@cotal-ai/auth 0.93.0 → 0.94.0

package/dist/service-caller-payload-bootstrap.d.ts

@@ -0,0 +1,30 @@
+/** Host-only payload observer and bootstrap. Uses the native broker VARZ API, never a caller's
+ * supplied topology or measurements. No generic SYS credential enters the data account or a client. */
+import { type NatsConnection } from "@nats-io/transport-node";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+import { type PlaneClaimHold } from "./plane-claim.js";
+/** Broker-owner provisioning only. Needs the registered SYS signing seed, not operator/root seed.
+ * The resulting short-lived credential can read VARZ only and is never persisted by this helper. */
+export declare function mintServiceCallerPayloadObserverCreds(sys: {
+    pub: string;
+    signingSeed: string;
+}): Promise<string>;
+export interface ServiceCallerPayloadBootstrap {
+    /** Host-private fresh short-lived VARZ-only credential, issued by the broker owner. */
+    observerCreds(): string | Promise<string>;
+}
+/** Startup assertion, and a fresh live verifier for each later positive issuance. The writer
+ * holds only this exact metadata key. The auth plane's existing claim must still be held. */
+export declare function bootstrapServiceCallerPayload(opts: {
+    registry: LifecycleRegistry;
+    hold: PlaneClaimHold;
+    servers: string;
+    accountPublicKey: string;
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+    source: ServiceCallerPayloadBootstrap;
+    onConnection?: (nc: NatsConnection, label: string) => void;
+}): Promise<() => Promise<void>>;
+//# sourceMappingURL=service-caller-payload-bootstrap.d.ts.map

package/dist/service-caller-payload-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-caller-payload-bootstrap.d.ts","sourceRoot":"","sources":["../src/service-caller-payload-bootstrap.ts"],"names":[],"mappings":"AAAA;uGACuG;AACvG,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAOlF,OAAO,EAA+E,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC9I,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIzF;oGACoG;AACpG,wBAAsB,qCAAqC,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtH;AACD,MAAM,WAAW,6BAA6B;IAC5C,uFAAuF;IACvF,aAAa,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AA4DD;6FAC6F;AAC7F,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,QAAQ,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAC7F,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,6BAA6B,CAAC;IACzF,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5D,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CA6C/B"}

package/dist/service-caller-payload-bootstrap.js

@@ -0,0 +1,154 @@
+/** Host-only payload observer and bootstrap. Uses the native broker VARZ API, never a caller's
+ * supplied topology or measurements. No generic SYS credential enters the data account or a client. */
+import { credsAuthenticator } from "@nats-io/transport-node";
+import { encodeUser, fmtCreds } from "@nats-io/jwt";
+import { fromPublic, fromSeed } from "@nats-io/nkeys";
+import { EpEnvelopeError, canonicalJson, contractDigest, credsClaims, dialerFor, epAuthBucket, isAccountNkey, newIdentity, recordsBucket, } from "@cotal-ai/core";
+import { openAuthorityClient } from "./authority-client.js";
+import { openLifecycleRegistry, registryMaxPayload, registryServerId, registryStores } from "./lifecycle-registry.js";
+import { readPlaneClaim, genuinePlaneHold } from "./plane-claim.js";
+import { parseServiceCallerPayloadRecord, SERVICE_CALLER_PAYLOAD_FLOOR, SERVICE_CALLER_PAYLOAD_KEY } from "./service-caller-payload.js";
+const enc = new TextEncoder(), dec = new TextDecoder("utf-8", { fatal: true });
+/** Broker-owner provisioning only. Needs the registered SYS signing seed, not operator/root seed.
+ * The resulting short-lived credential can read VARZ only and is never persisted by this helper. */
+export async function mintServiceCallerPayloadObserverCreds(sys) {
+    if (!isAccountNkey(sys.pub))
+        throw new Error("payload observer requires the broker system account");
+    const id = newIdentity(), prefix = `_INBOX_${id.id}`, user = fromSeed(enc.encode(id.seed));
+    const jwt = await encodeUser("service-caller-payload-observer", fromPublic(id.id), fromPublic(sys.pub), { pub: { allow: ["$SYS.REQ.SERVER.*.VARZ"] }, sub: { allow: [`${prefix}.>`] } }, { signer: fromSeed(enc.encode(sys.signingSeed)), exp: Math.floor(Date.now() / 1000) + 60 });
+    return dec.decode(fmtCreds(jwt, user));
+}
+const fail = (detail) => { throw new EpEnvelopeError("failed-precondition", `service caller payload: ${detail}`); };
+async function beforeDeadline(deadline, work, late) {
+    let timer, expired = false;
+    const ms = deadline - Date.now();
+    if (ms <= 0)
+        fail("observation deadline expired");
+    const flight = Promise.resolve().then(work).then(async (value) => {
+        if (expired) {
+            await late?.(value);
+            fail("observation deadline expired");
+        }
+        return value;
+    });
+    try {
+        return await Promise.race([flight, new Promise((_resolve, reject) => {
+                timer = setTimeout(() => { expired = true; reject(new EpEnvelopeError("failed-precondition", "service caller payload: observation deadline expired")); }, ms);
+            })]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const emptyObject = (o) => !!o && typeof o === "object" && !Array.isArray(o) && Object.keys(o).length === 0;
+/** A real complete single-server observation. Cluster/gateway/leaf configurations refuse even
+ * when no peer is connected: reply counts and current route counts cannot prove topology. */
+async function observe(registry, servers, source, deadline, onConnection) {
+    const serverId = registryServerId(registry), creds = await beforeDeadline(deadline, async () => source.observerCreds()), claims = credsClaims(creds);
+    const remaining = () => { const ms = deadline - Date.now(); if (ms <= 0)
+        fail("observation deadline expired"); return ms; };
+    if (!serverId || !/^N[A-Z2-7]{55}$/.test(serverId))
+        fail("the data connection has no broker incarnation");
+    const now = Math.floor(Date.now() / 1000);
+    if (!claims.sub || !Number.isSafeInteger(claims.exp) || !claims.exp || claims.exp <= now || claims.exp > now + 60)
+        fail("observer credential must expire within sixty seconds");
+    const allow = claims.nats?.pub?.allow, sub = claims.nats?.sub?.allow;
+    if (canonicalJson(allow) !== canonicalJson(["$SYS.REQ.SERVER.*.VARZ"]) || canonicalJson(sub) !== canonicalJson([`_INBOX_${claims.sub}.>`]))
+        fail("observer must have exactly VARZ-only read authority");
+    let nc;
+    try {
+        nc = await beforeDeadline(deadline, () => dialerFor(servers)({ servers, authenticator: credsAuthenticator(enc.encode(creds)), inboxPrefix: `_INBOX_${claims.sub}`,
+            reconnect: false, timeout: Math.min(3000, remaining()), name: "cotal:service-caller-payload-observer" }), late => late.close());
+        onConnection?.(nc, "cotal:service-caller-payload-observer");
+        if (nc.info?.server_id !== serverId)
+            fail("observer and data connection reached different brokers");
+        const reply = await nc.request(`$SYS.REQ.SERVER.${serverId}.VARZ`, enc.encode("{}"), { timeout: Math.min(3000, remaining()) });
+        const raw = JSON.parse(dec.decode(reply.data));
+        const data = raw?.data;
+        if (raw?.error !== undefined || raw?.server?.id !== serverId || data?.server_id !== serverId)
+            fail("VARZ response does not bind this broker");
+        if (Object.hasOwn(raw.server, "cluster") || !emptyObject(data.cluster) || !emptyObject(data.gateway) || !emptyObject(data.leaf)
+            || data.routes !== 0 || data.remotes !== 0 || data.leafnodes !== 0)
+            fail("only a declared standalone broker without gateway or leaf links is supported");
+        if (!Number.isSafeInteger(data.max_payload) || data.max_payload < SERVICE_CALLER_PAYLOAD_FLOOR)
+            fail(`broker max_payload ${String(data.max_payload)} is below required ${SERVICE_CALLER_PAYLOAD_FLOOR} bytes (2 MiB plus 1 KiB); configure the broker explicitly before enabling caller policy`);
+        if (!Number.isSafeInteger(data.max_control_line) || data.max_control_line < 4096)
+            fail("broker max_control_line does not admit native policy writes");
+        if (typeof data.config_digest !== "string" || !data.config_digest || typeof data.start !== "string" || typeof data.system_account !== "string"
+            || data.system_account !== (claims.nats?.issuer_account ?? claims.iss))
+            fail("VARZ config/system-account evidence is missing or foreign");
+        const stores = registryStores(registry), stream = await beforeDeadline(deadline, () => stores.jsm.streams.info(`KV_${epAuthBucket(stores.space)}`));
+        if (stream.config.max_msg_size !== -1)
+            fail("auth stream must have no per-message size cap");
+        const maxPayload = registryMaxPayload(registry);
+        if (registryServerId(registry) !== serverId || maxPayload === undefined || maxPayload < SERVICE_CALLER_PAYLOAD_FLOOR)
+            fail("data connection moved or has insufficient payload");
+        remaining();
+        return { serverId: serverId, configDigest: data.config_digest, floor: data.max_payload,
+            evidenceDigest: contractDigest({ serverId, systemAccount: data.system_account, start: data.start, configDigest: data.config_digest,
+                maxPayload: data.max_payload, maxControlLine: data.max_control_line, cluster: data.cluster, gateway: data.gateway, leaf: data.leaf,
+                stream: { name: stream.config.name, created: stream.created, maxMsgSize: stream.config.max_msg_size } }) };
+    }
+    finally {
+        await nc?.close();
+    }
+}
+/** Startup assertion, and a fresh live verifier for each later positive issuance. The writer
+ * holds only this exact metadata key. The auth plane's existing claim must still be held. */
+export async function bootstrapServiceCallerPayload(opts) {
+    const { registry, hold, source, servers, accountPublicKey, dataAccount } = opts, space = registryStores(registry).space;
+    if (dataAccount.pub !== accountPublicKey)
+        fail("assertion account differs from the host assignment");
+    const proof = genuinePlaneHold(hold);
+    if (!proof || proof.space !== space)
+        fail("assertion requires this account's genuine plane claim");
+    const assertHeld = (_what, deadline) => beforeDeadline(deadline, () => proof.assertHeld("before"));
+    const deadline = Date.now() + 10_000;
+    await assertHeld("assert caller payload", deadline);
+    const evidence = await observe(registry, servers, source, deadline, opts.onConnection);
+    const broker = { serverId: evidence.serverId, configDigest: evidence.configDigest, claimId: hold.claimId, claimGeneration: hold.generation };
+    const row = { v: 1, kind: "service-caller-payload", state: "asserted", floor: evidence.floor,
+        assertedAtMs: Date.now(), evidenceDigest: evidence.evidenceDigest, broker };
+    const writer = await beforeDeadline(deadline, () => openAuthorityClient({ onConnection: opts.onConnection, server: servers, space, dataAccount, label: "cotal:service-caller-payload-bootstrap", noReconnect: true,
+        grants: id => ({ publish: ["$JS.API.INFO", `$JS.API.STREAM.INFO.KV_${epAuthBucket(space)}`, `$JS.API.STREAM.INFO.KV_${recordsBucket(space)}`,
+                `$JS.API.STREAM.MSG.GET.KV_${epAuthBucket(space)}`, `$JS.API.STREAM.MSG.GET.KV_${recordsBucket(space)}`, `$KV.${epAuthBucket(space)}.${SERVICE_CALLER_PAYLOAD_KEY}`], subscribe: [`_INBOX_${id}.>`] }), log: () => { } }), late => late.close());
+    const writerDeadline = setTimeout(() => { void writer.close(); }, Math.max(0, deadline - Date.now()));
+    let assertedRevision;
+    try {
+        const r = await beforeDeadline(deadline, () => openLifecycleRegistry(writer.nc, space));
+        if (registryServerId(r) !== evidence.serverId)
+            fail("assertion writer reached another broker");
+        const kv = registryStores(r).authKv, previous = await beforeDeadline(deadline, () => kv.get(SERVICE_CALLER_PAYLOAD_KEY));
+        if (previous && previous.operation !== "PUT")
+            fail("assertion key has deletion history");
+        if (previous)
+            parseServiceCallerPayloadRecord(JSON.parse(dec.decode(previous.value)));
+        await assertHeld("commit caller payload assertion", deadline);
+        const bytes = enc.encode(canonicalJson(row));
+        const revision = previous ? await kv.update(SERVICE_CALLER_PAYLOAD_KEY, bytes, previous.revision) : await kv.create(SERVICE_CALLER_PAYLOAD_KEY, bytes);
+        const after = await beforeDeadline(deadline, () => kv.get(SERVICE_CALLER_PAYLOAD_KEY));
+        if (!after || after.operation !== "PUT" || after.revision !== revision || dec.decode(after.value) !== dec.decode(bytes))
+            fail("assertion write outcome is unconfirmed");
+        assertedRevision = revision;
+        await assertHeld("release caller payload assertion", deadline);
+    }
+    finally {
+        clearTimeout(writerDeadline);
+        await writer.close();
+    }
+    return async () => {
+        const deadline = Date.now() + 10_000;
+        await assertHeld("verify caller payload", deadline);
+        const fresh = await observe(registry, servers, source, deadline, opts.onConnection);
+        if (fresh.serverId !== broker.serverId || fresh.configDigest !== broker.configDigest || fresh.evidenceDigest !== row.evidenceDigest)
+            fail("broker configuration changed since bootstrap; reopen and reassert before caller issuance");
+        const assertion = await beforeDeadline(deadline, () => registryStores(registry).authKv.get(SERVICE_CALLER_PAYLOAD_KEY));
+        if (!assertion || assertion.operation !== "PUT" || assertion.revision !== assertedRevision || dec.decode(assertion.value) !== canonicalJson(row))
+            fail("payload assertion changed or was withdrawn since bootstrap");
+        await beforeDeadline(deadline, () => proof.assertHeld("after"));
+        const claim = await beforeDeadline(deadline, () => readPlaneClaim(registryStores(registry).authKv, space));
+        if (!claim || claim.state !== "held" || claim.claimId !== broker.claimId || claim.generation !== broker.claimGeneration)
+            fail("payload assertion belongs to another plane claim");
+    };
+}
+//# sourceMappingURL=service-caller-payload-bootstrap.js.map

package/dist/service-caller-payload-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-caller-payload-bootstrap.js","sourceRoot":"","sources":["../src/service-caller-payload-bootstrap.ts"],"names":[],"mappings":"AAAA;uGACuG;AACvG,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,GAChI,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AAC9I,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAuB,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,0BAA0B,EAAmC,MAAM,6BAA6B,CAAC;AAEzK,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,EAAE,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/E;oGACoG;AACpG,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,GAAyC;IACnG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpG,MAAM,EAAE,GAAG,WAAW,EAAE,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,iCAAiC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EACpG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,EAC/E,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAKD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAS,EAAE,GAAG,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,2BAA2B,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACnI,KAAK,UAAU,cAAc,CAAI,QAAgB,EAAE,IAAsB,EAAE,IAAmC;IAC5G,IAAI,KAAgD,EAAE,OAAO,GAAG,KAAK,CAAC;IACtE,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;QAC7D,IAAI,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACzE,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,qBAAqB,EAAE,sDAAsD,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChK,CAAC,CAAC,CAAC,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AACpC,CAAC;AACD,MAAM,WAAW,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAE9H;6FAC6F;AAC7F,KAAK,UAAU,OAAO,CAAC,QAA2B,EAAE,OAAe,EAAE,MAAqC,EAAE,QAAgB,EAC1H,YAA0D;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrJ,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5H,IAAI,CAAC,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAC/G,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;IACrE,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,wBAAwB,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,CAAC,UAAU,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACxI,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAC9D,IAAI,EAA8B,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YAC/J,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAClI,YAAY,EAAE,CAAC,EAAE,EAAE,uCAAuC,CAAC,CAAC;QAC5D,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;YAAE,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,QAAQ,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/H,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;QACvB,IAAI,GAAG,EAAE,KAAK,KAAK,SAAS,IAAI,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,QAAQ,IAAI,IAAI,EAAE,SAAS,KAAK,QAAQ;YAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC9I,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;eAC1H,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC;YAAE,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC3J,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,4BAA4B;YAC5F,IAAI,CAAC,sBAAsB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAsB,4BAA4B,0FAA0F,CAAC,CAAC;QACnM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI;YAAE,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACtJ,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;eACzI,IAAI,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,IAAI,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC5I,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACpJ,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7F,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,4BAA4B;YAAE,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAChL,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,QAAS,EAAE,YAAY,EAAE,IAAI,CAAC,aAAuB,EAAE,KAAK,EAAE,IAAI,CAAC,WAAqB;YACzG,cAAc,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChI,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBAClI,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AAClC,CAAC;AAED;6FAC6F;AAC7F,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAInD;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;IACxH,IAAI,WAAW,CAAC,GAAG,KAAK,gBAAgB;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,UAAU,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7I,MAAM,GAAG,GAA+D,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK;QACtJ,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,wCAAwC,EAAE,WAAW,EAAE,IAAI;QAChN,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,0BAA0B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;gBAC1I,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,0BAA0B,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACpP,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACxF,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC/F,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACzH,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACzF,IAAI,QAAQ;YAAE,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,UAAU,CAAC,iCAAiC,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;QACvJ,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACxK,gBAAgB,GAAG,QAAQ,CAAC;QAC5B,MAAM,UAAU,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACjE,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,UAAU,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,KAAK,GAAG,CAAC,cAAc;YACjI,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACnG,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACxH,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,KAAK,IAAI,SAAS,CAAC,QAAQ,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,GAAG,CAAC;YAC9I,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACrE,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,eAAe;YACrH,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC"}

package/dist/service-caller-payload.d.ts

@@ -0,0 +1,50 @@
+export declare const SERVICE_CALLER_PAYLOAD_KEY = "svchost.payload";
+/** O: a bound on the header block of one caller-policy create or CAS, which `max_payload` counts
+ *  with the body. The subject and publish line count against `max_control_line`, asserted
+ *  separately, so this bound is conservative. */
+export declare const SERVICE_CALLER_PAYLOAD_OVERHEAD = 1024;
+/** The smallest `max_payload` under which every row the headroom rule admits fits in one write. */
+export declare const SERVICE_CALLER_PAYLOAD_FLOOR: number;
+export type ServiceCallerPayloadRecord = 
+/** `floor` is the smallest `max_payload` the operator's complete per-server assertion observed. */
+{
+    v: 1;
+    kind: "service-caller-payload";
+    state: "asserted";
+    floor: number;
+    assertedAtMs: number;
+    evidenceDigest: string;
+    broker?: {
+        serverId: string;
+        configDigest: string;
+        claimId: string;
+        claimGeneration: number;
+    };
+} | {
+    v: 1;
+    kind: "service-caller-payload";
+    state: "withdrawn";
+    reason: "live-check" | "payload-precondition";
+    operationId: string | null;
+    atMs: number;
+};
+export declare function parseServiceCallerPayloadRecord(raw: unknown): ServiceCallerPayloadRecord;
+/** The live limits one connection observes: its server's `max_payload`, and the auth stream's
+ *  `max_msg_size` (-1 when unlimited). Undefined means the value could not be read. */
+export interface ServiceCallerPayloadLimits {
+    maxPayload: number | undefined;
+    authMaxMsgSize: number | undefined;
+}
+export type ServiceCallerPayloadCheck = {
+    holds: true;
+} | {
+    holds: false;
+    why: "unasserted" | "withdrawn" | "server-limit" | "stream-limit";
+};
+/** Whether the precondition holds now: asserted at or above the floor, and this connection's server
+ *  and the auth stream both admit the largest row. A finite stream limit fails it. */
+export declare function serviceCallerPayloadCheck(record: ServiceCallerPayloadRecord | undefined, live: ServiceCallerPayloadLimits): ServiceCallerPayloadCheck;
+/** Whether one row write of `bytes` fits the live limits: the smaller of the server's `max_payload`
+ *  and a finite auth-stream `max_msg_size`, less O. An unreadable limit never fits. */
+export declare function serviceCallerWriteFits(bytes: number, live: ServiceCallerPayloadLimits): boolean;
+//# sourceMappingURL=service-caller-payload.d.ts.map

package/dist/service-caller-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-caller-payload.d.ts","sourceRoot":"","sources":["../src/service-caller-payload.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D;;iDAEiD;AACjD,eAAO,MAAM,+BAA+B,OAAO,CAAC;AACpD,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,QAAgE,CAAC;AAE1G,MAAM,MAAM,0BAA0B;AACpC,mGAAmG;AACjG;IAAE,CAAC,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACvN;IAAE,CAAC,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,sBAAsB,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAY1J,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,OAAO,GAAG,0BAA0B,CAmBxF;AAED;uFACuF;AACvF,MAAM,WAAW,0BAA0B;IAAG,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE;AAElH,MAAM,MAAM,yBAAyB,GACjC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,CAAA;CAAE,CAAC;AAExF;sFACsF;AACtF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,EAAE,IAAI,EAAE,0BAA0B,GAAG,yBAAyB,CAMrJ;AAED;uFACuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAI/F"}

package/dist/service-caller-payload.js

@@ -0,0 +1,77 @@
+/** Package-internal payload precondition for caller policy. A policy row may grow to
+ * SERVICE_AUTHORITY_MAX_BYTES, and every row write is one message, so the revocation headroom the
+ * row reserves is publishable only where every server's `max_payload` admits the largest row plus
+ * the write's header block, and the auth stream sets no smaller per-message limit.
+ *
+ * The precondition has one durable record in the auth store, read by every caller-policy writer and
+ * by any later issuance path. Only a trusted complete broker observation may assert it. The stock
+ * standalone host bootstrap authenticates native VARZ and binds the row to its broker and plane
+ * claim. Any writer that sees a live check fail withdraws the record until explicit reassertion.
+ * One connection's INFO is not complete topology evidence and never replaces the observation. */
+import { EpEnvelopeError, SERVICE_AUTHORITY_MAX_BYTES, isContractDigest } from "@cotal-ai/core";
+export const SERVICE_CALLER_PAYLOAD_KEY = "svchost.payload";
+/** O: a bound on the header block of one caller-policy create or CAS, which `max_payload` counts
+ *  with the body. The subject and publish line count against `max_control_line`, asserted
+ *  separately, so this bound is conservative. */
+export const SERVICE_CALLER_PAYLOAD_OVERHEAD = 1024;
+/** The smallest `max_payload` under which every row the headroom rule admits fits in one write. */
+export const SERVICE_CALLER_PAYLOAD_FLOOR = SERVICE_AUTHORITY_MAX_BYTES + SERVICE_CALLER_PAYLOAD_OVERHEAD;
+function bad() { throw new EpEnvelopeError("bad-request", "invalid service caller payload precondition"); }
+function closed(raw, fields) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        bad();
+    const proto = Object.getPrototypeOf(raw);
+    if (proto !== Object.prototype && proto !== null)
+        bad();
+    if (fields.some((k) => !Object.hasOwn(raw, k)) || Reflect.ownKeys(raw).some((k) => typeof k !== "string" || !fields.includes(k)))
+        bad();
+    return raw;
+}
+const uint = (raw) => { if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0)
+    bad(); return raw; };
+export function parseServiceCallerPayloadRecord(raw) {
+    const o = raw;
+    if (o?.state === "asserted") {
+        const fields = ["v", "kind", "state", "floor", "assertedAtMs", "evidenceDigest"];
+        closed(raw, Object.hasOwn(o, "broker") ? [...fields, "broker"] : fields);
+        if (o.v !== 1 || o.kind !== "service-caller-payload" || typeof o.evidenceDigest !== "string" || !isContractDigest(o.evidenceDigest))
+            bad();
+        let broker;
+        if (o.broker !== undefined) {
+            const b = closed(o.broker, ["serverId", "configDigest", "claimId", "claimGeneration"]);
+            if (typeof b.serverId !== "string" || !/^N[A-Z2-7]{55}$/.test(b.serverId) || typeof b.configDigest !== "string" || !b.configDigest
+                || b.configDigest.length > 128 || typeof b.claimId !== "string" || !b.claimId || b.claimId.length > 128 || uint(b.claimGeneration) < 1)
+                bad();
+            broker = { serverId: b.serverId, configDigest: b.configDigest, claimId: b.claimId, claimGeneration: b.claimGeneration };
+        }
+        return { v: 1, kind: "service-caller-payload", state: "asserted", floor: uint(o.floor), assertedAtMs: uint(o.assertedAtMs), evidenceDigest: o.evidenceDigest, ...(broker ? { broker } : {}) };
+    }
+    closed(raw, ["v", "kind", "state", "reason", "operationId", "atMs"]);
+    if (o.v !== 1 || o.kind !== "service-caller-payload" || o.state !== "withdrawn" || (o.reason !== "live-check" && o.reason !== "payload-precondition"))
+        bad();
+    if (o.operationId !== null && (typeof o.operationId !== "string" || !/^[0-9a-f]{32}$/.test(o.operationId)))
+        bad();
+    return { v: 1, kind: "service-caller-payload", state: "withdrawn", reason: o.reason, operationId: o.operationId, atMs: uint(o.atMs) };
+}
+/** Whether the precondition holds now: asserted at or above the floor, and this connection's server
+ *  and the auth stream both admit the largest row. A finite stream limit fails it. */
+export function serviceCallerPayloadCheck(record, live) {
+    if (record === undefined || (record.state === "asserted" && record.floor < SERVICE_CALLER_PAYLOAD_FLOOR))
+        return { holds: false, why: "unasserted" };
+    if (record.state === "withdrawn")
+        return { holds: false, why: "withdrawn" };
+    if (live.maxPayload === undefined || live.maxPayload < SERVICE_CALLER_PAYLOAD_FLOOR)
+        return { holds: false, why: "server-limit" };
+    if (live.authMaxMsgSize !== -1)
+        return { holds: false, why: "stream-limit" };
+    return { holds: true };
+}
+/** Whether one row write of `bytes` fits the live limits: the smaller of the server's `max_payload`
+ *  and a finite auth-stream `max_msg_size`, less O. An unreadable limit never fits. */
+export function serviceCallerWriteFits(bytes, live) {
+    if (live.maxPayload === undefined || live.authMaxMsgSize === undefined)
+        return false;
+    const stream = live.authMaxMsgSize === -1 ? Number.POSITIVE_INFINITY : live.authMaxMsgSize;
+    return bytes <= Math.min(live.maxPayload, stream) - SERVICE_CALLER_PAYLOAD_OVERHEAD;
+}
+//# sourceMappingURL=service-caller-payload.js.map

package/dist/service-caller-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-caller-payload.js","sourceRoot":"","sources":["../src/service-caller-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;iGASiG;AACjG,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEhG,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;AAC5D;;iDAEiD;AACjD,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AACpD,mGAAmG;AACnG,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,GAAG,+BAA+B,CAAC;AAO1G,SAAS,GAAG,KAAY,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC,CAAC,CAAC;AAClH,SAAS,MAAM,CAAC,GAAY,EAAE,MAAyB;IACrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,GAAG,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,GAAG,EAAE,CAAC;IACxI,OAAO,GAA8B,CAAC;AACxC,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,EAAE,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;IAAE,GAAG,EAAE,CAAC,CAAC,OAAO,GAAa,CAAC,CAAC,CAAC,CAAC;AAEtI,MAAM,UAAU,+BAA+B,CAAC,GAAY;IAC1D,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;YAAE,GAAG,EAAE,CAAC;QAC3I,IAAI,MAA4E,CAAC;QACjF,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACvF,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY;mBAC7H,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC;gBAAE,GAAG,EAAE,CAAC;YAChJ,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,eAAyB,EAAE,CAAC;QACpI,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChM,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC;QAAE,GAAG,EAAE,CAAC;IAC7J,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAAE,GAAG,EAAE,CAAC;IAClH,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAA4B,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACzJ,CAAC;AAUD;sFACsF;AACtF,MAAM,UAAU,yBAAyB,CAAC,MAA8C,EAAE,IAAgC;IACxH,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,GAAG,4BAA4B,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;IACrJ,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC5E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,4BAA4B;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IAClI,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IAC7E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;uFACuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,IAAgC;IACpF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC3F,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,+BAA+B,CAAC;AACtF,CAAC"}

package/dist/service-caller-policy.d.ts

@@ -14,10 +14,69 @@ export interface NativeServiceCallerPolicyRead {
     row: NativeServiceCallerPolicy;
     revision: number;
 }
+/** A grant's immutable fields as canonical JSON: everything but `status`, the one field that advances. */
+export declare function immutableGrantView(g: ServiceCallerGrant): string;
+/** One stored grant's closed syntax, as a row holds it. */
+export declare function parseServiceCallerGrant(raw: unknown): ServiceCallerGrant;
+/** The auth-store key of one grantee's policy row. */
+export declare function servicePolicyKey(granteeUid: string): string;
 /** Stored syntax only. Eligibility, ancestry and native capability containment are host checks. */
 export declare function parseNativeServiceCallerPolicy(raw: unknown): NativeServiceCallerPolicy;
 /** Internal leader-served read. Deleted or corrupt records are not an absent/empty policy. */
 export declare function readNativeServiceCallerPolicy(reg: LifecycleRegistry, binding: ServiceCallerPolicyBinding): Promise<NativeServiceCallerPolicyRead | undefined>;
+/** Whether every grant of `row` could still take its largest status within the byte bound. */
+export declare function callerPolicyHasRevocationHeadroom(row: NativeServiceCallerPolicy): boolean;
+/** Appending `candidate` (status active) at `expectedRevision`. An existing grant with the same id
+ *  answers present whatever its status, because the comparison leaves out status, which only
+ *  advances: a replay after deny-new adopts the row and never reactivates the grant. */
+export type CallerAppendStep = {
+    kind: "present";
+    grant: ServiceCallerGrant;
+} | {
+    kind: "mismatch";
+} | {
+    kind: "moved";
+} | {
+    kind: "headroom";
+} | {
+    kind: "write";
+    row: NativeServiceCallerPolicy;
+};
+export declare function callerAppendStep(found: NativeServiceCallerPolicyRead | undefined, empty: NativeServiceCallerPolicy, expectedRevision: number, candidate: ServiceCallerGrant): CallerAppendStep;
+/** Deny-new: an active grant moves to `revoking` under `operationId` in phase `cutoff-required`. A
+ *  grant already revoking or revoked names the operation that holds its intent. */
+export type CallerBeginStep = {
+    kind: "absent";
+} | {
+    kind: "held";
+    grant: ServiceCallerGrant;
+    operationId: string;
+} | {
+    kind: "write";
+    row: NativeServiceCallerPolicy;
+    grant: ServiceCallerGrant;
+};
+export declare function callerBeginStep(row: NativeServiceCallerPolicy | undefined, grantId: string, operationId: string): CallerBeginStep;
+/** The cutoff marker and its fixed deadline, on a grant whose deny-new intent `operationId` holds.
+ *  The same marker again is a no-op; anything else is a conflict, so a recorded deadline is never
+ *  reset. `notBefore` is in epoch seconds. */
+export type CallerCutoffStep = {
+    kind: "absent";
+} | {
+    kind: "same";
+} | {
+    kind: "conflict";
+    detail: string;
+} | {
+    kind: "write";
+    row: NativeServiceCallerPolicy;
+};
+export declare function callerCutoffStep(row: NativeServiceCallerPolicy | undefined, grantId: string, marker: {
+    operationId: string;
+    markerKey: string;
+    markerRevision: number;
+    notBefore: number;
+}): CallerCutoffStep;
 /** Storage commit only, after trusted host eligibility checks. Never replaces an existing grant. */
 export declare function appendNativeServiceCallerGrant(reg: LifecycleRegistry, binding: ServiceCallerPolicyBinding, args: {
     expectedRevision: number;
@@ -29,4 +88,16 @@ export declare function beginNativeServiceCallerRevocation(reg: LifecycleRegistr
     grantId: string;
     operationId: string;
 }): Promise<NativeServiceCallerPolicyRead>;
+/** The cutoff step after deny-new: records the op-bound marker and its fixed deadline on a grant
+ *  whose intent this operation already holds. The same values again are a no-op. Other values,
+ *  another operation's intent in either revoking form, an active grant or a revoked one are a
+ *  conflict, so a recorded deadline is never reset. `notBefore` is in epoch seconds. */
+export declare function recordNativeServiceCallerCutoff(reg: LifecycleRegistry, binding: ServiceCallerPolicyBinding, args: {
+    expectedRevision: number;
+    grantId: string;
+    operationId: string;
+    markerKey: string;
+    markerRevision: number;
+    notBefore: number;
+}): Promise<NativeServiceCallerPolicyRead>;
 //# sourceMappingURL=service-caller-policy.d.ts.map

package/dist/service-caller-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-caller-policy.d.ts","sourceRoot":"","sources":["../src/service-caller-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAGmC,KAAK,gBAAgB,EAC9D,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAA4E,MAAM,4BAA4B,CAAC;AAE/I,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AACD,MAAM,WAAW,yBAA0B,SAAQ,0BAA0B;IAC3E,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AACD,MAAM,WAAW,6BAA6B;IAAG,GAAG,EAAE,yBAAyB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAuFnG,mGAAmG;AACnG,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,CAYtF;AAQD,8FAA8F;AAC9F,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAQnK;AA0BD,oGAAoG;AACpG,wBAAsB,8BAA8B,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE;IACtH,gBAAgB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;CACrD,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAgBzC;AAED,4GAA4G;AAC5G,wBAAsB,kCAAkC,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE;IAC1H,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;CAChE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAezC"}
+{"version":3,"file":"service-caller-policy.d.ts","sourceRoot":"","sources":["../src/service-caller-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAGmC,KAAK,gBAAgB,EAC9D,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAA4E,MAAM,4BAA4B,CAAC;AAE/I,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AACD,MAAM,WAAW,yBAA0B,SAAQ,0BAA0B;IAC3E,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AACD,MAAM,WAAW,6BAA6B;IAAG,GAAG,EAAE,yBAAyB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAsFnG,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAGhE;AAED,2DAA2D;AAC3D,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAAuB;AAChG,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAqD;AAEjH,mGAAmG;AACnG,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,CAYtF;AAQD,8FAA8F;AAC9F,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAQnK;AAoBD,8FAA8F;AAC9F,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAGzF;AAMD;;wFAEwF;AACxF,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,yBAAyB,CAAA;CAAE,CAAC;AACtD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,gBAAgB,CAO9L;AAED;mFACmF;AACnF,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,yBAAyB,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,yBAAyB,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,CAMjI;AAED;;8CAE8C;AAC9C,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,yBAAyB,CAAA;CAAE,CAAC;AACtD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,yBAAyB,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAS7M;AAID,oGAAoG;AACpG,wBAAsB,8BAA8B,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE;IACtH,gBAAgB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;CACrD,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAazC;AAED,4GAA4G;AAC5G,wBAAsB,kCAAkC,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE;IAC1H,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;CAChE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAczC;AAED;;;wFAGwF;AACxF,wBAAsB,+BAA+B,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE;IACvH,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CAC9H,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAazC"}

package/dist/service-caller-policy.js

@@ -109,6 +109,15 @@ function grant(raw) {
     return { grantId: id(o.grantId), endpoint: o.endpoint, instanceId: lifecycle(o.instanceId), serviceApprovalDigest: approvalDigest,
         capabilities, source: provenance, parentRefs: parents, status: state(o.status) };
 }
+/** A grant's immutable fields as canonical JSON: everything but `status`, the one field that advances. */
+export function immutableGrantView(g) {
+    return canonicalJson({ grantId: g.grantId, endpoint: g.endpoint, instanceId: g.instanceId, serviceApprovalDigest: g.serviceApprovalDigest,
+        capabilities: g.capabilities, source: g.source, parentRefs: g.parentRefs });
+}
+/** One stored grant's closed syntax, as a row holds it. */
+export function parseServiceCallerGrant(raw) { return grant(raw); }
+/** The auth-store key of one grantee's policy row. */
+export function servicePolicyKey(granteeUid) { return `servicepolicy.${lifecycle(granteeUid)}`; }
 /** Stored syntax only. Eligibility, ancestry and native capability containment are host checks. */
 export function parseNativeServiceCallerPolicy(raw) {
     const o = object(raw, ["v", "accountPublicKey", "space", "grantee", "grants"]);
@@ -133,7 +142,7 @@ function context(reg, binding) {
     const expected = parseNativeServiceCallerPolicy({ v: 1, ...binding, grants: [] });
     if (stores.space !== expected.space)
         throw new EpEnvelopeError("permission-denied", "caller policy belongs to another registry space");
-    return { kv: stores.authKv, key: `servicepolicy.${expected.grantee.lifecycleUid}`, expected };
+    return { kv: stores.authKv, key: servicePolicyKey(expected.grantee.lifecycleUid), expected };
 }
 /** Internal leader-served read. Deleted or corrupt records are not an absent/empty policy. */
 export async function readNativeServiceCallerPolicy(reg, binding) {
@@ -168,11 +177,44 @@ const maxStatusBytes = Math.max(...[
         markerRevision: Number.MAX_SAFE_INTEGER, notBefore: Number.MAX_SAFE_INTEGER },
     { state: "revoked", operationId: "f".repeat(32), verifiedAt: Number.MAX_SAFE_INTEGER },
 ].map(byteSize));
-function assertRevocationHeadroom(row) {
+/** Whether every grant of `row` could still take its largest status within the byte bound. */
+export function callerPolicyHasRevocationHeadroom(row) {
     const worstBytes = byteSize(row) + row.grants.reduce((sum, g) => sum + Math.max(0, maxStatusBytes - byteSize(g.status)), 0);
-    if (worstBytes > SERVICE_AUTHORITY_MAX_BYTES)
-        throw new EpEnvelopeError("resource-exhausted", "native service caller policy lacks all-grant revocation status headroom");
+    return worstBytes <= SERVICE_AUTHORITY_MAX_BYTES;
+}
+export function callerAppendStep(found, empty, expectedRevision, candidate) {
+    const existing = found?.row.grants.find((g) => g.grantId === candidate.grantId);
+    if (existing)
+        return immutableGrantView(existing) === immutableGrantView(candidate) ? { kind: "present", grant: existing } : { kind: "mismatch" };
+    if ((found?.revision ?? 0) !== expectedRevision)
+        return { kind: "moved" };
+    const row = found?.row ?? empty;
+    const next = { ...row, grants: [...row.grants, candidate] };
+    return callerPolicyHasRevocationHeadroom(next) ? { kind: "write", row: next } : { kind: "headroom" };
+}
+export function callerBeginStep(row, grantId, operationId) {
+    const existing = row?.grants.find((g) => g.grantId === grantId);
+    if (!row || !existing)
+        return { kind: "absent" };
+    if (existing.status.state !== "active")
+        return { kind: "held", grant: existing, operationId: existing.status.operationId };
+    const status = { state: "revoking", operationId, phase: "cutoff-required" };
+    return { kind: "write", row: { ...row, grants: row.grants.map((g) => (g.grantId === grantId ? { ...g, status } : g)) }, grant: { ...existing, status } };
+}
+export function callerCutoffStep(row, grantId, marker) {
+    const existing = row?.grants.find((g) => g.grantId === grantId);
+    if (!row || !existing)
+        return { kind: "absent" };
+    const next = { state: "revoking", operationId: id(marker.operationId), markerKey: marker.markerKey,
+        markerRevision: uint(marker.markerRevision, true), notBefore: uint(marker.notBefore, true) };
+    const s = existing.status;
+    if (s.state !== "revoking" || s.operationId !== next.operationId)
+        return { kind: "conflict", detail: "caller grant is not under this revocation operation's deny-new intent" };
+    if (!("phase" in s))
+        return canonicalJson(s) === canonicalJson(next) ? { kind: "same" } : { kind: "conflict", detail: "caller grant already records another cutoff marker" };
+    return { kind: "write", row: { ...row, grants: row.grants.map((g) => (g.grantId === grantId ? { ...g, status: next } : g)) } };
 }
+// ---- storage helpers ----------------------------------------------------------------------------
 /** Storage commit only, after trusted host eligibility checks. Never replaces an existing grant. */
 export async function appendNativeServiceCallerGrant(reg, binding, args) {
     const revision = uint(args.expectedRevision);
@@ -181,18 +223,17 @@ export async function appendNativeServiceCallerGrant(reg, binding, args) {
     const candidate = parseNativeServiceCallerPolicy({ v: 1, ...binding, grants: [args.grant] }).grants[0];
     if (candidate.status.state !== "active")
         bad();
-    const found = await readNativeServiceCallerPolicy(reg, binding), existing = found?.row.grants.find((g) => g.grantId === candidate.grantId);
-    if (existing) {
-        if (canonicalJson(existing) !== canonicalJson(candidate))
-            conflict("grant id is immutable and cannot be rebound or reactivated");
+    const found = await readNativeServiceCallerPolicy(reg, binding);
+    const step = callerAppendStep(found, context(reg, binding).expected, revision, candidate);
+    if (step.kind === "present")
         return found;
-    }
-    if ((found?.revision ?? 0) !== revision)
+    if (step.kind === "mismatch")
+        conflict("grant id is immutable and cannot be rebound");
+    if (step.kind === "moved")
         conflict("native caller policy revision changed");
-    const row = found?.row ?? context(reg, binding).expected;
-    const next = { ...row, grants: [...row.grants, candidate] };
-    assertRevocationHeadroom(next);
-    return write(reg, binding, next, revision);
+    if (step.kind === "headroom")
+        throw new EpEnvelopeError("resource-exhausted", "native service caller policy lacks all-grant revocation status headroom");
+    return write(reg, binding, step.row, revision);
 }
 /** Monotonic deny-new intent only. Cutoff, descendant invalidation and live retirement remain host work. */
 export async function beginNativeServiceCallerRevocation(reg, binding, args) {
@@ -202,17 +243,39 @@ export async function beginNativeServiceCallerRevocation(reg, binding, args) {
     const found = await readNativeServiceCallerPolicy(reg, binding);
     if (!found)
         throw new EpEnvelopeError("not-found", "native caller policy is absent");
-    const existing = found.row.grants.find((g) => g.grantId === grantId);
-    if (!existing)
+    const step = callerBeginStep(found.row, grantId, operationId);
+    if (step.kind === "absent")
         throw new EpEnvelopeError("not-found", "native caller grant is absent");
-    if (existing.status.state !== "active") {
-        if (existing.status.operationId !== operationId)
+    if (step.kind === "held") {
+        if (step.operationId !== operationId)
             conflict("caller grant is already bound to another revocation operation");
         return found;
     }
     if (found.revision !== revision)
         conflict("native caller policy revision changed");
-    return write(reg, binding, { ...found.row, grants: found.row.grants.map((g) => g.grantId === grantId
-            ? { ...g, status: { state: "revoking", operationId, phase: "cutoff-required" } } : g) }, found.revision);
+    return write(reg, binding, step.row, found.revision);
+}
+/** The cutoff step after deny-new: records the op-bound marker and its fixed deadline on a grant
+ *  whose intent this operation already holds. The same values again are a no-op. Other values,
+ *  another operation's intent in either revoking form, an active grant or a revoked one are a
+ *  conflict, so a recorded deadline is never reset. `notBefore` is in epoch seconds. */
+export async function recordNativeServiceCallerCutoff(reg, binding, args) {
+    const revision = uint(args.expectedRevision), grantId = id(args.grantId), operationId = id(args.operationId);
+    const marker = { operationId, markerKey: args.markerKey, markerRevision: uint(args.markerRevision, true), notBefore: uint(args.notBefore, true) };
+    const { accountPublicKey, space, grantee } = context(reg, binding).expected;
+    binding = { accountPublicKey, space, grantee };
+    const found = await readNativeServiceCallerPolicy(reg, binding);
+    if (!found)
+        throw new EpEnvelopeError("not-found", "native caller policy is absent");
+    const step = callerCutoffStep(found.row, grantId, marker);
+    if (step.kind === "absent")
+        throw new EpEnvelopeError("not-found", "native caller grant is absent");
+    if (step.kind === "conflict")
+        conflict(step.detail);
+    if (step.kind === "same")
+        return found;
+    if (found.revision !== revision)
+        conflict("native caller policy revision changed");
+    return write(reg, binding, step.row, found.revision);
 }
 //# sourceMappingURL=service-caller-policy.js.map