@cotal-ai/core 0.58.0 → 0.60.0

package/dist/liveness.js

@@ -0,0 +1,114 @@
+/** The two planes a peer may ask about. Deliberately a CLOSED set rather than a free string: the
+ *  whole complaint is that liveness is unaskable, and the fix must not become a general-purpose
+ *  probe rail that grows a third meaning later. `manager` is the lifecycle/control plane (its
+ *  control moved to the v0.4 `service` endpoint at 1d); `delivery` is the server-side delivery
+ *  daemon that serves `ctl.delivery`. */
+export const LIVENESS_PLANES = Object.freeze(["manager", "delivery"]);
+/** Is `plane` one this surface answers for? A closed-set guard, so an unrecognised plane is refused
+ *  rather than answered with a default — a probe that answers every input is the "sweep that gives
+ *  the same answer at every input" failure, and it would report health for planes that do not
+ *  exist. */
+export function isLivenessPlane(plane) {
+    return LIVENESS_PLANES.includes(plane);
+}
+/** Classify a lease record into responder state — #1594's pure classifier, moved here so the CLI
+ *  status surfaces and this liveness surface grade by the SAME rule.
+ *
+ *  `undefined` means the lease key is absent, which on a mesh that HAS a daemon recorded is an
+ *  unbound responder rather than a missing opinion: the daemon creates its lease before it binds, so
+ *  no lease at all means nothing has even claimed the slot.
+ *
+ *  `expectedHolder` is not optional information when it is knowable. A daemon that is SIGKILLed
+ *  leaves its `ready:true` record in the bucket for the rest of the bucket TTL, so `ready` alone
+ *  answers "did SOME daemon bind recently enough that its record has not expired", which is not the
+ *  question being asked. When the caller can name the daemon it means, a foreign or dead holder's
+ *  record classifies as `stale` rather than as health. When it genuinely cannot know, pass
+ *  `undefined` and the holder is not checked. */
+export function responderFromLease(lease, expectedHolder) {
+    if (lease === undefined)
+        return "unbound";
+    if (lease.ready !== true)
+        return "unbound";
+    if (expectedHolder !== undefined && lease.holder !== expectedHolder)
+        return "stale";
+    return "bound";
+}
+/** Read the axis through a caller-supplied lease reader, mapping a FAILED read to `unknown` rather
+ *  than to either health state. The reader is injected so offline surfaces (which must not open a
+ *  connection) and connected ones share one classification without sharing a transport. */
+export async function responderStateFromReader(readLease, expectedHolder) {
+    try {
+        return responderFromLease(await readLease(), expectedHolder);
+    }
+    catch {
+        return "unknown";
+    }
+}
+/** THE ONE RULE that turns a probe outcome into a responder verdict, and the heart of #1577.
+ *
+ *  ONLY `noResponders` may become `unbound`, because only it is the broker's own positive report
+ *  that no responder is subscribed. `timeout`, `refused` and `malformed` ALL become `unknown`: each
+ *  is a failure to find out, and this issue exists because failures to find out were being rendered
+ *  as findings. A peer that cannot reach the broker learns that it cannot reach the broker.
+ *
+ *  `replied` defers to the responder's OWN verdict, which it derived from its lease through
+ *  {@link responderFromLease} — so a daemon that has claimed its slot but not bound its loops
+ *  answers `unbound` about itself rather than being counted as alive merely because it answered. A
+ *  reply carrying no readable verdict is `malformed`, hence `unknown`; it is not silently promoted
+ *  to `bound` on the strength of having replied at all. That promotion is precisely the `pgrep`
+ *  error — treating evidence that a process exists as evidence that it works. */
+export function responderFromProbe(outcome, answered) {
+    if (outcome === "replied")
+        return answered ?? "unknown";
+    if (outcome === "noResponders")
+        return "unbound";
+    return "unknown";
+}
+/** Read a wire reply into an answer, or `undefined` if it is not one. Strict on purpose: an
+ *  unrecognised `responder` value, a plane that does not match the one asked about, or a body of the
+ *  wrong shape all return `undefined`, which the caller grades as `malformed` and therefore
+ *  `unknown`. A lenient parse here would let a garbled or foreign reply be read as health, and this
+ *  is the exact seam where "it said something" becomes "it said it was fine".
+ *
+ *  `instance` IS STRICT TOO, FOR A DIFFERENT REASON THAN THE OTHER FIELDS. It is not the verdict, so
+ *  a bad one cannot say "healthy" — but a caller compares tokens to tell two responders apart, and
+ *  a value it cannot compare (a number, an object, an empty string) would silently read as "the same
+ *  responder as the other answer that also had no usable token". That is a split rendered as
+ *  agreement. A reply naming a responder in a form this surface cannot read is therefore `malformed`
+ *  rather than an answer with the field dropped. A reply with NO `instance` at all is still
+ *  readable: it is an answer from a responder that predates the field. */
+export function parseLivenessAnswer(body, expectPlane) {
+    if (typeof body !== "object" || body === null)
+        return undefined;
+    const { plane, responder, instance } = body;
+    if (typeof plane !== "string" || !isLivenessPlane(plane) || plane !== expectPlane)
+        return undefined;
+    if (responder !== "bound" && responder !== "unbound" && responder !== "stale" && responder !== "unknown")
+        return undefined;
+    if (instance !== undefined && (typeof instance !== "string" || instance === ""))
+        return undefined;
+    return instance === undefined ? { plane, responder } : { plane, responder, instance };
+}
+/** The consequence of an unbound responder, in the operator's terms rather than the daemon's — per
+ *  plane, because they break different things and the reporter's cost was diagnosis time, not
+ *  ignorance that something was wrong. Purely presentational: no state, no identity. */
+export function livenessConsequence(plane) {
+    return plane === "delivery"
+        ? "no spawn, no retirement, no join until it binds"
+        : "no spawn, stop, attach or despawn until it binds";
+}
+/** Render one axis for a human, naming UNKNOWN as unchecked rather than as either health state.
+ *  The `unknown` arm is the line this whole issue is about: it must never read as reassurance. */
+export function livenessLine(answer) {
+    switch (answer.responder) {
+        case "bound":
+            return `${answer.plane}: responder bound`;
+        case "unbound":
+            return `${answer.plane}: RESPONDER NOT BOUND - ${livenessConsequence(answer.plane)}`;
+        case "stale":
+            return `${answer.plane}: RESPONDER NOT BOUND - a DEAD holder's ready record is still in the lease (it expires on its own) - ${livenessConsequence(answer.plane)}`;
+        case "unknown":
+            return `${answer.plane}: responder state UNCHECKED - the probe did not complete, so this is not a health report`;
+    }
+}
+//# sourceMappingURL=liveness.js.map

package/dist/liveness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"liveness.js","sourceRoot":"","sources":["../src/liveness.ts"],"names":[],"mappings":"AA8DA;;;;yCAIyC;AACzC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC,CAAC;AAG/E;;;aAGa;AACb,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAQ,eAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AA8CD;;;;;;;;;;;;iDAYiD;AACjD,MAAM,UAAU,kBAAkB,CAChC,KAAoC,EACpC,cAAuB;IAEvB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,OAAO,CAAC;IACpF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;2FAE2F;AAC3F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAuD,EACvD,cAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,SAAS,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;iFAYiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE,QAAyB;IACjF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,QAAQ,IAAI,SAAS,CAAC;IACxD,IAAI,OAAO,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;0EAY0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAAa,EAAE,WAA0B;IAC3E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAoE,CAAC;IAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACpG,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3H,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAClG,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED;;wFAEwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,KAAoB;IACtD,OAAO,KAAK,KAAK,UAAU;QACzB,CAAC,CAAC,iDAAiD;QACnD,CAAC,CAAC,kDAAkD,CAAC;AACzD,CAAC;AAED;kGACkG;AAClG,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,OAAO;YACV,OAAO,GAAG,MAAM,CAAC,KAAK,mBAAmB,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,GAAG,MAAM,CAAC,KAAK,2BAA2B,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvF,KAAK,OAAO;YACV,OAAO,GAAG,MAAM,CAAC,KAAK,wGAAwG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpK,KAAK,SAAS;YACZ,OAAO,GAAG,MAAM,CAAC,KAAK,0FAA0F,CAAC;IACrH,CAAC;AACH,CAAC"}

package/dist/provision.d.ts

@@ -460,6 +460,19 @@ export declare function mintPublicUserJwt(auth: SpaceAuth, publicId: string, pro
     jwt: string;
     exp: number;
 }>;
+/** Build the NATS user permission object for a profile: a default-deny allow-list scoped to
+ *  exactly what each profile does. Every profile is now enumerated least-privilege — the former
+ *  allow-all `manager` is gone (its roles split across supervisor/provisioner/operator/purger and the
+ *  PR 1.5 CLI-surface profiles). Subject/stream/durable names come from the shared builders so the ACLs
+ *  can't drift from the wire layout.
+ *
+ *  PRINCIPAL-PARAMETERIZED + MODE-AGNOSTIC (owner+actor grammar): `pr` carries the owner+actor wire
+ *  principal (chat/inst/svc/ctl subjects, per-agent durables, the presence key all scope to it) PLUS the
+ *  connection nkey (`pr.connId`, which scopes the private reply inbox `_INBOX_<connId>`). Core does NOT
+ *  fork on dev-vs-user — the composition root supplies the principal: the auth callout passes the derived
+ *  owner + ledger actor + the per-connection ephemeral nkey; the static/dev mint passes
+ *  `{owner:"local", actor:<id>, connId:<id>}` via {@link principalOf}. EXPORTED so the callout's injected
+ *  `permissionsFor` hook can feed a validated principal straight into the same builder. */
 export declare function permissionsFor(profile: Profile, space: string, pr: MintPrincipal, opts: MintOpts): Record<string, unknown>;
 /** Mint the scoped `membership-observer` creds — a SYSTEM-account user (conn A of the graph feed),
  *  signed with the in-memory `auth.sys.signingSeed` from a fresh {@link createSpaceAuth}. THROWS if that
@@ -472,17 +485,6 @@ export declare function mintMembershipObserverCreds(auth: SpaceAuth, identity: I
  *  eviction holds. Same mint-only-at-provision property as the observer (the $SYS seed is in-memory
  *  only), same fail-loud when it's absent. Paired with the observer at `up`. */
 export declare function mintConnectionEvictorCreds(auth: SpaceAuth, identity: Identity, opts?: MintOpts): Promise<string>;
-/** Render the `nats-server` config that trusts ONE broker operator and serves N spaces' accounts via
- *  the in-config MEMORY resolver.
- *
- *  Broker trust (operator + system account) comes from `broker` and has exactly one owner; the
- *  per-space data accounts are listed in `spaces`. Every space account is asserted to be signed by
- *  THIS broker's operator before it is preloaded: rendering a foreign-signed account would either
- *  refuse broker boot or, worse, advertise a tenant the broker cannot actually authenticate.
- *
- *  NOTE (W4): the MEMORY resolver is one static whole-broker map, so every mutation rewrites all of
- *  it. Concurrent add/remove of spaces needs a broker-authoritative inventory with generation/CAS
- *  and atomic promotion above this function; this renderer is deliberately pure. */
 /**
  * Render the config for an OPEN (no-auth) broker.
  *
@@ -513,6 +515,17 @@ export declare function openServerConfig(opts: {
     maxFileStore?: number;
     transport: BrokerTransport;
 }): string;
+/** Render the `nats-server` config that trusts ONE broker operator and serves N spaces' accounts via
+ *  the in-config MEMORY resolver.
+ *
+ *  Broker trust (operator + system account) comes from `broker` and has exactly one owner; the
+ *  per-space data accounts are listed in `spaces`. Every space account is asserted to be signed by
+ *  THIS broker's operator before it is preloaded: rendering a foreign-signed account would either
+ *  refuse broker boot or, worse, advertise a tenant the broker cannot actually authenticate.
+ *
+ *  NOTE (W4): the MEMORY resolver is one static whole-broker map, so every mutation rewrites all of
+ *  it. Concurrent add/remove of spaces needs a broker-authoritative inventory with generation/CAS
+ *  and atomic promotion above this function; this renderer is deliberately pure. */
 export declare function serverConfig(broker: BrokerAuth, spaces: readonly SpaceAccountAuth[], opts: {
     port?: number;
     host?: string;

package/dist/provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAmCL,KAAK,iBAAiB,EAYvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGhI,OAAO,EAAqG,KAAK,YAAY,EAA2B,MAAM,uBAAuB,CAAC;AAEtL,OAAO,EAAyD,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAInJ,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,mGAAmG;AACnG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,oBAAoB,GACpB,yBAAyB,GACzB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,GAKhB,aAAa,GAGb,gBAAgB,GAKhB,iBAAiB,GAKjB,gBAAgB,GAGhB,YAAY,GACZ,cAAc,GAMd,cAAc,GAQd,kBAAkB,GAIlB,QAAQ,GAIR,cAAc,GAGd,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,4GAA4G;IAC5G,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;;0EAI0E;AAC1E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C;;;;;;mGAMmG;AACnG,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;oDAOoD;AACpD,eAAO,MAAM,oBAAoB,QAA2D,CAAC;AAE7F;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAsCjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;;;;;;;2EAS2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;2EAKuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;0EAO0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,UAAU,EAAE,gBAAgB;CAAG;AAElE;;uGAEuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAG9F;AAED;qEACqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAcpG;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;yGAEyG;AACzG,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB7E;AAED;;;;;;;mGAOmG;AACnG,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED;;sEAEsE;AACtE,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBzG;AAED;;iFAEiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;mFAO+E;IAC/E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;sFAUkF;IAClF,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;mGAS+F;IAC/F,mBAAmB,CAAC,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAC1C;4FACoF;QACpF,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IACF;;;;;;;oEAOgE;IAChE,iBAAiB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;;;;;;;;kCAQ8B;IAC9B,qBAAqB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;kCAE8B;IAC9B,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;;;8DAG0D;IAC1D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;;8DAG0D;IAC1D,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;4GAGwG;IACxG,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,oFAAoF;IACpF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;oDAGgD;IAChD,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;2CAGuC;IACvC,aAAa,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE;;;;+BAI2B;IAC3B,WAAW,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IACrC;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;sBAKkB;IAClB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD;;;;yEAIqE;IACrE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;sCACkC;IAClC,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAoBD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;2FAEuF;IACvF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAkCnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqEjB;AA4CD;;;wBAGwB;AACxB,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CvC;AAmBD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsczB;AAwpCD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;;;;;;;;;;oFAUoF;AACpF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;CAC5B,GAAG,MAAM,CAST;AA2BD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;mEAI+D;IAC/D,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;kEAI8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8DAC0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,MAAM,CAyCR"}
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAmCL,KAAK,iBAAiB,EAevB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGhI,OAAO,EAAqG,KAAK,YAAY,EAA2B,MAAM,uBAAuB,CAAC;AAEtL,OAAO,EAAyD,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAInJ,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,mGAAmG;AACnG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,oBAAoB,GACpB,yBAAyB,GACzB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,GAKhB,aAAa,GAGb,gBAAgB,GAKhB,iBAAiB,GAKjB,gBAAgB,GAGhB,YAAY,GACZ,cAAc,GAMd,cAAc,GAQd,kBAAkB,GAIlB,QAAQ,GAIR,cAAc,GAGd,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,4GAA4G;IAC5G,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;;0EAI0E;AAC1E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C;;;;;;mGAMmG;AACnG,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;oDAOoD;AACpD,eAAO,MAAM,oBAAoB,QAA2D,CAAC;AAE7F;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAsCjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;;;;;;;2EAS2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;2EAKuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;0EAO0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,UAAU,EAAE,gBAAgB;CAAG;AAElE;;uGAEuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAG9F;AAED;qEACqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAcpG;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;yGAEyG;AACzG,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB7E;AAED;;;;;;;mGAOmG;AACnG,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED;;sEAEsE;AACtE,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBzG;AAED;;iFAEiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;mFAO+E;IAC/E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;sFAUkF;IAClF,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;mGAS+F;IAC/F,mBAAmB,CAAC,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAC1C;4FACoF;QACpF,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IACF;;;;;;;oEAOgE;IAChE,iBAAiB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;;;;;;;;kCAQ8B;IAC9B,qBAAqB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;kCAE8B;IAC9B,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;;;8DAG0D;IAC1D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;;8DAG0D;IAC1D,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;4GAGwG;IACxG,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,oFAAoF;IACpF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;oDAGgD;IAChD,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;2CAGuC;IACvC,aAAa,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE;;;;+BAI2B;IAC3B,WAAW,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IACrC;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;sBAKkB;IAClB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD;;;;yEAIqE;IACrE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;sCACkC;IAClC,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAoBD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;2FAEuF;IACvF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAkCnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqEjB;AA4CD;;;wBAGwB;AACxB,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CvC;AAMD;;;;;;;;;;;;2FAY2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0dzB;AAwtCD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;CAC5B,GAAG,MAAM,CAST;AA2BD;;;;;;;;;;oFAUoF;AACpF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;mEAI+D;IAC/D,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;kEAI8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8DAC0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,MAAM,CAyCR"}

package/dist/provision.js

@@ -18,7 +18,8 @@ import { TTL_RECONCILE_CANARY_KEY, ttlBuckets } from "./streams.js";
 import { join } from "node:path";
 import { decode, encodeOperator, encodeAccount, encodeUser, fmtCreds, } from "@nats-io/jwt";
 import { createOperator, createAccount, fromPublic, fromSeed } from "@nats-io/nkeys";
-import { token, spacePrefix, chatSubject, assertValidChannel, channelInAllow, principalKey, parsePrincipalKey, deprovisionTargetPrincipal, principalTags, assertInboxConnId, DEV_OWNER, unicastSubject, anycastSubject, controlServiceSubject, CONTROL_DELIVERY, CONTROL_DELIVERY_ADMIN, artifactBucket, objectStoreStream, chatStream, dmStream, taskStream, dlvStream, inboxStream, chatHistDurable, dmDurable, taskDurable, dlvDurable, presenceBucket, channelBucket, membersBucket, aclBucket, aclKey, memberKey, assertLifecycleToken, membershipBucket, deliveryBucket, managerBucket, MANAGER_LEASE_KEY, MANAGER_RENEWAL_LEASE_KEY, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, MEMBERSHIP_INBOX_PREFIX, FANOUT_DURABLE, INBOX_READER_DURABLE, } from "./subjects.js";
+import { token, spacePrefix, chatSubject, assertValidChannel, channelInAllow, principalKey, parsePrincipalKey, deprovisionTargetPrincipal, principalTags, assertInboxConnId, DEV_OWNER, unicastSubject, anycastSubject, controlServiceSubject, CONTROL_DELIVERY, CONTROL_DELIVERY_ADMIN, artifactBucket, objectStoreStream, chatStream, dmStream, taskStream, dlvStream, inboxStream, chatHistDurable, dmDurable, taskDurable, dlvDurable, presenceBucket, channelBucket, membersBucket, aclBucket, aclKey, memberKey, assertLifecycleToken, membershipBucket, deliveryBucket, managerBucket, MANAGER_LEASE_KEY, MANAGER_RENEWAL_LEASE_KEY, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, MEMBERSHIP_INBOX_PREFIX, FANOUT_DURABLE, INBOX_READER_DURABLE, livenessSubject, livenessServeFilter, livenessReplyGrant, } from "./subjects.js";
+import { LIVENESS_PLANES } from "./liveness.js";
 import { epCallerGrantRows, epServeGrantRows, epBaselineGrantRows, baselineCallerCapabilities, spawnCallerCapabilities, runCallerCapabilities, epRequestGrantRows, operatorInstrumentCapabilities, instanceOnlyManagerCapabilities, epDescribeAllGrantRow, BASELINE_LIFECYCLE_ENDPOINT, } from "./endpoint-grants.js";
 import { assertServeGrantMintable, finalizeServeIssuance } from "./endpoint-service.js";
 import { effectsBindGrants, poolOwnerBindGrants, goalWriterGrants, sessionLedgerGrants, epAuthBucket, sessionsBucket, epcStreamName, endpointPlaneStreamNames, eptReqStreamName, eptStreamName, hardenedAuthorityStreamNames, timerWriterDurable, timerWriterGrants } from "./endpoint-binding.js";
@@ -532,6 +533,9 @@ export async function mintPublicUserJwt(auth, publicId, profile, opts) {
     }
     return { jwt, exp: validDates.exp };
 }
+/** The profiles whose credential carries caller rails, and can therefore be minted as an
+ *  issuance (SPEC 13.15). Everything else is infrastructure or a one-shot with no rail to bind. */
+const ISSUABLE_PROFILES = new Set(["agent", "control-caller-privileged", "control-caller-admin", "deployer"]);
 /** Build the NATS user permission object for a profile: a default-deny allow-list scoped to
  *  exactly what each profile does. Every profile is now enumerated least-privilege — the former
  *  allow-all `manager` is gone (its roles split across supervisor/provisioner/operator/purger and the
@@ -545,9 +549,6 @@ export async function mintPublicUserJwt(auth, publicId, profile, opts) {
  *  owner + ledger actor + the per-connection ephemeral nkey; the static/dev mint passes
  *  `{owner:"local", actor:<id>, connId:<id>}` via {@link principalOf}. EXPORTED so the callout's injected
  *  `permissionsFor` hook can feed a validated principal straight into the same builder. */
-/** The profiles whose credential carries caller rails, and can therefore be minted as an
- *  issuance (SPEC 13.15). Everything else is infrastructure or a one-shot with no rail to bind. */
-const ISSUABLE_PROFILES = new Set(["agent", "control-caller-privileged", "control-caller-admin", "deployer"]);
 export function permissionsFor(profile, space, pr, opts) {
     // Guard the connId BEFORE any profile builds `_INBOX_<connId>.>`: in user mode connId is a client-
     // chosen nonce (untrusted), so a metacharacter here would escalate the inbox grant to every inbox.
@@ -843,6 +844,20 @@ export function permissionsFor(profile, space, pr, opts) {
         // daemon (NOT the manager). The reply rides this same subtree (`ctl.delivery.<o>.<a>.reply.<n>`, in
         // sub.allow below) so the daemon can answer without broad inbox-publish — see CONTROL_DELIVERY.
         controlServiceSubject(space, CONTROL_DELIVERY, pr.owner, pr.actor),
+        // THE PEER-READABLE LIVENESS PROBE (#1577) — one publish row per plane, each pinned to THIS
+        // agent's own principal slots, so a peer asks as itself and can never forge a probe from
+        // another. This is the row that makes liveness askable by a NON-OWNER: without it, the only
+        // hypothesis a peer could form for any failure was "my credentials are wrong", because the
+        // subjects that answer "is the manager alive" were owner-only.
+        //
+        // WHAT THIS DOES NOT GRANT, which is the half that keeps it from being a back door. It is
+        // PUBLISH ON A REQUEST SUBJECT, not a read of anything. The agent gains NO grant on the manager
+        // bucket (still absent by deliberate omission, below) and NO new read of the delivery bucket.
+        // The answer it can obtain is one enum per plane, because the responder reduces the lease row
+        // before replying and the row never crosses the wire. It cannot subscribe the SERVE filter
+        // either: `live.<plane>.*.*` is not in `sub.allow`, so an agent cannot impersonate a responder
+        // and answer a peer's probe with a comforting lie.
+        ...LIVENESS_PLANES.map((plane) => livenessSubject(space, plane, pr.owner, pr.actor)),
         // JetStream control plane — scoped to this agent's own streams/durables.
         "$JS.API.INFO",
         // STREAM.INFO: CHAT (join watermark, recall drop-marker, channel-list counts — a documented
@@ -1017,9 +1032,15 @@ export function permissionsFor(profile, space, pr, opts) {
     // Replies to this agent's durable join/leave/list requests ride `ctl.delivery.<o>.<a>.>` (NOT the
     // per-id _INBOX), so the scoped delivery daemon can answer without broad inbox-publish.
     const deliveryReplies = `${controlServiceSubject(space, CONTROL_DELIVERY, pr.owner, pr.actor)}.>`;
+    // Liveness answers (#1577) ride the probe's OWN request subtree, exactly like the delivery
+    // control replies above and for the same reason: the responder answers without needing broad
+    // inbox-publish. One row per plane, pinned to this agent's principal, so it can hear answers to
+    // ITS OWN probes and nothing else — it cannot subscribe a peer's reply lane and harvest answers
+    // addressed elsewhere.
+    const livenessReplies = LIVENESS_PLANES.map((plane) => `${livenessSubject(space, plane, pr.owner, pr.actor)}.>`);
     // Manager control replies ride the v0.4 ep reply rail (in `epSub`, keyed on the caller triple) —
     // the `ctl.<tier>.<id>.reply.>` subtrees are gone with the ctl rail (1d).
-    return { pub: { allow: pubAllow, deny: pubDeny }, sub: { allow: [inbox, deliveryReplies, ...subChat, ...epSub] } };
+    return { pub: { allow: pubAllow, deny: pubDeny }, sub: { allow: [inbox, deliveryReplies, ...livenessReplies, ...subChat, ...epSub] } };
 }
 /** One seat's manager control view. It carries no agent messaging or delivery surface, and every
  * manager request, including describe, is pinned to one exact registered instance. */
@@ -1098,6 +1119,15 @@ function supervisorPermissions(space, pr) {
                 // files it requests `reloadCreds` here so adoption is an explicit, auditable event. Self-scoped
                 // request subject (its own owner+actor slots), bounded reply subtree in sub.allow below.
                 controlServiceSubject(space, CONTROL_DELIVERY_ADMIN, pr.owner, pr.actor),
+                // LIVENESS REPLIES for the MANAGER plane (#1577), bounded to the `.reply.` leaf under a
+                // caller's own request subject. The supervisor is the natural responder for this plane: it
+                // is the process that HOLDS the manager lease, so it is the one that can answer the
+                // question honestly without anyone else being granted a read of the lease row.
+                //
+                // REPLIES ONLY, exactly like the delivery daemon's `ctl.delivery.*.*.reply.>`. The row stops
+                // at the leaf, so the supervisor cannot publish to the liveness REQUEST subjects themselves
+                // and therefore cannot forge a probe from a peer.
+                livenessReplyGrant(space, "manager"),
                 // #1694: a POINT READ of the delivery lease row, so the store-identity challenge can verify
                 // that the process which answered the queue-grouped admin rail is the holder that actually
                 // reloads the standing credentials. Without it the challenge can only report what some
@@ -1116,7 +1146,16 @@ function supervisorPermissions(space, pr) {
             // Own reply inbox + the delivery-admin reply subtree for its OWN requests. NO chat/inst/dlv
             // native sub (the supervisor reads no feed), NO manager control-tier serve (1d: that moved to
             // the endpoint-serve credential), NO broad `$JS.>`/`$KV.>` (the residual-2 read/admin path is gone).
-            allow: [`_INBOX_${pr.connId}.>`, `${controlServiceSubject(space, CONTROL_DELIVERY_ADMIN, pr.owner, pr.actor)}.>`],
+            //
+            // PLUS the manager-plane liveness SERVE filter (#1577): `live.manager.*.*`, queue-grouped, so
+            // any credentialed peer's presence probe reaches the lease holder. This is a serve
+            // subscription on a presence-only rail, not a widening of what the supervisor may read: the
+            // request body is empty and the subject carries only the caller's own principal.
+            allow: [
+                `_INBOX_${pr.connId}.>`,
+                `${controlServiceSubject(space, CONTROL_DELIVERY_ADMIN, pr.owner, pr.actor)}.>`,
+                livenessServeFilter(space, "manager"),
+            ],
         },
     };
 }
@@ -1143,6 +1182,12 @@ function remoteManagerPermissions(space, pr, pin) {
     const gateKey = epgateKey("manager", iid);
     const credPrefix = epcredFamilyPrefix("manager", iid);
     const repairKey = eprepairKey("manager", iid);
+    // The SUPERVISOR actor of the pair, which is the one that runs `Manager.start()` and therefore
+    // the only one that binds the manager plane's liveness responder (`service.ts` hands
+    // `credentials.supervisor` to the manager; the executor gets the instance-scoped registration
+    // surface). The liveness rows below are pinned to it so the executor does not carry authority to
+    // answer a probe it never serves.
+    const isSupervisorActor = pin.actor === `manager_${iid}`;
     const recordKeys = [
         recordSpecKey(RECORD_KINDS.svc, ["manager", iid]),
         recordStatusKey(RECORD_KINDS.svc, ["manager", iid]),
@@ -1177,9 +1222,35 @@ function remoteManagerPermissions(space, pr, pin) {
                 `$JS.API.CONSUMER.DELETE.KV_${AUTH}.>`,
                 ...recordKeys.map((key) => `$JS.API.DIRECT.GET.KV_${REC}.$KV.${REC}.${key}`),
                 `$JS.API.STREAM.MSG.GET.KV_${REC}`,
+                // LIVENESS REPLIES for the MANAGER plane (#1577), bounded to the `.reply.` leaf under a
+                // caller's own request subject — the same row and the same bound as the local supervisor
+                // profile holds.
+                //
+                // WHY THIS PROFILE NEEDS IT AT ALL. `Manager.start()` binds the manager plane's liveness
+                // responder unconditionally, and a remote manager runs the same `start()` under this
+                // credential. Without the serve subscription below the bind is denied, and a peer probing
+                // the manager plane then gets the broker's own no-responders answer, which this surface
+                // grades `unbound` — a definite verdict about the plane, produced by a gap in a credential,
+                // while the remote manager is bound and serving. A surface that exists to stop a failure to
+                // find out being rendered as a finding must not render its own missing grant as one.
+                //
+                // REPLIES ONLY. The row stops at the leaf, so a remote manager cannot publish to the
+                // liveness REQUEST subjects and therefore cannot forge a probe that appears to come from a
+                // peer, exactly as the supervisor row cannot.
+                ...(isSupervisorActor ? [livenessReplyGrant(space, "manager")] : []),
+            ],
+        },
+        sub: {
+            allow: [
+                `_INBOX_${pr.connId}.>`,
+                // The manager-plane liveness SERVE filter (#1577): `live.manager.*.*`, queue-grouped, so a
+                // credentialed peer's presence probe reaches this instance. A serve subscription on a
+                // presence-only rail and not a widening of what a remote manager may read: the request body
+                // is empty and the subject carries only the caller's own principal. The MANAGER plane only —
+                // this credential cannot serve `delivery`, so each plane still answers for itself.
+                ...(isSupervisorActor ? [livenessServeFilter(space, "manager")] : []),
             ],
         },
-        sub: { allow: [`_INBOX_${pr.connId}.>`] },
     };
 }
 /** The human-CLI OPERATOR permission set (closure (ii), residual 2) — the ephemeral key the headless
@@ -1718,17 +1789,6 @@ function provisionerPermissions(space, pr) {
         sub: { allow: [`_INBOX_${pr.connId}.>`] },
     };
 }
-/** The ephemeral, LIFECYCLE-PINNED §13.1 state-write permission set for the STATIC manager's
- *  lifecycle executor (Unit B). One credential per lifecycle OPERATION (activation, terminal,
- *  renewal ledger append): every grant names exactly ONE incarnation's keys — the alias head,
- *  the uid reservation, the manager slot row, the issuance gate, and the `cred.<uid>.>` ledger
- *  family — so a leaked executor cred can move one incarnation's state machine and nothing else.
- *
- *  Reads: records reads ride the keyed Direct Get form (the key is ON the subject, so the read
- *  grant stays key-pinned); the auth store is leader-served (`allow_direct=false`), so its reads
- *  are body-selected `STREAM.MSG.GET` — stream-scoped, NOT key-scoped (the requested key rides
- *  the PAYLOAD, which a subject grant cannot see). NAMED RESIDUAL: for its one-shot lifetime the
- *  executor can READ (never write) other rows in the auth store. */
 /** The ISSUER permission set (SPEC 13.15): value-writes on the evidence store (evidence, attempt,
  *  source index: create-only and CAS rows, keyed by generation) and on the accepted-row store
  *  (create-only, keyed by the client's token); the leader-served point read on the evidence
@@ -1775,6 +1835,17 @@ function runAdmitterPermissions(space, pr, pin) {
         sub: { allow: [`_INBOX_${pr.connId}.>`] },
     };
 }
+/** The ephemeral, LIFECYCLE-PINNED §13.1 state-write permission set for the STATIC manager's
+ *  lifecycle executor (Unit B). One credential per lifecycle OPERATION (activation, terminal,
+ *  renewal ledger append): every grant names exactly ONE incarnation's keys — the alias head,
+ *  the uid reservation, the manager slot row, the issuance gate, and the `cred.<uid>.>` ledger
+ *  family — so a leaked executor cred can move one incarnation's state machine and nothing else.
+ *
+ *  Reads: records reads ride the keyed Direct Get form (the key is ON the subject, so the read
+ *  grant stays key-pinned); the auth store is leader-served (`allow_direct=false`), so its reads
+ *  are body-selected `STREAM.MSG.GET` — stream-scoped, NOT key-scoped (the requested key rides
+ *  the PAYLOAD, which a subject grant cannot see). NAMED RESIDUAL: for its one-shot lifetime the
+ *  executor can READ (never write) other rows in the auth store. */
 function lifecycleExecutorPermissions(space, pr, pin) {
     const REC = recordsBucket(space), AUTH = epAuthBucket(space);
     // ALL keys DERIVED here from the pin coordinates — the slot key is `staticSlotKey(owner, alias)`,
@@ -1810,19 +1881,6 @@ function lifecycleExecutorPermissions(space, pr, pin) {
         sub: { allow: [`_INBOX_${pr.connId}.>`] },
     };
 }
-/** The ephemeral, ENDPOINT-INSTANCE-PINNED endpoint-serve executor permission set (P2 item 1,
- *  1a-serve): the manager mints this per registration/serve-mint op and drives the endpoint
- *  registration barrier's `epgate` CAS + the mint fence's `epcred` stage/revoke THROUGH it — never
- *  its standing seed/supervisor connection (critic #1's manager-specific "no seed shortcut"). Every
- *  WRITE is key-pinned to exactly ONE (endpoint, instanceId): the gate `epgate.<ep>.<iid>`, its
- *  serving ledger family `epcred.<ep>.<iid>.>`, and the registration's two records keys (the
- *  instance's `svc` spec + the endpoint's governance head — `registerServiceInstance` drives the
- *  slot-take/promote over this same connection). A leaked/mis-constructed executor can move exactly
- *  one endpoint instance's serve state and nothing else. The auth store is `allow_direct=false`, so
- *  reads are leader-served `STREAM.MSG.GET` (stream-scoped, NOT key-scoped — the key rides the
- *  payload); enumeration of the epcred family rides an ordered `keys()` consumer. NAMED RESIDUAL:
- *  for its one-shot lifetime the executor can READ (never write) other auth rows — endpoint/
- *  credential metadata, no bearer bytes; every WRITE stays key-pinned. */
 /** The SELF-MEDIATED goal-writer profile (P2 item 2, spawn-as-action): exactly
  *  {@link goalWriterGrants} for ITS endpoint — the goal bind + terminal facts, the goal-record KV
  *  writes, and the leader-served fencing reads — plus the connection-scoped reply inbox. Disjoint
@@ -1880,6 +1938,19 @@ function sessionLedgerPermissions(space, pr) {
     const g = sessionLedgerGrants(space, pr.connId);
     return { pub: { allow: g.publish }, sub: { allow: g.subscribe } };
 }
+/** The ephemeral, ENDPOINT-INSTANCE-PINNED endpoint-serve executor permission set (P2 item 1,
+ *  1a-serve): the manager mints this per registration/serve-mint op and drives the endpoint
+ *  registration barrier's `epgate` CAS + the mint fence's `epcred` stage/revoke THROUGH it — never
+ *  its standing seed/supervisor connection (critic #1's manager-specific "no seed shortcut"). Every
+ *  WRITE is key-pinned to exactly ONE (endpoint, instanceId): the gate `epgate.<ep>.<iid>`, its
+ *  serving ledger family `epcred.<ep>.<iid>.>`, and the registration's two records keys (the
+ *  instance's `svc` spec + the endpoint's governance head — `registerServiceInstance` drives the
+ *  slot-take/promote over this same connection). A leaked/mis-constructed executor can move exactly
+ *  one endpoint instance's serve state and nothing else. The auth store is `allow_direct=false`, so
+ *  reads are leader-served `STREAM.MSG.GET` (stream-scoped, NOT key-scoped — the key rides the
+ *  payload); enumeration of the epcred family rides an ordered `keys()` consumer. NAMED RESIDUAL:
+ *  for its one-shot lifetime the executor can READ (never write) other auth rows — endpoint/
+ *  credential metadata, no bearer bytes; every WRITE stays key-pinned. */
 function endpointServeExecutorPermissions(space, pr, pin) {
     const AUTH = epAuthBucket(space), REC = recordsBucket(space);
     // DERIVED from (endpoint, instanceId) via the core builders — never a caller literal.
@@ -2053,6 +2124,10 @@ function deliveryPermissions(space, pr) {
         `$JS.API.CONSUMER.MSG.NEXT.${INBOX}.${INBOX_READER_DURABLE}`,
         `$JS.API.CONSUMER.DELETE.${INBOX}.${INBOX_READER_DURABLE}`,
         `$JS.ACK.${INBOX}.${INBOX_READER_DURABLE}.>`,
+        // The reader removes an entry addressed to a retired lifecycle (its ACL row is tombstoned), so the
+        // store does not keep what no reader can ever deliver. Nothing new in substance: the reader can
+        // already ack any INBOX entry away.
+        `$JS.API.STREAM.MSG.DELETE.${INBOX}`,
         "$JS.FC.>", // ordered-consumer flow control
         // Reads: presence (@mention resolve) + channel registry (delivery class) + members + ACL (re-auth).
         ...kvRead(PKV), ...kvRead(CHKV), ...kvRead(MKV), ...kvRead(AKV),
@@ -2098,11 +2173,21 @@ function deliveryPermissions(space, pr) {
         // The privileged delivery-admin rail (D5 slice 5/6): same replies-only shape. Requests reach the
         // daemon on the sub below; only the supervisor cred can PUBLISH them (nats-server is the boundary).
         `${p}.ctl.delivery-admin.*.*.reply.>`,
+        // LIVENESS REPLIES for the DELIVERY plane (#1577) — same replies-only shape as the two control
+        // rails above. The daemon is the only process that can grade its own responder honestly: it
+        // knows its own incarnation, so a predecessor's `ready:true` corpse in the lease classifies as
+        // stale rather than as its own health. Bounded to the `.reply.` leaf, so it cannot publish to
+        // the request subjects and forge a probe from a peer.
+        livenessReplyGrant(space, "delivery"),
     ];
     const sub = [
         `_INBOX_${pr.connId}.>`,
         `${p}.ctl.delivery.*.*`, // serve the delivery control service (queue-grouped; owner+actor caller slots)
         `${p}.ctl.delivery-admin.*.*`, // serve the privileged admin rail (reloadCreds; eviction executor next)
+        // Serve the delivery plane's liveness probe (#1577), queue-grouped. Presence-only: the handler
+        // reduces the lease row to one enum before replying, so this subscription lets the daemon ANSWER
+        // a peer without any peer gaining a read of the lease.
+        livenessServeFilter(space, "delivery"),
     ];
     return { pub: { allow: pub }, sub: { allow: sub } };
 }
@@ -2204,17 +2289,6 @@ export async function mintConnectionEvictorCreds(auth, identity, opts = {}) {
     const creds = fmtCreds(userJwt, fromSeed(new TextEncoder().encode(identity.seed)));
     return new TextDecoder().decode(creds);
 }
-/** Render the `nats-server` config that trusts ONE broker operator and serves N spaces' accounts via
- *  the in-config MEMORY resolver.
- *
- *  Broker trust (operator + system account) comes from `broker` and has exactly one owner; the
- *  per-space data accounts are listed in `spaces`. Every space account is asserted to be signed by
- *  THIS broker's operator before it is preloaded: rendering a foreign-signed account would either
- *  refuse broker boot or, worse, advertise a tenant the broker cannot actually authenticate.
- *
- *  NOTE (W4): the MEMORY resolver is one static whole-broker map, so every mutation rewrites all of
- *  it. Concurrent add/remove of spaces needs a broker-authoritative inventory with generation/CAS
- *  and atomic promotion above this function; this renderer is deliberately pure. */
 /**
  * Render the config for an OPEN (no-auth) broker.
  *
@@ -2271,6 +2345,17 @@ function renderTlsBlock(transport) {
 }
 `;
 }
+/** Render the `nats-server` config that trusts ONE broker operator and serves N spaces' accounts via
+ *  the in-config MEMORY resolver.
+ *
+ *  Broker trust (operator + system account) comes from `broker` and has exactly one owner; the
+ *  per-space data accounts are listed in `spaces`. Every space account is asserted to be signed by
+ *  THIS broker's operator before it is preloaded: rendering a foreign-signed account would either
+ *  refuse broker boot or, worse, advertise a tenant the broker cannot actually authenticate.
+ *
+ *  NOTE (W4): the MEMORY resolver is one static whole-broker map, so every mutation rewrites all of
+ *  it. Concurrent add/remove of spaces needs a broker-authoritative inventory with generation/CAS
+ *  and atomic promotion above this function; this renderer is deliberately pure. */
 export function serverConfig(broker, spaces, opts) {
     if (!spaces.length)
         throw new Error("serverConfig: at least one space account is required");