@cotal-ai/auth 0.90.1 → 0.92.0

package/dist/run-cancel-observation.d.ts

@@ -0,0 +1,50 @@
+export interface RunCancelObservation {
+    readonly subject: string;
+    readonly id: string;
+    readonly runId: string;
+    readonly reason: string;
+    readonly class: string;
+    readonly inputDigest: string;
+    readonly outputDigest: string;
+    readonly instanceId: string;
+    readonly processEpoch: number;
+    readonly requestEndsAt: number;
+}
+export interface RunCancelLimits {
+    caller: number;
+    owner: number;
+    total: number;
+}
+export interface RunCancelClaim {
+    readonly observation: RunCancelObservation;
+    /** Validate custody without making a dispatch claim, including when a marker already exists. */
+    assertCurrent(): void;
+    /** Last synchronous guard, invoked at the actual marker writer's dispatch boundary. */
+    dispatch(): void;
+    /** Consume a claim that refused or completed. A conflicting redelivery stays poisoned. */
+    finish(): void;
+}
+/** Process-lifetime observation custody, not cross-restart deduplication. Tombstones count against
+ *  finite caller/owner/global quotas and are never evicted or made available again. */
+export declare class RunCancelObservations {
+    private readonly space;
+    private readonly now;
+    private readonly entries;
+    private readonly callers;
+    private readonly owners;
+    private readonly limits;
+    private readonly warnedBudgets;
+    constructor(space: string, limits?: RunCancelLimits, now?: () => number);
+    private coordinates;
+    /** Decode the same JSON/string shape as the serving seam. Invalid input grants no observation. */
+    observe(subject: string, data: Uint8Array): void;
+    private full;
+    private expire;
+    refusal(subject: string): {
+        kind: "refused-before-dispatch" | "outcome-unknown";
+        code: "permission-denied" | "resource-exhausted" | "failed-precondition" | "deadline-exceeded";
+    };
+    inspect(subject: string): RunCancelObservation;
+    claim(subject: string): RunCancelClaim;
+}
+//# sourceMappingURL=run-cancel-observation.d.ts.map

package/dist/run-cancel-observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-cancel-observation.d.ts","sourceRoot":"","sources":["../src/run-cancel-observation.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AACD,MAAM,WAAW,eAAe;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAUjF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,gGAAgG;IAChG,aAAa,IAAI,IAAI,CAAC;IACtB,uFAAuF;IACvF,QAAQ,IAAI,IAAI,CAAC;IACjB,0FAA0F;IAC1F,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;uFACuF;AACvF,qBAAa,qBAAqB;IAOpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA+E,OAAO,CAAC,QAAQ,CAAC,GAAG;IANrI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;gBAErC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,eAA2D,EAAmB,GAAG,eAA0B;IAO/J,OAAO,CAAC,WAAW;IAQnB,kGAAkG;IAClG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI;IA0ChD,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,yBAAyB,GAAG,iBAAiB,CAAC;QAAC,IAAI,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,qBAAqB,GAAG,mBAAmB,CAAA;KAAE;IAWjL,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;IAQ9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc;CA+BvC"}

package/dist/run-cancel-observation.js

@@ -0,0 +1,146 @@
+import { createHash } from "node:crypto";
+import { EpEnvelopeError, canonicalJson, parseEpSubject, parseEndpointRequest, checkRequestSubjectAgreement, isIssuedCaller, readRunCancelInput, RUN_CANCEL_MAX_DEADLINE_MS, } from "@cotal-ai/core";
+/** Process-lifetime observation custody, not cross-restart deduplication. Tombstones count against
+ *  finite caller/owner/global quotas and are never evicted or made available again. */
+export class RunCancelObservations {
+    space;
+    now;
+    entries = new Map();
+    callers = new Map();
+    owners = new Map();
+    limits;
+    warnedBudgets = new Set();
+    constructor(space, limits = { caller: 64, owner: 256, total: 10_000 }, now = () => performance.now()) {
+        this.space = space;
+        this.now = now;
+        if (![limits.caller, limits.owner, limits.total].every(n => Number.isSafeInteger(n) && n > 0)
+            || limits.caller > limits.owner || limits.owner >= limits.total)
+            throw new Error("run-cancel custody limits require 0 < caller <= owner < total");
+        this.limits = Object.freeze({ ...limits });
+    }
+    coordinates(subject) {
+        const parsed = parseEpSubject(subject);
+        if (!subject.startsWith(`cotal.${this.space}.`) || !parsed || parsed.plane !== "request" || parsed.rail !== "v1"
+            || parsed.route !== "inst" || parsed.endpoint !== "manager" || parsed.command !== "run-cancel"
+            || parsed.target !== null || !isIssuedCaller(parsed.caller))
+            return undefined;
+        return { caller: canonicalJson([parsed.caller.owner, parsed.caller.actor, parsed.caller.uid]), owner: parsed.caller.owner, instanceId: parsed.instanceId };
+    }
+    /** Decode the same JSON/string shape as the serving seam. Invalid input grants no observation. */
+    observe(subject, data) {
+        const coordinates = this.coordinates(subject);
+        if (!coordinates)
+            return;
+        let observation;
+        let fingerprint;
+        try {
+            const parsed = parseEpSubject(subject);
+            if (parsed.plane !== "request")
+                return;
+            const envelope = parseEndpointRequest(JSON.parse(new TextDecoder().decode(data)));
+            checkRequestSubjectAgreement(envelope, parsed);
+            const input = readRunCancelInput(envelope.args);
+            if (!Number.isSafeInteger(envelope.deadlineMs) || envelope.deadlineMs <= 0 || envelope.deadlineMs > RUN_CANCEL_MAX_DEADLINE_MS
+                || !envelope.bind || envelope.bind.instanceId !== coordinates.instanceId
+                || envelope.class !== "ephemeral" || typeof envelope.op.inputDigest !== "string" || typeof envelope.op.outputDigest !== "string")
+                return;
+            fingerprint = createHash("sha256").update(canonicalJson({ id: envelope.id, args: input, class: envelope.class,
+                op: envelope.op, bind: envelope.bind, deadlineMs: envelope.deadlineMs })).digest("hex");
+            observation = Object.freeze({ subject, id: envelope.id, ...input, class: envelope.class,
+                inputDigest: envelope.op.inputDigest, outputDigest: envelope.op.outputDigest,
+                instanceId: envelope.bind.instanceId, processEpoch: envelope.bind.epoch,
+                requestEndsAt: this.now() + envelope.deadlineMs });
+        }
+        catch {
+            return;
+        }
+        const prior = this.entries.get(subject);
+        if (prior) {
+            if (prior.fingerprint !== fingerprint) {
+                prior.state = "conflicted";
+                delete prior.observation;
+            }
+            else
+                this.expire(prior);
+            return;
+        }
+        const budget = this.full(coordinates);
+        if (budget) {
+            if (!this.warnedBudgets.has(budget)) {
+                this.warnedBudgets.add(budget);
+                console.warn(`run-cancel custody: ${budget} lifetime budget exhausted; new observations refused`);
+            }
+            return;
+        }
+        this.entries.set(subject, { fingerprint, requestEndsAt: observation.requestEndsAt, state: "available", observation, mayHaveDispatched: false });
+        this.callers.set(coordinates.caller, (this.callers.get(coordinates.caller) ?? 0) + 1);
+        this.owners.set(coordinates.owner, (this.owners.get(coordinates.owner) ?? 0) + 1);
+    }
+    full(coordinates) {
+        if (this.entries.size >= this.limits.total)
+            return "total";
+        if ((this.callers.get(coordinates.caller) ?? 0) >= this.limits.caller)
+            return "caller";
+        if ((this.owners.get(coordinates.owner) ?? 0) >= this.limits.owner)
+            return "owner";
+        return undefined;
+    }
+    expire(entry) {
+        if (entry.state === "available" && this.now() >= entry.requestEndsAt) {
+            entry.state = "expired";
+            delete entry.observation;
+        }
+    }
+    refusal(subject) {
+        const entry = this.entries.get(subject);
+        if (entry) {
+            this.expire(entry);
+            return { kind: entry.mayHaveDispatched || entry.state === "claimed" || entry.claim !== undefined ? "outcome-unknown" : "refused-before-dispatch",
+                code: entry.state === "expired" ? "deadline-exceeded" : "failed-precondition" };
+        }
+        const coordinates = this.coordinates(subject);
+        return { kind: "refused-before-dispatch", code: coordinates && this.full(coordinates) ? "resource-exhausted" : "permission-denied" };
+    }
+    inspect(subject) {
+        const entry = this.entries.get(subject);
+        if (entry)
+            this.expire(entry);
+        if (!entry || entry.state !== "available" || !entry.observation)
+            throw new EpEnvelopeError(this.refusal(subject).code, "run-cancel observation is not available");
+        return entry.observation;
+    }
+    claim(subject) {
+        const observation = this.inspect(subject);
+        const entry = this.entries.get(subject);
+        const token = Symbol();
+        entry.state = "claimed";
+        entry.claim = token;
+        const assertCurrent = () => {
+            if (entry.state !== "claimed" || entry.claim !== token)
+                throw new EpEnvelopeError("failed-precondition", "run-cancel observation was consumed or conflicted");
+            if (this.now() >= entry.requestEndsAt) {
+                entry.state = "expired";
+                throw new EpEnvelopeError("deadline-exceeded", "run-cancel original observation deadline expired");
+            }
+        };
+        return {
+            observation,
+            assertCurrent,
+            dispatch: () => {
+                assertCurrent();
+                entry.state = "consumed";
+                entry.mayHaveDispatched = true;
+                delete entry.observation;
+            },
+            finish: () => {
+                if (entry.claim !== token)
+                    return;
+                delete entry.claim;
+                if (entry.state === "claimed")
+                    entry.state = "consumed";
+                delete entry.observation;
+            },
+        };
+    }
+}
+//# sourceMappingURL=run-cancel-observation.js.map

package/dist/run-cancel-observation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-cancel-observation.js","sourceRoot":"","sources":["../src/run-cancel-observation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,4BAA4B,EAClG,cAAc,EAAE,kBAAkB,EAAE,0BAA0B,GAC/D,MAAM,gBAAgB,CAAC;AAkCxB;uFACuF;AACvF,MAAM,OAAO,qBAAqB;IAOH;IAAqG;IANjH,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnC,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,MAAM,CAA4B;IAClC,aAAa,GAAG,IAAI,GAAG,EAAyB,CAAC;IAElE,YAA6B,KAAa,EAAE,SAA0B,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,EAAmB,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAAlI,UAAK,GAAL,KAAK,CAAQ;QAAwF,QAAG,GAAH,GAAG,CAA0B;QAC7J,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;eACxF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;YAC/D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;eAC3G,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY;eAC3F,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAChF,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAW,EAAE,CAAC;IAC9J,CAAC;IAED,kGAAkG;IAClG,OAAO,CAAC,OAAe,EAAE,IAAgB;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,WAAiC,CAAC;QACtC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAE,CAAC;YACxC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClF,4BAA4B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAW,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAW,GAAG,0BAA0B;mBAC3H,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU;mBACrE,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,QAAQ,CAAC,EAAE,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,CAAC,YAAY,KAAK,QAAQ;gBAAE,OAAO;YAC3I,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBAC3G,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1F,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrF,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC,YAAY;gBAC5E,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;gBACvE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAW,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACtC,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC;gBAC3B,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;;gBAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,sDAAsD,CAAC,CAAC;YACpG,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QAChJ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,CAAC;IAEO,IAAI,CAAC,WAA8C;QACzD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,KAAY;QACzB,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACrE,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YACxB,OAAO,KAAK,CAAC,WAAW,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;gBAC9I,IAAI,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IACvI,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW;YAC7D,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;QACnG,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACpB,MAAM,aAAa,GAAG,GAAS,EAAE;YAC/B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;gBACpD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;YACxG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACtC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;gBACxB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,kDAAkD,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC;QACF,OAAO;YACL,WAAW;YACX,aAAa;YACb,QAAQ,EAAE,GAAG,EAAE;gBACb,aAAa,EAAE,CAAC;gBAChB,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;gBACzB,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC/B,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;YACD,MAAM,EAAE,GAAG,EAAE;gBACX,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;oBAAE,OAAO;gBAClC,OAAO,KAAK,CAAC,KAAK,CAAC;gBACnB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;gBACxD,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service-adapter.d.ts

@@ -0,0 +1,6 @@
+import { type Command } from "@cotal-ai/core";
+import { type LocalProcess, type ServicePreset } from "@cotal-ai/workspace";
+export declare const authServicePreset: ServicePreset;
+export declare const authServiceProcess: LocalProcess;
+export declare const nativeAuthServiceCommand: Command;
+//# sourceMappingURL=service-adapter.d.ts.map

package/dist/service-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-adapter.d.ts","sourceRoot":"","sources":["../src/service-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,OAAO,EAAmB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAIuB,KAAK,YAAY,EAAE,KAAK,aAAa,EAClE,MAAM,qBAAqB,CAAC;AAmC7B,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,YAyBhC,CAAC;AAQF,eAAO,MAAM,wBAAwB,EAAE,OAsBtC,CAAC"}

package/dist/service-adapter.js

@@ -0,0 +1,120 @@
+import { isAbsolute, join } from "node:path";
+import { registry } from "@cotal-ai/core";
+import { AUTH_PIDFILE, CommandFailure, claimServicePid, colorEnabled, hasUserAuthState, localProcessPath, observeServiceStartup, protectedLocalDirectory, publishServiceStartup, readPidfile, resolveNativeServiceTarget, serviceOperationId, serviceStartupPath, validateServiceStartupPath, } from "@cotal-ai/workspace";
+import { authServiceFlags } from "./daemon-flags.js";
+import { authServiceConfiguration, runAuthService } from "./service.js";
+const daemonOptions = authServiceFlags.filter((flag) => flag.name !== "space");
+const portOptions = new Set(["port", "exchange-public-port"]);
+function targetFor(root, space, server) {
+    const target = resolveNativeServiceTarget(root, space, server);
+    if (target.mode !== "user" || !hasUserAuthState(target.root, space, { readOnly: true }))
+        throw new CommandFailure("refused", "UNSUPPORTED", "the auth-service preset requires this root's prepared hosting user-auth state; no issuer or account was generated");
+    const url = new URL(target.server.includes("://") ? target.server : `nats://${target.server}`);
+    if (target.tlsRequired || url.protocol !== "nats:" || !["127.0.0.1", "[::1]", "::1", "localhost"].includes(url.hostname))
+        throw new CommandFailure("refused", "UNSUPPORTED", "this native auth-service transport currently supports only its registered plain loopback broker; a TLS requirement or remote broker was not weakened");
+    protectedLocalDirectory(join(target.root, ".cotal"));
+    return target;
+}
+function nativeValues(space, server, options) {
+    const values = { space, server };
+    for (const flag of daemonOptions) {
+        if (flag.name === "server")
+            continue;
+        const value = options[flag.name];
+        if (value === undefined || value === false)
+            continue;
+        values[flag.name] = value === true ? true : String(value);
+        if (typeof value === "string" && /[\u0000-\u001f\u007f]/u.test(value))
+            throw new CommandFailure("refused", "SCHEMA_INVALID", "native auth-service option values cannot contain terminal controls");
+        if (flag.name.endsWith("url") || flag.name === "advertised-server") {
+            let url;
+            try {
+                url = new URL(String(value));
+            }
+            catch {
+                throw new CommandFailure("refused", "SCHEMA_INVALID", "a native auth-service advertised address must be a URL without credential values");
+            }
+            if (url.username || url.password || url.search || url.hash)
+                throw new CommandFailure("refused", "SCHEMA_INVALID", "native auth-service advertised addresses cannot carry credentials, query parameters or fragments on argv");
+        }
+    }
+    try {
+        authServiceConfiguration({ values, positionals: [], raw: [] });
+    }
+    catch {
+        throw new CommandFailure("refused", "SCHEMA_INVALID", "native auth-service options do not form one valid daemon configuration; no authority plane was opened");
+    }
+    return values;
+}
+export const authServicePreset = {
+    kind: "service-preset", name: "auth-service", adapter: "auth-service", timeoutMs: 60000,
+    summary: "prepared native user-auth authority and exchange on its registered loopback broker",
+};
+export const authServiceProcess = {
+    kind: "local-process", name: "auth-service", label: "auth service", order: 30,
+    controllerOnly: true, pidFile: AUTH_PIDFILE,
+    service: {
+        abiVersion: 1, requiresCli: true, readiness: "process",
+        capabilities: { multiInstance: false, foreground: true, logs: true }, paths: { root: "directory" },
+        optionsSchema: { type: "object", additionalProperties: false, required: ["root"], properties: {
+                root: { type: "string", minLength: 1, maxLength: 4096, description: "registered hosting root with its existing native auth key projection" },
+                ...Object.fromEntries(daemonOptions.map((flag) => [flag.name, {
+                        ...(portOptions.has(flag.name) ? { type: "integer", minimum: 0, maximum: 65535 } : flag.type === "boolean" ? { type: "boolean" } : { type: "string", minLength: 1, maxLength: 4096 }), description: flag.description,
+                    }])),
+            } },
+    },
+    buildServiceLaunch(context) {
+        if (!context.cliInvocation?.length)
+            throw new CommandFailure("refused", "UNSUPPORTED", "the native auth service requires the verified cotal invocation; no PATH binary was selected");
+        if (context.credentialRef)
+            throw new CommandFailure("refused", "UNSUPPORTED", "the auth service loads its prepared native key projection; a generic caller credential was not substituted");
+        const target = targetFor(String(context.options.root), context.space, context.options.server);
+        const values = nativeValues(context.space, target.server, context.options);
+        if (readPidfile(localProcessPath(AUTH_PIDFILE, { root: target.root, space: context.space })) !== undefined)
+            throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "an existing auth-service custody record is retained; no daemon or legacy slot was adopted or reclaimed");
+        const [executable, ...self] = context.cliInvocation;
+        const args = [...self, ...(colorEnabled() ? [] : ["--no-color"]), "__service-auth", "--root", target.root, "--service-instance", context.instanceId, "--launch-request", context.launchRequestId, "--ready-file", serviceStartupPath(context)];
+        for (const [key, value] of Object.entries(values))
+            if (value !== undefined)
+                args.push(`--${key}`, ...(value === true ? [] : [String(value)]));
+        return { executable: executable, args, cwd: target.root };
+    },
+    async checkServiceReadiness(context) { return observeServiceStartup(context, "auth-planes-ready"); },
+};
+function validateChild(args) {
+    if (args.positionals.length || ["root", "space", "server", "service-instance", "launch-request", "ready-file"].some((key) => typeof args.values[key] !== "string" || !args.values[key]))
+        throw new CommandFailure("refused", "USAGE_INVALID", "the native auth-service child requires one complete explicit controller launch");
+    for (const key of ["root", "ready-file"])
+        if (!isAbsolute(String(args.values[key])) || /[\u0000-\u001f\u007f]/u.test(String(args.values[key])))
+            throw new CommandFailure("refused", "USAGE_INVALID", "native auth-service paths must be absolute and contain no terminal controls");
+    serviceOperationId(args.values["service-instance"]);
+    serviceOperationId(args.values["launch-request"]);
+}
+export const nativeAuthServiceCommand = {
+    kind: "command", name: "__service-auth", hidden: true, prepareMeshTarget: false,
+    summary: "native auth-service child with exclusive process custody and a private startup receipt",
+    flags: [...authServiceFlags,
+        { name: "root", type: "string" }, { name: "service-instance", type: "string" },
+        { name: "launch-request", type: "string" }, { name: "ready-file", type: "string" },
+    ], validate: validateChild,
+    async run(args) {
+        validateChild(args);
+        const target = targetFor(String(args.values.root), String(args.values.space), String(args.values.server));
+        const values = nativeValues(target.space, target.server, args.values);
+        const instanceId = serviceOperationId(args.values["service-instance"]), launchRequestId = serviceOperationId(args.values["launch-request"]), path = String(args.values["ready-file"]);
+        validateServiceStartupPath(path, instanceId, launchRequestId);
+        const release = claimServicePid({ root: target.root, space: target.space }, AUTH_PIDFILE);
+        try {
+            await runAuthService({ ...args, values }, undefined, {
+                root: target.root, quiet: true,
+                onReady: () => publishServiceStartup(path, { phase: "auth-planes-ready", space: target.space, instanceId, launchRequestId }),
+                onClosed: release,
+            });
+        }
+        catch {
+            throw new CommandFailure("unknown", "OPERATION_UNKNOWN", "the native auth-service initialization or startup receipt was not confirmed; original custody was retained and no new launch was retried");
+        }
+    },
+};
+registry.register(authServiceProcess, authServicePreset, nativeAuthServiceCommand);
+//# sourceMappingURL=service-adapter.js.map

package/dist/service-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-adapter.js","sourceRoot":"","sources":["../src/service-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAiC,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAC7E,gBAAgB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,qBAAqB,EACvF,WAAW,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,kBAAkB,EAC/E,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAExE,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAE9D,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,MAAe;IAC7D,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,mHAAmH,CAAC,CAAC;IACjQ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,sJAAsJ,CAAC,CAAC;IACrU,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc,EAAE,OAA0C;IAC7F,MAAM,MAAM,GAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK;YAAE,SAAS;QACrD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,oEAAoE,CAAC,CAAC;QACnM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACnE,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,kFAAkF,CAAC,CAAC;YAAC,CAAC;YAC1L,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,0GAA0G,CAAC,CAAC;QAChO,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IACvE,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,uGAAuG,CAAC,CAAC;IAAC,CAAC;IACzK,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC9C,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK;IACvF,OAAO,EAAE,oFAAoF;CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;IAC7E,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY;IAC3C,OAAO,EAAE;QACP,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;QACtD,YAAY,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAClG,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;gBAC5F,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,sEAAsE,EAAE;gBAC5I,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;wBAC5D,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;qBACrN,CAAC,CAAC,CAAC;aACL,EAAE;KACJ;IACD,kBAAkB,CAAC,OAAO;QACxB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,6FAA6F,CAAC,CAAC;QACtL,IAAI,OAAO,CAAC,aAAa;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,4GAA4G,CAAC,CAAC;QAC5L,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,MAA4B,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,WAAW,CAAC,gBAAgB,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,wGAAwG,CAAC,CAAC;QAC/Q,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,UAAU,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/O,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,EAAE,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,EAAE,UAAU,EAAE,UAAW,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,qBAAqB,CAAC,OAAO,IAAI,OAAO,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;CACrG,CAAC;AAEF,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,gFAAgF,CAAC,CAAC;IAChU,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;QAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,6EAA6E,CAAC,CAAC;IACpR,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAY;IAC/C,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK;IAC/E,OAAO,EAAE,wFAAwF;IACjG,KAAK,EAAE,CAAC,GAAG,gBAAgB;QACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnF,EAAE,QAAQ,EAAE,aAAa;IAC1B,KAAK,CAAC,GAAG,CAAC,IAAI;QACZ,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtL,0BAA0B,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE;gBACnD,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI;gBAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;gBAC5H,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,0IAA0I,CAAC,CAAC;QAAC,CAAC;IACnN,CAAC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC"}

package/dist/service-custody.d.ts

@@ -1,18 +1,20 @@
+/** Package-internal DORMANT writer for canonical R9 service native custody: bootstrap from an
+ * exact reservation to an active stamped root, and endpoint-first cancellation. Nothing in the
+ * product calls it and the index does not export it. It grants no approval, serving, terminal
+ * retirement, alias release or rotation.
+ *
+ * Readiness here is local control: a genuine plane-claim hold re-read before and after every
+ * write, plus a synchronous fatal latch. It is not broker writer exclusion. A paused writer can
+ * still land a write after its last check; safety comes from per-key zero-history create and
+ * revision CAS, which make every late write either a loss or unreleased residue. */
 import { type ServiceUidCustodyV1 } from "@cotal-ai/core";
-import { type LifecycleRegistry } from "./lifecycle-registry.js";
-import { type PlaneClaimHold } from "./plane-claim.js";
-/** One broker request, clipped to the remaining original deadline. */
-export declare const S1_REQUEST_TIMEOUT_MS = 5000;
+import { type ServiceAssignmentBinding, type ServiceGateRows } from "./native-service-gate.js";
+import { type ServiceCustodyHost, type ServiceWriteScope } from "./service-write.js";
+export { S1_MAX_UNKNOWN_ROUNDS, S1_REQUEST_TIMEOUT_MS, openServiceCustodyHost, type ServiceCustodyHost } from "./service-write.js";
 /** Re-reads after a CAS loss before a step holds. */
 export declare const S1_MAX_CAS_REDECIDE = 4;
 /** Re-pins of a byte-identical open native gate after a sibling's touch. */
 export declare const S1_MAX_GATE_REPIN = 8;
-/** Classify-then-retry rounds for a write whose outcome is unknown. */
-export declare const S1_MAX_UNKNOWN_ROUNDS = 3;
-export interface ServiceCustodyHost {
-    readonly space: string;
-    readonly accountPublicKey: string;
-}
 export interface ServiceBootstrapIntent {
     readonly lifecycleUid: string;
     readonly notAfterMs: number;
@@ -62,16 +64,23 @@ export type ServiceCancelResult = {
     kind: "foreign-operation";
     opId: string;
 } | ServiceCustodyHeld;
-/** The one trusted composition: a genuine registry, a genuine hold for the same space, the
- *  configured account, and a fatal latch only the returned `trip` sets. The held check is the
- *  closure captured when the hold was acquired, never the hold's mutable `guard` field. */
-export declare function openServiceCustodyHost(opts: {
-    registry: LifecycleRegistry;
-    hold: PlaneClaimHold;
-    accountPublicKey: string;
-}): {
-    host: ServiceCustodyHost;
-    trip(reason: string): void;
+/** Package-internal: every key one custody run for this identity can write. Only bootstrap creates
+ *  the UID reservation, and its root credential id is minted during the run, so roots are a family. */
+export declare function serviceCustodyKeys(id: {
+    owner: string;
+    actor: string;
+    endpoint: string;
+    instanceId: string;
+    lifecycleUid: string;
+}, run: "bootstrap" | "cancel"): ServiceWriteScope;
+/** Package-internal: the custody keys of one exact reservation, through the same validation every
+ *  custody intent uses. */
+export declare function serviceReservationKeys(host: ServiceCustodyHost, reservation: ServiceUidCustodyV1, run: "bootstrap" | "cancel"): ServiceWriteScope;
+/** Package-internal: the binding and endpoint-gate rows of one exact reservation, through the
+ *  same validation every custody intent uses. Grants nothing; host operations read the gate with it. */
+export declare function serviceAssignmentGate(host: ServiceCustodyHost, reservation: ServiceUidCustodyV1): {
+    binding: ServiceAssignmentBinding;
+    epgate: ServiceGateRows;
 };
 /** Seal the original admitted bootstrap material once. `notAfterMs` is the creation authority's
  *  fixed deadline; the writer never defaults, extends or resets it. */

package/dist/service-custody.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-custody.d.ts","sourceRoot":"","sources":["../src/service-custody.ts"],"names":[],"mappings":"AAWA,OAAO,EAEwF,KAAK,mBAAmB,EACtH,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjF,OAAO,EAAoB,KAAK,cAAc,EAAkB,MAAM,kBAAkB,CAAC;AAQzF,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAC3C,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,MAAM,WAAW,kBAAkB;IAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AACjG,MAAM,WAAW,sBAAsB;IAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AACtG,MAAM,WAAW,mBAAmB;IAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC7F,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9G,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACjH,kBAAkB,CAAC;AACvB,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC;IAC/F,UAAU,CAAC,EAAE,iBAAiB,GAAG,aAAa,GAAG,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3C,kBAAkB,CAAC;AAgBvB;;2FAE2F;AAC3F,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAUtL;AAiBD;uEACuE;AACvE,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE;IAAE,WAAW,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAM5J;AAED,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE;IAAE,WAAW,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,mBAAmB,CAOvK;AAmWD;iGACiG;AACjG,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAUzG;AAgHD;uFACuF;AACvF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWlI"}
+{"version":3,"file":"service-custody.d.ts","sourceRoot":"","sources":["../src/service-custody.ts"],"names":[],"mappings":"AAAA;;;;;;;;oFAQoF;AACpF,OAAO,EAEyE,KAAK,mBAAmB,EACvG,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAmB,KAAK,wBAAwB,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAQhH,OAAO,EAEyB,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAC9E,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEnI,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,MAAM,WAAW,sBAAsB;IAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AACtG,MAAM,WAAW,mBAAmB;IAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC7F,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9G,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACjH,kBAAkB,CAAC;AACvB,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC;IAC/F,UAAU,CAAC,EAAE,iBAAiB,GAAG,aAAa,GAAG,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3C,kBAAkB,CAAC;AAwBvB;uGACuG;AACvG,wBAAgB,kBAAkB,CAAC,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EACjI,GAAG,EAAE,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAOhD;AAED;2BAC2B;AAC3B,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAEjJ;AAED;wGACwG;AACxG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,GAAG;IAAE,OAAO,EAAE,wBAAwB,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAGhK;AAED;uEACuE;AACvE,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE;IAAE,WAAW,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAM5J;AAED,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE;IAAE,WAAW,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,mBAAmB,CAOvK;AAoOD;iGACiG;AACjG,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAUzG;AAgHD;uFACuF;AACvF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWlI"}