@cotal-ai/auth 0.89.0 → 0.90.0

package/dist/native-issuance.js

@@ -1,5 +1,5 @@
 import { fromPublic } from "@nats-io/nkeys";
-import { EP_AUTH_MARKER_TTL_MS, epAuthBucket, nativeIssuanceKey } from "@cotal-ai/core";
+import { EP_AUTH_MARKER_TTL_MS, SERVICE_ACCESS_TTL_SECONDS, contractDigest, epAuthBucket, epcredRowKey, nativeIssuanceKey, parseLedgerRow, parseServiceConnectionBinding, parseServiceRegistrationWitness, } from "@cotal-ai/core";
 import { CLOCK_TOLERANCE_SEC } from "./token.js";
 import { registryStores } from "./lifecycle-registry.js";
 const FIELDS = ["v", "space", "owner", "actor", "lifecycleUid", "credentialId", "view", "connId", "iat", "exp"];
@@ -13,6 +13,28 @@ function assertSeconds(v, what) {
         throw new Error(`natkey: ${what} must be a positive integer of seconds`);
     return v;
 }
+function parseServiceEvidence(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("natkey: invalid service evidence");
+    const o = raw;
+    if (Object.keys(o).length !== 3 || Object.keys(o).some((k) => !["witness", "credentialId", "connection"].includes(k))
+        || typeof o.credentialId !== "string")
+        throw new Error("natkey: invalid service evidence");
+    const witness = parseServiceRegistrationWitness(o.witness), connection = parseServiceConnectionBinding(o.connection);
+    epcredRowKey(witness.endpoint, witness.instanceId, o.credentialId);
+    return { witness, credentialId: o.credentialId, connection };
+}
+async function verifyServiceEvidence(kv, record) {
+    const service = record.service;
+    const key = epcredRowKey(service.witness.endpoint, service.witness.instanceId, service.credentialId), entry = await kv.get(key);
+    if (!entry || entry.operation !== "PUT")
+        throw new Error("natkey: service issuance evidence is unavailable");
+    const row = parseLedgerRow(entry.value, key);
+    if (row.state !== "active" || row.holderPrincipal !== `${record.owner}.${record.actor}` || row.exp !== record.exp
+        || row.sourceChain.length !== 1 || row.sourceChain[0] !== "root" || !row.serviceConnection
+        || contractDigest(row.serviceConnection) !== contractDigest(service.connection))
+        throw new Error("natkey: service issuance evidence does not match the connection");
+}
 /** Build the record from the validated token alone: never from a fresh alias lookup. */
 export function nativeIssuanceRecord(space, i) {
     const t = i.token;
@@ -24,14 +46,26 @@ export function nativeIssuanceRecord(space, i) {
     const iat = assertSeconds(i.iat, "iat"), exp = assertSeconds(i.exp, "exp");
     if (exp <= iat)
         throw new Error("natkey: exp must follow iat");
-    return { v: 1, space, owner: t.owner, actor: t.act.actor, lifecycleUid, credentialId, view: t.act.view ?? "agent", connId: i.connId, iat, exp };
+    const record = { v: 1, space, owner: t.owner, actor: t.act.actor, lifecycleUid, credentialId,
+        view: t.act.view ?? "agent", connId: i.connId, iat, exp };
+    if (t.act.view === "service-endpoint") {
+        if (!i.service || !t.act.service || exp > t.exp)
+            throw new Error("natkey: service issuance requires bounded native evidence");
+        record.service = parseServiceEvidence({ ...i.service, witness: t.act.service.witness });
+        if (record.service.connection.userNkey !== i.userNkey)
+            throw new Error("natkey: service evidence names a different user key");
+    }
+    else if (i.service !== undefined)
+        throw new Error("natkey: ordinary issuance cannot carry service evidence");
+    return record.service ? parseNativeIssuanceRecord(record) : record;
 }
 /** Parse a stored row; anything but the closed v1 shape refuses. */
 export function parseNativeIssuanceRecord(raw) {
     if (typeof raw !== "object" || raw === null || Array.isArray(raw))
         throw new Error("natkey: record is not an object");
     const keys = Object.keys(raw);
-    if (keys.length !== FIELDS.length || !FIELDS.every((f) => keys.includes(f)))
+    if (keys.length !== FIELDS.length + (Object.hasOwn(raw, "service") ? 1 : 0) || !FIELDS.every((f) => keys.includes(f))
+        || keys.some((key) => key !== "service" && !FIELDS.includes(key)))
         throw new Error(`natkey: record fields ${JSON.stringify(keys.sort())} are not the closed v1 set`);
     const r = raw;
     if (r.v !== 1)
@@ -41,6 +75,16 @@ export function parseNativeIssuanceRecord(raw) {
             throw new Error(`natkey: record ${f} is not a non-empty string`);
     assertSeconds(r.iat, "iat");
     assertSeconds(r.exp, "exp");
+    if ((r.view === "service-endpoint") !== Object.hasOwn(r, "service"))
+        throw new Error("natkey: service view and evidence must occur together");
+    if (r.service !== undefined) {
+        const service = parseServiceEvidence(r.service), witness = service.witness;
+        if (r.space !== witness.space || r.owner !== witness.principal.owner || r.actor !== witness.principal.actor
+            || r.lifecycleUid !== witness.principal.lifecycleUid || r.credentialId !== witness.rootCredentialId
+            || r.exp <= r.iat || r.exp > r.iat + SERVICE_ACCESS_TTL_SECONDS)
+            throw new Error("natkey: service evidence does not match its native root and lifetime");
+        return { ...r, service };
+    }
     return r;
 }
 /**
@@ -54,8 +98,21 @@ export function makeNativeIssuanceRecorder(registry, fence) {
     return async (i) => {
         const key = assertUserNkey(i.userNkey);
         const record = nativeIssuanceRecord(space, i);
-        await authKv.create(key, new TextEncoder().encode(JSON.stringify(record)));
-        await fence(i.token);
+        const token = record.service ? structuredClone(i.token) : i.token;
+        const bytes = new TextEncoder().encode(JSON.stringify(record));
+        if (record.service) {
+            await verifyServiceEvidence(authKv, record);
+            await authKv.put(key, bytes, { previousSeq: 0 });
+            await verifyServiceEvidence(authKv, record);
+            const stored = await readNativeIssuance(authKv, i.userNkey);
+            if (!stored || contractDigest(stored) !== contractDigest(record))
+                throw new Error("natkey: service receipt changed before release");
+        }
+        else
+            await authKv.create(key, bytes);
+        await fence(token);
+        if (record.service && record.exp <= Math.floor(Date.now() / 1000))
+            throw new Error("natkey: service issuance expired before release");
     };
 }
 /** Leader-read one key's evidence (the auth bucket is not Direct-capable). Absent is `undefined`. */
@@ -63,7 +120,10 @@ export async function readNativeIssuance(kv, userNkey) {
     const entry = await kv.get(assertUserNkey(userNkey));
     if (!entry || entry.operation !== "PUT")
         return undefined;
-    return parseNativeIssuanceRecord(entry.json());
+    const record = parseNativeIssuanceRecord(entry.json());
+    if (record.service && record.service.connection.userNkey !== userNkey)
+        throw new Error("natkey: service receipt key does not match its connection");
+    return record;
 }
 /**
  * Remove the rows whose minted JWT expired more than the clock tolerance ago (a session-caller's
@@ -71,13 +131,14 @@ export async function readNativeIssuance(kv, userNkey) {
  * `STREAM.MSG.GET` `next_by_subj` read over `natkey.` (no consumer: none may be created on the auth
  * bucket), and each removal is a KV purge pinned to the exact sequence read. A row that does not
  * parse throws: corrupt evidence is the caller's fault to surface, never a skipped row. The purge
- * marker carries the bucket's own marker TTL, so it expires too.
+ * marker carries the bucket's own marker TTL, so it expires too. Expired service evidence is
+ * retained: elapsed JWT time alone is not topology-qualified absence or terminal retirement.
  */
 export async function pruneNativeIssuance(registry, nowSec) {
     const { authKv, jsm, space } = registryStores(registry);
     const bucket = epAuthBucket(space);
     const prefix = `$KV.${bucket}.`;
-    let seq = 1, live = 0, pruned = 0;
+    let seq = 1, live = 0, pruned = 0, retainedService = 0;
     for (;;) {
         const m = await jsm.streams.getMessage(`KV_${bucket}`, { seq, next_by_subj: `${prefix}natkey.>` });
         if (!m)
@@ -90,13 +151,18 @@ export async function pruneNativeIssuance(registry, nowSec) {
         if (assertUserNkey(key.slice("natkey.".length)) !== key)
             throw new Error(`natkey: stored subject ${JSON.stringify(m.subject)} is not a natkey row`);
         const record = parseNativeIssuanceRecord(m.json());
-        if (record.exp + CLOCK_TOLERANCE_SEC < nowSec) {
+        if (record.service && nativeIssuanceKey(record.service.connection.userNkey) !== key)
+            throw new Error("natkey: service receipt key does not match its connection");
+        if (record.exp + CLOCK_TOLERANCE_SEC < nowSec && record.service) {
+            retainedService++;
+        }
+        else if (record.exp + CLOCK_TOLERANCE_SEC < nowSec) {
             await authKv.purge(key, { previousSeq: m.seq, ttl: `${EP_AUTH_MARKER_TTL_MS / 1000}s` });
             pruned++;
         }
         else
             live++;
     }
-    return { live, pruned };
+    return { live, pruned, retainedService };
 }
 //# sourceMappingURL=native-issuance.js.map

package/dist/native-issuance.js.map

@@ -1 +1 @@
-{"version":3,"file":"native-issuance.js","sourceRoot":"","sources":["../src/native-issuance.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAA2B,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AA4BjF,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAEzH,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,uDAAuD;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,IAAY;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;IAC1I,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,CAAiB;IACnE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5H,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IACxL,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAClJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAC/K,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAU;QACpG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAChH,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAoC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B,EAAE,KAA+C;IACrH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAA2B,EAAE,MAAc;IACnF,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,MAAM,GAAG,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;IAClC,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,EAA2B,CAAC,CAAC;QAC5H,IAAI,CAAC,CAAC;YAAE,MAAM;QACd,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAChB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACpJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,GAAG,mBAAmB,GAAG,MAAM,EAAE,CAAC;YAC9C,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,qBAAqB,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;YACzF,MAAM,EAAE,CAAC;QACX,CAAC;;YAAM,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"native-issuance.js","sourceRoot":"","sources":["../src/native-issuance.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAChH,cAAc,EAAE,6BAA6B,EAAE,+BAA+B,GAE/E,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAA2B,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AA8BjF,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAEzH,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,uDAAuD;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,IAAY;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;IAC1I,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/G,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAChH,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,6BAA6B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrH,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAM,EAAE,MAA4B;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAQ,CAAC;IAChC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;WAC5G,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB;WACvF,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AACvF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,CAAiB;IACnE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5H,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IACxL,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAyB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY;QAChH,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC5D,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC9H,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAChI,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAChH,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,CAAE,MAA4B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAC9L,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAU;QACpG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAChH,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9I,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC3E,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK;eACtG,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,gBAAgB;eAC/F,CAAC,CAAC,GAAc,IAAK,CAAC,CAAC,GAAc,IAAK,CAAC,CAAC,GAAc,GAAI,CAAC,CAAC,GAAc,GAAG,0BAA0B;YAC/G,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAqC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAoC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B,EAAE,KAA+C;IACrH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtI,CAAC;;YAAM,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACpJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAA2B,EAAE,MAAc;IACnF,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,MAAM,GAAG,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC;IACvD,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,EAA2B,CAAC,CAAC;QAC5H,IAAI,CAAC,CAAC;YAAE,MAAM;QACd,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAChB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACpJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,GAAG;YACjF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,GAAG,GAAG,mBAAmB,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAChE,eAAe,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,GAAG,mBAAmB,GAAG,MAAM,EAAE,CAAC;YACrD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,qBAAqB,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;YACzF,MAAM,EAAE,CAAC;QACX,CAAC;;YAAM,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC"}

package/dist/native-service-callout.d.ts

@@ -0,0 +1,38 @@
+import { type ServiceConnectionBinding, type ServiceRegistrationWitness } from "@cotal-ai/core";
+import type { ConnectReader } from "./connect-reader.js";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+import { type ServiceAssignmentBinding } from "./native-service-gate.js";
+import type { ValidatedUserToken } from "./token.js";
+export interface NativeServiceCalloutAuthority {
+    readonly space: string;
+    readonly accountPublicKey: string;
+}
+interface ServiceCalloutContext {
+    connection: ServiceConnectionBinding;
+    inboxNonce: string;
+    admittedAt: number;
+}
+interface ServiceCalloutResult {
+    jwt: string;
+    principal: string;
+    exp: number;
+}
+/** Native host composition only. Assignment lookup and restore/mutation readiness belong to the
+ * host; neither callback is a public approval hook. Services receive no registry or signing key.
+ */
+export declare function createNativeServiceCalloutAuthority(opts: {
+    registry: LifecycleRegistry;
+    reader: () => ConnectReader;
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+    resolveAssignment: (witness: ServiceRegistrationWitness) => Promise<ServiceAssignmentBinding>;
+    readClusterArtifact: (digest: string) => unknown | Promise<unknown>;
+    assertOpen: () => void;
+}): NativeServiceCalloutAuthority;
+/** A structural object cannot opt into native service minting or select another tenant account. */
+export declare function assertNativeServiceCalloutAuthority(authority: NativeServiceCalloutAuthority, space: string, accountPublicKey: string): void;
+export declare function issueNativeServiceCallout(authority: NativeServiceCalloutAuthority, token: ValidatedUserToken, context: ServiceCalloutContext): Promise<ServiceCalloutResult>;
+export {};
+//# sourceMappingURL=native-service-callout.d.ts.map

package/dist/native-service-callout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-service-callout.d.ts","sourceRoot":"","sources":["../src/native-service-callout.ts"],"names":[],"mappings":"AAAA,OAAO,EAE+D,KAAK,wBAAwB,EAAE,KAAK,0BAA0B,EACnI,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,OAAO,EAAkD,KAAK,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAC5G,UAAU,qBAAqB;IAAG,UAAU,EAAE,wBAAwB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAChH,UAAU,oBAAoB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAI9E;;GAEG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,QAAQ,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,aAAa,CAAC;IAAC,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5G,iBAAiB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9F,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CAC7F,GAAG,6BAA6B,CA6ChC;AAED,mGAAmG;AACnG,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAG3I;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,6BAA6B,EAAE,KAAK,EAAE,kBAAkB,EAC3G,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAI/D"}

package/dist/native-service-callout.js

@@ -0,0 +1,71 @@
+import { SERVICE_ACCESS_TTL_SECONDS, authorizeServeGrant, contractDigest, mintServiceCalloutJwt, parseServiceConnectionBinding, parseServiceRegistrationWitness, principalKey, serveIssuanceGateKv, } from "@cotal-ai/core";
+import { registryStores } from "./lifecycle-registry.js";
+import { makeNativeIssuanceRecorder } from "./native-issuance.js";
+import { readNativeServiceAccess, readNativeServiceGate } from "./native-service-gate.js";
+import { nativeServiceNameAuthority } from "./native-service-name.js";
+const authorities = new WeakMap();
+/** Native host composition only. Assignment lookup and restore/mutation readiness belong to the
+ * host; neither callback is a public approval hook. Services receive no registry or signing key.
+ */
+export function createNativeServiceCalloutAuthority(opts) {
+    const { registry, reader, resolveAssignment, readClusterArtifact, assertOpen } = opts;
+    const dataAccount = { ...opts.dataAccount }, stores = registryStores(registry), space = stores.space;
+    const authority = Object.freeze({ space, accountPublicKey: dataAccount.pub });
+    const names = nativeServiceNameAuthority(registry, { space, accountPublicKey: dataAccount.pub });
+    authorities.set(authority, async (raw, supplied) => {
+        const token = structuredClone(raw), connection = parseServiceConnectionBinding(supplied.connection);
+        const { inboxNonce, admittedAt } = supplied, expiresAt = Math.min(token.exp, admittedAt + SERVICE_ACCESS_TTL_SECONDS);
+        if (!Number.isSafeInteger(admittedAt) || admittedAt <= 0 || admittedAt > Math.floor(Date.now() / 1000)
+            || !Number.isSafeInteger(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000))
+            throw new Error("service callout requires its original live admission deadline");
+        if (token.act.view !== "service-endpoint" || !token.act.service)
+            throw new Error("service callout requires a validated service bearer");
+        const witness = parseServiceRegistrationWitness(token.act.service.witness);
+        if (witness.accountPublicKey !== dataAccount.pub || witness.space !== space)
+            throw new Error("service callout bearer belongs to another native account or space");
+        assertOpen();
+        const binding = { ...await resolveAssignment(witness) }, bindingDigest = contractDigest(binding);
+        if (binding.accountPublicKey !== dataAccount.pub || binding.space !== space)
+            throw new Error("service callout assignment belongs to another native account or space");
+        await readNativeServiceAccess(registry, reader(), binding, token, expiresAt);
+        const serve = await authorizeServeGrant(stores.recordsKv, { space, endpoint: witness.endpoint, instanceId: witness.instanceId,
+            epoch: witness.processEpoch, holder: { owner: witness.principal.owner }, authority: names, readClusterArtifact,
+            readProcessEpoch: async () => {
+                const gate = await readNativeServiceGate(registry, binding);
+                if (!gate)
+                    throw new Error("service callout has no native gate");
+                return gate.row.processEpoch;
+            } });
+        assertOpen();
+        const minted = await mintServiceCalloutJwt({ space, account: dataAccount }, { serve,
+            gate: serveIssuanceGateKv(stores.authKv, space, { endpoint: witness.endpoint, instanceId: witness.instanceId }),
+            principal: witness.principal, connection, inboxNonce, admittedAt, accessExpiresAt: token.exp, expiresAt });
+        const record = makeNativeIssuanceRecorder(registry, async (currentToken) => {
+            assertOpen();
+            const current = { ...await resolveAssignment(witness) };
+            if (contractDigest(current) !== bindingDigest)
+                throw new Error("service assignment changed before callout release");
+            await readNativeServiceAccess(registry, reader(), current, currentToken, expiresAt);
+            assertOpen();
+        });
+        await record({ userNkey: connection.userNkey, token, connId: inboxNonce, iat: minted.iat, exp: minted.exp,
+            service: { credentialId: minted.credentialId, connection } });
+        assertOpen();
+        if (expiresAt <= Math.floor(Date.now() / 1000))
+            throw new Error("service callout expired before response");
+        return { jwt: minted.jwt, principal: principalKey(witness.principal.owner, witness.principal.actor).key, exp: expiresAt };
+    });
+    return authority;
+}
+/** A structural object cannot opt into native service minting or select another tenant account. */
+export function assertNativeServiceCalloutAuthority(authority, space, accountPublicKey) {
+    if (!authorities.has(authority) || authority.space !== space || authority.accountPublicKey !== accountPublicKey)
+        throw new Error("service callout authority is not native or belongs to another account/space");
+}
+export function issueNativeServiceCallout(authority, token, context) {
+    const issue = authorities.get(authority);
+    if (!issue)
+        throw new Error("service callout authority is not native");
+    return issue(token, context);
+}
+//# sourceMappingURL=native-service-callout.js.map

package/dist/native-service-callout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-service-callout.js","sourceRoot":"","sources":["../src/native-service-callout.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAAE,mBAAmB,EAAE,cAAc,EAAE,qBAAqB,EAAE,6BAA6B,EACrH,+BAA+B,EAAE,YAAY,EAAE,mBAAmB,GACnE,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAiC,MAAM,0BAA0B,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAOtE,MAAM,WAAW,GAAG,IAAI,OAAO,EAAwC,CAAC;AAExE;;GAEG;AACH,MAAM,UAAU,mCAAmC,CAAC,IAInD;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IACtF,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACrG,MAAM,SAAS,GAAkC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7G,MAAM,KAAK,GAAG,0BAA0B,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACjG,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpG,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,0BAA0B,CAAC,CAAC;QACtH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;eACjG,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACxI,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,gBAAgB,KAAK,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACzE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,UAAU,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACjG,IAAI,OAAO,CAAC,gBAAgB,KAAK,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACzE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;YAC3H,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB;YAC9G,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC5D,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YAC/B,CAAC,EAAE,CAAC,CAAC;QACP,UAAU,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK;YACjF,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/G,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,0BAA0B,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACzE,UAAU,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACpH,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACpF,UAAU,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;YACvG,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChE,UAAU,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3G,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5H,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mCAAmC,CAAC,SAAwC,EAAE,KAAa,EAAE,gBAAwB;IACnI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,SAAS,CAAC,gBAAgB,KAAK,gBAAgB;QAC7G,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAwC,EAAE,KAAyB,EAC3G,OAA8B;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/native-service-gate.d.ts

@@ -0,0 +1,72 @@
+import { type EndpointGateRow, type EpCapability, type ServiceGateAuthority, type ServiceRegistrationWitness } from "@cotal-ai/core";
+import type { ConnectReader } from "./connect-reader.js";
+import type { ValidatedUserToken } from "./token.js";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+export interface ServiceAssignmentBinding {
+    accountPublicKey: string;
+    space: string;
+    owner: string;
+    endpoint: string;
+    instanceId: string;
+    lifecycleUid: string;
+    assignmentDigest: string;
+}
+type ServiceRow = EndpointGateRow & {
+    authorityFamily: "service";
+    serviceAuthority: ServiceGateAuthority;
+};
+interface ServiceGateRead {
+    row: ServiceRow;
+    revision: number;
+}
+/** Internal host storage seam. Consent and name authority are not established by a gate write. */
+export declare function readNativeServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding): Promise<ServiceGateRead | undefined>;
+/** Package-internal pure endpoint-gate rows for a writer that issues, bounds and re-checks every
+ *  request itself. No I/O: the same rows and checks the helpers below write and read. */
+export interface ServiceGateRows {
+    readonly key: string;
+    /** Parse bytes read at `key`; `conflict` when they belong to another immutable assignment. */
+    parse(value: Uint8Array): ServiceRow;
+    /** Bytes of the pending-root row that a zero-history create writes. */
+    readonly pending: Uint8Array;
+    /** Bytes of the frozen revoked row that a zero-history create writes before the gate exists. */
+    uncreatedFence(operationId: string): Uint8Array;
+    /** Bytes of the deny-new successor of `row`, or `undefined` when it is already revoked. */
+    deny(row: ServiceRow, operationId: string): Uint8Array | undefined;
+}
+/** The pure endpoint-gate rows of one assignment in this registry's space. */
+export declare function serviceGateRows(reg: LifecycleRegistry, binding: ServiceAssignmentBinding): ServiceGateRows;
+/** Create the unmintable endpoint gate before native root activation. Never adopts a different assignment. */
+export declare function createPendingServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding): Promise<ServiceGateRead>;
+/** Current native access prerequisites, not a serving grant or an issuance release fence.
+ * The host supplies an already signature-validated token and fixes expiresAt before its first
+ * authority read. Final issuance still needs a fresh check and the native serving gate CAS.
+ */
+export declare function readNativeServiceAccess(reg: LifecycleRegistry, reader: ConnectReader, expected: ServiceAssignmentBinding, raw: ValidatedUserToken, expiresAt: number): Promise<{
+    witness: ServiceRegistrationWitness;
+    gateRevision: number;
+    expiresAt: number;
+}>;
+/** Final approval CAS. The host must first verify the proposal, owner consent and operator target policy. */
+export declare function approveNativeServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, args: {
+    expectedRevision: number;
+    rootCredentialId: string;
+    approvalDigest: string;
+    nameAuthorityRevision: number;
+    approvalExpiresAt: number | null;
+    callerCeiling: EpCapability[];
+}): Promise<ServiceGateRead>;
+/** The host withholds both access and renewal material until this monotonic activation CAS wins. */
+export declare function markNativeServiceActivated(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, args: {
+    expectedRevision: number;
+    witness: ServiceRegistrationWitness;
+}): Promise<ServiceGateRead>;
+/** Durable deny-new only. This is never a terminal retirement result or broker absence proof. */
+export declare function denyNativeServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, args: {
+    expectedRevision: number;
+    operationId: string;
+}): Promise<ServiceGateRead>;
+/** Fence cancellation before the endpoint gate exists. Native UID cancellation remains a separate required barrier. */
+export declare function fenceUncreatedServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, operationId: string): Promise<ServiceGateRead>;
+export {};
+//# sourceMappingURL=native-service-gate.d.ts.map

package/dist/native-service-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-service-gate.d.ts","sourceRoot":"","sources":["../src/native-service-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAGoB,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAC3F,KAAK,0BAA0B,EAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjF,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AACD,KAAK,UAAU,GAAG,eAAe,GAAG;IAAE,eAAe,EAAE,SAAS,CAAC;IAAC,gBAAgB,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAC3G,UAAU,eAAe;IAAG,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAoB/D,kGAAkG;AAClG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAM3I;AAkCD;yFACyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,gGAAgG;IAChG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IAChD,2FAA2F;IAC3F,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACpE;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,GAAG,eAAe,CAc1G;AAED,8GAA8G;AAC9G,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC,CAMlI;AAuBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EACzF,QAAQ,EAAE,wBAAwB,EAAE,GAAG,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACvF,OAAO,EAAE,0BAA0B,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CAC9E,CAAC,CAgDH;AAED,6GAA6G;AAC7G,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE;IAC9G,gBAAgB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAC1G,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,YAAY,EAAE,CAAC;CACjE,GAAG,OAAO,CAAC,eAAe,CAAC,CAe3B;AAED,oGAAoG;AACpG,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE;IAChH,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,0BAA0B,CAAC;CAC/D,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3B;AAED,iGAAiG;AACjG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE;IAC3G,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;CAC/C,GAAG,OAAO,CAAC,eAAe,CAAC,CAK3B;AAED,uHAAuH;AACvH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAOxJ"}

package/dist/native-service-gate.js

@@ -0,0 +1,219 @@
+import { EpEnvelopeError, SERVICE_ACCESS_TTL_SECONDS, assertLifecycleToken, createRowByteIdempotent, epgateKey, isCasLoss, parseEndpointCapabilities, parseEndpointGate, parseServiceRegistrationWitness, principalKey, serviceEndpointActor, serviceGateApprovalLive, } from "@cotal-ai/core";
+import { readNativeServiceName } from "./native-service-name.js";
+import { registryStores } from "./lifecycle-registry.js";
+import { readConnectServiceRoot, readRegistryServiceRoot } from "./service-root-reader.js";
+const enc = new TextEncoder();
+const bytes = (row) => enc.encode(JSON.stringify(row));
+const conflict = (message) => { throw new EpEnvelopeError("conflict", message); };
+function coordinates(reg, binding) {
+    const stores = registryStores(reg);
+    if (stores.space !== binding.space)
+        throw new EpEnvelopeError("permission-denied", "service assignment belongs to another space");
+    const actor = serviceEndpointActor(binding);
+    return { kv: stores.authKv, key: epgateKey(binding.endpoint, binding.instanceId), actor, principal: principalKey(binding.owner, actor).key };
+}
+function parseFor(binding, key, principal, value) {
+    const row = parseEndpointGate(value, key);
+    if (row.authorityFamily !== "service" || !row.serviceAuthority || row.principal !== principal
+        || row.serviceAuthority.assignmentDigest !== binding.assignmentDigest || row.serviceAuthority.lifecycleUid !== binding.lifecycleUid)
+        conflict("service gate belongs to another immutable assignment");
+    return row;
+}
+/** Internal host storage seam. Consent and name authority are not established by a gate write. */
+export async function readNativeServiceGate(reg, binding) {
+    const { kv, key, principal } = coordinates(reg, binding);
+    const entry = await kv.get(key);
+    if (!entry)
+        return undefined;
+    if (entry.operation !== "PUT")
+        throw new EpEnvelopeError("failed-precondition", "service gate is deleted; absence cannot be inferred from a tombstone");
+    return { row: parseFor(binding, key, principal, entry.value), revision: entry.revision };
+}
+function pendingRow(reg, binding) {
+    const { key, principal } = coordinates(reg, binding);
+    const row = {
+        state: "open", generation: 0, processEpoch: 0, registrationRevision: 0, nameAuthorityRevision: 0,
+        principal, authorityFamily: "service", serviceAuthority: {
+            v: 1, assignmentDigest: binding.assignmentDigest, lifecycleUid: binding.lifecycleUid,
+            state: "pending-root", rootCredentialId: null, rootExpiresAt: null, approvalDigest: null,
+            approvalExpiresAt: null, callerCeiling: [], activationIssued: false,
+        },
+    };
+    parseEndpointGate(bytes(row), key);
+    return row;
+}
+function deniedRow(row, operationId) {
+    assertLifecycleToken(operationId, "operationId");
+    if (row.serviceAuthority.state === "revoked")
+        return undefined;
+    const authority = { ...row.serviceAuthority, state: "revoked" };
+    return row.state === "open"
+        ? { ...row, state: "frozen", op: { opId: operationId, kind: "retirement" }, serviceAuthority: authority }
+        : { ...row, serviceAuthority: authority };
+}
+function uncreatedFenceRow(reg, binding, operationId) {
+    assertLifecycleToken(operationId, "operationId");
+    const { key } = coordinates(reg, binding), pending = pendingRow(reg, binding);
+    const row = { ...pending, state: "frozen", op: { opId: operationId, kind: "retirement" },
+        serviceAuthority: { ...pending.serviceAuthority, state: "revoked" } };
+    parseEndpointGate(bytes(row), key);
+    return row;
+}
+/** The pure endpoint-gate rows of one assignment in this registry's space. */
+export function serviceGateRows(reg, binding) {
+    const { key, principal } = coordinates(reg, binding), frozenBinding = { ...binding };
+    return Object.freeze({
+        key, pending: bytes(pendingRow(reg, frozenBinding)),
+        parse: (value) => parseFor(frozenBinding, key, principal, value),
+        uncreatedFence: (operationId) => bytes(uncreatedFenceRow(reg, frozenBinding, operationId)),
+        deny: (row, operationId) => {
+            const next = deniedRow(row, operationId);
+            if (next === undefined)
+                return undefined;
+            const encoded = bytes(next);
+            parseEndpointGate(encoded, key);
+            return encoded;
+        },
+    });
+}
+/** Create the unmintable endpoint gate before native root activation. Never adopts a different assignment. */
+export async function createPendingServiceGate(reg, binding) {
+    const { kv, key } = coordinates(reg, binding);
+    await createRowByteIdempotent(kv, key, pendingRow(reg, binding));
+    const created = await readNativeServiceGate(reg, binding);
+    if (!created)
+        throw new EpEnvelopeError("unavailable", "created service gate is not readable; retain the operation identity");
+    return created;
+}
+async function current(reg, binding, expectedRevision) {
+    const found = await readNativeServiceGate(reg, binding);
+    if (!found || found.revision !== expectedRevision)
+        conflict("service gate revision changed");
+    return found;
+}
+async function replace(reg, binding, before, row) {
+    const { kv, key } = coordinates(reg, binding);
+    const encoded = bytes(row);
+    parseEndpointGate(encoded, key);
+    try {
+        return { row, revision: await kv.update(key, encoded, before.revision) };
+    }
+    catch (error) {
+        if (isCasLoss(error))
+            conflict("service gate changed before its transition committed");
+        throw new EpEnvelopeError("unavailable", "service gate transition outcome is unknown; retain the operation identity");
+    }
+}
+async function rootExpiry(reg, binding, rootCredentialId, nowMs) {
+    return (await readRegistryServiceRoot(reg, binding, rootCredentialId, nowMs)).expiresAt;
+}
+/** Current native access prerequisites, not a serving grant or an issuance release fence.
+ * The host supplies an already signature-validated token and fixes expiresAt before its first
+ * authority read. Final issuance still needs a fresh check and the native serving gate CAS.
+ */
+export async function readNativeServiceAccess(reg, reader, expected, raw, expiresAt) {
+    const binding = { ...expected }, now = Math.floor(Date.now() / 1000);
+    if (raw.act.view !== "service-endpoint" || raw.act.service?.duty !== "serve")
+        throw new EpEnvelopeError("permission-denied", "native service access requires a validated service bearer");
+    const witness = parseServiceRegistrationWitness(raw.act.service.witness);
+    const token = { ...raw, scope: [...raw.scope], act: { ...raw.act,
+            scope: raw.act.scope === undefined ? undefined : [...raw.act.scope], service: { duty: "serve", witness } } };
+    const { actor } = coordinates(reg, binding);
+    if (reader.space !== binding.space || token.space !== binding.space || token.owner !== binding.owner
+        || token.act.owner !== binding.owner || token.act.actor !== actor || token.act.lifecycleUid !== binding.lifecycleUid
+        || token.act.credentialId !== witness.rootCredentialId || token.credentialId !== witness.rootCredentialId
+        || token.scope.length || token.act.scope?.length || witness.accountPublicKey !== binding.accountPublicKey
+        || witness.space !== binding.space || witness.endpoint !== binding.endpoint || witness.instanceId !== binding.instanceId
+        || witness.principal.owner !== binding.owner || witness.principal.actor !== actor || witness.principal.lifecycleUid !== binding.lifecycleUid)
+        throw new EpEnvelopeError("permission-denied", "service bearer does not bind the native assignment");
+    if (!Number.isSafeInteger(expiresAt) || !Number.isSafeInteger(token.exp) || expiresAt <= now
+        || expiresAt > token.exp || expiresAt > now + SERVICE_ACCESS_TTL_SECONDS)
+        throw new EpEnvelopeError("expired", "service access requires its original bounded expiry");
+    // The native cred root and the endpoint's epcred issuance family are distinct authorities.
+    const connectRoot = await readConnectServiceRoot(reader, binding, witness.rootCredentialId, Date.now());
+    const rootExpiresAt = await rootExpiry(reg, binding, witness.rootCredentialId, Date.now());
+    const found = await readNativeServiceGate(reg, binding);
+    if (!found)
+        throw new EpEnvelopeError("permission-denied", "service assignment has no native gate");
+    const { row } = found, authority = row.serviceAuthority, stamp = authority.registration;
+    if (row.state !== "open" || !authority.activationIssued || authority.pendingRegistration !== undefined
+        || !serviceGateApprovalLive(authority, Math.floor(Date.now() / 1000)) || !stamp
+        || authority.rootCredentialId !== witness.rootCredentialId || authority.approvalDigest !== witness.approvalDigest
+        || row.processEpoch !== witness.processEpoch || row.registrationRevision !== witness.registrationRevision
+        || row.nameAuthorityRevision !== witness.nameAuthorityRevision || stamp.processEpoch !== witness.processEpoch
+        || stamp.registrationRevision !== witness.registrationRevision || stamp.nameAuthorityRevision !== witness.nameAuthorityRevision
+        || stamp.requestId !== witness.registrationRequestId || stamp.registrationProof !== witness.registrationProof)
+        throw new EpEnvelopeError("permission-denied", "service access does not match the current activated registration");
+    if (expiresAt > connectRoot.expiresAt || expiresAt > rootExpiresAt || expiresAt > authority.rootExpiresAt
+        || (authority.approvalExpiresAt !== null && expiresAt > authority.approvalExpiresAt))
+        throw new EpEnvelopeError("expired", "service access outlives its native root or approval");
+    const name = await readNativeServiceName(reg, binding, binding.endpoint);
+    if (!name || name.owner !== binding.owner || name.revision !== witness.nameAuthorityRevision)
+        throw new EpEnvelopeError("permission-denied", "service access does not match the native name binding");
+    const finalGate = await readNativeServiceGate(reg, binding);
+    if (!finalGate || finalGate.revision !== found.revision)
+        throw new EpEnvelopeError("conflict", "service authority changed during the access read");
+    const finalRoot = await readConnectServiceRoot(reader, binding, witness.rootCredentialId, Date.now());
+    if (finalRoot.uidRevision !== connectRoot.uidRevision || finalRoot.headRevision !== connectRoot.headRevision
+        || finalRoot.gateRevision !== connectRoot.gateRevision || finalRoot.rootRevision !== connectRoot.rootRevision)
+        throw new EpEnvelopeError("conflict", "service native root authority changed during the access read");
+    if (expiresAt <= Math.floor(Date.now() / 1000))
+        throw new EpEnvelopeError("expired", "service access expired during native authorization");
+    return { witness, gateRevision: found.revision, expiresAt };
+}
+/** Final approval CAS. The host must first verify the proposal, owner consent and operator target policy. */
+export async function approveNativeServiceGate(reg, binding, args) {
+    const found = await current(reg, binding, args.expectedRevision);
+    if (found.row.state !== "open" || found.row.serviceAuthority.state !== "pending-root")
+        conflict("only the pending root assignment can receive its first approval");
+    if (!Number.isSafeInteger(args.nameAuthorityRevision) || args.nameAuthorityRevision <= 0)
+        throw new EpEnvelopeError("failed-precondition", "service approval requires its native name binding revision");
+    const now = Date.now();
+    const authority = {
+        ...found.row.serviceAuthority, state: "approved", rootCredentialId: args.rootCredentialId,
+        rootExpiresAt: await rootExpiry(reg, binding, args.rootCredentialId, now), approvalDigest: args.approvalDigest,
+        approvalExpiresAt: args.approvalExpiresAt, callerCeiling: parseEndpointCapabilities(args.callerCeiling),
+    };
+    if (!serviceGateApprovalLive(authority, Math.floor(now / 1000)))
+        throw new EpEnvelopeError("expired", "service approval has already expired");
+    return replace(reg, binding, found, { ...found.row, nameAuthorityRevision: args.nameAuthorityRevision, serviceAuthority: authority });
+}
+/** The host withholds both access and renewal material until this monotonic activation CAS wins. */
+export async function markNativeServiceActivated(reg, binding, args) {
+    const witness = parseServiceRegistrationWitness(args.witness);
+    const found = await current(reg, binding, args.expectedRevision), row = found.row, authority = row.serviceAuthority;
+    const { actor } = coordinates(reg, binding);
+    if (witness.accountPublicKey !== binding.accountPublicKey || witness.space !== binding.space
+        || witness.endpoint !== binding.endpoint || witness.instanceId !== binding.instanceId
+        || witness.principal.owner !== binding.owner || witness.principal.actor !== actor
+        || witness.principal.lifecycleUid !== binding.lifecycleUid || witness.rootCredentialId !== authority.rootCredentialId
+        || witness.approvalDigest !== authority.approvalDigest || witness.processEpoch !== row.processEpoch
+        || witness.registrationRevision !== row.registrationRevision || witness.nameAuthorityRevision !== row.nameAuthorityRevision
+        || !authority.registration || witness.registrationRequestId !== authority.registration.requestId || witness.registrationProof !== authority.registration.registrationProof)
+        conflict("activation witness does not match the current service registration");
+    const now = Date.now();
+    if (row.state !== "open" || !serviceGateApprovalLive(authority, Math.floor(now / 1000)))
+        throw new EpEnvelopeError("expired", "service approval no longer permits activation");
+    await rootExpiry(reg, binding, witness.rootCredentialId, now);
+    if (authority.activationIssued)
+        return found;
+    return replace(reg, binding, found, { ...row, serviceAuthority: { ...authority, activationIssued: true } });
+}
+/** Durable deny-new only. This is never a terminal retirement result or broker absence proof. */
+export async function denyNativeServiceGate(reg, binding, args) {
+    assertLifecycleToken(args.operationId, "operationId");
+    const found = await current(reg, binding, args.expectedRevision);
+    const next = deniedRow(found.row, args.operationId);
+    return next === undefined ? found : replace(reg, binding, found, next);
+}
+/** Fence cancellation before the endpoint gate exists. Native UID cancellation remains a separate required barrier. */
+export async function fenceUncreatedServiceGate(reg, binding, operationId) {
+    assertLifecycleToken(operationId, "operationId");
+    const { kv, key } = coordinates(reg, binding), row = uncreatedFenceRow(reg, binding, operationId);
+    await createRowByteIdempotent(kv, key, row);
+    const created = await readNativeServiceGate(reg, binding);
+    if (!created)
+        throw new EpEnvelopeError("unavailable", "created service gate is not readable; retain the operation identity");
+    return created;
+}
+//# sourceMappingURL=native-service-gate.js.map