@cotal-ai/auth 0.88.0 → 0.90.0

package/dist/service-custody-shapes.js

@@ -0,0 +1,138 @@
+/** Package-internal closed shapes for canonical R9 service native custody: the head variants, the
+ * native gate variants, the native root row and the digest mirror. The active-root reader and the
+ * dormant custody writer share the closed field sets, the closed-record check and the mirror rule
+ * from here. Each keeps its own predicates: the writer's parsers also accept the creating,
+ * cancelling, frozen and revoked forms that the active-only reader refuses. Never exported from
+ * the index. */
+import { EpEnvelopeError, assertLifecycleToken, contractDigest, isContractDigest, serviceEndpointActor, } from "@cotal-ai/core";
+const HEAD_BASE = ["owner", "actor", "lifecycleUid", "managerInstance", "processEpoch", "serviceCustody"];
+/** Closed field sets, one per record variant. */
+export const HEAD_FIELDS = {
+    "service-creating": [...HEAD_BASE, "state", "op", "rootPlan"],
+    active: [...HEAD_BASE, "state", "currentCredentialId"],
+    "service-cancelling": [...HEAD_BASE, "state", "op", "rootPlan", "currentCredentialId"],
+};
+export const GATE_FIELDS = { open: ["lifecycleUid", "state", "generation", "serviceCustody"], frozen: ["lifecycleUid", "state", "generation", "serviceCustody", "op"] };
+export const ROOT_FIELDS = ["credentialId", "holderPrincipal", "lifecycleUid", "sourceChain", "state", "exp", "serviceCustody"];
+/** A plain-prototype object carrying exactly `fields`, or `fail` is called. */
+export function closedRecord(value, fields, fail) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return fail();
+    const proto = Object.getPrototypeOf(value);
+    if ((proto !== Object.prototype && proto !== null) || Reflect.ownKeys(value).length !== fields.length
+        || fields.some(k => !Object.hasOwn(value, k)))
+        return fail();
+    return value;
+}
+/** The closed `{v:1, uidDigest}` mirror must name exactly `digest`. A malformed mirror calls
+ *  `failShape` (default `fail`); a well-formed mirror naming another digest calls `fail`. */
+export function assertMirror(value, digest, fail, failShape = fail) {
+    const o = closedRecord(value, ["v", "uidDigest"], failShape);
+    if (o.v !== 1 || o.uidDigest !== digest)
+        fail();
+}
+export function serviceCustodyIdentity(uid) {
+    const { native, assignment } = uid;
+    const actor = serviceEndpointActor({ accountPublicKey: native.accountPublicKey, space: native.space, owner: assignment.owner, endpoint: assignment.endpoint, instanceId: assignment.instanceId });
+    if (actor !== assignment.actor)
+        invalid("service reservation does not carry its derived actor");
+    const digest = contractDigest(uid);
+    return { uid: structuredClone(uid), digest, lifecycleUid: native.lifecycleUid, owner: assignment.owner, actor, instanceId: assignment.instanceId,
+        endpoint: assignment.endpoint, holderPrincipal: `${assignment.owner}.${actor}`, mirror: { v: 1, uidDigest: digest } };
+}
+function invalid(detail) {
+    throw new EpEnvelopeError("failed-precondition", `service custody ${detail}`);
+}
+const shapeFail = (what) => () => invalid(`${what} does not match its closed schema`);
+const lifecycleToken = (v) => {
+    if (typeof v !== "string")
+        return false;
+    try {
+        assertLifecycleToken(v);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const positiveSafe = (v) => typeof v === "number" && Number.isSafeInteger(v) && v > 0;
+function parsePlan(value) {
+    if (value === null)
+        return null;
+    const o = closedRecord(value, ["credentialId", "expMs"], shapeFail("root plan"));
+    if (!lifecycleToken(o.credentialId) || !positiveSafe(o.expMs))
+        invalid("root plan has invalid coordinates");
+    return { credentialId: o.credentialId, expMs: o.expMs };
+}
+function parseOp(value, kind) {
+    const o = closedRecord(value, ["kind", "opId", "requestDigest"], shapeFail(`${kind} operation`));
+    if (o.kind !== kind || !lifecycleToken(o.opId) || typeof o.requestDigest !== "string" || !isContractDigest(o.requestDigest))
+        invalid(`${kind} operation has invalid coordinates`);
+    return { kind, opId: o.opId, requestDigest: o.requestDigest };
+}
+/** Parse a head of this UID. Throws `failed-precondition` for any other identity, digest or shape. */
+export function parseServiceHead(value, id) {
+    const state = value && typeof value === "object" ? value.state : undefined;
+    if (state !== "service-creating" && state !== "active" && state !== "service-cancelling")
+        return invalid("head has no service state");
+    const o = closedRecord(value, HEAD_FIELDS[state], shapeFail(`${state} head`));
+    assertMirror(o.serviceCustody, id.digest, () => invalid("head mirror is missing or mismatched"));
+    if (o.owner !== id.owner || o.actor !== id.actor || o.lifecycleUid !== id.lifecycleUid
+        || o.managerInstance !== id.instanceId || o.processEpoch !== 1)
+        invalid("head does not bind this immutable service identity");
+    const base = { owner: id.owner, actor: id.actor, lifecycleUid: id.lifecycleUid, managerInstance: id.instanceId, processEpoch: 1, serviceCustody: { ...id.mirror } };
+    if (state === "service-creating") {
+        const op = parseOp(o.op, "service-create");
+        if (op.opId !== id.uid.creation.operationId || op.requestDigest !== id.uid.creation.requestDigest)
+            invalid("creating head does not carry its creation operation");
+        return { ...base, state, op, rootPlan: parsePlan(o.rootPlan) };
+    }
+    if (state === "active") {
+        if (!lifecycleToken(o.currentCredentialId))
+            invalid("active head has no root credential id");
+        return { ...base, state, currentCredentialId: o.currentCredentialId };
+    }
+    const op = parseOp(o.op, "service-cancel"), rootPlan = parsePlan(o.rootPlan);
+    const stamp = o.currentCredentialId;
+    if (stamp !== null && (!lifecycleToken(stamp) || rootPlan === null || rootPlan.credentialId !== stamp))
+        invalid("cancelling head stamp does not match its preserved root plan");
+    return { ...base, state, op, rootPlan, currentCredentialId: stamp };
+}
+/** Parse the native gate of this UID. Throws `failed-precondition` for any other identity or shape. */
+export function parseServiceNativeGate(value, id) {
+    const state = value && typeof value === "object" ? value.state : undefined;
+    if (state !== "open" && state !== "frozen")
+        return invalid("native gate has no service state");
+    const o = closedRecord(value, GATE_FIELDS[state], shapeFail(`${state} native gate`));
+    assertMirror(o.serviceCustody, id.digest, () => invalid("native gate mirror is missing or mismatched"));
+    if (o.lifecycleUid !== id.lifecycleUid)
+        invalid("native gate belongs to another UID");
+    if (state === "open") {
+        if (o.generation !== 1)
+            invalid("open native gate is not at generation 1");
+        return { lifecycleUid: id.lifecycleUid, state, generation: 1, serviceCustody: { ...id.mirror } };
+    }
+    const op = closedRecord(o.op, ["opId", "kind"], shapeFail("native gate operation"));
+    // Activation freezes only the initial generation 0; a cancellation keeps the generation it froze.
+    if (!lifecycleToken(op.opId) || !(op.kind === "activation" ? o.generation === 0 : op.kind === "service-cancel" && (o.generation === 0 || o.generation === 1)))
+        invalid("frozen native gate has invalid coordinates");
+    return { lifecycleUid: id.lifecycleUid, state, generation: o.generation, serviceCustody: { ...id.mirror }, op: { opId: op.opId, kind: op.kind } };
+}
+/** Parse the native root row of this UID. Throws `failed-precondition` for any other identity or shape. */
+export function parseServiceNativeRoot(value, id, credentialId) {
+    const o = closedRecord(value, ROOT_FIELDS, shapeFail("native root"));
+    assertMirror(o.serviceCustody, id.digest, () => invalid("native root mirror is missing or mismatched"));
+    if (o.credentialId !== credentialId || o.lifecycleUid !== id.lifecycleUid || o.holderPrincipal !== id.holderPrincipal
+        || !Array.isArray(o.sourceChain) || o.sourceChain.length !== 1 || o.sourceChain[0] !== "root"
+        || (o.state !== "active" && o.state !== "revoked") || !positiveSafe(o.exp))
+        invalid("native root does not bind this immutable service identity");
+    return { credentialId, holderPrincipal: id.holderPrincipal, lifecycleUid: id.lifecycleUid, sourceChain: ["root"], state: o.state, exp: o.exp, serviceCustody: { ...id.mirror } };
+}
+/** Encode one record, refusing bytes its own parser would not read back to the same value. */
+export function encodeRoundTrip(value, parse) {
+    const text = JSON.stringify(value);
+    if (contractDigest(parse(JSON.parse(text))) !== contractDigest(value))
+        invalid("encoder produced a row its parser reads differently");
+    return new TextEncoder().encode(text);
+}
+//# sourceMappingURL=service-custody-shapes.js.map

package/dist/service-custody-shapes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-custody-shapes.js","sourceRoot":"","sources":["../src/service-custody-shapes.ts"],"names":[],"mappings":"AAAA;;;;;gBAKgB;AAChB,OAAO,EACL,eAAe,EAAE,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,GAE9F,MAAM,gBAAgB,CAAC;AAqBxB,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,CAAU,CAAC;AACnH,iDAAiD;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC;IAC7D,MAAM,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,qBAAqB,CAAC;IACtD,oBAAoB,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,qBAAqB,CAAC;CAC9E,CAAC;AACX,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAW,CAAC;AACjL,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAU,CAAC;AAEzI,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,MAAyB,EAAE,IAAiB;IACvF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;WAChG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAC/D,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,MAAc,EAAE,IAAiB,EAAE,YAAyB,IAAI;IAC3G,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM;QAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAQD,MAAM,UAAU,sBAAsB,CAAC,GAAwB;IAC7D,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;IACnC,MAAM,KAAK,GAAG,oBAAoB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAClM,IAAI,KAAK,KAAK,UAAU,CAAC,KAAK;QAAE,OAAO,CAAC,sDAAsD,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU;QAC9I,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,UAAU,CAAC,KAAK,IAAI,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AAC1H,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;AAChF,CAAC;AACD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAU,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;AACrG,MAAM,cAAc,GAAG,CAAC,CAAU,EAAe,EAAE;IACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACvE,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5G,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC5G,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,OAAO,CAAgD,KAAc,EAAE,IAAO;IACrF,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,SAAS,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC;QACzH,OAAO,CAAC,GAAG,IAAI,oCAAoC,CAAC,CAAC;IACvD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,aAAa,EAAE,CAAC,CAAC,aAAuB,EAAE,CAAC;AACpF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,EAA0B;IACzE,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,IAAI,KAAK,KAAK,kBAAkB,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,oBAAoB;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACtI,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;IAC9E,YAAY,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,YAAY;WACjF,CAAC,CAAC,eAAe,KAAK,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC;QAC9D,OAAO,CAAC,oDAAoD,CAAC,CAAC;IAChE,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9K,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,aAAa,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa;YAAE,OAAO,CAAC,qDAAqD,CAAC,CAAC;QAClK,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC7F,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAA6B,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,CAAC,CAAC,mBAAmB,CAAC;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC;QACpG,OAAO,CAAC,8DAA8D,CAAC,CAAC;IAC1E,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAsB,EAAE,CAAC;AACvF,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,EAA0B;IAC/E,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC/F,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC;IACrF,YAAY,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,YAAY;QAAE,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACtF,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC;YAAE,OAAO,CAAC,yCAAyC,CAAC,CAAC;QAC3E,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;IACnG,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACpF,kGAAkG;IAClG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC;QAC3J,OAAO,CAAC,4CAA4C,CAAC,CAAC;IACxD,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAmB,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAc,EAAE,IAAI,EAAE,EAAE,CAAC,IAAuC,EAAE,EAAE,CAAC;AAC1M,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,EAA0B,EAAE,YAAoB;IACrG,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,eAAe,KAAK,EAAE,CAAC,eAAe;WAChH,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM;WAC1F,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,OAAO,CAAC,2DAA2D,CAAC,CAAC;IACvE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,CAAC,eAAe,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;AACnL,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAI,KAAQ,EAAE,KAA8B;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACtI,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/service-custody.d.ts

@@ -0,0 +1,96 @@
+import { type ServiceUidCustodyV1 } from "@cotal-ai/core";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+import { type PlaneClaimHold } from "./plane-claim.js";
+/** One broker request, clipped to the remaining original deadline. */
+export declare const S1_REQUEST_TIMEOUT_MS = 5000;
+/** Re-reads after a CAS loss before a step holds. */
+export declare const S1_MAX_CAS_REDECIDE = 4;
+/** Re-pins of a byte-identical open native gate after a sibling's touch. */
+export declare const S1_MAX_GATE_REPIN = 8;
+/** Classify-then-retry rounds for a write whose outcome is unknown. */
+export declare const S1_MAX_UNKNOWN_ROUNDS = 3;
+export interface ServiceCustodyHost {
+    readonly space: string;
+    readonly accountPublicKey: string;
+}
+export interface ServiceBootstrapIntent {
+    readonly lifecycleUid: string;
+    readonly notAfterMs: number;
+}
+export interface ServiceCancelIntent {
+    readonly lifecycleUid: string;
+    readonly opId: string;
+}
+export type ServiceCustodyHeld = {
+    kind: "held";
+    reason: string;
+    step: string;
+    detail: string;
+    opId: string;
+};
+export type ServiceBootstrapResult = {
+    kind: "active";
+    root: {
+        credentialId: string;
+        expMs: number;
+    };
+} | {
+    kind: "cancelled";
+    opId: string;
+} | {
+    kind: "endpoint-revoked";
+} | {
+    kind: "uid-burned";
+} | {
+    kind: "identity-collision";
+} | {
+    kind: "name-unbound";
+} | ServiceCustodyHeld;
+export type ServiceCancelResult = {
+    kind: "pending";
+    phase: "cancelled-nonterminal";
+    root: "none" | "revoked" | "retained-stamped";
+    rootDetail?: "created-revoked" | "cas-revoked" | "already-revoked";
+    opId: string;
+} | {
+    kind: "uid-unconfirmed";
+    held: true;
+    opId: string;
+} | {
+    kind: "uid-foreign";
+} | {
+    kind: "foreign-operation";
+    opId: string;
+} | ServiceCustodyHeld;
+/** The one trusted composition: a genuine registry, a genuine hold for the same space, the
+ *  configured account, and a fatal latch only the returned `trip` sets. The held check is the
+ *  closure captured when the hold was acquired, never the hold's mutable `guard` field. */
+export declare function openServiceCustodyHost(opts: {
+    registry: LifecycleRegistry;
+    hold: PlaneClaimHold;
+    accountPublicKey: string;
+}): {
+    host: ServiceCustodyHost;
+    trip(reason: string): void;
+};
+/** Seal the original admitted bootstrap material once. `notAfterMs` is the creation authority's
+ *  fixed deadline; the writer never defaults, extends or resets it. */
+export declare function sealServiceBootstrapIntent(host: ServiceCustodyHost, input: {
+    reservation: ServiceUidCustodyV1;
+    notAfterMs: number;
+}): ServiceBootstrapIntent;
+/** Seal an accepted cancellation of this exact reservation. The intent itself does not expire. */
+export declare function sealServiceCancelIntent(host: ServiceCustodyHost, input: {
+    reservation: ServiceUidCustodyV1;
+    opId: string;
+    requestDigest: string;
+}): ServiceCancelIntent;
+/** Bootstrap the exact sealed reservation toward an active stamped root, resuming any durable
+ *  progress of the same creation. Every request is bounded by the intent's original deadline. */
+export declare function runServiceBootstrap(intent: ServiceBootstrapIntent): Promise<ServiceBootstrapResult>;
+/** Run one bounded invocation of an accepted cancellation. `deadlineMs` bounds this invocation
+ *  only; the same intent may be invoked again and resumes its own durable progress. */
+export declare function cancelServiceCustody(intent: ServiceCancelIntent, opts: {
+    deadlineMs: number;
+}): Promise<ServiceCancelResult>;
+//# sourceMappingURL=service-custody.d.ts.map

package/dist/service-custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-custody.d.ts","sourceRoot":"","sources":["../src/service-custody.ts"],"names":[],"mappings":"AAWA,OAAO,EAEwF,KAAK,mBAAmB,EACtH,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjF,OAAO,EAAoB,KAAK,cAAc,EAAkB,MAAM,kBAAkB,CAAC;AAQzF,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAC3C,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,MAAM,WAAW,kBAAkB;IAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AACjG,MAAM,WAAW,sBAAsB;IAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AACtG,MAAM,WAAW,mBAAmB;IAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC7F,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9G,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACjH,kBAAkB,CAAC;AACvB,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC;IAC/F,UAAU,CAAC,EAAE,iBAAiB,GAAG,aAAa,GAAG,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3C,kBAAkB,CAAC;AAgBvB;;2FAE2F;AAC3F,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAUtL;AAiBD;uEACuE;AACvE,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE;IAAE,WAAW,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAM5J;AAED,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE;IAAE,WAAW,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,mBAAmB,CAOvK;AAmWD;iGACiG;AACjG,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAUzG;AAgHD;uFACuF;AACvF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWlI"}