@cotal-ai/core 0.16.0 → 0.18.0

package/dist/evict.d.ts

@@ -134,6 +134,53 @@ export declare function observePlaneLivenessWithCreds(opts: {
     query: PlaneLivenessQuery;
     options?: EvictOptions;
 }): Promise<PlaneLivenessResult>;
+/** A principal's liveness verdict. `live` = a connection attributed to it exists NOW; `gone` = a
+ *  COMPLETE, single-server-proven sweep proves none does; `unknown` = the observation cannot decide.
+ *  A caller MUST treat `unknown` as "may still be live" — never as gone. */
+export type PrincipalLiveness = "live" | "gone" | "unknown";
+/** The probe's bound reply: the principal ECHOED back with its verdict (a reply that does not echo
+ *  the exact principal asked about never authorizes), plus `sweepComplete` — CONNZ observation
+ *  completeness, kept as its own field and NEVER folded into the verdict. */
+export interface PrincipalLivenessResult {
+    principal: string;
+    state: PrincipalLiveness;
+    sweepComplete: boolean;
+    note?: string;
+}
+/** Closed, ECHO-BOUND parse of a wire-crossing {@link PrincipalLivenessResult} — the caller
+ *  validates the delivery-admin rail's reply BEFORE reasoning over it. Exactly the v1 keys, the
+ *  state in the enum, and the echoed principal EQUAL to the one queried. Undefined on ANY
+ *  violation; the caller maps that to `unknown` (a garbled or foreign oracle must block the repair,
+ *  never authorize it). `expected` is required precisely so the echo cannot be forgotten. */
+export declare function parsePrincipalLivenessResult(v: unknown, expected: string): PrincipalLivenessResult | undefined;
+/**
+ * Answer whether ONE principal holds any live connection — the read-only half of principal
+ * eviction, drawn from the SAME {@link livenessSweep} the plane oracle uses, so an observation good
+ * enough to authorize a repair is validated identically wherever it is read.
+ *
+ *  - `live`: a complete sweep attributed at least one connection to the principal.
+ *  - `gone`: the sweep is COMPLETE, the single-server mode is PROVEN (SPEC 13.13), and no connection
+ *    attributes to the principal. The single-server proof is required for the same reason the plane
+ *    reclaim requires it: in a clustered account, CONNZ absence cannot distinguish a genuinely dead
+ *    holder from a live one behind a partition, and reading the second as "gone" is exactly the
+ *    unsafe direction for a repair that revokes and evicts a credential family.
+ *  - `unknown`: the sweep under-reported, or the single-server mode is unproven.
+ *
+ * Refuses a non-principal loudly: CONNZ attribution only ever surfaces `local`/`u_…` owners, so a
+ * syntactically-valid non-principal would sweep clean and return a HEALTHY `gone` — false
+ * confidence for a typo'd target. Same boundary `executeEviction` applies to its filter.
+ */
+export declare function observePrincipalLiveness(observerConn: NatsConnection, accountId: string, principal: string, options?: EvictOptions): Promise<PrincipalLivenessResult>;
+/** Creds-level wrapper for the delivery daemon's admin-rail principal-liveness verb: open the $SYS
+ *  observer PER CALL (the eviction seam's rule — never a standing $SYS connection), run
+ *  {@link observePrincipalLiveness}, drain. Read-only: no evictor cred enters this path. */
+export declare function observePrincipalLivenessWithCreds(opts: {
+    servers: string;
+    observerCreds: string;
+    accountId: string;
+    principal: string;
+    options?: EvictOptions;
+}): Promise<PrincipalLivenessResult>;
 /** Creds-level wrapper for composition roots that hold the two $SYS creds as FILES/strings (the
  *  delivery daemon's admin-rail executor): open the observer (under its granted inbox prefix) and
  *  the kick-only evictor PER CALL, run {@link evictDeniedPrincipal}, and drain both — eviction is a

package/dist/evict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evict.d.ts","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAiCA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAgC3F;;sDAEsD;AACtD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qGAAqG;IACrG,SAAS,EAAE,MAAM,CAAC;IAClB;0FACsF;IACtF,YAAY,EAAE,OAAO,CAAC;IACtB;sDACkD;IAClD,YAAY,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;6CAC6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiHD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,cAAc,EAC5B,WAAW,EAAE,cAAc,EAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAID;;;mEAGmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;0FAE0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;gCAGgC;AAChC,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5D;;;4FAG4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC5D,OAAO,EAAE;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC7D,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;yEAEyE;AACzE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,cAAc,CAShE;AAED;;;gGAGgG;AAChG,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAkBpF;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,cAAc,EAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CA6E9B;AAED;;wFAEwF;AACxF,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAY/B;AAED;;;;qGAIqG;AACrG,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1B"}
+{"version":3,"file":"evict.d.ts","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAiCA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAgC3F;;sDAEsD;AACtD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qGAAqG;IACrG,SAAS,EAAE,MAAM,CAAC;IAClB;0FACsF;IACtF,YAAY,EAAE,OAAO,CAAC;IACtB;sDACkD;IAClD,YAAY,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;6CAC6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiID;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,cAAc,EAC5B,WAAW,EAAE,cAAc,EAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAID;;;mEAGmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;0FAE0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;gCAGgC;AAChC,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5D;;;4FAG4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC5D,OAAO,EAAE;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC7D,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;yEAEyE;AACzE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,cAAc,CAShE;AAED;;;gGAGgG;AAChG,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAkBpF;AAiJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,cAAc,EAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED;;wFAEwF;AACxF,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAY/B;AAaD;;4EAE4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5D;;6EAE6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;6FAI6F;AAC7F,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAS9G;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,cAAc,EAC5B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAclC;AAED;;4FAE4F;AAC5F,wBAAsB,iCAAiC,CAAC,IAAI,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAYnC;AAED;;;;qGAIqG;AACrG,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1B"}

package/dist/evict.js

@@ -32,7 +32,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
-import { connzRequestSubject, principalFromConnz, serverKickSubject, MEMBERSHIP_INBOX_PREFIX } from "./subjects.js";
+import { connzRequestSubject, isPrincipalOwnerToken, parsePrincipalKey, principalFromConnz, serverKickSubject, MEMBERSHIP_INBOX_PREFIX } from "./subjects.js";
 const enc = (s) => new TextEncoder().encode(s);
 const MAX_PAGES = 64; // fan-out pagination guard (mirrors the membership feed's under-report ceiling)
 /** Scan this account's live connections, projected to `{cid, serverId, principal}`. Returns
@@ -47,12 +47,17 @@ async function scanLive(observerConn, accountId, opts) {
     let unroutable = false; // a reply named no server id → its conns can't be KICKed → scan is not complete
     const sweep = randomUUID(); // per-sweep reply-inbox nonce: concurrent sweeps must never cross-talk
     let seq = 0;
+    // See the lost-page check below: servers that owe a page after the previous round.
+    let owed = new Set();
+    let lostPage = false;
     for (let page = 0; page < MAX_PAGES; page++) {
         const offset = page * opts.pageLimit;
         const replies = await connzRound(observerConn, accountId, offset, opts, sweep, seq++);
         if (replies.length)
             gotAnyReply = true;
         let fullPageSomewhere = false;
+        const deliveredThisRound = new Set();
+        const owesAfterThisRound = new Set();
         for (const r of replies) {
             const serverId = r.data?.server_id ?? r.server?.id;
             if (!serverId) {
@@ -79,15 +84,28 @@ async function scanLive(observerConn, accountId, opts) {
                 conns.push({ cid: c.cid, serverId, principal });
             }
             const total = r.data?.total ?? 0;
-            if (cs.length >= opts.pageLimit && offset + cs.length < total)
+            // Same progress rule as `livenessSweep`: answering is not delivering (see there).
+            if (cs.length > 0 || offset >= total)
+                deliveredThisRound.add(serverId);
+            if (cs.length >= opts.pageLimit && offset + cs.length < total) {
                 fullPageSomewhere = true;
+                owesAfterThisRound.add(serverId);
+            }
         }
+        // THE LOST-PAGE CHECK (same defect, same fix, as `livenessSweep`): a server that reported more
+        // data and then failed to deliver a page has gone silent mid-pagination, not ended. Reading
+        // that as an ending makes a scan that MISSED live connections report itself complete — and here
+        // that is `verifiedGone:true` for a principal still holding a connection past the first page.
+        for (const s of owed)
+            if (!deliveredThisRound.has(s))
+                lostPage = true;
+        owed = owesAfterThisRound;
         if (!fullPageSomewhere)
             break; // no server still has a full page → done
         if (page === MAX_PAGES - 1)
             truncated = true;
     }
-    return { conns, complete: gotAnyReply && !truncated && !unroutable };
+    return { conns, complete: gotAnyReply && !truncated && !unroutable && !lostPage };
 }
 /** One CONNZ round: fan out the account request, collect every server's reply within the window. */
 function connzRound(observerConn, accountId, offset, opts, sweep, seq) {
@@ -252,44 +270,15 @@ export function parsePlaneLivenessResult(v) {
     return { ledger, records, sweepComplete: r.sweepComplete, ...(r.note !== undefined ? { note: r.note } : {}) };
 }
 /**
- * Answer a plane-liveness query over the account's live connections (the delivery daemon's
- * read-only half of the #29 HIGH 3 reclaim protocol; observer cred only, no KICK). Verdict rules,
- * fail-safe by construction:
- *
- *  - `live`: a connection carrying the claimed `userNkey` exists ANYWHERE (any server, any cid —
- *    wider than the exact tuple on purpose: an identity that still holds ANY connection must block
- *    takeover), or the exact `(serverId, cid)` pair is present.
- *  - `gone`: the sweep is COMPLETE, the observation PROVES the single-server mode, and the claimed
- *    `userNkey` appears nowhere. This includes the claimed `serverId` being absent from the
- *    repliers entirely: `server_id` is per-broker-RUN, so after a broker restart the claimed
- *    incarnation can never reply again while every connection it held is gone by definition —
- *    requiring its reply forever would turn every whole-stack crash into a permanent reclaim
- *    wedge (the inverted-lockout class).
- *
- *    THE SINGLE-SERVER PROOF (SPEC 13.13): CONNZ absence alone cannot distinguish a RESTARTED
- *    claimed server (genuinely gone) from a PARTITIONED one (live, unreachable) — both present as
- *    "the claimed serverId did not reply". The discriminator is the responding server's OWN
- *    topology declaration, never an inference from who replied: `gone` additionally requires that
- *    EVERY reply carried a server envelope declaring NO cluster membership (`server.cluster`
- *    absent — nats-server sets it, config-named or dynamically generated, whenever clustering is
- *    configured) and that exactly ONE distinct server replied. A standalone process cannot have a
- *    silent same-cluster peer holding the claimed connection, so its complete reply is the whole
- *    truth; a partitioned cluster member still DECLARES its cluster and reads `unknown`. NAMED
- *    RESIDUALS: a leafnode/gateway-extended account is outside the cluster self-report (such
- *    topologies are out of contract for the auth account until a multi-server incarnation
- *    authority exists), and a backup-restore onto a fresh broker can present a still-running
- *    foreign predecessor's `serverId` as dead.
- *  - `unknown`: the sweep under-reported (no replies, truncation, an unroutable row) OR the
- *    single-server mode is unproven (a cluster self-report, multiple repliers, or a reply without
- *    the server envelope) — the caller refuses takeover.
+ * The read-only CONNZ sweep both liveness verdicts are drawn from — ONE fail-closed observation,
+ * shared so a probe and the repair it authorizes can never disagree about what "gone" means.
  *
- *  Closed surface: the CONNZ request carries no caller-selected filter (account-wide sweep only)
- *  and the reply exposes ONLY the two bound verdicts + sweep completeness — never a connection
- *  listing. A row matching the claimed nkey under ANY connection name counts live (fail safe);
- *  the residual "is this nkey connected" bit the verb leaks is strictly weaker than the kick
- *  authority the same rail already carries.
+ * FAIL-CLOSED reply validation: only a SUCCESSFUL, well-formed CONNZ page may count toward an
+ * authorizing sweep. An API error, a missing/empty server envelope, a present but non-string (or
+ * empty-string) cluster declaration, an envelope/data server-id mismatch, or a structurally
+ * incomplete data page each mark the sweep malformed (⇒ every verdict `unknown`).
  */
-export async function observePlaneLiveness(observerConn, accountId, query, options = {}) {
+async function livenessSweep(observerConn, accountId, options = {}) {
     const opts = {
         settleMs: options.settleMs ?? 250,
         maxWaitMs: options.maxWaitMs ?? 2000,
@@ -303,17 +292,20 @@ export async function observePlaneLiveness(observerConn, accountId, query, optio
     const repliers = new Set();
     const sweep = randomUUID(); // per-sweep reply-inbox nonce: concurrent sweeps must never cross-talk
     let seq = 0;
+    // Servers that reported MORE data after the previous round, and therefore OWE a page on this one.
+    // A server that owes a page and does not deliver a well-formed one has UNDER-REPORTED — the sweep
+    // must not read that silence as the end of the data (see `lostPage`).
+    let owed = new Set();
+    let lostPage = false;
     for (let page = 0; page < MAX_PAGES; page++) {
         const offset = page * opts.pageLimit;
         const replies = await connzRound(observerConn, accountId, offset, opts, sweep, seq++);
         if (replies.length)
             gotAnyReply = true;
         let fullPageSomewhere = false;
+        const deliveredThisRound = new Set();
+        const owesAfterThisRound = new Set();
         for (const r of replies) {
-            // FAIL-CLOSED reply validation: only a SUCCESSFUL, well-formed CONNZ page may count toward a
-            // reclaim-authorizing sweep. An API error, a missing/empty server envelope, a present but
-            // non-string (or empty-string) cluster declaration, an envelope/data server-id mismatch, or a
-            // structurally incomplete data page each mark the sweep malformed (=> every verdict unknown).
             const envId = r.server?.id;
             const cluster = r.server?.cluster;
             if (r.error !== undefined ||
@@ -336,38 +328,107 @@ export async function observePlaneLiveness(observerConn, accountId, query, optio
                     malformed = true; // an id-less row could BE the claimed connection — fail safe
                     continue;
                 }
-                conns.push({ serverId, cid: c.cid, ...(typeof c.authorized_user === "string" ? { userNkey: c.authorized_user } : {}) });
+                const principal = principalFromConnz(c);
+                conns.push({
+                    serverId, cid: c.cid,
+                    ...(typeof c.authorized_user === "string" ? { userNkey: c.authorized_user } : {}),
+                    ...(principal === null ? {} : { principal }),
+                });
             }
             const total = r.data.total;
-            if (cs.length >= opts.pageLimit && offset + cs.length < total)
+            // PROGRESS, not merely a reply: a server that owes the rest of its data discharges that debt
+            // only by handing some over (`cs.length > 0`) or by showing there is none left to hand
+            // (`offset >= total`). An empty page at an offset still short of `total` answers without
+            // delivering, and accepting it as an ending clears the debt exactly as silence used to.
+            if (cs.length > 0 || offset >= total)
+                deliveredThisRound.add(serverId);
+            if (cs.length >= opts.pageLimit && offset + cs.length < total) {
                 fullPageSomewhere = true;
+                owesAfterThisRound.add(serverId);
+            }
         }
+        // THE LOST-PAGE CHECK. A server that said "there is more" and then failed to deliver the rest
+        // has not ended its data — it has stopped mid-pagination, and its remaining connections were
+        // never seen. Reading that as the end is how a sweep that MISSED a live connection reports
+        // itself COMPLETE, and a complete-and-absent sweep is exactly what authorizes `gone`. Fail
+        // closed: the observation is an under-report, not an ending.
+        for (const s of owed)
+            if (!deliveredThisRound.has(s))
+                lostPage = true;
+        owed = owesAfterThisRound;
         if (!fullPageSomewhere)
             break;
         if (page === MAX_PAGES - 1)
             truncated = true;
     }
-    const sweepComplete = gotAnyReply && !truncated && !malformed;
-    // The single-server proof (see the doc): `gone` is sound ONLY when every responder declared
-    // standalone topology and exactly one server replied — a declaration, never a reply-count guess.
-    const singleServerProven = sweepComplete && !clusterDeclared && repliers.size === 1;
+    const sweepComplete = gotAnyReply && !truncated && !malformed && !lostPage;
+    return {
+        conns, sweepComplete, clusterDeclared, repliers: repliers.size,
+        singleServerProven: sweepComplete && !clusterDeclared && repliers.size === 1,
+    };
+}
+/** The one-line reason a sweep cannot yield `gone`, or undefined when it can. `decision` names what
+ *  the verdict was going to authorize, so the operator reads why THIS answer is withheld. */
+function sweepShortfallNote(s, decision) {
+    if (!s.sweepComplete)
+        return "CONNZ sweep under-reported (no responder, truncation, an API error, or a malformed reply) - liveness UNKNOWN";
+    if (s.singleServerProven)
+        return undefined;
+    return s.clusterDeclared
+        ? `the broker DECLARES cluster membership - a partitioned member could still hold the connection, so CONNZ liveness cannot adjudicate ${decision} outside the single-server mode (SPEC 13.13) - liveness UNKNOWN`
+        : `${s.repliers} distinct servers replied - the single-server mode the verdict requires is unproven (SPEC 13.13) - liveness UNKNOWN`;
+}
+/**
+ * Answer a plane-liveness query over the account's live connections (the delivery daemon's
+ * read-only half of the #29 HIGH 3 reclaim protocol; observer cred only, no KICK). Verdict rules,
+ * fail-safe by construction:
+ *
+ *  - `live`: a connection carrying the claimed `userNkey` exists ANYWHERE (any server, any cid —
+ *    wider than the exact tuple on purpose: an identity that still holds ANY connection must block
+ *    takeover), or the exact `(serverId, cid)` pair is present.
+ *  - `gone`: the sweep is COMPLETE, the observation PROVES the single-server mode, and the claimed
+ *    `userNkey` appears nowhere. This includes the claimed `serverId` being absent from the
+ *    repliers entirely: `server_id` is per-broker-RUN, so after a broker restart the claimed
+ *    incarnation can never reply again while every connection it held is gone by definition —
+ *    requiring its reply forever would turn every whole-stack crash into a permanent reclaim
+ *    wedge (the inverted-lockout class).
+ *
+ *    THE SINGLE-SERVER PROOF (SPEC 13.13): CONNZ absence alone cannot distinguish a RESTARTED
+ *    claimed server (genuinely gone) from a PARTITIONED one (live, unreachable) — both present as
+ *    "the claimed serverId did not reply". The discriminator is the responding server's OWN
+ *    topology declaration, never an inference from who replied: `gone` additionally requires that
+ *    EVERY reply carried a server envelope declaring NO cluster membership (`server.cluster`
+ *    absent — nats-server sets it, config-named or dynamically generated, whenever clustering is
+ *    configured) and that exactly ONE distinct server replied. A standalone process cannot have a
+ *    silent same-cluster peer holding the claimed connection, so its complete reply is the whole
+ *    truth; a partitioned cluster member still DECLARES its cluster and reads `unknown`. NAMED
+ *    RESIDUALS: a leafnode/gateway-extended account is outside the cluster self-report (such
+ *    topologies are out of contract for the auth account until a multi-server incarnation
+ *    authority exists), and a backup-restore onto a fresh broker can present a still-running
+ *    foreign predecessor's `serverId` as dead.
+ *  - `unknown`: the sweep under-reported (no replies, truncation, an unroutable row) OR the
+ *    single-server mode is unproven (a cluster self-report, multiple repliers, or a reply without
+ *    the server envelope) — the caller refuses takeover.
+ *
+ *  Closed surface: the CONNZ request carries no caller-selected filter (account-wide sweep only)
+ *  and the reply exposes ONLY the two bound verdicts + sweep completeness — never a connection
+ *  listing. A row matching the claimed nkey under ANY connection name counts live (fail safe);
+ *  the residual "is this nkey connected" bit the verb leaks is strictly weaker than the kick
+ *  authority the same rail already carries.
+ */
+export async function observePlaneLiveness(observerConn, accountId, query, options = {}) {
+    const s = await livenessSweep(observerConn, accountId, options);
     const verdict = (tuple) => {
-        const live = conns.some((c) => c.userNkey === tuple.userNkey || (c.serverId === tuple.serverId && c.cid === tuple.cid));
+        const live = s.conns.some((c) => c.userNkey === tuple.userNkey || (c.serverId === tuple.serverId && c.cid === tuple.cid));
         if (live)
             return "live";
-        return singleServerProven ? "gone" : "unknown";
+        return s.singleServerProven ? "gone" : "unknown";
     };
-    const note = !sweepComplete
-        ? "CONNZ sweep under-reported (no responder, truncation, an API error, or a malformed reply) - liveness UNKNOWN"
-        : !singleServerProven
-            ? clusterDeclared
-                ? "the broker DECLARES cluster membership - a partitioned member could still hold the claimed connections, so CONNZ liveness cannot adjudicate a plane reclaim outside the single-server mode (SPEC 13.13) - liveness UNKNOWN"
-                : `${repliers.size} distinct servers replied - the single-server mode the reclaim verdict requires is unproven (SPEC 13.13) - liveness UNKNOWN`
-            : undefined;
+    const note = sweepShortfallNote(s, "a plane reclaim");
     return {
         ledger: { tuple: query.ledger, state: verdict(query.ledger) },
         records: { tuple: query.records, state: verdict(query.records) },
-        sweepComplete,
+        sweepComplete: s.sweepComplete,
         ...(note === undefined ? {} : { note }),
     };
 }
@@ -388,6 +449,77 @@ export async function observePlaneLivenessWithCreds(opts) {
         await observer.drain().catch(() => { });
     }
 }
+/** Closed, ECHO-BOUND parse of a wire-crossing {@link PrincipalLivenessResult} — the caller
+ *  validates the delivery-admin rail's reply BEFORE reasoning over it. Exactly the v1 keys, the
+ *  state in the enum, and the echoed principal EQUAL to the one queried. Undefined on ANY
+ *  violation; the caller maps that to `unknown` (a garbled or foreign oracle must block the repair,
+ *  never authorize it). `expected` is required precisely so the echo cannot be forgotten. */
+export function parsePrincipalLivenessResult(v, expected) {
+    if (v === null || typeof v !== "object")
+        return undefined;
+    for (const k of Object.keys(v))
+        if (!["principal", "state", "sweepComplete", "note"].includes(k))
+            return undefined;
+    const r = v;
+    if (typeof r.principal !== "string" || r.principal !== expected)
+        return undefined;
+    if (r.state !== "live" && r.state !== "gone" && r.state !== "unknown")
+        return undefined;
+    if (typeof r.sweepComplete !== "boolean")
+        return undefined;
+    if (r.note !== undefined && (typeof r.note !== "string" || r.note.length === 0 || r.note.length > 2048))
+        return undefined;
+    return { principal: r.principal, state: r.state, sweepComplete: r.sweepComplete, ...(r.note !== undefined ? { note: r.note } : {}) };
+}
+/**
+ * Answer whether ONE principal holds any live connection — the read-only half of principal
+ * eviction, drawn from the SAME {@link livenessSweep} the plane oracle uses, so an observation good
+ * enough to authorize a repair is validated identically wherever it is read.
+ *
+ *  - `live`: a complete sweep attributed at least one connection to the principal.
+ *  - `gone`: the sweep is COMPLETE, the single-server mode is PROVEN (SPEC 13.13), and no connection
+ *    attributes to the principal. The single-server proof is required for the same reason the plane
+ *    reclaim requires it: in a clustered account, CONNZ absence cannot distinguish a genuinely dead
+ *    holder from a live one behind a partition, and reading the second as "gone" is exactly the
+ *    unsafe direction for a repair that revokes and evicts a credential family.
+ *  - `unknown`: the sweep under-reported, or the single-server mode is unproven.
+ *
+ * Refuses a non-principal loudly: CONNZ attribution only ever surfaces `local`/`u_…` owners, so a
+ * syntactically-valid non-principal would sweep clean and return a HEALTHY `gone` — false
+ * confidence for a typo'd target. Same boundary `executeEviction` applies to its filter.
+ */
+export async function observePrincipalLiveness(observerConn, accountId, principal, options = {}) {
+    const parsed = parsePrincipalKey(principal);
+    if (!parsed || !isPrincipalOwnerToken(parsed.owner))
+        throw new Error(`principalLiveness: "${principal}" is not a real owner.actor principal (owner must be \`local\` or a derived \`u_…\` token — the only shapes CONNZ attribution can surface); a clean sweep for it would be false confidence, not a verdict`);
+    const s = await livenessSweep(observerConn, accountId, options);
+    const live = s.conns.some((c) => c.principal === principal);
+    const note = sweepShortfallNote(s, "a freeze-holder repair");
+    return {
+        principal,
+        state: live ? "live" : s.singleServerProven ? "gone" : "unknown",
+        sweepComplete: s.sweepComplete,
+        // A `live` verdict is conclusive on its own — the shortfall note explains a WITHHELD `gone`.
+        ...(!live && note !== undefined ? { note } : {}),
+    };
+}
+/** Creds-level wrapper for the delivery daemon's admin-rail principal-liveness verb: open the $SYS
+ *  observer PER CALL (the eviction seam's rule — never a standing $SYS connection), run
+ *  {@link observePrincipalLiveness}, drain. Read-only: no evictor cred enters this path. */
+export async function observePrincipalLivenessWithCreds(opts) {
+    const observer = await connect({
+        servers: opts.servers,
+        authenticator: credsAuthenticator(enc(opts.observerCreds)),
+        inboxPrefix: MEMBERSHIP_INBOX_PREFIX,
+        maxReconnectAttempts: 0,
+    });
+    try {
+        return await observePrincipalLiveness(observer, opts.accountId, opts.principal, opts.options ?? {});
+    }
+    finally {
+        await observer.drain().catch(() => { });
+    }
+}
 /** Creds-level wrapper for composition roots that hold the two $SYS creds as FILES/strings (the
  *  delivery daemon's admin-rail executor): open the observer (under its granted inbox prefix) and
  *  the kick-only evictor PER CALL, run {@link evictDeniedPrincipal}, and drain both — eviction is a

package/dist/evict.js.map

@@ -1 +1 @@
-{"version":3,"file":"evict.js","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAEpH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gFAAgF;AA2DtG;;;;wBAIwB;AACxB,KAAK,UAAU,QAAQ,CACrB,YAA4B,EAC5B,SAAiB,EACjB,IAA0E;IAE1E,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,GAAG,KAAK,CAAC,CAAC,gFAAgF;IACxG,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,uEAAuE;IACnG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,6FAA6F;gBAC7F,0FAA0F;gBAC1F,mFAAmF;gBACnF,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,mFAAmF;gBACnF,sFAAsF;gBACtF,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,SAAS;oBAAE,SAAS,CAAC,mEAAmE;gBAC7F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9B,wFAAwF;oBACxF,0FAA0F;oBAC1F,wFAAwF;oBACxF,UAAU,GAAG,IAAI,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,KAAK;gBAAE,iBAAiB,GAAG,IAAI,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,MAAM,CAAC,yCAAyC;QACxE,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;AACvE,CAAC;AAED,oGAAoG;AACpG,SAAS,UAAU,CACjB,YAA4B,EAC5B,SAAiB,EACjB,MAAc,EACd,IAA0E,EAC1E,KAAa,EACb,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,iGAAiG;QACjG,gGAAgG;QAChG,yCAAyC;QACzC,MAAM,KAAK,GAAG,GAAG,uBAAuB,UAAU,KAAK,IAAI,GAAG,EAAE,CAAC;QACjE,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,IAAI,MAAiD,CAAC;QACtD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE;YACxC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,IAAI,GAAG;oBAAE,OAAO;gBAChB,IAAI,CAAC;oBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAC1E,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,YAAY,CAAC,OAAO,CAClB,mBAAmB,CAAC,SAAS,CAAC,EAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;2EAE2E;AAC3E,KAAK,UAAU,IAAI,CAAC,WAA2B,EAAE,IAAc;IAC7D,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnI,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAwC,CAAC;IAC9D,IAAI,IAAI,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAA4B,EAC5B,WAA2B,EAC3B,SAAiB,EACjB,SAAiB,EACjB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,QAAQ;QACjB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,yFAAyF,EAAE,CAAC;IAE3L,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;IAEjJ,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,uFAAuF;IACvF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAClB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,kDAAkD,EAAE,CAAC;QACzJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3F,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAChH,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,GAAG,CAAC;YACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,mCAAmC,IAAI,CAAC,eAAe,yCAAyC,EAAE,CAAC;IAClO,CAAC;IACD,kEAAkE;IAClE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAuCD;;yEAEyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;IACtG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;QACnF,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QACrE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CACrE,CAAC;AACJ,CAAC;AAED;;;gGAGgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAClH,MAAM,CAAC,GAAG,CAAiC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,CAAU,EAAmE,EAAE;QAC3F,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;QACrF,MAAM,CAAC,GAAG,CAAyC,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1H,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAA4B,EAC5B,SAAiB,EACjB,KAAyB,EACzB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;IACF,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,eAAe,GAAG,KAAK,CAAC,CAAC,qEAAqE;IAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,uEAAuE;IACnG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAI,CAAC,CAAC,MAA4C,EAAE,OAAO,CAAC;YACzE,IACE,CAAC,CAAC,KAAK,KAAK,SAAS;gBACrB,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC/C,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBAChF,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;gBAC/D,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;gBAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACjI,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,eAAe,GAAG,IAAI,CAAC;YACxD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAA+B,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9B,SAAS,GAAG,IAAI,CAAC,CAAC,6DAA6D;oBAC/E,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1H,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,KAAK;gBAAE,iBAAiB,GAAG,IAAI,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,MAAM;QAC9B,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC;IAC9D,4FAA4F;IAC5F,iGAAiG;IACjG,MAAM,kBAAkB,GAAG,aAAa,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,CAAC,KAAqB,EAAqB,EAAE;QAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxH,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC;QACxB,OAAO,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,aAAa;QACzB,CAAC,CAAC,8GAA8G;QAChH,CAAC,CAAC,CAAC,kBAAkB;YACnB,CAAC,CAAC,eAAe;gBACf,CAAC,CAAC,4NAA4N;gBAC9N,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,6HAA6H;YACjJ,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAC7D,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAChE,aAAa;QACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;wFAEwF;AACxF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAMnD;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;qGAIqG;AACrG,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAOnD;IACC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzD,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"evict.js","sourceRoot":"","sources":["../src/evict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE9J,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gFAAgF;AA2DtG;;;;wBAIwB;AACxB,KAAK,UAAU,QAAQ,CACrB,YAA4B,EAC5B,SAAiB,EACjB,IAA0E;IAE1E,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,GAAG,KAAK,CAAC,CAAC,gFAAgF;IACxG,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,uEAAuE;IACnG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,mFAAmF;IACnF,IAAI,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,6FAA6F;gBAC7F,0FAA0F;gBAC1F,mFAAmF;gBACnF,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,mFAAmF;gBACnF,sFAAsF;gBACtF,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,SAAS;oBAAE,SAAS,CAAC,mEAAmE;gBAC7F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9B,wFAAwF;oBACxF,0FAA0F;oBAC1F,wFAAwF;oBACxF,UAAU,GAAG,IAAI,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;YACjC,kFAAkF;YAClF,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,KAAK;gBAAE,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBAC9D,iBAAiB,GAAG,IAAI,CAAC;gBACzB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,+FAA+F;QAC/F,4FAA4F;QAC5F,gGAAgG;QAChG,8FAA8F;QAC9F,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;QACtE,IAAI,GAAG,kBAAkB,CAAC;QAC1B,IAAI,CAAC,iBAAiB;YAAE,MAAM,CAAC,yCAAyC;QACxE,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;AACpF,CAAC;AAED,oGAAoG;AACpG,SAAS,UAAU,CACjB,YAA4B,EAC5B,SAAiB,EACjB,MAAc,EACd,IAA0E,EAC1E,KAAa,EACb,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,iGAAiG;QACjG,gGAAgG;QAChG,yCAAyC;QACzC,MAAM,KAAK,GAAG,GAAG,uBAAuB,UAAU,KAAK,IAAI,GAAG,EAAE,CAAC;QACjE,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,IAAI,MAAiD,CAAC;QACtD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE;YACxC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,IAAI,GAAG;oBAAE,OAAO;gBAChB,IAAI,CAAC;oBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAc,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAC1E,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,YAAY,CAAC,OAAO,CAClB,mBAAmB,CAAC,SAAS,CAAC,EAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;2EAE2E;AAC3E,KAAK,UAAU,IAAI,CAAC,WAA2B,EAAE,IAAc;IAC7D,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnI,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAwC,CAAC;IAC9D,IAAI,IAAI,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAA4B,EAC5B,WAA2B,EAC3B,SAAiB,EACjB,SAAiB,EACjB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,QAAQ;QACjB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,yFAAyF,EAAE,CAAC;IAE3L,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;IAEjJ,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,uFAAuF;IACvF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAClB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,kDAAkD,EAAE,CAAC;QACzJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3F,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAChH,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,GAAG,CAAC;YACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,mCAAmC,IAAI,CAAC,eAAe,yCAAyC,EAAE,CAAC;IAClO,CAAC;IACD,kEAAkE;IAClE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAuCD;;yEAEyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;IACtG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;QACnF,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QACrE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CACrE,CAAC;AACJ,CAAC;AAED;;;gGAGgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAClH,MAAM,CAAC,GAAG,CAAiC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,CAAU,EAAmE,EAAE;QAC3F,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;QACrF,MAAM,CAAC,GAAG,CAAyC,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1H,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAoCD;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC1B,YAA4B,EAC5B,SAAiB,EACjB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;IACF,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,eAAe,GAAG,KAAK,CAAC,CAAC,qEAAqE;IAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,uEAAuE;IACnG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,kGAAkG;IAClG,kGAAkG;IAClG,sEAAsE;IACtE,IAAI,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAI,CAAC,CAAC,MAA4C,EAAE,OAAO,CAAC;YACzE,IACE,CAAC,CAAC,KAAK,KAAK,SAAS;gBACrB,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC/C,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;gBAChF,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;gBAC/D,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;gBAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACjI,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,eAAe,GAAG,IAAI,CAAC;YACxD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAA+B,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9B,SAAS,GAAG,IAAI,CAAC,CAAC,6DAA6D;oBAC/E,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG;oBACpB,GAAG,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC3B,6FAA6F;YAC7F,uFAAuF;YACvF,yFAAyF;YACzF,wFAAwF;YACxF,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,KAAK;gBAAE,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBAC9D,iBAAiB,GAAG,IAAI,CAAC;gBACzB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,8FAA8F;QAC9F,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,6DAA6D;QAC7D,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;QACtE,IAAI,GAAG,kBAAkB,CAAC;QAC1B,IAAI,CAAC,iBAAiB;YAAE,MAAM;QAC9B,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC;IAC3E,OAAO;QACL,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI;QAC9D,kBAAkB,EAAE,aAAa,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;6FAC6F;AAC7F,SAAS,kBAAkB,CAAC,CAAgB,EAAE,QAAgB;IAC5D,IAAI,CAAC,CAAC,CAAC,aAAa;QAClB,OAAO,8GAA8G,CAAC;IACxH,IAAI,CAAC,CAAC,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,CAAC,CAAC,eAAe;QACtB,CAAC,CAAC,sIAAsI,QAAQ,iEAAiE;QACjN,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,qHAAqH,CAAC;AACzI,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAA4B,EAC5B,SAAiB,EACjB,KAAyB,EACzB,UAAwB,EAAE;IAE1B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,KAAqB,EAAqB,EAAE;QAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1H,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC;QACxB,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAC7D,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAChE,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;wFAEwF;AACxF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAMnD;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AA4BD;;;;6FAI6F;AAC7F,MAAM,UAAU,4BAA4B,CAAC,CAAU,EAAE,QAAgB;IACvE,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IACnH,MAAM,CAAC,GAAG,CAAqC,CAAC;IAChD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClF,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxF,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1H,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvI,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,YAA4B,EAC5B,SAAiB,EACjB,SAAiB,EACjB,UAAwB,EAAE;IAE1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,2MAA2M,CAAC,CAAC;IAC/P,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7D,OAAO;QACL,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAChE,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,6FAA6F;QAC7F,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;4FAE4F;AAC5F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,IAMvD;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;qGAIqG;AACrG,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAOnD;IACC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,WAAW,EAAE,uBAAuB;QACpC,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzD,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/identity.d.ts

@@ -16,6 +16,25 @@ export interface Identity {
 /** Generate a fresh user nkey identity locally. The seed is derived here and never
  *  leaves the generating process except as a creds file handed to its own agent. */
 export declare function newIdentity(): Identity;
+/** The signing half an authority-bearing artifact needs: `signArtifact` / `mintSessionGrant`
+ *  take exactly `{ sign(input): Uint8Array }`, and the matching `publicKey` is what the
+ *  verifying anchor pins. An nkey KeyPair already satisfies both; this narrows it to the
+ *  artifact surface so a consumer that must not depend on `@nats-io/nkeys` directly (an
+ *  `implementations/*` package) can still sign — core owns the signing primitive. */
+export interface ArtifactSigner {
+    /** The signer's nkey public key (`U…`) — the `SignerAnchor.publicKey` a verifier resolves. */
+    publicKey: string;
+    /** Ed25519 signature over an artifact's canonical signature input. */
+    sign(input: Uint8Array): Uint8Array;
+}
+/** Build an artifact signer from an existing nkey seed (e.g. an endpoint's own key material).
+ *  The seed never leaves the process; only signatures + the public key do. */
+export declare function artifactSignerFromSeed(seed: string): ArtifactSigner;
+/** A fresh artifact signer (its own keypair + seed): for a self-signing endpoint that mints its
+ *  own session grants and registers the matching public key as its `sessions` trust anchor. */
+export declare function newArtifactSigner(): ArtifactSigner & {
+    seed: string;
+};
 /** The stable id carried by a creds file: the agent's nkey public key. Derived from the
  *  seed block (format-independent) and cross-checked against the JWT subject — a mismatch
  *  means a corrupt or spliced creds file (a seed paired with someone else's JWT), which
@@ -27,6 +46,21 @@ export declare function idFromCreds(creds: string): string;
  *  needs the token rather than the whole envelope. Returns undefined when there is no JWT block;
  *  callers decide whether that is fatal. */
 export declare function jwtFromCreds(creds: string): string | undefined;
+/** The ACCOUNT a creds file authenticates as.
+ *
+ *  `iss` is NOT the answer, and assuming it was is a live-verified mistake: when a user JWT is
+ *  signed by an account SIGNING key (which every credential this repo mints is), `iss` carries the
+ *  SIGNING key and the account identity lives in `nats.issuer_account`. Comparing `iss` to an
+ *  account public key rejects every correctly-configured mesh. So: `nats.issuer_account` when
+ *  present, falling back to `iss` for a JWT signed directly by the account identity key.
+ *
+ *  This exists so a process can cross-check its own tenancy against material it read off DISK.
+ *  A daemon that resolves its scan target from a file (`membership.json`) has no way, without
+ *  this, to notice it is reading a DIFFERENT tenant's file than the one it authenticates as — and
+ *  a complete, well-formed sweep of the wrong account is indistinguishable from "the principal is
+ *  gone". Fail-closed: no JWT block, or no usable `iss`, throws rather than returning a value a
+ *  caller might compare loosely. */
+export declare function accountFromCreds(creds: string): string;
 /** A non-secret GENERATION token for a credential: SHA-256 of its compact USER JWT.
  *
  *  The JWT, not the whole creds envelope, on purpose. The JWT is exactly what the broker is

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;oFACoF;AACpF,wBAAgB,WAAW,IAAI,QAAQ,CAItC;AAED;;;;;kBAKkB;AAClB,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;4CAE4C;AAC5C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED;;;;;;;;;;6FAU6F;AAC7F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;;6FAG6F;AAC7F,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAQpH;AAED;;;;;uFAKuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;yEAGyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAWzD"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;oFACoF;AACpF,wBAAgB,WAAW,IAAI,QAAQ,CAItC;AAED;;;;qFAIqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;CACrC;AAED;8EAC8E;AAC9E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAGnE;AAED;+FAC+F;AAC/F,wBAAgB,iBAAiB,IAAI,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAGrE;AAED;;;;;kBAKkB;AAClB,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;4CAE4C;AAC5C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED;;;;;;;;;;;;;oCAaoC;AACpC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAatD;AAED;;;;;;;;;;6FAU6F;AAC7F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;;6FAG6F;AAC7F,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAQpH;AAED;;;;;uFAKuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;yEAGyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAWzD"}

package/dist/identity.js

@@ -7,6 +7,18 @@ export function newIdentity() {
     const seed = new TextDecoder().decode(kp.getSeed());
     return { id: kp.getPublicKey(), seed };
 }
+/** Build an artifact signer from an existing nkey seed (e.g. an endpoint's own key material).
+ *  The seed never leaves the process; only signatures + the public key do. */
+export function artifactSignerFromSeed(seed) {
+    const kp = fromSeed(new TextEncoder().encode(seed));
+    return { publicKey: kp.getPublicKey(), sign: (input) => kp.sign(input) };
+}
+/** A fresh artifact signer (its own keypair + seed): for a self-signing endpoint that mints its
+ *  own session grants and registers the matching public key as its `sessions` trust anchor. */
+export function newArtifactSigner() {
+    const { seed } = newIdentity();
+    return { ...artifactSignerFromSeed(seed), seed };
+}
 /** The stable id carried by a creds file: the agent's nkey public key. Derived from the
  *  seed block (format-independent) and cross-checked against the JWT subject — a mismatch
  *  means a corrupt or spliced creds file (a seed paired with someone else's JWT), which
@@ -22,6 +34,40 @@ export function idFromCreds(creds) {
 export function jwtFromCreds(creds) {
     return creds.match(/BEGIN NATS USER JWT-----\s*([\s\S]*?)\s*------END NATS USER JWT/)?.[1].trim();
 }
+/** The ACCOUNT a creds file authenticates as.
+ *
+ *  `iss` is NOT the answer, and assuming it was is a live-verified mistake: when a user JWT is
+ *  signed by an account SIGNING key (which every credential this repo mints is), `iss` carries the
+ *  SIGNING key and the account identity lives in `nats.issuer_account`. Comparing `iss` to an
+ *  account public key rejects every correctly-configured mesh. So: `nats.issuer_account` when
+ *  present, falling back to `iss` for a JWT signed directly by the account identity key.
+ *
+ *  This exists so a process can cross-check its own tenancy against material it read off DISK.
+ *  A daemon that resolves its scan target from a file (`membership.json`) has no way, without
+ *  this, to notice it is reading a DIFFERENT tenant's file than the one it authenticates as — and
+ *  a complete, well-formed sweep of the wrong account is indistinguishable from "the principal is
+ *  gone". Fail-closed: no JWT block, or no usable `iss`, throws rather than returning a value a
+ *  caller might compare loosely. */
+export function accountFromCreds(creds) {
+    const jwt = jwtFromCreds(creds);
+    if (!jwt)
+        throw new Error("creds: no NATS user JWT block found - cannot determine the issuing account");
+    const payload = jwt.split(".")[1];
+    if (!payload)
+        throw new Error("creds: the NATS user JWT is not a three-part token - cannot determine the issuing account");
+    let claims;
+    try {
+        claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    }
+    catch (e) {
+        throw new Error(`creds: the NATS user JWT payload does not decode (${e.message}) - cannot determine the issuing account`);
+    }
+    const c = claims;
+    const account = typeof c?.nats?.issuer_account === "string" ? c.nats.issuer_account : c?.iss;
+    if (typeof account !== "string" || !/^A[A-Z2-7]{55}$/.test(account))
+        throw new Error("creds: the NATS user JWT names no issuing account in account-nkey form (neither `nats.issuer_account` nor `iss`) - cannot determine the issuing account");
+    return account;
+}
 /** A non-secret GENERATION token for a credential: SHA-256 of its compact USER JWT.
  *
  *  The JWT, not the whole creds envelope, on purpose. The JWT is exactly what the broker is

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;;6FAU6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8E,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;uFAKuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,qDAAqD;IACxF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAChC,MAAM,IAAI,KAAK,CAAC,6KAA6K,CAAC,CAAC;IACjM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBtD;oFACoF;AACpF,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAcD;8EAC8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,OAAO,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;;;kBAKkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;oCAaoC;AACpC,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC3H,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qDAAsD,CAAW,CAAC,OAAO,0CAA0C,CAAC,CAAC;IAAC,CAAC;IACnJ,MAAM,CAAC,GAAG,MAAuE,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAC7F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yJAAyJ,CAAC,CAAC;IAC7K,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;6FAU6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8E,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;uFAKuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,qDAAqD;IACxF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAChC,MAAM,IAAI,KAAK,CAAC,6KAA6K,CAAC,CAAC;IACjM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}