@cotal-ai/core 0.86.0 → 0.88.0

package/dist/private-tool-results.d.ts

@@ -0,0 +1,253 @@
+import { type AnchorResolver, type SignerAnchor } from "./endpoint-signing.js";
+/** Declaration-only contracts for SPEC §13.19. Parsing is not signature verification,
+ *  current-state authorization, issuance, registration or permission to serve. */
+export declare const TOOL_RESULTS_ENDPOINT = "tool-results";
+export declare const TOOL_RESULT_MAX_CONTENT_BYTES: number;
+export declare const TOOL_RESULT_MAX_ENTRIES = 256;
+export declare const TOOL_RESULT_MAX_RETENTION_MS: number;
+export declare const TOOL_RESULT_CONSENT_MAX_TTL_MS: number;
+export interface ToolResultTarget {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+}
+export interface ToolResultConsent {
+    v: 1;
+    kind: "tool-result-consent";
+    id: string;
+    space: string;
+    target: ToolResultTarget;
+    holder: {
+        owner: string;
+        actor: string;
+    };
+    /** Milliseconds since the Unix epoch, as for other §13.10 timed artifacts. */
+    iat: number;
+    exp: number;
+    issuer: {
+        keyId: string;
+    };
+    sig: string;
+}
+/** A create-only marker's value. Retention and monotonic writes belong to the auth store. */
+export interface ToolResultRevocation {
+    v: 1;
+    kind: "tool-result-revocation";
+    space: string;
+    consentId: string;
+    target: ToolResultTarget;
+    revokedAt: number;
+}
+/** Wire coordinates, not a branded EpServeGrant. No consuming authority accepts this shape
+ *  alone. The host must register and authorize the real grant before material can be installed. */
+export interface ToolResultServingMaterial {
+    v: 1;
+    kind: "tool-result-serving-material";
+    space: string;
+    accountPublicKey: string;
+    target: ToolResultTarget;
+    grant: {
+        endpoint: "tool-results";
+        instanceId: string;
+        epoch: number;
+        registrationRevision: number;
+    };
+    credential: string;
+    snapshot: {
+        t0: number;
+        watermark: number;
+        watermarkTakenAt: number;
+        revokedConsentIds: string[];
+    };
+    /** Unix seconds; fixed from snapshot.t0, not from delivery or installation. */
+    expiresAt: number;
+}
+export type ToolResultAnswer = {
+    state: "available";
+    threadId: string;
+    toolCallId: string;
+    content: string;
+    truncated: boolean;
+    byteCount: number;
+    error: boolean;
+    capturedAt: number;
+} | {
+    state: "pending";
+    threadId: string;
+    toolCallId: string;
+} | {
+    state: "not-shared" | "missing" | "expired";
+};
+export type ToolResultRevocationOutcome = {
+    state: "known" | "refused" | "unknown";
+    consentId: string;
+};
+export declare const TOOL_RESULT_CONSENT_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: Record<string, unknown>;
+};
+export declare const TOOL_RESULT_REVOCATION_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: Record<string, unknown>;
+};
+export declare const TOOL_RESULT_SERVING_MATERIAL_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: Record<string, unknown>;
+};
+export declare const TOOL_RESULT_INPUT_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: Record<string, unknown>;
+};
+export declare const TOOL_RESULT_ANSWER_SCHEMAS: {
+    available: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    pending: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    "not-shared": {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    missing: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    expired: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+};
+export declare const TOOL_RESULT_OUTPUT_SCHEMA: {
+    oneOf: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    }[];
+};
+export declare const TOOL_RESULT_CONSENT_INPUT_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: Record<string, unknown>;
+};
+export declare const TOOL_RESULT_CONSENT_OUTPUT_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: Record<string, unknown>;
+};
+export declare const TOOL_RESULT_REVOKE_INPUT_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: Record<string, unknown>;
+};
+export declare const TOOL_RESULT_REVOKE_ANSWER_SCHEMAS: {
+    known: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    refused: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    unknown: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+};
+export declare const TOOL_RESULT_REVOKE_OUTPUT_SCHEMA: {
+    oneOf: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    }[];
+};
+/** Frozen declarations only. No service registration, handler, grant or profile is installed. */
+export declare const TOOL_RESULTS_COMMANDS: ({
+    name: string;
+    capability: string;
+    input: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    output: {
+        oneOf: {
+            type: string;
+            additionalProperties: boolean;
+            required: string[];
+            properties: Record<string, unknown>;
+        }[];
+    };
+} | {
+    name: string;
+    capability: string;
+    input: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+    output: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: Record<string, unknown>;
+    };
+})[];
+export declare const TOOL_RESULTS_CLUSTER: {
+    urn: string;
+    revision: number;
+    attributes: never[];
+    events: never[];
+    commands: {
+        name: string;
+        class: string;
+        targeted: boolean;
+        modes: string[];
+        capability: string;
+        inputDigest: string;
+        outputDigest: string;
+    }[];
+};
+/** Parse shape and static bindings only; verify signatures and current authority separately. */
+export declare function parseToolResultConsent(raw: unknown): ToolResultConsent;
+export declare function parseToolResultRevocation(raw: unknown): ToolResultRevocation;
+export declare function parseToolResultServingMaterial(raw: unknown): ToolResultServingMaterial;
+export declare function parseToolResultAnswer(raw: unknown): ToolResultAnswer;
+export declare function parseToolResultRevocationOutcome(raw: unknown): ToolResultRevocationOutcome;
+/** Resolve only the accepted anchor family/scope. This does not verify a consent signature,
+ *  establish human proof or authorize redemption; no signer is exposed. */
+export declare function resolveToolResultConsentAnchor(resolve: AnchorResolver, keyId: string, at: number): Promise<SignerAnchor>;
+//# sourceMappingURL=private-tool-results.d.ts.map

package/dist/private-tool-results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-tool-results.d.ts","sourceRoot":"","sources":["../src/private-tool-results.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgD,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE7H;kFACkF;AAClF,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AACpD,eAAO,MAAM,6BAA6B,QAAY,CAAC;AACvD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE,MAAM,WAAW,gBAAgB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;CAAE;AACzF,MAAM,WAAW,iBAAiB;IAChC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,wBAAwB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;mGACmG;AACnG,MAAM,WAAW,yBAAyB;IACxC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,8BAA8B,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE;QAAE,QAAQ,EAAE,cAAc,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IACrG,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnG,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxJ;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AACpD,MAAM,MAAM,2BAA2B,GAAG;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBxG,eAAO,MAAM,0BAA0B;;;;;CAIpC,CAAC;AACJ,eAAO,MAAM,6BAA6B;;;;;CAEvC,CAAC;AACJ,eAAO,MAAM,mCAAmC;;;;;CAO7C,CAAC;AACJ,eAAO,MAAM,wBAAwB;;;;;CAA2B,CAAC;AACjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMrC,CAAC;AACH,eAAO,MAAM,yBAAyB;;;;;;;CAAmE,CAAC;AAC1G,eAAO,MAAM,gCAAgC;;;;;CAA8D,CAAC;AAC5G,eAAO,MAAM,iCAAiC;;;;;CAAkD,CAAC;AACjG,eAAO,MAAM,+BAA+B;;;;;CAAwC,CAAC;AACrF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;CAI5C,CAAC;AACH,eAAO,MAAM,gCAAgC;;;;;;;CAA0E,CAAC;AAExH,iGAAiG;AACjG,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAIhC,CAAC;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;CAO/B,CAAC;AAkBH,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,CAItE;AACD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAE5E;AACD,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,CAKtF;AACD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAIpE;AACD,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,2BAA2B,CAE1F;AAED;2EAC2E;AAC3E,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAI9H"}

package/dist/private-tool-results.js

@@ -0,0 +1,141 @@
+import { fromPublic } from "@nats-io/nkeys";
+import { canonicalJson } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { isAccountNkey } from "./identity.js";
+import { compileContractSchema, singleDocumentClosure } from "./schema-profile.js";
+import { resolveAnchorForUse, assertAnchorScopeCovers } from "./endpoint-signing.js";
+/** Declaration-only contracts for SPEC §13.19. Parsing is not signature verification,
+ *  current-state authorization, issuance, registration or permission to serve. */
+export const TOOL_RESULTS_ENDPOINT = "tool-results";
+export const TOOL_RESULT_MAX_CONTENT_BYTES = 64 * 1024;
+export const TOOL_RESULT_MAX_ENTRIES = 256;
+export const TOOL_RESULT_MAX_RETENTION_MS = 60 * 60 * 1000;
+export const TOOL_RESULT_CONSENT_MAX_TTL_MS = 24 * 60 * 60 * 1000;
+function deepFreeze(value) {
+    if (value !== null && typeof value === "object") {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+const text = { type: "string", minLength: 1 };
+const id = { type: "string", minLength: 1, maxLength: 200, pattern: "^[A-Za-z0-9_-]+$" };
+const actor = { type: "string", minLength: 1, pattern: "^[A-Za-z0-9_]+$" };
+const owner = { type: "string", pattern: "^u_[a-z2-7]{26}$" };
+const uid = { type: "string", pattern: "^[a-z0-9]{26,32}$" };
+const space = { type: "string", minLength: 1, pattern: "^[A-Za-z0-9_-]+$" };
+const uint = { type: "integer", minimum: 0, maximum: Number.MAX_SAFE_INTEGER };
+const bool = { type: "boolean" };
+const closed = (properties) => ({ type: "object", additionalProperties: false, required: Object.keys(properties), properties });
+const target = closed({ owner, actor, lifecycleUid: uid });
+const pair = { threadId: text, toolCallId: text };
+const status = (state, fields = {}) => closed({ state: { const: state }, ...fields });
+export const TOOL_RESULT_CONSENT_SCHEMA = deepFreeze(closed({
+    v: { const: 1 }, kind: { const: "tool-result-consent" }, id, space, target,
+    holder: closed({ owner, actor }), iat: uint, exp: uint,
+    issuer: closed({ keyId: id }), sig: { type: "string", pattern: "^[A-Za-z0-9_-]{86}$" },
+}));
+export const TOOL_RESULT_REVOCATION_SCHEMA = deepFreeze(closed({
+    v: { const: 1 }, kind: { const: "tool-result-revocation" }, space, consentId: id, target, revokedAt: uint,
+}));
+export const TOOL_RESULT_SERVING_MATERIAL_SCHEMA = deepFreeze(closed({
+    v: { const: 1 }, kind: { const: "tool-result-serving-material" }, space,
+    accountPublicKey: { type: "string", pattern: "^A[A-Z2-7]{55}$" }, target,
+    grant: closed({ endpoint: { const: TOOL_RESULTS_ENDPOINT }, instanceId: uid, epoch: uint, registrationRevision: { ...uint, minimum: 1 } }),
+    credential: { type: "string", minLength: 1, maxLength: 16384 },
+    snapshot: closed({ t0: uint, watermark: uint, watermarkTakenAt: uint, revokedConsentIds: { type: "array", uniqueItems: true, items: id } }),
+    expiresAt: uint,
+}));
+export const TOOL_RESULT_INPUT_SCHEMA = deepFreeze(closed(pair));
+export const TOOL_RESULT_ANSWER_SCHEMAS = deepFreeze({
+    available: status("available", { ...pair, content: { type: "string", maxLength: TOOL_RESULT_MAX_CONTENT_BYTES }, truncated: bool, byteCount: { ...uint, maximum: TOOL_RESULT_MAX_CONTENT_BYTES }, error: bool, capturedAt: uint }),
+    pending: status("pending", pair),
+    "not-shared": status("not-shared"),
+    missing: status("missing"),
+    expired: status("expired"),
+});
+export const TOOL_RESULT_OUTPUT_SCHEMA = deepFreeze({ oneOf: Object.values(TOOL_RESULT_ANSWER_SCHEMAS) });
+export const TOOL_RESULT_CONSENT_INPUT_SCHEMA = deepFreeze(closed({ consent: TOOL_RESULT_CONSENT_SCHEMA }));
+export const TOOL_RESULT_CONSENT_OUTPUT_SCHEMA = deepFreeze(status("active", { consentId: id }));
+export const TOOL_RESULT_REVOKE_INPUT_SCHEMA = deepFreeze(closed({ consentId: id }));
+export const TOOL_RESULT_REVOKE_ANSWER_SCHEMAS = deepFreeze({
+    known: status("known", { consentId: id }),
+    refused: status("refused", { consentId: id }),
+    unknown: status("unknown", { consentId: id }),
+});
+export const TOOL_RESULT_REVOKE_OUTPUT_SCHEMA = deepFreeze({ oneOf: Object.values(TOOL_RESULT_REVOKE_ANSWER_SCHEMAS) });
+/** Frozen declarations only. No service registration, handler, grant or profile is installed. */
+export const TOOL_RESULTS_COMMANDS = deepFreeze([
+    { name: "tool-result", capability: "tool-results.read", input: TOOL_RESULT_INPUT_SCHEMA, output: TOOL_RESULT_OUTPUT_SCHEMA },
+    { name: "tool-result-consent", capability: "tool-results.consent", input: TOOL_RESULT_CONSENT_INPUT_SCHEMA, output: TOOL_RESULT_CONSENT_OUTPUT_SCHEMA },
+    { name: "tool-result-revoke", capability: "tool-results.revoke", input: TOOL_RESULT_REVOKE_INPUT_SCHEMA, output: TOOL_RESULT_REVOKE_OUTPUT_SCHEMA },
+]);
+export const TOOL_RESULTS_CLUSTER = deepFreeze({
+    urn: "ai.cotal.tool-results", revision: 1, attributes: [], events: [],
+    commands: TOOL_RESULTS_COMMANDS.map(row => ({
+        name: row.name, class: "ephemeral", targeted: true, modes: ["handle"], capability: row.capability,
+        inputDigest: singleDocumentClosure(row.input).closureDigest,
+        outputDigest: singleDocumentClosure(row.output).closureDigest,
+    })),
+});
+const validators = new WeakMap();
+function bad(what) {
+    throw new EpEnvelopeError("bad-request", `private tool-result ${what} does not match its closed contract`, undefined, "not-executed");
+}
+function parse(schema, raw, what) {
+    let copy;
+    try {
+        copy = JSON.parse(canonicalJson(raw));
+    }
+    catch {
+        bad(what);
+    }
+    let validate = validators.get(schema);
+    if (!validate) {
+        validate = compileContractSchema({ root: schema });
+        validators.set(schema, validate);
+    }
+    if (!validate(copy))
+        bad(what);
+    return deepFreeze(copy);
+}
+/** Parse shape and static bindings only; verify signatures and current authority separately. */
+export function parseToolResultConsent(raw) {
+    const c = parse(TOOL_RESULT_CONSENT_SCHEMA, raw, "consent");
+    if (c.holder.owner !== c.target.owner || c.holder.actor === c.target.actor || c.exp <= c.iat || c.exp - c.iat > TOOL_RESULT_CONSENT_MAX_TTL_MS)
+        bad("consent binding or window");
+    return c;
+}
+export function parseToolResultRevocation(raw) {
+    return parse(TOOL_RESULT_REVOCATION_SCHEMA, raw, "revocation");
+}
+export function parseToolResultServingMaterial(raw) {
+    const m = parse(TOOL_RESULT_SERVING_MATERIAL_SCHEMA, raw, "serving material");
+    if (!isAccountNkey(m.accountPublicKey) || m.snapshot.watermarkTakenAt < m.snapshot.t0 || m.expiresAt !== Math.floor(m.snapshot.t0 / 1000) + 600)
+        bad("serving material binding or expiry");
+    try {
+        fromPublic(m.accountPublicKey);
+    }
+    catch {
+        bad("serving material account key");
+    }
+    return m;
+}
+export function parseToolResultAnswer(raw) {
+    const a = parse(TOOL_RESULT_OUTPUT_SCHEMA, raw, "answer");
+    if (a.state === "available" && new TextEncoder().encode(a.content).length !== a.byteCount)
+        bad("answer byte count");
+    return a;
+}
+export function parseToolResultRevocationOutcome(raw) {
+    return parse(TOOL_RESULT_REVOKE_OUTPUT_SCHEMA, raw, "revocation outcome");
+}
+/** Resolve only the accepted anchor family/scope. This does not verify a consent signature,
+ *  establish human proof or authorize redemption; no signer is exposed. */
+export async function resolveToolResultConsentAnchor(resolve, keyId, at) {
+    const anchor = await resolveAnchorForUse(resolve, { keyId, role: "consents", at });
+    assertAnchorScopeCovers(anchor, "consents", TOOL_RESULTS_ENDPOINT, "private tool-result consent");
+    return anchor;
+}
+//# sourceMappingURL=private-tool-results.js.map

package/dist/private-tool-results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-tool-results.js","sourceRoot":"","sources":["../src/private-tool-results.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAA0C,MAAM,uBAAuB,CAAC;AAE7H;kFACkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AACpD,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgDlE,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;YAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QACvF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC9C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AACzF,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC3E,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC9D,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC7D,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC5E,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;AAC/E,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,MAAM,MAAM,GAAG,CAAC,UAAmC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACzJ,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;AAC3D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAClD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,SAAkC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAEvH,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1D,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM;IAC1E,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI;IACtD,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE;CACvF,CAAC,CAAC,CAAC;AACJ,MAAM,CAAC,MAAM,6BAA6B,GAAG,UAAU,CAAC,MAAM,CAAC;IAC7D,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;CAC1G,CAAC,CAAC,CAAC;AACJ,MAAM,CAAC,MAAM,mCAAmC,GAAG,UAAU,CAAC,MAAM,CAAC;IACnE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,KAAK;IACvE,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,MAAM;IACxE,KAAK,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;IAC1I,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;IAC3I,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,CAAC;AACJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAClO,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC;CAC3B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;AAC1G,MAAM,CAAC,MAAM,gCAAgC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;AAC5G,MAAM,CAAC,MAAM,iCAAiC,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACjG,MAAM,CAAC,MAAM,+BAA+B,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,iCAAiC,GAAG,UAAU,CAAC;IAC1D,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;CAC9C,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC;AAExH,iGAAiG;AACjG,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;IAC9C,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC5H,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAAE,KAAK,EAAE,gCAAgC,EAAE,MAAM,EAAE,iCAAiC,EAAE;IACvJ,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,qBAAqB,EAAE,KAAK,EAAE,+BAA+B,EAAE,MAAM,EAAE,gCAAgC,EAAE;CACpJ,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;IAC7C,GAAG,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;IACrE,QAAQ,EAAE,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;QACjG,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa;QAC3D,YAAY,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,aAAa;KAC9D,CAAC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,IAAI,OAAO,EAAoD,CAAC;AACnF,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,uBAAuB,IAAI,qCAAqC,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACxI,CAAC;AACD,SAAS,KAAK,CAAI,MAAc,EAAE,GAAY,EAAE,IAAY;IAC1D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACnE,IAAI,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAM,CAAC;AAC/B,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,CAAC,GAAG,KAAK,CAAoB,0BAA0B,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,8BAA8B;QAAE,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACjL,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,KAAK,CAAC,6BAA6B,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AACD,MAAM,UAAU,8BAA8B,CAAC,GAAY;IACzD,MAAM,CAAC,GAAG,KAAK,CAA4B,mCAAmC,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;QAAE,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC3L,IAAI,CAAC;QAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,CAAC,GAAG,KAAK,CAAmB,yBAAyB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS;QAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpH,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,OAAO,KAAK,CAAC,gCAAgC,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;AAC5E,CAAC;AAED;2EAC2E;AAC3E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAuB,EAAE,KAAa,EAAE,EAAU;IACrG,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/process-runtime.d.ts

@@ -0,0 +1,6 @@
+import type { PresenceRuntime } from "./types.js";
+/** This OS process's observation for one lifecycle scope. Each scope keeps one random id for the
+ *  process lifetime, including after an endpoint disconnects. Every scope shares the process start,
+ *  even when a lifecycle is registered later. It does not date a parent or model harness process. */
+export declare function processRuntime(lifecycleUid?: string): PresenceRuntime;
+//# sourceMappingURL=process-runtime.d.ts.map

package/dist/process-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-runtime.d.ts","sourceRoot":"","sources":["../src/process-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKlD;;qGAEqG;AACrG,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,eAAe,CAOrE"}

package/dist/process-runtime.js

@@ -0,0 +1,15 @@
+import { randomUUID } from "node:crypto";
+const startedAt = Math.floor(performance.timeOrigin);
+const scopes = new Map();
+/** This OS process's observation for one lifecycle scope. Each scope keeps one random id for the
+ *  process lifetime, including after an endpoint disconnects. Every scope shares the process start,
+ *  even when a lifecycle is registered later. It does not date a parent or model harness process. */
+export function processRuntime(lifecycleUid) {
+    let own = scopes.get(lifecycleUid);
+    if (!own) {
+        own = Object.freeze({ id: randomUUID(), startedAt, source: "endpoint-process" });
+        scopes.set(lifecycleUid, own);
+    }
+    return own;
+}
+//# sourceMappingURL=process-runtime.js.map

package/dist/process-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-runtime.js","sourceRoot":"","sources":["../src/process-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;AACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuC,CAAC;AAE9D;;qGAEqG;AACrG,MAAM,UAAU,cAAc,CAAC,YAAqB;IAClD,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/provision.d.ts

@@ -441,6 +441,11 @@ export interface MintPrincipal {
      *  dm/dlv/chathist grants are lifecycle-keyed EXACT names, so a credential cannot name another
      *  incarnation's resources. Other profiles ignore it. */
     lifecycleUid?: string;
+    /** The connection's history-reader id, the key of the observer and admin profiles' reader deletes
+     *  ({@link historyReaderConsumer}). A static mint leaves it unset, because there `connId` is the
+     *  credential's own nkey, which its holder proves by signing. The auth callout sets it to
+     *  {@link calloutReaderId}, because there `connId` is the inbox nonce the client chose. */
+    readerId?: string;
 }
 /** Onboard an agent for launch (auth mode): pre-create its bind-only DM (+ Plane-3 DELIVER + role
  *  TASK) durables, RECORD its read ACL in the durable registry (unless `durableMembership:false`), and

package/dist/provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAmCL,KAAK,iBAAiB,EAgBvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGhI,OAAO,EAAqG,KAAK,YAAY,EAA2B,MAAM,uBAAuB,CAAC;AAEtL,OAAO,EAAyD,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAKnJ,OAAO,EAA8D,KAAK,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC9I,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,gGAAgG;AAChG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,oBAAoB,GACpB,yBAAyB,GACzB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,GAKhB,aAAa,GAGb,gBAAgB,GAKhB,iBAAiB,GAKjB,gBAAgB,GAGhB,YAAY,GACZ,cAAc,GAMd,cAAc,GAQd,kBAAkB,GAIlB,QAAQ,GAIR,cAAc,GAId,iBAAiB,GAGjB,iBAAiB,GAGjB,gBAAgB,GAEhB,uBAAuB,GACvB,gCAAgC,GAChC,8BAA8B,GAC9B,iCAAiC,CAAC;AAEtC,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;;0EAI0E;AAC1E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C;;;;;;mGAMmG;AACnG,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;oDAOoD;AACpD,eAAO,MAAM,oBAAoB,QAA2D,CAAC;AAE7F;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CA4CjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;;;;;;;2EAS2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;2EAKuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;0EAO0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,UAAU,EAAE,gBAAgB;CAAG;AAElE;;uGAEuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAG9F;AAED;qEACqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAcpG;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;8FAE8F;AAC9F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB7E;AAED;;;;;;;mGAOmG;AACnG,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED;;sEAEsE;AACtE,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBzG;AAED;;8CAE8C;AAC9C,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;mFAO+E;IAC/E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;oGAUgG;IAChG,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;mGAS+F;IAC/F,mBAAmB,CAAC,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAC1C;4FACoF;QACpF,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IACF;;;;;;;oEAOgE;IAChE,iBAAiB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;;;;;;;4EAOwE;IACxE,qBAAqB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;kCAE8B;IAC9B,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;;;8DAG0D;IAC1D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;;8DAG0D;IAC1D,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;4GAGwG;IACxG,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,oFAAoF;IACpF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;oDAGgD;IAChD,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;2CAGuC;IACvC,aAAa,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE;2FACuF;IACvF,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAChD;;;;+BAI2B;IAC3B,WAAW,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IACrC;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;sBAKkB;IAClB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD;;;;yEAIqE;IACrE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;sCACkC;IAClC,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD;gEAC4D;IAC5D,cAAc,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,iGAAiG;IACjG,cAAc,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;8FAC0F;IAC1F,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAwCD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;2FAEuF;IACvF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqEjB;AA4CD;;;;uDAIuD;AACvD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,CAAA;CAAE,EAC1F,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CvC;AAMD;;;;;;;;;;;;2FAY2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgdzB;AAmuCD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;CAC5B,GAAG,MAAM,CAST;AA2BD;;;;;;;;;;oFAUoF;AACpF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;mEAI+D;IAC/D,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;kEAI8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8DAC0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,MAAM,CAyCR"}
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAqCL,KAAK,iBAAiB,EAgBvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAmD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGhI,OAAO,EAAqG,KAAK,YAAY,EAA2B,MAAM,uBAAuB,CAAC;AAEtL,OAAO,EAAyD,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAKnJ,OAAO,EAA8D,KAAK,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC9I,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,gGAAgG;AAChG,MAAM,MAAM,OAAO,GACf,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,YAAY,GACZ,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,oBAAoB,GACpB,yBAAyB,GACzB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,eAAe,GAEf,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GAGV,2BAA2B,GAC3B,sBAAsB,GACtB,UAAU,GAIV,gBAAgB,GAKhB,aAAa,GAGb,gBAAgB,GAKhB,iBAAiB,GAKjB,gBAAgB,GAGhB,YAAY,GACZ,cAAc,GAMd,cAAc,GAQd,kBAAkB,GAIlB,QAAQ,GAIR,cAAc,GAId,iBAAiB,GAGjB,iBAAiB,GAGjB,gBAAgB,GAEhB,uBAAuB,GACvB,gCAAgC,GAChC,8BAA8B,GAC9B,iCAAiC,CAAC;AAEtC,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GAKpB,kBAAkB,GAClB,UAAU,GACV,yBAAyB,GACzB,OAAO,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;;0EAI0E;AAC1E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C;;;;;;mGAMmG;AACnG,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;oDAOoD;AACpD,eAAO,MAAM,oBAAoB,QAA2D,CAAC;AAE7F;;;qGAGqG;AACrG,eAAO,MAAM,0BAA0B,QAAe,CAAC;AAEvD;;;;;2EAK2E;AAC3E,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D;yFACyF;AACzF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,wBAAwB,CA4CjF,CAAC;AAWF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,wBAAwB,CAEjF;AAED;;;oGAGoG;AACpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AACjG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgC,GAAG,UAAU,CAcnG;AAED;;;;;;;;;2EAS2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;2EAKuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;0EAO0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,UAAU,EAAE,gBAAgB;CAAG;AAElE;;uGAEuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAG9F;AAED;qEACqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAcpG;AAYD;;;;;;;yEAOyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAazD;AAED;;8FAE8F;AAC9F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrF;AAED;;;kEAGkE;AAClE,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB7E;AAED;;;;;;;mGAOmG;AACnG,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED;;sEAEsE;AACtE,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBzG;AAED;;8CAE8C;AAC9C,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIvE;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB;6GACyG;IACzG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;mFAO+E;IAC/E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;sFAEkF;IAClF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;2FAGuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;4DAGwD;IACxD,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;oDAEgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;oGAUgG;IAChG,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;wFAKoF;IACpF,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;0DAEsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;yFAMqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;mGAS+F;IAC/F,mBAAmB,CAAC,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAC1C;4FACoF;QACpF,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IACF;;;;;;;oEAOgE;IAChE,iBAAiB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F;;;;;;;4EAOwE;IACxE,qBAAqB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;kCAE8B;IAC9B,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;;;8DAG0D;IAC1D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;;8DAG0D;IAC1D,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;4GAGwG;IACxG,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,oFAAoF;IACpF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;oDAGgD;IAChD,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;2CAGuC;IACvC,aAAa,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE;2FACuF;IACvF,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAChD;;;;+BAI2B;IAC3B,WAAW,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IACrC;gGAC4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;sBAKkB;IAClB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD;;;;yEAIqE;IACrE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;sCACkC;IAClC,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD;gEAC4D;IAC5D,cAAc,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,iGAAiG;IACjG,cAAc,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;8FAC0F;IAC1F,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,iGAAiG;IACjG,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAwCD,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C;;2FAEuF;IACvF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;mBAMe;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC;;;;uFAImF;IACnF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;6EAEyE;IACzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;iDAK6C;IAC7C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;4GAG4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;+FAG2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAoBD;;;;;;yDAMyD;AACzD,wBAAsB,cAAc,CAClC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;sFAIsF;AACtF,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BnB;AAGD;;;;;;iGAMiG;AACjG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAqEjB;AA4CD;;;;uDAIuD;AACvD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,CAAA;CAAE,EAC1F,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CvC;AAMD;;;;;;;;;;;;2FAY2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,QAAQ,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAydzB;AA+uCD;;;;;0FAK0F;AAC1F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3H;AAoBD;;gFAEgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1H;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;CAC5B,GAAG,MAAM,CAST;AA2BD;;;;;;;;;;oFAUoF;AACpF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;4FACwF;IACxF,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;mEAI+D;IAC/D,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;kEAI8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8DAC0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,MAAM,CAyCR"}

package/dist/provision.js

@@ -19,7 +19,7 @@ import { randomBytes } from "node:crypto";
 import { join } from "node:path";
 import { decode, encodeOperator, encodeAccount, encodeUser, fmtCreds, } from "@nats-io/jwt";
 import { createOperator, createAccount, fromPublic, fromSeed } from "@nats-io/nkeys";
-import { token, spacePrefix, chatSubject, assertValidChannel, resolveReadAcl, principalKey, parsePrincipalKey, deprovisionTargetPrincipal, principalTags, assertInboxConnId, DEV_OWNER, unicastSubject, anycastSubject, controlServiceSubject, CONTROL_DELIVERY, CONTROL_DELIVERY_ADMIN, artifactBucket, objectStoreStream, chatStream, dmStream, taskStream, dlvStream, inboxStream, chatHistDurable, dmDurable, taskDurable, dlvDurable, presenceBucket, channelBucket, membersBucket, aclBucket, aclKey, memberKey, assertLifecycleToken, membershipBucket, deliveryBucket, managerBucket, MANAGER_LEASE_KEY, MANAGER_RENEWAL_LEASE_KEY, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, MEMBERSHIP_INBOX_PREFIX, FANOUT_DURABLE, INBOX_READER_DURABLE, livenessSubject, livenessServeFilter, livenessReplyGrant, isTransferStream, } from "./subjects.js";
+import { token, spacePrefix, chatSubject, assertValidChannel, resolveReadAcl, principalKey, parsePrincipalKey, deprovisionTargetPrincipal, principalTags, assertInboxConnId, DEV_OWNER, unicastSubject, anycastSubject, controlServiceSubject, CONTROL_DELIVERY, CONTROL_DELIVERY_ADMIN, artifactBucket, objectStoreStream, chatStream, dmStream, taskStream, dlvStream, inboxStream, chatHistDurable, historyReaderConsumer, HISTORY_READERS, dmDurable, taskDurable, dlvDurable, presenceBucket, channelBucket, membersBucket, aclBucket, aclKey, memberKey, assertLifecycleToken, membershipBucket, deliveryBucket, managerBucket, MANAGER_LEASE_KEY, MANAGER_RENEWAL_LEASE_KEY, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, MEMBERSHIP_INBOX_PREFIX, FANOUT_DURABLE, INBOX_READER_DURABLE, livenessSubject, livenessServeFilter, livenessReplyGrant, isTransferStream, } from "./subjects.js";
 import { LIVENESS_PLANES } from "./liveness.js";
 import { epCallerGrantRows, epServeGrantRows, epBaselineGrantRows, baselineCallerCapabilities, spawnCallerCapabilities, runCallerCapabilities, epRequestGrantRows, operatorInstrumentCapabilities, instanceOnlyManagerCapabilities, epDescribeAllGrantRow, BASELINE_LIFECYCLE_ENDPOINT, } from "./endpoint-grants.js";
 import { assertServeGrantMintable, finalizeServeIssuance } from "./endpoint-service.js";
@@ -789,23 +789,30 @@ export function permissionsFor(profile, space, pr, opts) {
         const sub = profile === "admin"
             ? [`${spacePrefix(space)}.chat.>`, `${spacePrefix(space)}.inst.>`, `${spacePrefix(space)}.svc.>`, inbox]
             : [`${spacePrefix(space)}.chat.>`, inbox];
+        // History readers (channelHistory, multiChannelHistory, dmHistory) are named consumers keyed on
+        // this connection's reader id (see MintPrincipal.readerId). The profile may delete exactly those
+        // names and no other consumer (#4123): each read deletes its readers when it ends, so polling no
+        // longer fills the stream's consumer limit.
+        const readerId = pr.readerId ?? pr.connId;
+        const readerDeletes = (stream) => Array.from({ length: HISTORY_READERS }, (_, i) => `$JS.API.CONSUMER.DELETE.${stream}.${historyReaderConsumer(readerId, i)}`);
         const allow = [
             "$JS.API.INFO",
             `$JS.API.STREAM.INFO.${CHAT}`,
             `$JS.API.STREAM.INFO.${KV}`,
-            // NO CONSUMER.DELETE on any stream this profile reads (#691). Its consumers are client-named
-            // ordered consumers (`oc_<nuid>_<serial>`, the serial bumped on every rebuild), so the only
-            // expressible grant is stream-wide, and stream-wide let one observer delete another
-            // principal's live watch cursors and the delivery daemon's fan-out durable. The broker reaps
-            // these consumers at their inactive threshold instead, and the client treats a refused
-            // delete of its own ephemeral consumer as that designed outcome.
+            // NO stream-wide CONSUMER.DELETE on any stream this profile reads (#691). Its watch consumers
+            // are client-named ordered consumers (`oc_<nuid>_<serial>`, the serial bumped on every
+            // rebuild), so the only expressible grant for them is stream-wide, and stream-wide let one
+            // observer delete another principal's live watch cursors and the delivery daemon's fan-out
+            // durable. The broker reaps those consumers at their inactive threshold instead, and the
+            // client treats a refused delete of its own watch consumer as that designed outcome.
             //
-            // ephemeral backlog consumer (channelHistory): a multi-filter create can't encode its
-            // filter in the subject → bare form; the .> form covers named consumers.
+            // history reader consumer: a multi-filter create can't encode its filter in the subject → bare
+            // form; the .> form covers the single-filter named create.
             `$JS.API.CONSUMER.CREATE.${CHAT}`,
             `$JS.API.CONSUMER.CREATE.${CHAT}.>`,
             `$JS.API.CONSUMER.INFO.${CHAT}.>`,
             `$JS.API.CONSUMER.MSG.NEXT.${CHAT}.>`,
+            ...readerDeletes(CHAT),
             `$JS.ACK.${CHAT}.>`,
             `$JS.API.CONSUMER.CREATE.${KV}.>`, // kv.watch ordered consumer (roster is public)
             `$JS.API.CONSUMER.INFO.${KV}.>`,
@@ -835,7 +842,7 @@ export function permissionsFor(profile, space, pr, opts) {
         if (profile === "admin") {
             // DM history backfill (dmHistory): same bare-form gotcha as CHAT — filter_subjects is
             // plural so the create lands on the bare subject; the .> form covers named consumers.
-            allow.push(`$JS.API.STREAM.INFO.${DM}`, `$JS.API.CONSUMER.CREATE.${DM}`, `$JS.API.CONSUMER.CREATE.${DM}.>`, `$JS.API.CONSUMER.INFO.${DM}.>`, `$JS.API.CONSUMER.MSG.NEXT.${DM}.>`, `$JS.ACK.${DM}.>`);
+            allow.push(`$JS.API.STREAM.INFO.${DM}`, `$JS.API.CONSUMER.CREATE.${DM}`, `$JS.API.CONSUMER.CREATE.${DM}.>`, `$JS.API.CONSUMER.INFO.${DM}.>`, `$JS.API.CONSUMER.MSG.NEXT.${DM}.>`, ...readerDeletes(DM), `$JS.ACK.${DM}.>`);
         }
         return { sub: { allow: sub }, pub: { allow } };
     }
@@ -1063,6 +1070,12 @@ export function permissionsFor(profile, space, pr, opts) {
     // the `ctl.<tier>.<id>.reply.>` subtrees are gone with the ctl rail.
     return { pub: { allow: pubAllow, deny: pubDeny }, sub: { allow: [inbox, deliveryReplies, ...livenessReplies, ...subChat, ...epSub] } };
 }
+/** The reads a launch on one Manager needs: `status` (its execution mode and which connectors it
+ * can launch), `models` (their catalogs) and `resolve-cwd` (a directory's canonical form on its
+ * host). A spawn holder learns each by launching there, so a spawn-scoped manager-caller view
+ * carries them on its one pinned instance. The standing spawn set does not: it reaches every
+ * manager in the space through the class rail. */
+const LAUNCH_READ_COMMANDS = Object.freeze(["status", "models", "resolve-cwd"]);
 /** One seat's manager control view. It carries no agent messaging or delivery surface, and every
  * manager request, including describe, is pinned to one exact registered instance. */
 function managerCallerPermissions(space, pr, opts) {
@@ -1076,6 +1089,7 @@ function managerCallerPermissions(space, pr, opts) {
         { endpoint: BASELINE_LIFECYCLE_ENDPOINT, command: "describe" },
         ...baselineCallerCapabilities().filter((cap) => cap.endpoint === BASELINE_LIFECYCLE_ENDPOINT),
         ...(caps.includes("spawn") ? spawnCallerCapabilities(pr.owner) : []),
+        ...(caps.includes("spawn") ? LAUNCH_READ_COMMANDS.map((command) => ({ endpoint: BASELINE_LIFECYCLE_ENDPOINT, command })) : []),
         ...(caps.includes("run") ? runCallerCapabilities(pr.owner) : []),
         ...(caps.includes("admin") ? operatorInstrumentCapabilities("admin", pr.owner) : []),
     ];
@@ -1294,14 +1308,18 @@ function operatorPermissions(space, pr) {
                 anycastSubject(space, "*", pr.owner, pr.actor), // svc.*.<o>.<a>   — anycast any role as me
                 `$KV.${presenceBucket(space)}.${principalKey(pr.owner, pr.actor).key}`, // own presence key only
                 "$JS.API.INFO",
-                // Presence watch (name→id resolution + the live roster) — read-only ordered consumer. No
-                // STREAM.MSG.GET (the roster is the in-memory watch cache).
+                // Presence read (name→id resolution + the roster). The transient endpoint reads the bucket once
+                // with a batched Direct Get, whose request subject is the bare stream (#4091); the consumer rows
+                // serve a watch. No STREAM.MSG.GET.
                 `$JS.API.STREAM.INFO.${PKV}`,
+                `$JS.API.DIRECT.GET.${PKV}`,
                 `$JS.API.CONSUMER.CREATE.${PKV}.>`,
                 `$JS.API.CONSUMER.INFO.${PKV}.>`,
-                // Channel registry read — the transient endpoint opens+watches it, and multicast reads a
-                // channel's delivery class. Read-only (no `$KV.<channel>` write — that's the provisioner).
+                // Channel registry read — the transient endpoint reads it once (batched Direct Get), multicast
+                // reads a channel's delivery class, and `channels list` scans it. Read-only (no `$KV.<channel>`
+                // write — that's the provisioner).
                 `$JS.API.STREAM.INFO.${CHKV}`,
+                `$JS.API.DIRECT.GET.${CHKV}`,
                 `$JS.API.STREAM.MSG.GET.${CHKV}`,
                 // Keyed KV get rides `DIRECT.GET.<stream>.$KV.<bucket>.<key>` — the key is in the SUBJECT, so
                 // the grant needs the trailing `.>` (unlike STREAM.MSG.GET, which carries it in the payload).