAM,cAAc,GAAG,KAAK,EAAM,CAAa,EAAE,EAAU,EAAE,GAAW,EAAc,EAAE;QACtF,IAAI,CAA4C,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;gBACxC,CAAC;YAAC,IAAI,CAAC;gBAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC;IACF,sGAAsG;IACtG,oGAAoG;IACpG,sGAAsG;IACtG,sGAAsG;IACtG,+DAA+D;IAC/D,MAAM,YAAY,GAAG,KAAK,EAAE,CAA0C,EAA2C,EAAE;QACjH,sGAAsG;QACtG,mGAAmG;QACnG,qFAAqF;QACrF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ;YACzB,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;QACrI,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,+FAA+F,CAAC,CAAC,CAAC;QAC3M,8EAA8E;QAC9E,8FAA8F;QAC9F,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ;YACxE,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC,CAAC;QACnI,sGAAsG;QACtG,iGAAiG;QACjG,oGAAoG;QACpG,8CAA8C;QAC9C,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7C,mGAAmG;QACnG,qGAAqG;QACrG,oGAAoG;QACpG,mGAAmG;QACnG,sGAAsG;QACtG,IAAI,SAAS,KAAK,cAAc,IAAI,KAAK,IAAI,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,0MAA0M,CAAC,CAAC;QAC9N,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAC3G,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ;YACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC,CAAC,sBAAsB;QACnH,cAAc,GAAG,SAAS,CAAC,CAAC,qFAAqF;QACjH,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,uGAAuG;IACvG,wGAAwG;IACxG,yFAAyF;IACzF,KAAK,UAAU,cAAc;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC,CAAC,+CAA+C;QAC5G,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,qEAAsE,CAAW,CAAC,OAAO,+EAA+E,CAAC,CAAC;YAC9K,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,sGAAsG;IACtG,uGAAuG;IACvG,wGAAwG;IACxG,IAAI,UAAU;QAAE,YAAY,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC;IAElE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,iDAAiD;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,aAAa,GAAG,KAAK,CAAC,CAAC,4EAA4E;IAEvG,oGAAoG;IACpG,KAAK,UAAU,UAAU,CAAC,MAAc;QACtC,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,GAAG,uBAAuB,IAAI,MAAM,EAAE,EAAE,CAAC;YACvD,MAAM,GAAG,GAAiB,EAAE,CAAC;YAC7B,IAAI,MAAiD,CAAC;YACtD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC;oBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;gBACjC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACrB,IAAI,GAAG;wBAAE,OAAO;oBAChB,IAAI,CAAC;wBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;oBAC1E,IAAI,MAAM;wBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;oBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;yDAIqD;IACrD,KAAK,UAAU,aAAa;QAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,oDAAoD;QAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,6CAA6C;QACpF,IAAI,QAAQ,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAC;QAC1D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC;oBAAE,GAAG,CAAC,6GAA6G,CAAC,CAAC;gBACnI,MAAM;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,GAAG,CAAC;gBACrD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC,eAAe,KAAK,QAAQ;wBAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,4CAA4C;oBACjG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5C,gGAAgG;gBAChG,6FAA6F;gBAC7F,2FAA2F;gBAC3F,mGAAmG;gBACnG,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK;oBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YACvD,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;gBACxB,GAAG,CAAC,gCAAgC,SAAS,mBAAmB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACzI,CAAC;QACD,mGAAmG;QACnG,qGAAqG;QACrG,uGAAuG;QACvG,qGAAqG;QACrG,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,+EAA+E;QAC/E,IAAI,QAAQ,IAAI,SAAS,IAAI,CAAC,QAAQ;YACpC,GAAG,CAAC,8FAA8F,CAAC,CAAC;QACtG,uGAAuG;QACvG,sGAAsG;QACtG,yGAAyG;QACzG,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,aAAa,GAAG,IAAI,CAAC;YACrB,GAAG,CAAC,kCAAkC,WAAW,CAAC,IAAI,qKAAqK,CAAC,CAAC;QAC/N,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAED;2FACuF;IACvF,KAAK,UAAU,kBAAkB;QAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBAAE,SAAS;YAClE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjD,qGAAqG;QACrG,sGAAsG;QACtG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,sGAAsG;QACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,uGAAuG;QACvG,wGAAwG;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,mBAAmB;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAChE,IAAI,CAAC;oBAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAqB,EAAE,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEzD,oGAAoG;QACpG,mGAAmG;QACnG,8DAA8D;QAC9D,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,OAAO,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC,CAAC,yDAAyD;QAChG,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC;gBACd,MAAM,SAAS,EAAE,CAAC;YACpB,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,iEAAkE,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,kGAAkG;IAClG,IAAI,QAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE1G,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,EAAE,CAAC,CAAC,sBAAsB;IAEpC,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,aAAa,CAAC,QAAiB;YACnC,6FAA6F;YAC7F,kGAAkG;YAClG,8FAA8F;YAC9F,gGAAgG;YAChG,kGAAkG;YAClG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;YAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChF,mGAAmG;YACnG,kGAAkG;YAClG,sEAAsE;YACtE,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,SAAS,GAAG,IAAI,CAAC;YACjB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,OAAO;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAAC,aAAa,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACvF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;;;0DAkB0D;AAC1D,SAAS,OAAO,CAAC,KAAa,EAAE,IAA8B,EAAE,CAAkB;IAChF,MAAM,IAAI,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,sEAAsE;IACxG,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,6EAA6E;IAC9F,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,6DAA6D;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,CAAoB,EAAE,CAAoB;IAChE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,KAAK,CAAC,CAAW,EAAE,CAAW;IACrC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/provision.d.ts

@@ -46,16 +46,40 @@ export interface CredHealth {
     error?: string;
 }
 export declare function inspectCredHealth(creds: string, nowSec?: number): CredHealth;
-/** A space's persisted trust material. The `signingSeed` is the sensitive provisioner
- *  secret; everything else is public (JWTs) or recoverable. The system-account `signingSeed` is the ONE
- *  field {@link saveSpaceAuth} never writes to disk — it lives only in memory, just long enough at `cotal
- *  up` to mint the scoped membership-observer cred (see {@link mintMembershipObserverCreds}). */
-export interface SpaceAuth {
-    space: string;
+/** BROKER-level trust: the operator root and the system account. A nats-server trusts exactly ONE
+ *  operator and one system account, so this is the per-BROKER authority, not a per-space one. With
+ *  many spaces on one broker (W4) every space's accounts are signed by this one operator.
+ *
+ *  `sys.signingSeed` is minting capability for system-account users (the membership observer and the
+ *  connection evictor). It is in-memory only on a fresh {@link createBrokerAuth} and is NOT written
+ *  by the local filesystem persistence, so on that path a space added after first boot cannot mint
+ *  its `$SYS` users. A hosted composition that needs incremental space provisioning must hold this
+ *  seed in a BROKER-scoped secret store (never a tenant-scoped one, which would give each tenant its
+ *  own operator or duplicate the seed and so recreate multiple owners). */
+export interface BrokerAuth {
     operator: {
         seed: string;
         jwt: string;
     };
+    sys: {
+        pub: string;
+        jwt: string;
+        signingSeed?: string;
+    };
+    /** Monotonic generation of the system-account authority. {@link rotateSystemAccount} bumps it
+     *  IN MEMORY (each rotation is the next generation of the value it derived from); persistence
+     *  (`saveBrokerAuth`) then only accepts a sys-changing write that is the DIRECT successor of the
+     *  current record, refusing anything else as stale. Absent = 0 (in-memory creates and
+     *  pre-generation records). The JWT `iat` cannot carry this ordering — it is second-resolution,
+     *  so two generations minted within one second are unordered by it. */
+    gen?: number;
+}
+/** SPACE-level trust: one space's data account, signed by its broker's operator. This is the only
+ *  part of a space's trust material a space actually OWNS; broker trust is referenced, never owned
+ *  (a per-space restore or rotation must not be able to move the broker's root). The `signingSeed`
+ *  is the sensitive provisioner secret that mints this account's users. */
+export interface SpaceAccountAuth {
+    space: string;
     account: {
         pub: string;
         seed: string;
@@ -63,14 +87,24 @@ export interface SpaceAuth {
         signingSeed: string;
         signingPub: string;
     };
-    /** `signingSeed` is in-memory only (a fresh {@link createSpaceAuth}); NEVER persisted — minting a
-     *  system-account user is broker-admin capability, so no standing `$SYS` seed is left on disk. */
-    sys: {
-        pub: string;
-        jwt: string;
-        signingSeed?: string;
-    };
 }
+/** The COMPOSED read view of one space's full trust chain: broker authority plus that space's
+ *  account. Deliberately structurally identical to the pre-W4 single-space shape, so the many
+ *  existing readers compose rather than churn.
+ *
+ *  This is a read adapter, never a persistence authority: it is produced by loading the two
+ *  persisted records and validating their binding. Writing a composed value back as one document
+ *  would let a mutation made through space A resurrect a stale broker copy when space B next loads
+ *  it, which is exactly the ownership bug the split exists to prevent. */
+export interface SpaceAuth extends BrokerAuth, SpaceAccountAuth {
+}
+/** Compose the read view from its two persisted authorities. Fails loud when the space account was
+ *  not signed by THIS broker's operator: a self-consistent account signed by a FOREIGN operator is
+ *  perfectly valid on its own and would otherwise be rendered into the resolver as untrusted trust. */
+export declare function composeSpaceAuth(broker: BrokerAuth, spaceAccount: SpaceAccountAuth): SpaceAuth;
+/** The binding check behind {@link composeSpaceAuth} and registry admission: this space's data
+ *  account JWT must be issued by this broker's operator identity. */
+export declare function assertAccountSignedByBroker(broker: BrokerAuth, spaceAccount: SpaceAccountAuth): void;
 /** Reduce a {@link SpaceAuth} to just the material a *minting* host needs: `space`,
  *  `account.pub`, and `account.signingSeed` (the only fields {@link mintCreds} reads).
  *  The operator root-of-trust, system account, and the account's own seed are blanked.
@@ -89,7 +123,22 @@ export declare function rotateDataAccountSigningKey(auth: SpaceAuth): Promise<Sp
  * `sys.signingSeed` is intentionally in-memory only; callers must mint replacement observer creds before
  * persisting via `saveSpaceAuth`, which strips the seed again. */
 export declare function rotateSystemAccount(auth: SpaceAuth): Promise<SpaceAuth>;
-/** Generate a fresh operator → account(+signing key) → system-account chain for a space. */
+/** Generate a fresh BROKER trust root: operator → system account. One per broker, NOT one per space.
+ *  `label` names the operator (cosmetic, but it lands in the operator JWT); multi-space brokers pass
+ *  a broker label, and the single-space compatibility path passes the space name so existing
+ *  operator names are unchanged.
+ *
+ *  The returned `sys.signingSeed` is the ONLY window in which system-account users (the membership
+ *  observer and the connection evictor) can be minted, because the local filesystem persistence does
+ *  not write it. Callers that need to add spaces later must retain it in a broker-scoped store. */
+export declare function createBrokerAuth(label: string): Promise<BrokerAuth>;
+/** Generate one space's data account (+ signing key), signed by an EXISTING broker operator. This is
+ *  the per-tenant half of provisioning: call it once per space against the same {@link BrokerAuth}
+ *  to put many spaces on one broker, each in its own NATS account. */
+export declare function createSpaceAccountAuth(broker: BrokerAuth, space: string): Promise<SpaceAccountAuth>;
+/** Generate a fresh operator → account(+signing key) → system-account chain for a space.
+ *  The single-space composition of {@link createBrokerAuth} + {@link createSpaceAccountAuth}: one
+ *  broker whose only tenant is this space, which is exactly the pre-W4 shape. */
 export declare function createSpaceAuth(space: string): Promise<SpaceAuth>;
 /** Options shaping a minted user's permissions. */
 export interface MintOpts {
@@ -289,9 +338,18 @@ export declare function mintMembershipObserverCreds(auth: SpaceAuth, identity: I
  *  eviction holds. Same mint-only-at-provision property as the observer (the $SYS seed is in-memory
  *  only), same fail-loud when it's absent. Paired with the observer at `up`. */
 export declare function mintConnectionEvictorCreds(auth: SpaceAuth, identity: Identity, opts?: MintOpts): Promise<string>;
-/** Render the `nats-server` config that trusts this space's operator and serves its
- *  accounts via the in-config MEMORY resolver. */
-export declare function serverConfig(auth: SpaceAuth, opts: {
+/** Render the `nats-server` config that trusts ONE broker operator and serves N spaces' accounts via
+ *  the in-config MEMORY resolver.
+ *
+ *  Broker trust (operator + system account) comes from `broker` and has exactly one owner; the
+ *  per-space data accounts are listed in `spaces`. Every space account is asserted to be signed by
+ *  THIS broker's operator before it is preloaded: rendering a foreign-signed account would either
+ *  refuse broker boot or, worse, advertise a tenant the broker cannot actually authenticate.
+ *
+ *  NOTE (W4): the MEMORY resolver is one static whole-broker map, so every mutation rewrites all of
+ *  it. Concurrent add/remove of spaces needs a broker-authoritative inventory with generation/CAS
+ *  and atomic promotion above this function; this renderer is deliberately pure. */
+export declare function serverConfig(broker: BrokerAuth, spaces: readonly SpaceAccountAuth[], opts: {
     port?: number;
     host?: string;
     storeDir: string;

package/dist/provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AAwBA,OAAO,EAqBL,KAAK,WAAW,EAgBhB,KAAK,iBAAiB,EAWvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAqF,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC5I,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGhI,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,mGAAmG;AACnG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,4GAA4G;IAC5G,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAwBjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;iGAGiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7F;sGACkG;IAClG,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;yGAEyG;AACzG,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAa7E;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA+BvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;sGAKkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;sFAUkF;IAClF,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;kCAK8B;IAC9B,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD;;;;kCAI8B;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAoBD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;0EAEsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAED;;;;;;;;;;;;2FAY2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0SzB;AA0lBD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;kDACkD;AAClD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD,GACA,MAAM,CAuBR"}
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AAyBA,OAAO,EAqBL,KAAK,WAAW,EAgBhB,KAAK,iBAAiB,EAWvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAqF,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC5I,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGhI,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,mGAAmG;AACnG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,4GAA4G;IAC5G,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAwBjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;;;;;;;2EAS2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;2EAKuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;0EAO0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,UAAU,EAAE,gBAAgB;CAAG;AAElE;;uGAEuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAG9F;AAED;qEACqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAcpG;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;yGAEyG;AACzG,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB7E;AAED;;;;;;;mGAOmG;AACnG,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED;;sEAEsE;AACtE,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBzG;AAED;;iFAEiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;sGAKkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;sFAUkF;IAClF,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;kCAK8B;IAC9B,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD;;;;kCAI8B;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAoBD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;0EAEsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAED;;;;;;;;;;;;2FAY2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0SzB;AA0lBD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;;;;;;;;;;oFAUoF;AACpF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD,GACA,MAAM,CA+BR"}