@cotal-ai/auth 0.12.0 → 0.13.0

package/dist/connect-reader.js

@@ -0,0 +1,154 @@
+import { jetstreamManager } from "@nats-io/jetstream";
+import { EpEnvelopeError, assertInboxConnId, epAuthBucket, recordsBucket } from "@cotal-ai/core";
+import { assertAuthorityStreamShape, openLifecycleMappingReader, readLifecycleMappingLeader } from "./lifecycle-registry.js";
+import { credRowKey, parseLedgerRow } from "./credential-ledger.js";
+/**
+ * The connect reader's SCOPED credential grant (SPEC 13.9). Read-only over BOTH authority stores,
+ * plus the bind-time shape-proof INFO and a connection-scoped reply inbox. It holds NO write, NO
+ * consumer create/update/delete, NO `DIRECT.GET`, and no account-wide inbox.
+ *
+ * D32 residual (named, not pretend-confined): `$JS.API.STREAM.MSG.GET.<stream>` is body-selected —
+ * broker ACLs cannot scope it to only `cred.`/head subjects, so this grant is a space-wide read of
+ * credential METADATA (holderPrincipal/state/chain/lifecycleUid/exp; NO secret key material rides
+ * the row, confirmed against the closed `CredentialLedgerRow` schema) plus the caller-selected-reply
+ * injection class every raw `MSG.GET` profile carries. Acceptable for this trusted, bounded-lived,
+ * short-exp+renewed infra reader; a genuinely ledgered infra-reader family is the deferred
+ * infra-mint work (a self-minted reader is revoked by stopping the service / rotating the seed, not
+ * an agent-barrier revoke — it is not a managed-agent or endpoint descendant).
+ */
+export function authConnectReaderGrants(space, connId) {
+    const auth = `KV_${epAuthBucket(space)}`;
+    const records = `KV_${recordsBucket(space)}`;
+    // `connId` is the ONLY untrusted subject-forming interpolant (the space-derived stream names are
+    // trusted boot config); route it through the same grammar the sibling mediator/cleaner builders
+    // use, so a `>`/`*`/dotted value can never widen the scoped inbox to an account-wide subscribe.
+    const inbox = assertInboxConnId(connId);
+    return {
+        publish: [
+            "$JS.API.INFO",
+            `$JS.API.STREAM.INFO.${auth}`,
+            `$JS.API.STREAM.INFO.${records}`,
+            `$JS.API.STREAM.MSG.GET.${auth}`,
+            `$JS.API.STREAM.MSG.GET.${records}`,
+        ],
+        subscribe: [`_INBOX_${inbox}.>`],
+    };
+}
+const READERS = new WeakMap();
+function internals(reader) {
+    const i = READERS.get(reader);
+    if (!i)
+        throw new EpEnvelopeError("failed-precondition", "the connect reader was not constructed by openConnectReader(); a hand-assembled context never authorizes (SPEC 13.12)");
+    return i;
+}
+/**
+ * Open (or re-open, on reconnect) the connect reader on a DATA-account connection, shape-proving
+ * BOTH stores at bind (SPEC 13.12) — primary/un-mirrored/non-evicting, and the auth store
+ * additionally `allow_direct=false`. Call this on every (re)bind: a dropped reader reconnecting
+ * could land on a mirror/follower, so the primary-store proof must re-run before it serves any
+ * connect read again. A store that cannot be proved never serves.
+ */
+export async function openConnectReader(nc, space) {
+    const authBucket = epAuthBucket(space);
+    let jsm;
+    try {
+        jsm = await jetstreamManager(nc);
+        const authCfg = (await jsm.streams.info(`KV_${authBucket}`)).config;
+        assertAuthorityStreamShape(authCfg, authBucket);
+        if (authCfg.allow_direct !== false)
+            throw new EpEnvelopeError("failed-precondition", `the auth store ${authBucket} has allow_direct=${String(authCfg.allow_direct)}, not false; a Direct-Get-capable credential store defeats leader-served deny-new (SPEC 13.1); reprovision`);
+    }
+    catch (e) {
+        if (e instanceof EpEnvelopeError)
+            throw e;
+        throw new EpEnvelopeError("failed-precondition", `the connect reader cannot bind + shape-prove the auth store ${authBucket} (SPEC 13.12): ${e?.message ?? String(e)}`);
+    }
+    // The records-head reads go through the mapping reader, which shape-proves the records store the
+    // same way at its own bind — so both stores are proved on this (re)bind.
+    const mapping = await openLifecycleMappingReader(nc, space);
+    const reader = Object.freeze({ space });
+    READERS.set(reader, { space, jsm, mapping });
+    return reader;
+}
+/**
+ * Leader-read a single credential-ledger row `cred.<uid>.<credid>` from the auth store (never a
+ * follower `DIRECT.GET`: a stale replica could still read `active` after a revoke). Returns
+ * `undefined` for a genuinely absent row; a DEL/PURGE marker or a garbled row THROWS (a deletion is
+ * never absence, and garbled trusted-path state never authorizes).
+ */
+async function readCredRowLeader(reader, uid, credid) {
+    const { jsm, space } = internals(reader);
+    const bucket = epAuthBucket(space);
+    const key = credRowKey(uid, credid);
+    let m;
+    try {
+        m = await jsm.streams.getMessage(`KV_${bucket}`, { last_by_subj: `$KV.${bucket}.${key}` });
+    }
+    catch (e) {
+        if (e.code === 10037)
+            return undefined; // no message on the subject
+        throw e;
+    }
+    if (!m)
+        return undefined;
+    const op = m.header?.get("KV-Operation");
+    if (op)
+        throw new EpEnvelopeError("failed-precondition", `the credential row ${key} carries a ${op} marker; a deletion is never absence; a revoked credential is a row with state:"revoked", not a tombstone (SPEC 13.1)`);
+    return parseLedgerRow(m.data, key);
+}
+/** A source chain that is EXACTLY the single `root` member (the root-issuance case, whose deny-new
+ *  also pins the lifecycle head's `currentCredentialId`). Session/handle chains are descendants. */
+function isRootChain(chain) {
+    return chain.length === 1 && chain[0] === "root";
+}
+/**
+ * The connect-time deny-new check (SPEC 13.1). Assumes the caller (the ledger connect authorizer)
+ * has ALREADY run the actor-row + scope + lifecycle-equality checks; this adds the credential-row
+ * liveness proof. THROWS to deny; returns on allow. Fail-closed throughout: absent/revoked/expired/
+ * mismatched rows and every read failure deny.
+ *
+ *  1. the bearer MUST carry `act.credentialId` (grammar-valid from validateUserToken). Claimless =>
+ *     deny (deny-new needs the claim; a pre-R1 bearer re-exchanges). A view bearer is NOT exempt;
+ *     a bearer merely lacking `act.view` is a normal agent connect and is fine.
+ *  2. leader-read `cred.<lifecycleUid>.<credid>`; require it exist, be `active`, be unexpired under
+ *     the service clock, and bind holderPrincipal `<owner>.<actor>` + lifecycleUid + credentialId
+ *     with NO normalization slack.
+ *  3. root-issued credential (`sourceChain === ["root"]`): ALSO leader-read the lifecycle head and
+ *     require it `active` with `currentCredentialId === credid`, so a SUPERSEDED root issuance is
+ *     denied even if its old row still reads active (release-last keeps these consistent; head
+ *     equality is the belt). A descendant (session/handle) leaf row is sufficient here: revoking an
+ *     ancestor revokes the whole `cred.<uid>.>` family / `bysrc` chain and verified-evicts before
+ *     the operation reports success, and after the leaf CAS deny-new holds.
+ */
+export async function authorizeConnectCredential(reader, t, now) {
+    const credid = t.act.credentialId;
+    if (credid === undefined)
+        throw new EpEnvelopeError("permission-denied", "the bearer carries no credential claim (act.credentialId); connect deny-new requires it; re-exchange for a fresh bearer (lifecycle credential-bound from v0.4 R1)");
+    const uid = t.act.lifecycleUid;
+    if (uid === undefined)
+        throw new EpEnvelopeError("permission-denied", "the bearer carries no lifecycle claim; a credential row is keyed by lifecycle uid (SPEC 13.1)");
+    const row = await readCredRowLeader(reader, uid, credid);
+    if (row === undefined)
+        throw new EpEnvelopeError("permission-denied", `no credential row cred.${uid}.${credid}; a revoked or never-issued credential does not connect (deny-new, SPEC 13.1)`);
+    if (row.state !== "active")
+        throw new EpEnvelopeError("permission-denied", `credential cred.${uid}.${credid} is "${row.state}", not active; a revoked credential does not connect (deny-new, SPEC 13.1)`);
+    const holder = `${t.owner}.${t.act.actor}`;
+    if (row.holderPrincipal !== holder)
+        throw new EpEnvelopeError("permission-denied", `credential cred.${uid}.${credid} is held by "${row.holderPrincipal}", not the connecting principal "${holder}"; a credential never authorizes a different principal (SPEC 13.1)`);
+    if (row.lifecycleUid !== uid)
+        throw new EpEnvelopeError("permission-denied", `credential row cred.${uid}.${credid} names lifecycle ${row.lifecycleUid}, not ${uid} (key/value divergence, SPEC 13.1)`);
+    if (row.credentialId !== credid)
+        throw new EpEnvelopeError("permission-denied", `credential row cred.${uid}.${credid} names credentialId ${row.credentialId} (key/value divergence, SPEC 13.1)`);
+    if (row.exp <= now())
+        throw new EpEnvelopeError("permission-denied", `credential cred.${uid}.${credid} expired at ${row.exp}; a lapsed credential does not connect (SPEC 13.1)`);
+    if (isRootChain(row.sourceChain)) {
+        const head = await readLifecycleMappingLeader(internals(reader).mapping, t.owner, t.act.actor);
+        if (head === undefined)
+            throw new EpEnvelopeError("permission-denied", `no lifecycle head for "${t.owner}/${t.act.actor}"; a root credential connect requires the current head (SPEC 13.1)`);
+        if (head.mapping.state !== "active")
+            throw new EpEnvelopeError("permission-denied", `the lifecycle head for "${t.owner}/${t.act.actor}" is "${head.mapping.state}", not active; a root credential of a retiring/retired incarnation does not connect (SPEC 13.1)`);
+        if (head.mapping.currentCredentialId !== credid)
+            throw new EpEnvelopeError("permission-denied", `the current root credential for "${t.owner}/${t.act.actor}" is ${head.mapping.currentCredentialId ?? "(none)"}, not ${credid}; a superseded root issuance does not connect (deny-new, SPEC 13.1)`);
+    }
+}
+//# sourceMappingURL=connect-reader.js.map

package/dist/connect-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-reader.js","sourceRoot":"","sources":["../src/connect-reader.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,0BAA0B,EAA+B,MAAM,yBAAyB,CAAC;AAC1J,OAAO,EAAE,UAAU,EAAE,cAAc,EAA4B,MAAM,wBAAwB,CAAC;AAG9F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc;IACnE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAaD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAyC,CAAC;AAErE,SAAS,SAAS,CAAC,MAAqB;IACtC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QACJ,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,uHAAuH,CAAC,CAAC;IAC5K,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAkB,EAAE,KAAa;IACvE,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACpE,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK;YAChC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,kBAAkB,UAAU,qBAAqB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,4GAA4G,CAAC,CAAC;IAChP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,eAAe;YAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,+DAA+D,UAAU,kBAAmB,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpL,CAAC;IACD,iGAAiG;IACjG,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,MAAqB,EAAE,GAAW,EAAE,MAAc;IACjF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;IACN,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC,CAAC,4BAA4B;QAC5F,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,EAAE;QACJ,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,sBAAsB,GAAG,cAAc,EAAE,uHAAuH,CAAC,CAAC;IACrN,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;oGACoG;AACpG,SAAS,WAAW,CAAC,KAAe;IAClC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAqB,EAAE,CAAqB,EAAE,GAAiB;IAC9G,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mKAAmK,CAAC,CAAC;IACtN,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS;QACnB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,+FAA+F,CAAC,CAAC;IAElJ,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,SAAS;QACnB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,0BAA0B,GAAG,IAAI,MAAM,+EAA+E,CAAC,CAAC;IACzK,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QACxB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,MAAM,QAAQ,GAAG,CAAC,KAAK,4EAA4E,CAAC,CAAC;IAChL,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM;QAChC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,MAAM,gBAAgB,GAAG,CAAC,eAAe,oCAAoC,MAAM,oEAAoE,CAAC,CAAC;IACpO,IAAI,GAAG,CAAC,YAAY,KAAK,GAAG;QAC1B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,uBAAuB,GAAG,IAAI,MAAM,oBAAoB,GAAG,CAAC,YAAY,SAAS,GAAG,oCAAoC,CAAC,CAAC;IAC3K,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM;QAC7B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,uBAAuB,GAAG,IAAI,MAAM,uBAAuB,GAAG,CAAC,YAAY,oCAAoC,CAAC,CAAC;IAClK,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE;QAClB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,MAAM,eAAe,GAAG,CAAC,GAAG,oDAAoD,CAAC,CAAC;IAE7J,IAAI,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/F,IAAI,IAAI,KAAK,SAAS;YACpB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,oEAAoE,CAAC,CAAC;QACvK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,iGAAiG,CAAC,CAAC;QAChO,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,MAAM;YAC7C,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,QAAQ,SAAS,MAAM,qEAAqE,CAAC,CAAC;IACvP,CAAC;AACH,CAAC"}

package/dist/continuity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continuity.d.ts","sourceRoot":"","sources":["../src/continuity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAWhG,eAAO,MAAM,sBAAsB,oCAAoC,CAAC;AAcxE;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsF5H;AAQD,oFAAoF;AACpF,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAmBlC"}
+{"version":3,"file":"continuity.d.ts","sourceRoot":"","sources":["../src/continuity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAWhG,eAAO,MAAM,sBAAsB,oCAAoC,CAAC;AAcxE;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsF5H;AAQD,oFAAoF;AACpF,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsBlC"}

package/dist/continuity.js

@@ -129,9 +129,12 @@ export async function validateRetainedManagedAgent(input) {
         throw new Error(`retained sentinel credential for ${input.owner}.${input.actor} does not match space "${input.space}"`);
     // This checks the token hash in constant time and re-walks the current delegation envelope.
     const row = ledgerAuthorizeAgentExchange(input.dir, input.owner, input.actor, input.actorToken);
+    if (!row.lifecycleUid)
+        throw new Error(`retained agent ${input.owner}.${input.actor} has no lifecycleUid on its current ledger row; re-grant it (bearers are lifecycle-bound from v0.4)`);
     return {
         owner: row.owner,
         actor: row.actor,
+        lifecycleUid: row.lifecycleUid,
         scope: [...row.scope],
         allowSubscribe: [...row.allowSubscribe],
         allowPublish: [...row.allowPublish],

package/dist/continuity.js.map

@@ -1 +1 @@
-{"version":3,"file":"continuity.js","sourceRoot":"","sources":["../src/continuity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAgB,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAExE,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxG,MAAM,YAAY,GAAG,CAAC,MAAgB,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,KAA0B,EAAU,EAAE,CACxE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAI,KAAoB,EAAE,KAAa,EAAE,IAAY;IACxE,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,eAAe,IAAI,6EAA6E,CAAC,CAAC;IAClJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAkB,EAAE,GAAW,EAAE,KAAa;IAC3F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,cAAc,KAAK,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,uBAAuB,MAAM,CAAC,MAAM,iBAAiB,KAAK,GAAG,CAAC,CAAC;IAEjH,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;QAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG;QACtI,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,yCAAyC,CAAC,CAAC;IAE7F,MAAM,aAAa,GAAG,MAAM,CAAU,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;IAClD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAC1D,IAAI,aAAa,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU;QACtH,QAAQ,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG;QACjG,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG;QACzE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,mGAAmG,CAAC,CAAC;IACvJ,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC;SAChC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;QAC9B,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;QAChD,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,SAAS,EAAE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,SAAU,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9G,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI;SAClC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;KACrB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG;QAChB,KAAK;QACL,OAAO,EAAE;YACP,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG;YAC7B,cAAc;YACd,UAAU,EAAE,iBAAiB;YAC7B,iBAAiB;YACjB,cAAc;YACd,iBAAiB,EAAE,UAAU,CAAC,8BAA8B,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;YAClF,kBAAkB,EAAE,UAAU,CAAC,+BAA+B,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACrF,kBAAkB,EAAE,UAAU,CAAC,+BAA+B,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5F,eAAe,EAAE,UAAU,CAAC,4BAA4B,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5E,YAAY,EAAE,UAAU,CAAC,gCAAgC,EAAE,OAAO,CAAC,YAAY,CAAC;YAChF,aAAa,EAAE,UAAU,CAAC,iCAAiC,EAAE,OAAO,CAAC,aAAa,CAAC;SACpF;QACD,WAAW,EAAE,UAAU,CAAC,uBAAuB,EAAE,WAAW,CAAC;QAC7D,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACvF,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAClF,MAAM;KACP,CAAC;IACF,OAAO;QACL,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,sBAAsB,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAQlD;IACC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,KAAK,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC3H,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,MAAM,iBAAiB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,KAAK,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACnI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,0BAA0B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAE1H,4FAA4F;IAC5F,MAAM,GAAG,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAChG,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;QACrB,cAAc,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"continuity.js","sourceRoot":"","sources":["../src/continuity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAgB,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAExE,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxG,MAAM,YAAY,GAAG,CAAC,MAAgB,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,KAA0B,EAAU,EAAE,CACxE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAI,KAAoB,EAAE,KAAa,EAAE,IAAY;IACxE,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,eAAe,IAAI,6EAA6E,CAAC,CAAC;IAClJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAkB,EAAE,GAAW,EAAE,KAAa;IAC3F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,cAAc,KAAK,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,uBAAuB,MAAM,CAAC,MAAM,iBAAiB,KAAK,GAAG,CAAC,CAAC;IAEjH,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;QAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG;QACtI,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,yCAAyC,CAAC,CAAC;IAE7F,MAAM,aAAa,GAAG,MAAM,CAAU,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;IAClD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAC1D,IAAI,aAAa,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU;QACtH,QAAQ,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG;QACjG,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG;QACzE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,mGAAmG,CAAC,CAAC;IACvJ,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC;SAChC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;QAC9B,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;QAChD,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,SAAS,EAAE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,SAAU,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9G,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI;SAClC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;KACrB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG;QAChB,KAAK;QACL,OAAO,EAAE;YACP,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG;YAC7B,cAAc;YACd,UAAU,EAAE,iBAAiB;YAC7B,iBAAiB;YACjB,cAAc;YACd,iBAAiB,EAAE,UAAU,CAAC,8BAA8B,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;YAClF,kBAAkB,EAAE,UAAU,CAAC,+BAA+B,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACrF,kBAAkB,EAAE,UAAU,CAAC,+BAA+B,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5F,eAAe,EAAE,UAAU,CAAC,4BAA4B,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5E,YAAY,EAAE,UAAU,CAAC,gCAAgC,EAAE,OAAO,CAAC,YAAY,CAAC;YAChF,aAAa,EAAE,UAAU,CAAC,iCAAiC,EAAE,OAAO,CAAC,aAAa,CAAC;SACpF;QACD,WAAW,EAAE,UAAU,CAAC,uBAAuB,EAAE,WAAW,CAAC;QAC7D,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACvF,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAClF,MAAM;KACP,CAAC;IACF,OAAO;QACL,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,sBAAsB,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAQlD;IACC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,KAAK,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC3H,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,MAAM,iBAAiB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,KAAK,CAAC,KAAK,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACnI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,0BAA0B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAE1H,4FAA4F;IAC5F,MAAM,GAAG,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAChG,IAAI,CAAC,GAAG,CAAC,YAAY;QACnB,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,qGAAqG,CAAC,CAAC;IACrK,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;QACrB,cAAc,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/credential-ledger.d.ts

@@ -0,0 +1,343 @@
+/**
+ * The D13 NORMATIVE CREDENTIAL LEDGER + the full TAKEOVER ISSUANCE BARRIER, slices (3)+(2b)
+ * (SPEC §13.1, as amended). The sibling of `lifecycle-registry.ts`: the SAME minting authority
+ * over the SAME two stores, reached only through the sealed registry ({@link registryStores}),
+ * so a caller that cannot open the registry can neither write a ledger row nor run a barrier.
+ *
+ * What is here (all §13.1-normative):
+ *  - the AGENT-family ledger rows `cred.<lifecycleUid>.<credentialId>` — the closed row schema
+ *    `{ credentialId, holderPrincipal, lifecycleUid, sourceChain, state: active|revoked, exp }`
+ *    (monotonic state; revoked rows are never deleted), the per-ancestor lineage index
+ *    `bysrc.<issuerKeyId>.<id>.<lifecycleUid>.<credentialId>`, and the shared row codec the
+ *    ENDPOINT family `epcred.<endpoint>.<instanceId>.<credentialId>` reuses (same schema, same
+ *    discipline; the session adapter writes that family);
+ *  - the MINT PROTOCOL (observe gate → write rows → revision-pinned gate touch-CAS → release):
+ *    {@link stageAgentMint} + {@link finalizeAgentMint}. The touch is the §13.1 fence — a gate
+ *    (or any presented source gate) that moved since observation makes the pinned write LOSE,
+ *    the mint marks its OWN rows revoked and never releases. An unledgered mint cannot occur
+ *    through this module: release is gated on finalize, and finalize is gated on the staged
+ *    rows existing;
+ *  - SOURCE GATES `srcgate.<issuerKeyId>.<id>` (`{ state: open | frozen }`, CAS): every handle
+ *    in a presented chain is observed at stage and touch-CASed at finalize, and
+ *    {@link revokeHandleSource} is the handle-revocation walk — freeze the source gate FIRST,
+ *    enumerate `bysrc.`, revoke every descendant row, then VERIFIED cluster-wide eviction of
+ *    every revoked row's holder principal (fail-closed; the gate stays frozen forever);
+ *  - the TAKEOVER BARRIER {@link runAgentTakeoverBarrier} in the normative order: durable op
+ *    intent (`stage.<opId>`, create-only) → gate CAS `open → frozen` carrying the intent →
+ *    point-in-time enumeration of `cred.<lifecycleUid>.>` (the SEALED auth-ledger scanner's
+ *    fence-free LastPerSubject read — `ledger-scanner.ts`; the barrier profile holds NO auth-stream
+ *    `CONSUMER.CREATE`, whose body cannot be subject-confined, so the CREATE lives only in the
+ *    scanner's own sealed credential) → revoke EVERY row → VERIFIED
+ *    eviction of every holder principal (the injected `evictPrincipal` seam; `verifiedGone`
+ *    is the ONLY success — anything else throws and the gate STAYS frozen) → the epoch head
+ *    CAS LAST ({@link advanceEpochWithinTakeover}) → reopen the gate at generation G+1. Every
+ *    boundary is crash-resumable from the durable intent ({@link resumeAgentTakeover}), and
+ *    only the SAME operation resumes it.
+ *
+ * Deny-new vs kill-live, stated precisely (the two halves of revocation, §13.1):
+ *  - the ledger row CAS is the deny-new SUBSTRATE (rows live in a replicated, leader-served
+ *    JetStream KV, `allow_direct=false`, §13.12). The REDEEM arm is wired here: the session
+ *    release reads the normative row and refuses a `revoked` one, so a burned session
+ *    credential never re-releases. The CONNECT arm (the auth callout reading `cred.<uid>.<id>`
+ *    to refuse an OFFLINE credential's reconnect) is NOT wired in this slice: it needs the
+ *    ROOT credential ledgered (the head's `currentCredentialId`, which the activation saga
+ *    leaves absent until production issuance) and the presented credential to carry its id, so
+ *    it lands with production activation wiring. Until then, this barrier's deny-new covers the
+ *    REDEEM path and the LIVE connections it evicts; an offline root credential whose lifecycle
+ *    UID is preserved across takeover is NOT denied reconnect by the barrier alone (§13.1
+ *    requires takeover to FAIL LOUD where it cannot revoke + verified-evict, e.g. static
+ *    credentials — enforced at that connect-arm wiring, not here);
+ *  - the injected verified eviction is the cluster-wide kill-live with re-scan (core
+ *    `evictDeniedPrincipal`: CONNZ scan → per-server KICK → re-scan; partial scans fail
+ *    closed), which handles the LIVE half regardless of the connect-arm.
+ *
+ * SURFACE: NOTHING here is exported from the package index. The executor seam is the sealed
+ * registry itself (constructed only over the minting authority's authenticated connection);
+ * an `opId` is an identifier, never a bearer capability. Implementation staging lives in the
+ * `stage.` family only — never under a ledger prefix a barrier enumerates.
+ */
+import type { KV } from "@nats-io/kv";
+import { type EvictionResult } from "@cotal-ai/core";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+export declare const SOURCE_ROOT = "root";
+/** Validate ONE sourceChain member — `root`, `handle.<issuerKeyId>.<id>`, or
+ *  `session.<sessionId>` (SPEC 13.1) — and return its parsed shape. */
+export declare function parseSourceMember(member: unknown): {
+    kind: "root";
+} | {
+    kind: "handle";
+    issuerKeyId: string;
+    id: string;
+} | {
+    kind: "session";
+    sessionId: string;
+};
+/** The agent-family ledger key `cred.<lifecycleUid>.<credentialId>`. */
+export declare function credRowKey(lifecycleUid: string, credentialId: string): string;
+/** The endpoint-family ledger key `epcred.<endpoint>.<instanceId>.<credentialId>` (disjoint by
+ *  explicit prefix, never arity, SPEC 13.1). */
+export declare function epcredRowKey(endpoint: string, instanceId: string, credentialId: string): string;
+/** The per-ancestor lineage index key `bysrc.<issuerKeyId>.<id>.<lifecycleUid>.<credentialId>`. */
+export declare function bysrcKey(issuerKeyId: string, id: string, lifecycleUid: string, credentialId: string): string;
+/** The per-handle source gate key `srcgate.<issuerKeyId>.<id>`. */
+export declare function srcgateKey(issuerKeyId: string, id: string): string;
+/** A takeover/registration operation's durable intent key `stage.<opId>` (the `stage.<opId>.`
+ *  staging family root — NEVER under a ledger prefix a barrier enumerates, SPEC 13.1). */
+export declare function stageIntentKey(opId: string): string;
+/** The §13.1 credential-ledger row, closed. `lifecycleUid` is the HOLDER's KEY identity
+ *  component: the managed agent's lifecycle UID in the `cred.` family, the endpoint instance's
+ *  `instanceId` in the `epcred.` family (SPEC 13.1: `instanceId` is to an endpoint what
+ *  `lifecycleUid` is to a managed agent). `endpoint` is present ONLY in the `epcred.` family
+ *  (it forms the key there and is absent in `cred.`), so the KEY identity is never conflated
+ *  with the eviction target. `holderPrincipal` is who the barrier KICKs: ALWAYS a CONNZ-
+ *  attributable `<owner>.<actor>` dot-form (the caller principal in the `cred.` family; the
+ *  serving instance's own connection principal in the `epcred.` family, recorded from the
+ *  endpoint gate), NEVER the endpoint name (which CONNZ cannot attribute). */
+export interface CredentialLedgerRow {
+    credentialId: string;
+    holderPrincipal: string;
+    lifecycleUid: string;
+    /** The endpoint NAME whose token forms the `epcred.` key; present iff this is an endpoint-
+     *  family row, absent in the `cred.` family (which the lifecycleUid keys). */
+    endpoint?: string;
+    /** The FULL verified lineage at mint: `root` | `handle.<issuerKeyId>.<id>`… |
+     *  `session.<sessionId>` (SPEC 13.1 — for a handle redemption EVERY handle in the presented
+     *  chain, never only the leaf). */
+    sourceChain: string[];
+    /** Monotonic: `active → revoked` only; a revoked row is never deleted. */
+    state: "active" | "revoked";
+    exp: number;
+}
+/** Parse + validate a ledger row at its consuming boundary — closed schema, and the embedded
+ *  identity MUST rebuild the row's own key, so a key-mismatched or family-swapped poison row
+ *  never authorizes (SPEC 13.1/13.3). */
+export declare function parseLedgerRow(raw: Uint8Array, key: string): CredentialLedgerRow;
+/** Create-only write of a ledger/index row with the BYTE-IDENTICAL retry (a crashed writer's
+ *  retry of its OWN deterministic row proceeds; foreign content under a staged name refuses —
+ *  a name never silently re-binds, SPEC 13.6 discipline). PACKAGE-INTERNAL: the session
+ *  adapter writes its `epcred.` rows through this. */
+export declare function createRowByteIdempotent(kv: KV, key: string, value: unknown): Promise<void>;
+/** Idempotent monotonic revocation mark on a ledger row (revision-pinned CAS; a lost pin
+ *  re-reads — terminal-now returns, still-active retries). An ABSENT key refuses: the ledger
+ *  is never-deleted, so "revoke a row that does not exist" is a caller bug or corruption,
+ *  never a silent success. PACKAGE-INTERNAL (the session adapter routes through this too). */
+export declare function markLedgerRowRevoked(kv: KV, key: string): Promise<"revoked" | "already-revoked">;
+/** A per-handle source gate: `open` mints, `frozen` is the revocation fence (terminal for a
+ *  revoked handle — a source gate never reopens; SPEC 13.1). */
+export interface SourceGateRow {
+    issuerKeyId: string;
+    id: string;
+    state: "open" | "frozen";
+}
+/** Observe a source gate (the candidate read feeding a pinned CAS/touch). A DEL/PURGE marker
+ *  refuses loudly — a gate is never deleted. */
+export declare function observeSourceGate(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+}): Promise<{
+    row: SourceGateRow;
+    revision: number;
+} | undefined>;
+/** Create a handle's source gate OPEN (at the handle's own provisioning). Create-only:
+ *  idempotent for the identical row; anything else (including a deletion marker) conflicts. */
+export declare function createSourceGateOpen(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+}): Promise<void>;
+/** CAS a source gate `open → frozen` at the observed revision — the handle-revocation fence
+ *  (SPEC 13.1: freeze BEFORE enumerating `bysrc.`; an in-flight redemption either finished
+ *  before the freeze, so its rows are in the enumeration, or loses its pinned touch). */
+export declare function freezeSourceGate(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+    revision: number;
+}): Promise<void>;
+/** What {@link stageAgentMint} durably staged, handed to {@link finalizeAgentMint}. BRANDED
+ *  (WeakMap membership): only {@link stageAgentMint} produces one, so a hand-assembled or
+ *  mutated object (e.g. an empty `pins` array that would finalize with no gate proof) can never
+ *  reach the touch-CAS. The finalize NEVER trusts fields read back from this object: the
+ *  authoritative pins/rowKey snapshot lives in the module-private WeakMap value (a
+ *  shallow-frozen public array left mutable pin OBJECTS a caller could rewrite to duplicate
+ *  the source-gate pin and skip the lifecycle gate). The public object is deep-frozen too,
+ *  but the snapshot is the authority. */
+export interface StagedAgentMint {
+    readonly lifecycleUid: string;
+    readonly credentialId: string;
+    /** The observed lifecycle-gate + source-gate pins the finalize touch-CASes, keyed by KV key. */
+    readonly pins: ReadonlyArray<{
+        readonly key: string;
+        readonly revision: number;
+    }>;
+    /** The staged row's own key (what a losing finalize revokes). */
+    readonly rowKey: string;
+}
+/**
+ * Stage an AGENT-family mint (SPEC 13.1 mint protocol, steps observe + write-rows): observe
+ * the lifecycle issuance gate (must exist and be `open` — a frozen gate is a barrier in
+ * flight, a retired one is terminal) and EVERY presented handle's source gate (must exist and
+ * be `open`), recording each revision; then create the ledger row (`state: "active"` — the
+ * row is authority only after finalize releases, and the barrier enumerates it either way)
+ * and one `bysrc.` index row per handle chain member. Returns the staged coordinates for
+ * {@link finalizeAgentMint}. Nothing is released here.
+ */
+export declare function stageAgentMint(reg: LifecycleRegistry, args: {
+    lifecycleUid: string;
+    credentialId: string;
+    holderPrincipal: string;
+    sourceChain: string[];
+    exp: number;
+}): Promise<StagedAgentMint>;
+/**
+ * Finalize an AGENT-family mint (SPEC 13.1 mint protocol, step gate-CAS): touch-CAS every
+ * observed gate — the lifecycle gate and each presented source gate — at its pinned revision,
+ * each DISTINCT key once, in CANONICAL (sorted) order (the same crossed-pair discipline as the
+ * session stage). The touch preserves the value and bumps only the revision: a barrier or a
+ * handle revocation that moved ANY of them since observation makes the pinned write LOSE, the
+ * mint marks its OWN row revoked, and throws `permission-denied` — it never releases. Only a
+ * finalize that returns cleanly permits the caller to release the credential bytes.
+ */
+export declare function finalizeAgentMint(reg: LifecycleRegistry, staged: StagedAgentMint): Promise<void>;
+/** One enumerated ledger row (its key, parsed value, and store revision). */
+export interface EnumeratedRow {
+    key: string;
+    row: CredentialLedgerRow;
+    revision: number;
+}
+/**
+ * Enumerate a lifecycle's FULL descendant family `cred.<lifecycleUid>.>` (SPEC 13.1/13.9) through
+ * the SEALED auth-ledger scanner ({@link registryScanner}). The scan is a fence-free LastPerSubject
+ * read: under the normative history=1 store a same-subject `active→revoked` overwrite EVICTS the
+ * pre-scan revision, so the scanner delivers each subject's CURRENT last (a concurrent revoke is
+ * SEEN, never dropped). The scanner holds the ONLY auth-stream `CONSUMER.CREATE` on its own sealed
+ * credential; the barrier profile holds none (a consumer-create body is not subject-ACL confinable,
+ * nats-server#8274 — ledger-scanner.ts).
+ */
+export declare function enumerateAgentFamily(reg: LifecycleRegistry, lifecycleUid: string): Promise<EnumeratedRow[]>;
+/** A durable operation intent under `stage.<opId>` (SINGLE segment: the session release pins
+ *  live at `stage.session.<sid>.<c|s>` and are not operations). */
+export interface OperationIntentRef {
+    opId: string;
+    kind: "takeover" | "retirement";
+    lifecycleUid: string;
+}
+/**
+ * Enumerate every durable OPERATION intent `stage.<opId>` (SPEC 13.1) — the boot-resume
+ * discovery: a barrier executor that crashed mid-operation finds what it may owe here (whether
+ * an intent is actually OWED is the gate's call: only a gate still frozen by that opId is —
+ * completed and lost operations leave their intent behind by design). Multi-segment `stage.`
+ * keys (the session release pins) are not operations and are skipped; a single-segment intent
+ * that carries a DEL/PURGE marker, fails to parse, or names an unknown kind THROWS — an intent
+ * is never deleted while resumable, and garbled trusted-path state never drives a barrier.
+ */
+export declare function enumerateOperationIntents(reg: LifecycleRegistry): Promise<OperationIntentRef[]>;
+/** The injected VERIFIED-EVICTION seam (§13.9: the barrier executor holds the deployment's
+ *  `evictPrincipal` capability for exactly this step). `verifiedGone` is the ONLY success. */
+export type EvictPrincipal = (principal: string) => Promise<EvictionResult>;
+/** The injected SESSION-PAIR reconciler (SPEC 13.1: a lifecycle barrier tears down BOTH halves
+ *  of a session, not just the caller credential under `cred.<uid>.>`). For each distinct
+ *  `session.<sessionId>` naming a revoked descendant, the barrier calls this to terminalize the
+ *  `session.<sessionId>` row and revoke the paired serving `epcred.` row, and it RETURNS the
+ *  serving row's CONNZ-attributable holder principal(s) so the barrier can UNION them into its
+ *  verified-eviction set (SPEC 13.6: a takeover on either side revokes BOTH credentials WITH
+ *  eviction — a row-only revocation would leave an already-connected serving session live).
+ *  Injected (not imported) so the credential ledger never depends on the session adapter.
+ *  Idempotent: an already-reconciled session still returns its principals (a resumed barrier
+ *  must still evict). */
+export type ReconcileSessionPair = (sessionId: string) => Promise<{
+    servingPrincipals: readonly string[];
+}>;
+/** The barrier's injected capabilities. `reconcileSessionPair` is optional: a deployment with
+ *  no sessions omits it, but a lifecycle that HAS session-derived credentials and omits it
+ *  fails loud (a torn-down half would be left live). */
+export interface TakeoverDeps {
+    evictPrincipal: EvictPrincipal;
+    reconcileSessionPair?: ReconcileSessionPair;
+}
+/** The durable takeover intent at `stage.<opId>` — captured BEFORE the freeze, so a crashed
+ *  barrier resumes the SAME operation from the SAME coordinates ({@link resumeAgentTakeover}). */
+export interface TakeoverIntent {
+    kind: "takeover";
+    lifecycleUid: string;
+    owner: string;
+    actor: string;
+    /** The head epoch the barrier supersedes (the epoch CAS advances fromEpoch → fromEpoch+1). */
+    fromEpoch: number;
+    /** The gate generation the barrier freezes at (the reopen advances it to fromGeneration+1). */
+    fromGeneration: number;
+}
+/** The barrier's outcome (durable facts, re-readable on resume). */
+export interface TakeoverResult {
+    opId: string;
+    lifecycleUid: string;
+    /** The successor's fenced epoch (fromEpoch + 1). */
+    toEpoch: number;
+    /** The gate's first mintable generation for the successor (fromGeneration + 1). */
+    toGeneration: number;
+    /** Ledger rows this run transitioned `active → revoked` (0 on a resume that found them done). */
+    revokedRows: number;
+    /** Every DISTINCT principal the barrier verified evicted (family holders + the alias itself). */
+    evictedPrincipals: string[];
+}
+/**
+ * The shared CONTAINMENT core of the lifecycle barriers (SPEC 13.1: takeover and terminal
+ * retirement run the SAME revoke + verified-evict discipline over the SAME family):
+ * point-in-time enumeration of `cred.<lifecycleUid>.>` → revoke EVERY row (idempotent — a
+ * resumed barrier finds some already revoked; the row CAS is the deny-new SUBSTRATE, module
+ * header) → reconcile BOTH halves of every session-derived credential (the reconciler
+ * terminalizes `session.<sessionId>` and revokes the paired serving `epcred.` row, returning
+ * the serving holders; a lifecycle that HAS session-derived credentials but no reconciler
+ * fails loud — the serving half would be left live) → VERIFIED cluster-wide eviction of every
+ * enumerated holder principal (revoked earlier runs included: their connections may still be
+ * live), the alias principal itself, and every session-serving principal. Fail-closed per
+ * principal: anything but `verifiedGone` throws and the calling barrier's gate stays frozen.
+ * PACKAGE-INTERNAL: both barriers reach it through the sealed registry only.
+ */
+export declare function containLifecycleFamily(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    barrier: "takeover" | "retirement";
+}, deps: TakeoverDeps): Promise<{
+    revokedRows: number;
+    evictedPrincipals: string[];
+}>;
+/**
+ * Run the FULL takeover issuance barrier for a managed-agent lifecycle (SPEC 13.1, in the
+ * normative order — see the module header). Idempotent/crash-resumable: every step re-checks
+ * durable state, so calling it again with the SAME `opId` (directly or via
+ * {@link resumeAgentTakeover}) finishes the same operation; a DIFFERENT operation's freeze,
+ * a foreign epoch/generation movement, or a stranger's opId refuses before any CAS.
+ *
+ * FAIL-CLOSED CONTRACT: any failure after the freeze leaves the gate FROZEN (nothing mints)
+ * and the epoch un-advanced; eviction failure (`verifiedGone !== true` for ANY principal)
+ * throws `unavailable` — takeover MUST fail loud rather than proceed over a live predecessor.
+ */
+export declare function runAgentTakeoverBarrier(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    opId: string;
+}, deps: TakeoverDeps): Promise<TakeoverResult>;
+/** Resume a crashed takeover from its durable intent alone (`{ opId }` — SPEC 13.1: the intent
+ *  decides WHICH operation a frozen gate belongs to; `{ opId, kind }` alone resumes
+ *  deterministically). Re-runs {@link runAgentTakeoverBarrier} with the intent's own
+ *  coordinates; a stranger's opId (no intent) is `not-found`. */
+export declare function resumeAgentTakeover(reg: LifecycleRegistry, opId: string, deps: TakeoverDeps): Promise<TakeoverResult>;
+/**
+ * Revoke a sturdy handle at its SOURCE (SPEC 13.1): CAS the source gate `open → frozen` FIRST
+ * (the fence — an in-flight redemption under this handle either finished before the freeze,
+ * so its rows are in the enumeration, or loses its pinned finalize touch and never releases),
+ * then enumerate `bysrc.<issuerKeyId>.<id>.>`, revoke EVERY descendant ledger row it indexes
+ * (credentials minted under this handle OR under any descendant handle that carried it in the
+ * chain), and run VERIFIED cluster-wide eviction of every revoked row's holder principal —
+ * fail-closed, exactly the takeover discipline. The source gate stays frozen forever (a
+ * revoked handle never mints again); an already-frozen gate resumes the walk idempotently.
+ */
+export declare function revokeHandleSource(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+}, deps: TakeoverDeps): Promise<{
+    revokedRows: number;
+    evictedPrincipals: string[];
+}>;
+//# sourceMappingURL=credential-ledger.d.ts.map

package/dist/credential-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-ledger.d.ts","sourceRoot":"","sources":["../src/credential-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EASL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAoCjC,eAAO,MAAM,WAAW,SAAS,CAAC;AAElC;uEACuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAYlK;AASD,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE7E;AACD;gDACgD;AAChD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/F;AACD,mGAAmG;AACnG,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5G;AACD,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAElE;AACD;0FAC0F;AAC1F,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAID;;;;;;;;8EAQ8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB;kFAC8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;uCAEmC;IACnC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0EAA0E;IAC1E,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;yCAEyC;AACzC,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA8ChF;AAED;;;sDAGsD;AACtD,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhG;AAED;;;8FAG8F;AAC9F,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAkBtG;AAID;gEACgE;AAChE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC1B;AAgBD;gDACgD;AAChD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAQ/D;AAED;+FAC+F;AAC/F,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3H;AAED;;yFAEyF;AACzF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzI;AA4BD;;;;;;;yCAOyC;AACzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAOD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChH,OAAO,CAAC,eAAe,CAAC,CAkD1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCtG;AAID,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,mBAAmB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEjH;AAED;mEACmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA2BrG;AAID;8FAC8F;AAC9F,MAAM,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAE5E;;;;;;;;;yBASyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAE5G;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;kGACkG;AAClG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,CAAC;CACxB;AAuBD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,YAAY,CAAA;CAAE,EAChG,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgC/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC1E,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CAiIzB;AAED;;;iEAGiE;AACjE,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAO3H;AAID;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACzC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA6C/D"}