@cotal-ai/auth 0.12.0 → 0.13.1

package/dist/authority-client.js

@@ -0,0 +1,346 @@
+/**
+ * The auth service's SELF-MINTED data-account connections (R1). The service already holds the
+ * data account's signing seed (minting scoped users IS its function), so its own infrastructure
+ * access is signed from that seed directly — a ledgered `cred.`/`epcred.` row would create no
+ * enforcement point (connect never re-reads the reader's own row) and would be enumerated by the
+ * lifecycle barriers as if it were an agent's. The revoke story is the D5 class: stop the service
+ * or rotate the data-account signing seed. A genuinely LEDGERED infra-credential family is the
+ * deferred infra-mint work; migrate onto it there, do not invent it here.
+ *
+ * Two connections, least-privilege by construction:
+ *  - the CONNECT READER (`cotal:auth-reader:<space>`): read-only over both authority stores
+ *    ({@link authConnectReaderGrants}), supervised — shape-proved on EVERY (re)bind, unproved
+ *    while disconnected, so a reader that cannot currently prove its stores DENIES every connect.
+ *  - the MINT WRITER (`cotal:auth-mint:<space>`): the exchange-time issuance executor
+ *    ({@link authorityWriterGrants}) — store ensure + the activation saga + the root-credential
+ *    mint protocol. Its unfenced reads only feed revision-pinned CASes (a stale read LOSES) or a
+ *    bearer stamp the leader-served connect arm re-checks, so bind-time proof suffices.
+ *
+ * RENEWAL IS A FAIL-CLOSED BOUNDARY: each connection authenticates with a SHORT-exp user JWT over
+ * a stable nkey, re-minted in-process at half-life; the broker disconnects the connection at JWT
+ * expiry and the reconnect presents the freshest mint. A renewal-mint failure fires
+ * {@link AuthorityClientOpts.onRenewalFailure} IMMEDIATELY — the supervised reader downs itself
+ * on it (unproved + connection closed), so connects DENY from the moment the renewal fails, not
+ * only when the old credential eventually expires. A downed reader never comes back without a
+ * service restart; there is no file-only fallback.
+ */
+import { connect, jwtAuthenticator } from "@nats-io/transport-node";
+import { encodeUser } from "@nats-io/jwt";
+import { fromPublic, fromSeed } from "@nats-io/nkeys";
+import { EpEnvelopeError, assertInboxConnId, endpointToken, epAuthBucket, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey } from "@cotal-ai/core";
+import { authConnectReaderGrants, openConnectReader } from "./connect-reader.js";
+/** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
+ *  in-memory credential that closes with the service — never an unbounded persisted one). */
+export const AUTHORITY_CLIENT_TTL_SEC = 15 * 60;
+/**
+ * The MINT WRITER's scoped credential grant (SPEC 13.9): the exchange-time issuance executor.
+ * Exactly the store-ensure + activation-saga + root-mint surface:
+ *
+ *  - `$JS.API.STREAM.CREATE` on both authority KV streams and `STREAM.UPDATE` on records (the
+ *    boot-time `ensureAuthorityStores`), `STREAM.INFO` on both (ensure verify + §13.12 bind
+ *    proof), `STREAM.MSG.GET` on both (auth-store KV reads are leader-only by shape; fenced
+ *    record reads), and records `DIRECT.GET` (the records bucket is Direct-capable and its KV
+ *    reads here only feed revision-pinned CASes, which a stale read LOSES — fail-closed).
+ *  - `$KV` writes on EXACTLY the issuance keys: auth `gate.` / `cred.` / `bysrc.` (the gate CAS
+ *    fence and the mint's rows) and records `lifecycle.` / `uid.` (the alias head and the
+ *    space-global uid reservation). No `srcgate.`/`stage.`/`session.` writes: root issuance
+ *    presents no handles and runs no takeover; barriers are NOT this credential's job.
+ *
+ * Named residuals (D32 class, not pretend-confined): `STREAM.MSG.GET` is body-selected, so this
+ * is a stream-wide METADATA read of both stores; the `$KV` prefixes span every uid/alias (broker
+ * ACLs cannot scope "only the row you are minting"), so a compromised writer can forge issuance
+ * rows — it is the ISSUANCE AUTHORITY, that authority is exactly what it holds; and every raw
+ * MSG.GET/DIRECT.GET profile carries the caller-selected-reply injection class.
+ */
+export function authorityWriterGrants(space, connId) {
+    const auth = `KV_${epAuthBucket(space)}`;
+    const records = `KV_${recordsBucket(space)}`;
+    // Same connId hygiene as authConnectReaderGrants: the only untrusted subject-forming input goes
+    // through the shared inbox grammar so it can never widen the scoped inbox.
+    const inbox = assertInboxConnId(connId);
+    return {
+        publish: [
+            "$JS.API.INFO",
+            `$JS.API.STREAM.CREATE.${auth}`,
+            `$JS.API.STREAM.CREATE.${records}`,
+            `$JS.API.STREAM.UPDATE.${records}`,
+            `$JS.API.STREAM.INFO.${auth}`,
+            `$JS.API.STREAM.INFO.${records}`,
+            `$JS.API.STREAM.MSG.GET.${auth}`,
+            `$JS.API.STREAM.MSG.GET.${records}`,
+            `$JS.API.DIRECT.GET.${records}`,
+            `$JS.API.DIRECT.GET.${records}.>`,
+            `$KV.${epAuthBucket(space)}.gate.>`,
+            `$KV.${epAuthBucket(space)}.cred.>`,
+            `$KV.${epAuthBucket(space)}.bysrc.>`,
+            `$KV.${recordsBucket(space)}.lifecycle.>`,
+            `$KV.${recordsBucket(space)}.uid.>`,
+        ],
+        subscribe: [`_INBOX_${inbox}.>`],
+    };
+}
+/**
+ * The BARRIER EXECUTOR's scoped credential grant (SPEC 13.9): the lifecycle-barrier surface —
+ * exactly what the takeover barrier (and its retirement sibling) reaches through the sealed
+ * registry, on its OWN connection so the latency-sensitive mint writer never carries barrier
+ * authority (its own doc pins "barriers are NOT this credential's job"):
+ *
+ *  - `STREAM.INFO` on both stores (the registry's §13.12 bind proof), `STREAM.MSG.GET` on both
+ *    (leader-served gate/cred/intent and head reads), and records `DIRECT.GET` (reads that only
+ *    feed revision-pinned CASes — the mint writer's own discipline).
+ *  - NO auth-stream `CONSUMER.CREATE` at all (46e778f re-verify): a consumer-create BODY is not
+ *    subject-ACL confinable, so any create grant admits a durable PUSH exporter surviving revoke
+ *    (nats-server#8274). This profile therefore does NOT enumerate: the barrier's
+ *    family/intent/lineage LastPerSubject scans run on the SEALED auth-ledger scanner, a SEPARATE
+ *    dedicated credential that holds the only auth-stream `CONSUMER.CREATE` and never escapes the
+ *    process (`ledger-scanner.ts`). The `STREAM.MSG.GET` here is only this profile's leader-served
+ *    POINT reads (a specific gate/cred/intent/head `last_by_subj`), never a family scan. No consumer
+ *    authority on either stream.
+ *  - `$KV` writes on EXACTLY the barrier keys: auth `gate.` (the freeze/reopen CAS), `cred.`
+ *    (the family revokes), `stage.` (the durable operation intent), and records `lifecycle.`
+ *    (the containment/epoch head CASes). No `bysrc.`/`uid.` (a barrier never mints), no
+ *    `srcgate.`/`session.` (handle revocation and session reconcile are injected seams, not
+ *    this credential's job).
+ *
+ * Named residuals (D32 class, not pretend-confined): the stream-wide body-selected `MSG.GET`
+ * metadata read (a ONE-SHOT read to the requester's own inbox while the credential is live — not
+ * a durable/push exporter) and the caller-selected-reply injection class ride this profile like
+ * its siblings; and the `$KV` prefixes span every uid (broker ACLs cannot scope "only the family
+ * you are containing") — the executor IS the barrier authority, and that authority is exactly
+ * what it holds.
+ */
+export function authorityBarrierGrants(space, connId) {
+    const auth = `KV_${epAuthBucket(space)}`;
+    const records = `KV_${recordsBucket(space)}`;
+    // Same connId hygiene as its siblings: the only untrusted subject-forming input goes through
+    // the shared inbox grammar so it can never widen the scoped inbox.
+    const inbox = assertInboxConnId(connId);
+    // The §13.1 frontier step reads the last sequence of every stream in the retirement's
+    // `frontierStreams` (a subset of the CLOSED {@link retirementFrontierStreams} set). Grant
+    // STREAM.INFO for exactly that set, from the same source the intent is validated against, so the
+    // frontier authority and the frontier-writable set never drift (a real callout broker denies an
+    // ungranted INFO and the resume wedges forever). records INFO is already listed; the frontier set
+    // adds EPF/EPW/EPE (records dedups below).
+    const frontierInfo = retirementFrontierStreams(space).map((s) => `$JS.API.STREAM.INFO.${s}`);
+    return {
+        publish: [
+            "$JS.API.INFO",
+            `$JS.API.STREAM.INFO.${auth}`,
+            `$JS.API.STREAM.INFO.${records}`,
+            ...frontierInfo.filter((r) => r !== `$JS.API.STREAM.INFO.${records}`),
+            `$JS.API.STREAM.MSG.GET.${auth}`,
+            `$JS.API.STREAM.MSG.GET.${records}`,
+            `$JS.API.DIRECT.GET.${records}`,
+            `$JS.API.DIRECT.GET.${records}.>`,
+            // NO auth-stream `CONSUMER.CREATE` (security/fact/distsys/freelance, 46e778f re-verify): the
+            // extended `CONSUMER.CREATE.<auth>.<name>.<filter>` API pins name+filter on the SUBJECT but
+            // the request BODY is not subject-ACL confinable — a holder can set `durable_name`
+            // (== the subject name token) + PUSH `deliver_subject` (nats-server#8274) and leave a DURABLE
+            // exporter of every current/future gate/cred/stage row that SURVIVES this connection and JWT
+            // revoke. Subject-token pinning cannot stop it; only holding no create can. The barrier's
+            // family/intent/lineage enumerations therefore run on the SEALED auth-ledger scanner — a
+            // SEPARATE dedicated credential that holds the only auth-stream `CONSUMER.CREATE` and never
+            // escapes the process (ledger-scanner.ts) — NOT on this profile. The `STREAM.MSG.GET` granted
+            // above is only this profile's leader-served POINT reads (a specific gate/cred/intent/head
+            // `last_by_subj`). Remaining D32 residual (unchanged, accepted): that stream-wide `MSG.GET`
+            // while the credential is LIVE is a one-shot read to the requester's own inbox carrying the
+            // caller-selected-reply injection class — never a durable/push exporter.
+            `$KV.${epAuthBucket(space)}.gate.>`,
+            `$KV.${epAuthBucket(space)}.cred.>`,
+            // ONE token: the barrier's own durable operation intents `stage.<opId>` — never `stage.>`,
+            // which would also reach the session ledger's `stage.session.<sid>.<c|s>` release pins (a
+            // family the SESSION writer owns). The documented-future takeover/registration successor
+            // artifacts (`stage.<opId>.…`) have no writer yet; compose `stage.*.>` in the slice that
+            // introduces them, so forgetting fails loud here instead of widening silently now.
+            `$KV.${epAuthBucket(space)}.stage.*`,
+            // The PLANE CLAIM (#29 HIGH 3, SPEC 13.13): the ONE exact never-deleted key the plane-open
+            // create/CAS protocol writes (`plane` — no `.>`/`.*` widen; the row binds the two sealed
+            // scanner connection tuples and its held/released state). Reads ride the leader-served
+            // `STREAM.MSG.GET` above. Only this profile writes it; the claim IS the cross-process
+            // single-plane exclusion, so a wider row here would hand takeover authority to whatever
+            // else composes onto this profile.
+            `$KV.${epAuthBucket(space)}.plane`,
+            `$KV.${recordsBucket(space)}.lifecycle.>`,
+            // The retirement FRONTIER record `frontier.<lifecycleUid>` (§13.7: create-only, never
+            // deleted, one key per retired lifecycle, recorded once under its own operation's opId
+            // BEFORE the gate/head terminals): the barrier is its one writer, and the exact-arity
+            // `frontier.*` row is that authority (#29 piece 4; a barrier without it is broker-denied
+            // at step 6 on a real callout broker, masked by super-user smoke brokers).
+            `$KV.${recordsBucket(space)}.frontier.*`,
+        ],
+        subscribe: [`_INBOX_${inbox}.>`],
+    };
+}
+/** The RETIREMENT SETTLEMENT EXECUTOR's op-bounded rows (SPEC 13.9 "Retirement settlement",
+ *  the ceee1a1 authority split): COMPOSED onto {@link authorityBarrierGrants} for ONE retirement
+ *  operation over its EFFECTIVE INVENTORY endpoint/pools (the target's accepted obligation routes
+ *  UNIONED with the durable intent's trusted additive hints) — never a standing grant, never
+ *  minted without a live intent. Per effective-inventory pool: the lease-record CAS write
+ *  (`lease.<endpoint>.<pool>.…` — create for the worker-less expiry sentinel, revision-pinned
+ *  update otherwise) and the lease-derived `wrk` terminal create-only publish
+ *  (`epf.<endpoint>.wrk.<pool>.>`, first terminal wins). Plus the leader-served EPF fencing
+ *  reads (`STREAM.MSG.GET.EPF_<space>`: the acceptance-decision re-derivation and the
+ *  terminal-observe/CAS-loser reads); the records-side fencing/CAS reads ride the barrier
+ *  profile this composes onto. The `epw.>` ENQUEUE row is deliberately absent: the executor's
+ *  reconcile is reachable only for items at/past their own `workExpiry` (the settlement seam
+ *  refuses `expired` before the horizon), which structurally never takes the re-enqueue repair
+ *  branch — if a code change ever reached it, the broker denies and the barrier fails loud.
+ *
+ *  D32 residuals, EXPLICIT (the relocated forge the bounded cleaner does NOT carry): KV subject
+ *  permissions cannot distinguish CAS from overwrite or DEL/PURGE markers, and the `wrk`
+ *  publish is payload-blind, so a compromised executor can forge a lease settlement or work
+ *  terminal WITHIN its EFFECTIVE-INVENTORY pools (never beyond them); the space-wide EPF
+ *  `STREAM.MSG.GET` exposure and the caller-selected-reply injection ride it like every
+ *  API-holding profile. Op-bounded, effective-inventory-confined, revoked with the operation. */
+export function barrierExecutorSettlementGrants(space, endpoint, pools) {
+    if (!Array.isArray(pools) || pools.length === 0)
+        throw new EpEnvelopeError("failed-precondition", "an executor settlement grant lists at least one exact pool (SPEC 13.9: the op intent enumerates them; a poolless settlement authority is none)");
+    const e = endpointToken(endpoint);
+    const publish = [];
+    for (const pool of pools) {
+        const p = assertPoolToken(pool);
+        publish.push(`${spacePrefix(space)}.epf.${e}.wrk.${p}.>`, `$KV.${recordsBucket(space)}.lease.${e}.${p}.>`);
+    }
+    publish.push(`$JS.API.STREAM.MSG.GET.${epfStreamName(space)}`);
+    return { publish };
+}
+/**
+ * Open one self-minted data-account connection: a stable user nkey, a short-exp user JWT signed
+ * by the data account's signing seed, re-minted in-process at half-life. The authenticator
+ * presents the FRESHEST mint on every (re)connect; see the module header for why a failed
+ * renewal fail-closes instead of retrying on a lapsed credential.
+ */
+export async function openAuthorityClient(opts) {
+    const identity = newIdentity();
+    const grants = opts.grants(identity.id);
+    const signer = fromSeed(new TextEncoder().encode(opts.dataAccount.signingSeed));
+    const mint = async () => encodeUser(opts.label, fromPublic(identity.id), fromPublic(opts.dataAccount.pub), { pub: { allow: grants.publish }, sub: { allow: grants.subscribe },
+        ...(opts.principal ? { tags: principalTags(opts.principal.owner, opts.principal.actor) } : {}) }, 
+    // planeCandidate: NON-EXPIRING by design (see the option's doc — the named fact-3 residual);
+    // every other authority connection keeps the short-exp + half-life-renewal boundary.
+    opts.planeCandidate ? { signer } : { signer, exp: Math.floor(Date.now() / 1000) + AUTHORITY_CLIENT_TTL_SEC });
+    let currentJwt = await mint();
+    const renew = async () => {
+        if (opts.probeRenewal?.fail)
+            throw new Error("probe-forced renewal failure");
+        return mint();
+    };
+    // No renewal timer for a planeCandidate: nothing expires, and a fresh mint could only be
+    // presented on the reconnect the non-reconnecting shape forbids.
+    const renewal = opts.planeCandidate ? undefined : setInterval(() => {
+        void renew().then((jwt) => { currentJwt = jwt; }, (e) => {
+            opts.log(`${opts.label}: credential renewal FAILED (${e?.message ?? String(e)}) - failing closed NOW (fail-closed renewal boundary)`);
+            opts.onRenewalFailure?.();
+        });
+    }, opts.probeRenewal?.intervalMs ?? (AUTHORITY_CLIENT_TTL_SEC / 2) * 1000);
+    let nc;
+    try {
+        nc = await connect({
+            servers: opts.server,
+            name: opts.label,
+            authenticator: jwtAuthenticator(() => currentJwt, new TextEncoder().encode(identity.seed)),
+            inboxPrefix: `_INBOX_${identity.id}`,
+            // planeCandidate and the per-call repair connections (#4) never auto-reconnect; every standing
+            // authority connection reconnects infinitely so a broker blip never downs it silently.
+            ...(opts.planeCandidate || opts.noReconnect ? { reconnect: false, maxReconnectAttempts: 0 } : { maxReconnectAttempts: -1 }),
+        });
+    }
+    catch (e) {
+        if (renewal !== undefined)
+            clearInterval(renewal);
+        throw e;
+    }
+    let tuple;
+    let gone;
+    if (opts.planeCandidate) {
+        // The claim row pins this exact identity; a connect whose INFO cannot supply it is unusable
+        // as an ownership-bearing connection — fail loud, never claim over a hole.
+        const info = nc.info;
+        if (typeof info?.server_id !== "string" || info.server_id.length === 0 ||
+            typeof info.client_id !== "number" || !Number.isSafeInteger(info.client_id) || info.client_id <= 0) {
+            await nc.close().catch(() => { });
+            throw new EpEnvelopeError("unavailable", `${opts.label}: the broker INFO carries no usable (server_id, client_id) for the plane claim (got server_id=${JSON.stringify(info?.server_id)}, client_id=${JSON.stringify(info?.client_id)}); an ownership-bearing scanner connection must be claim-pinnable (SPEC 13.13)`);
+        }
+        tuple = { serverId: info.server_id, cid: info.client_id, userNkey: identity.id };
+        gone = nc.closed().then(() => undefined, () => undefined);
+    }
+    return {
+        nc,
+        connId: identity.id,
+        ...(opts.principal ? { principal: principalKey(opts.principal.owner, opts.principal.actor).key } : {}),
+        ...(tuple ? { tuple } : {}),
+        ...(gone ? { gone } : {}),
+        close: async () => {
+            if (renewal !== undefined)
+                clearInterval(renewal);
+            await nc.close().catch(() => { });
+        },
+    };
+}
+/**
+ * Open the supervised connect reader: the self-minted reader connection plus the §13.12 bind
+ * discipline ACROSS RECONNECTS. The shape proof re-runs on EVERY (re)bind, not just startup — a
+ * dropped reader reconnecting could land on a mirror/follower, so it is UNPROVED from the moment
+ * the connection drops until {@link openConnectReader} passes again, and `current()` refuses in
+ * between. The initial proof is awaited: this constructor resolving IS the readiness signal.
+ */
+export async function openSupervisedConnectReader(opts) {
+    const label = `cotal:auth-reader:${opts.space}`;
+    let reader;
+    let closed = false;
+    let client;
+    client = await openAuthorityClient({
+        ...opts,
+        label,
+        grants: (connId) => authConnectReaderGrants(opts.space, connId),
+        // Renewal failure is a fail-closed boundary NOW: down the reader the instant a remint
+        // rejects, so connects DENY immediately instead of riding the old credential to its expiry.
+        onRenewalFailure: () => {
+            reader = undefined;
+            opts.log(`${label}: credential renewal failed - reader downed NOW, connects deny until the service restarts (fail-closed)`);
+            if (!closed)
+                void client?.close();
+        },
+    });
+    const c = client;
+    try {
+        reader = await openConnectReader(c.nc, opts.space);
+    }
+    catch (e) {
+        await c.close();
+        throw e;
+    }
+    void (async () => {
+        for await (const s of c.nc.status()) {
+            if (closed)
+                break;
+            if (s.type === "disconnect" || s.type === "error") {
+                reader = undefined;
+                opts.log(`${label}: connection lost (${s.type}) - connects DENY until the rebind shape proof passes`);
+            }
+            else if (s.type === "reconnect") {
+                try {
+                    reader = await openConnectReader(c.nc, opts.space);
+                    opts.log(`${label}: rebound and shape-proved; connect reads resume`);
+                }
+                catch (e) {
+                    reader = undefined;
+                    opts.log(`${label}: REBIND SHAPE PROOF FAILED (${e?.message ?? String(e)}) - connects stay denied`);
+                }
+            }
+        }
+    })();
+    return {
+        current: () => {
+            if (reader === undefined)
+                throw new EpEnvelopeError("unavailable", "the connect-credential reader is not currently bound + shape-proved; a connect is never authorized without the live credential row (deny-new is fail-closed, SPEC 13.1/13.12)");
+            return reader;
+        },
+        close: async () => {
+            closed = true;
+            reader = undefined; // a closed reader refuses immediately, not on the next status event
+            await c.close();
+        },
+    };
+}
+//# sourceMappingURL=authority-client.js.map

package/dist/authority-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;AACvP,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAsED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC;YACxG,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/barrier-evict.d.ts

@@ -0,0 +1,16 @@
+import type { EvictPrincipal } from "./credential-ledger.js";
+/**
+ * Build the barrier executor's `evictPrincipal` capability over the delivery daemon's
+ * `ctl.delivery-admin` rail. Per-call connection (an eviction is a rare, heavyweight barrier
+ * step; a standing privileged connection would be a wider surface holding nothing).
+ */
+export declare function makeDeliveryAdminEvictor(opts: {
+    space: string;
+    server: string;
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+    log: (line: string) => void;
+}): EvictPrincipal;
+//# sourceMappingURL=barrier-evict.d.ts.map

package/dist/barrier-evict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"barrier-evict.d.ts","sourceRoot":"","sources":["../src/barrier-evict.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAO7D;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,cAAc,CAkEjB"}

package/dist/barrier-evict.js

@@ -0,0 +1,100 @@
+/**
+ * The auth service's VERIFIED-EVICTION seam (SPEC 13.1/13.9). The lifecycle barriers require
+ * `verifiedGone === true` before any epoch advance or head terminal, and the `$SYS` scan → KICK →
+ * verify capability lives with the DELIVERY DAEMON (co-located with the broker) — NEVER in this
+ * process: the auth service holds the data-account signing seed, and the D5 rail-split exists
+ * precisely so no seed-holding process also holds broker-admin `$SYS` material. This module
+ * reaches the daemon over the wire on the privileged `ctl.delivery-admin` control rail (the
+ * exact mechanism `cotal actor revoke` uses), with a caller credential self-minted per call from
+ * the data-account seed the service already holds.
+ *
+ * FAIL-CLOSED MAPPING: every failure — no daemon (NoResponders/timeout), a refusal, a garbled
+ * reply, or a reply describing a DIFFERENT principal — returns `verifiedGone:false` with an
+ * honest note. The calling barrier then throws and its gate stays frozen/resumable; this seam
+ * never fabricates success and never throws raw (the barrier owns the canonical error copy).
+ *
+ * Named residual (panel-reviewable): the caller credential rides the SUPERVISOR profile (the
+ * `cotal actor revoke` precedent) — only that profile holds the `ctl.delivery-admin` publish
+ * grant. The service holds the account signing seed, so this confers no authority it does not
+ * already have; a dedicated narrow delivery-admin infra profile is the cleaner target once the
+ * ledgered infra-mint family (#30) lands — migrate there, do not invent it here.
+ */
+import { CotalEndpoint, mintCreds, newIdentity } from "@cotal-ai/core";
+/** The per-eviction credential's TTL (Security H3): one delivery-admin call runs in a 15s request
+ *  budget; 60s covers connect + the call + teardown with margin, and bounds the blast radius of a
+ *  copied supervisor credential to a minute rather than the profile's default 24h. */
+const EVICTOR_CRED_TTL_SECONDS = 60;
+/**
+ * Build the barrier executor's `evictPrincipal` capability over the delivery daemon's
+ * `ctl.delivery-admin` rail. Per-call connection (an eviction is a rare, heavyweight barrier
+ * step; a standing privileged connection would be a wider surface holding nothing).
+ */
+export function makeDeliveryAdminEvictor(opts) {
+    // The stripped mint view (core's stripSpaceAuth shape): mintCreds reads ONLY space +
+    // account.pub + account.signingSeed; the operator/system material is genuinely absent here.
+    const auth = {
+        space: opts.space,
+        operator: { seed: "", jwt: "" },
+        account: { pub: opts.dataAccount.pub, seed: "", jwt: "", signingSeed: opts.dataAccount.signingSeed, signingPub: "" },
+        sys: { pub: "", jwt: "" },
+    };
+    const failClosed = (principal, note) => {
+        opts.log(`auth-barrier-evict: ${principal}: ${note}`);
+        return { principal, kicked: 0, remaining: 0, verifiedGone: false, scanComplete: false, note };
+    };
+    return async (principal) => {
+        const id = newIdentity();
+        let ep;
+        try {
+            // Security H3: this is a per-eviction credential for ONE ~15s delivery-admin call, not a
+            // standing connection. The `supervisor` profile is default standing-renewable (24h); mint it
+            // with a tight TTL so a COPIED credential expires almost immediately instead of carrying a
+            // day of full manager-control-tier + lease/presence authority. (The dedicated narrow
+            // delivery-admin infra profile is the #30 target; until then, bound the lifetime here.)
+            const creds = await mintCreds(auth, id, "supervisor", { expiresInSeconds: EVICTOR_CRED_TTL_SECONDS });
+            ep = new CotalEndpoint({
+                space: opts.space,
+                servers: opts.server,
+                creds,
+                card: { id: id.id, name: "auth-barrier-evict", kind: "endpoint" },
+                channels: [],
+                consume: false,
+                watchChannels: false,
+                watchPresence: false,
+                registerPresence: false,
+            });
+            ep.on("error", () => { });
+            await ep.start();
+            const r = await ep.requestDeliveryAdmin("evictPrincipal", { principal }, 15_000);
+            if (!r.ok)
+                return failClosed(principal, `the delivery daemon refused the eviction: ${r.error ?? "(no error copy)"}`);
+            const d = r.data;
+            if (d === undefined || d === null || d.principal !== principal ||
+                typeof d.kicked !== "number" || !Number.isSafeInteger(d.kicked) || d.kicked < 0 ||
+                typeof d.remaining !== "number" || !Number.isSafeInteger(d.remaining) || d.remaining < 0 ||
+                typeof d.verifiedGone !== "boolean" || typeof d.scanComplete !== "boolean")
+                return failClosed(principal, `the delivery daemon returned a garbled or foreign eviction result (${JSON.stringify(r.data ?? null)}); a result that does not verifiably describe this principal never authorizes`);
+            // An internally CONTRADICTORY success never authorizes: the barriers gate on
+            // `verifiedGone === true` alone, so a tuple claiming verified-gone while admitting an
+            // incomplete scan or surviving connections would launder a partial answer into an epoch
+            // advance / head terminal. Verified-gone is conclusive only as (scan complete, none remain).
+            if (d.verifiedGone === true && (d.scanComplete !== true || d.remaining !== 0))
+                return failClosed(principal, `the delivery daemon claimed verifiedGone with scanComplete=${String(d.scanComplete)} and remaining=${d.remaining}; an internally contradictory eviction result never authorizes`);
+            return {
+                principal,
+                kicked: d.kicked,
+                remaining: d.remaining,
+                verifiedGone: d.verifiedGone,
+                scanComplete: d.scanComplete,
+                ...(typeof d.note === "string" ? { note: d.note } : {}),
+            };
+        }
+        catch (e) {
+            return failClosed(principal, `the delivery-admin rail is unreachable (${e instanceof Error ? e.message : String(e)}); eviction is UNKNOWN and the barrier fails closed`);
+        }
+        finally {
+            await ep?.stop().catch(() => { });
+        }
+    };
+}
+//# sourceMappingURL=barrier-evict.js.map

package/dist/barrier-evict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"barrier-evict.js","sourceRoot":"","sources":["../src/barrier-evict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAuC,MAAM,gBAAgB,CAAC;AAG5G;;sFAEsF;AACtF,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAKxC;IACC,qFAAqF;IACrF,4FAA4F;IAC5F,MAAM,IAAI,GAAc;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAC/B,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE;QACpH,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KAC1B,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAkB,EAAE;QACrE,IAAI,CAAC,GAAG,CAAC,uBAAuB,SAAS,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAChG,CAAC,CAAC;IACF,OAAO,KAAK,EAAE,SAAiB,EAA2B,EAAE;QAC1D,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,IAAI,EAA6B,CAAC;QAClC,IAAI,CAAC;YACH,yFAAyF;YACzF,6FAA6F;YAC7F,2FAA2F;YAC3F,qFAAqF;YACrF,wFAAwF;YACxF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACtG,EAAE,GAAG,IAAI,aAAa,CAAC;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,MAAM;gBACpB,KAAK;gBACL,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,EAAE;gBACjE,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAC;YACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,SAAS,EAAE,6CAA6C,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC,CAAC;YACrH,MAAM,CAAC,GAAG,CAAC,CAAC,IAA2C,CAAC;YACxD,IACE,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAC1D,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC/E,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC;gBACxF,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS;gBAE1E,OAAO,UAAU,CAAC,SAAS,EAAE,sEAAsE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,+EAA+E,CAAC,CAAC;YACpN,6EAA6E;YAC7E,sFAAsF;YACtF,wFAAwF;YACxF,6FAA6F;YAC7F,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC;gBAC3E,OAAO,UAAU,CAAC,SAAS,EAAE,8DAA8D,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,SAAS,gEAAgE,CAAC,CAAC;YAClN,OAAO;gBACL,SAAS;gBACT,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CAAC,SAAS,EAAE,2CAA2C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;QAC3K,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/connect-reader.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The connect-time credential reader — the R1 "deny-new" substrate. At every connect the callout
+ * must prove the presented bearer's `credentialId` still names a LIVE `cred.<uid>.<credid>` row,
+ * so that revoking that row denies the NEXT connect (the v1 revocation lever that actually bites).
+ *
+ * The credential rows and the lifecycle head live in the DATA account, but the callout runs on the
+ * CALLOUT account, and NATS accounts are isolated — so the auth service opens ONE standing
+ * data-account reader connection (self-minted from the `dataAccount` signing seed it already
+ * holds; see {@link authConnectReaderGrants}) and this module reads through it.
+ *
+ * Two authority stores, both leader-served and both shape-proved on EVERY (re)bind (SPEC 13.12):
+ *  - `cred.<uid>.<credid>` lives in `KV_cotal_auth_<space>` (`allow_direct=false`);
+ *  - the lifecycle head `lifecycle.<owner>.<actor>` (carrying `currentCredentialId`) lives in
+ *    `KV_cotal_records_<space>`.
+ * A follower/mirror can serve a STALE row that still reads `active` after a revoke, silently
+ * defeating deny-new, so reads are leader-served `STREAM.MSG.GET` (never `DIRECT.GET`) AND the
+ * store is proved primary/un-mirrored/non-evicting at bind. Any read/shape/parse failure DENIES
+ * the connect; there is no file-only fallback.
+ */
+import type { NatsConnection } from "@nats-io/transport-node";
+import type { ValidatedUserToken } from "./token.js";
+/**
+ * The connect reader's SCOPED credential grant (SPEC 13.9). Read-only over BOTH authority stores,
+ * plus the bind-time shape-proof INFO and a connection-scoped reply inbox. It holds NO write, NO
+ * consumer create/update/delete, NO `DIRECT.GET`, and no account-wide inbox.
+ *
+ * D32 residual (named, not pretend-confined): `$JS.API.STREAM.MSG.GET.<stream>` is body-selected —
+ * broker ACLs cannot scope it to only `cred.`/head subjects, so this grant is a space-wide read of
+ * credential METADATA (holderPrincipal/state/chain/lifecycleUid/exp; NO secret key material rides
+ * the row, confirmed against the closed `CredentialLedgerRow` schema) plus the caller-selected-reply
+ * injection class every raw `MSG.GET` profile carries. Acceptable for this trusted, bounded-lived,
+ * short-exp+renewed infra reader; a genuinely ledgered infra-reader family is the deferred
+ * infra-mint work (a self-minted reader is revoked by stopping the service / rotating the seed, not
+ * an agent-barrier revoke — it is not a managed-agent or endpoint descendant).
+ */
+export declare function authConnectReaderGrants(space: string, connId: string): {
+    publish: string[];
+    subscribe: string[];
+};
+/** A sealed, brand-checked connect reader (a hand-assembled context never authorizes). */
+export interface ConnectReader {
+    readonly space: string;
+}
+/**
+ * Open (or re-open, on reconnect) the connect reader on a DATA-account connection, shape-proving
+ * BOTH stores at bind (SPEC 13.12) — primary/un-mirrored/non-evicting, and the auth store
+ * additionally `allow_direct=false`. Call this on every (re)bind: a dropped reader reconnecting
+ * could land on a mirror/follower, so the primary-store proof must re-run before it serves any
+ * connect read again. A store that cannot be proved never serves.
+ */
+export declare function openConnectReader(nc: NatsConnection, space: string): Promise<ConnectReader>;
+/**
+ * The connect-time deny-new check (SPEC 13.1). Assumes the caller (the ledger connect authorizer)
+ * has ALREADY run the actor-row + scope + lifecycle-equality checks; this adds the credential-row
+ * liveness proof. THROWS to deny; returns on allow. Fail-closed throughout: absent/revoked/expired/
+ * mismatched rows and every read failure deny.
+ *
+ *  1. the bearer MUST carry `act.credentialId` (grammar-valid from validateUserToken). Claimless =>
+ *     deny (deny-new needs the claim; a pre-R1 bearer re-exchanges). A view bearer is NOT exempt;
+ *     a bearer merely lacking `act.view` is a normal agent connect and is fine.
+ *  2. leader-read `cred.<lifecycleUid>.<credid>`; require it exist, be `active`, be unexpired under
+ *     the service clock, and bind holderPrincipal `<owner>.<actor>` + lifecycleUid + credentialId
+ *     with NO normalization slack.
+ *  3. root-issued credential (`sourceChain === ["root"]`): ALSO leader-read the lifecycle head and
+ *     require it `active` with `currentCredentialId === credid`, so a SUPERSEDED root issuance is
+ *     denied even if its old row still reads active (release-last keeps these consistent; head
+ *     equality is the belt). A descendant (session/handle) leaf row is sufficient here: revoking an
+ *     ancestor revokes the whole `cred.<uid>.>` family / `bysrc` chain and verified-evicts before
+ *     the operation reports success, and after the leaf CAS deny-new holds.
+ */
+export declare function authorizeConnectCredential(reader: ConnectReader, t: ValidatedUserToken, now: () => number): Promise<void>;
+//# sourceMappingURL=connect-reader.d.ts.map

package/dist/connect-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-reader.d.ts","sourceRoot":"","sources":["../src/connect-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAK9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBjH;AAQD,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAWD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBjG;AAgCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC/H"}