@cotal-ai/core 0.101.7 → 0.102.0

package/dist/issuer-session.d.ts

@@ -1,9 +1,10 @@
 /**
- * One issuance window (SPEC 13.15): an ephemeral `issuer` connection over which a mint stages
- * and releases its evidence and writes the accepted row, a lifecycle terminal retires the
- * issuances bound to its ledger family, and a host resolves the evidence a caller's request
- * rides. The connection lives for the callback only; no standing credential holds a grant on
- * either issued-authority store.
+ * The `issuer` connection (SPEC 13.15), over which a mint stages and releases its evidence and
+ * writes the accepted row, a lifecycle terminal retires the issuances bound to its ledger family,
+ * and a host resolves the evidence a caller's request rides. {@link withIssuerSession} opens one
+ * for one callback. {@link holdIssuerSession} is the auth plane's held session for its connect-time
+ * issuances: one connection on short-lived credentials, replaced before they expire, that closes
+ * with the plane.
  */
 import { type JetStreamManager } from "@nats-io/jetstream";
 import { type KV } from "@nats-io/kv";
@@ -21,10 +22,35 @@ export interface IssuerSession {
      *  coordinate is refused rather than guessed live. */
     sourceIsLive(source: IssuedSourceRef): Promise<boolean>;
 }
-export declare function withIssuerSession<T>(args: {
+type IssuerSessionArgs = {
     servers: string;
     space: string;
     auth: SpaceAuth;
     tls: boolean;
-}, fn: (session: IssuerSession) => Promise<T>): Promise<T>;
+};
+/** One issuance window on its own connection, which lives for the callback only. */
+export declare function withIssuerSession<T>(args: IssuerSessionArgs, fn: (session: IssuerSession) => Promise<T>): Promise<T>;
+/** The issuer session one auth plane holds (SPEC 13.15). */
+export interface HeldIssuerSession {
+    /** Run one issuance on the held connection, dialing one on fresh credentials when none is live.
+     *  The issuance's own reads and writes all happen inside `fn`; the holder keeps the connection
+     *  and nothing it read. A connection lost while `fn` runs fails that issuance, and nothing `fn`
+     *  sent is sent again: the next issuance dials a new connection. */
+    run<T>(fn: (session: IssuerSession) => Promise<T>): Promise<T>;
+    /** Refuse every later issuance and drain every connection this holder dialed, including one an
+     *  issuance is still using. */
+    close(): Promise<void>;
+}
+/**
+ * Hold one issuer session for one account, space and auth plane. The connection never reconnects.
+ * Its credential keeps the `issuer` profile's short expiry, or `ttlSeconds` when shorter. At a
+ * random point between half and four fifths of that lifetime the connection stops taking new
+ * issuances and drains once the ones it is running finish, so the broker never expires it, and the
+ * next issuance dials a new one on new credentials. Nothing is dialed until the first issuance.
+ */
+export declare function holdIssuerSession(args: IssuerSessionArgs & {
+    name: string;
+    ttlSeconds?: number;
+}): HeldIssuerSession;
+export {};
 //# sourceMappingURL=issuer-session.d.ts.map

package/dist/issuer-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issuer-session.d.ts","sourceRoot":"","sources":["../src/issuer-session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAK9D,OAAO,EAAiD,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE9H,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtB;;;0DAGsD;IACtD,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EACvE,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CA4BZ"}
+{"version":3,"file":"issuer-session.d.ts","sourceRoot":"","sources":["../src/issuer-session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAK9D,OAAO,EAAiD,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE9H,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtB;;;0DAGsD;IACtD,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,KAAK,iBAAiB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAsC3F,oFAAoF;AACpF,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAO1H;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC;;;wEAGoE;IACpE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/D;mCAC+B;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,CAkEpH"}

package/dist/issuer-session.js

@@ -1,9 +1,10 @@
 /**
- * One issuance window (SPEC 13.15): an ephemeral `issuer` connection over which a mint stages
- * and releases its evidence and writes the accepted row, a lifecycle terminal retires the
- * issuances bound to its ledger family, and a host resolves the evidence a caller's request
- * rides. The connection lives for the callback only; no standing credential holds a grant on
- * either issued-authority store.
+ * The `issuer` connection (SPEC 13.15), over which a mint stages and releases its evidence and
+ * writes the accepted row, a lifecycle terminal retires the issuances bound to its ledger family,
+ * and a host resolves the evidence a caller's request rides. {@link withIssuerSession} opens one
+ * for one callback. {@link holdIssuerSession} is the auth plane's held session for its connect-time
+ * issuances: one connection on short-lived credentials, replaced before they expire, that closes
+ * with the plane.
  */
 import { jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
@@ -12,12 +13,19 @@ import { epAuthBucket } from "./endpoint-binding.js";
 import { EpEnvelopeError } from "./endpoint-envelope.js";
 import { issuanceGateKey, parseIssuanceGate } from "./lifecycle-state.js";
 import { acceptedBucket, issuedBucket, openIssuedStore } from "./issued-authority.js";
-import { newIdentity } from "./identity.js";
-import { mintCreds } from "./provision.js";
+import { credsClaims, newIdentity } from "./identity.js";
+import { credentialLifetime, mintCreds } from "./provision.js";
+import { armRenewal, renewalDeadlineMs } from "./renewal.js";
 import { standaloneConnectOpts } from "./streams.js";
-export async function withIssuerSession(args, fn) {
-    const creds = await mintCreds(args.auth, newIdentity(), "issuer");
-    const nc = await dialerFor(args.servers)({ servers: args.servers, ...standaloneConnectOpts({ creds, tls: args.tls }), maxReconnectAttempts: 0 });
+/** Dial one `issuer` connection on freshly minted credentials and bind its stores. It never
+ *  reconnects: a lost connection closes at once, failing every request still on it, so nothing an
+ *  issuance sent before the loss is sent again. Returns the session and the credential's lifetime. */
+async function openIssuerSession(args, opts = {}) {
+    const creds = await mintCreds(args.auth, newIdentity(), "issuer", opts.ttlSeconds === undefined ? {} : { expiresInSeconds: opts.ttlSeconds });
+    const { iat, exp } = credsClaims(creds);
+    if (iat === undefined || exp === undefined)
+        throw new Error("an issuer credential must carry iat and exp");
+    const nc = await dialerFor(args.servers)({ servers: args.servers, ...standaloneConnectOpts({ creds, tls: args.tls }), ...(opts.name ? { name: opts.name } : {}), reconnect: false, maxReconnectAttempts: 0 });
     try {
         const kvm = new Kvm(nc);
         const jsm = await jetstreamManager(nc);
@@ -42,10 +50,103 @@ export async function withIssuerSession(args, fn) {
                 return false;
             return parseIssuanceGate(entry.data, key, m[1]).state !== "retired";
         };
-        return await fn({ nc, jsm, store, accepted, sourceIsLive });
+        return { session: { nc, jsm, store, accepted, sourceIsLive }, issuedAtMs: iat * 1000, expiresAtMs: exp * 1000 };
+    }
+    catch (e) {
+        await nc.close().catch(() => { });
+        throw e;
+    }
+}
+/** One issuance window on its own connection, which lives for the callback only. */
+export async function withIssuerSession(args, fn) {
+    const { session } = await openIssuerSession(args);
+    try {
+        return await fn(session);
     }
     finally {
-        await nc.drain().catch(() => nc.close());
+        await session.nc.drain().catch(() => session.nc.close());
     }
 }
+/**
+ * Hold one issuer session for one account, space and auth plane. The connection never reconnects.
+ * Its credential keeps the `issuer` profile's short expiry, or `ttlSeconds` when shorter. At a
+ * random point between half and four fifths of that lifetime the connection stops taking new
+ * issuances and drains once the ones it is running finish, so the broker never expires it, and the
+ * next issuance dials a new one on new credentials. Nothing is dialed until the first issuance.
+ */
+export function holdIssuerSession(args) {
+    const maxTtl = credentialLifetime("issuer").defaultTtlSeconds;
+    if (args.ttlSeconds !== undefined && (!Number.isSafeInteger(args.ttlSeconds) || args.ttlSeconds < 5 || args.ttlSeconds > maxTtl))
+        throw new Error(`issuer session ttlSeconds must be an integer between 5 and ${maxTtl} seconds (got ${args.ttlSeconds})`);
+    const live = new Set();
+    let current;
+    let closed = false;
+    const refuseClosed = () => {
+        if (closed)
+            throw new EpEnvelopeError("unavailable", `the issuer session for space "${args.space}" is closed`);
+    };
+    // Settles without rejecting: a teardown that fails leaves nothing this holder could do again.
+    const drain = (h) => h.drained ??= h.session.nc.drain().catch(() => h.session.nc.close()).catch(() => { });
+    const retire = (h) => {
+        h.retired = true;
+        h.cancel();
+        if (h.running === 0)
+            void drain(h);
+    };
+    const dial = async () => {
+        const { session, issuedAtMs, expiresAtMs } = await openIssuerSession(args, { name: args.name, ...(args.ttlSeconds !== undefined ? { ttlSeconds: args.ttlSeconds } : {}) });
+        const h = { session, renewBy: renewalDeadlineMs(issuedAtMs, expiresAtMs), running: 0, retired: false, cancel: () => { } };
+        live.add(h);
+        h.cancel = armRenewal(args.space, issuedAtMs, expiresAtMs, () => retire(h));
+        void session.nc.closed().then(() => {
+            h.retired = true;
+            h.cancel();
+            live.delete(h);
+        });
+        return h;
+    };
+    const acquire = async () => {
+        for (;;) {
+            refuseClosed();
+            const pending = current ??= dial();
+            let h;
+            try {
+                h = await pending;
+            }
+            catch (e) {
+                if (current === pending)
+                    current = undefined;
+                throw e;
+            }
+            refuseClosed();
+            if (!h.retired && Date.now() < h.renewBy)
+                return h;
+            if (current === pending)
+                current = undefined;
+            retire(h);
+        }
+    };
+    return {
+        run: async (fn) => {
+            const h = await acquire();
+            h.running++;
+            try {
+                return await fn(h.session);
+            }
+            finally {
+                if (--h.running === 0 && h.retired)
+                    void drain(h);
+            }
+        },
+        close: async () => {
+            closed = true;
+            await current?.catch(() => undefined);
+            current = undefined;
+            const held = [...live];
+            for (const h of held)
+                h.cancel();
+            await Promise.all(held.map(drain));
+        },
+    };
+}
 //# sourceMappingURL=issuer-session.js.map

package/dist/issuer-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"issuer-session.js","sourceRoot":"","sources":["../src/issuer-session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAA0C,MAAM,uBAAuB,CAAC;AAC9H,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAcrD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuE,EACvE,EAA0C;IAE1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IACjJ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAuB,EAAoB,EAAE;YACvE,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBACrE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iBAAiB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,iEAAiE,CAAC,CAAC;YAChK,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAC3D,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9D,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;QACvE,CAAC,CAAC;QACF,OAAO,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"issuer-session.js","sourceRoot":"","sources":["../src/issuer-session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAA0C,MAAM,uBAAuB,CAAC;AAC9H,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAgBrD;;sGAEsG;AACtG,KAAK,UAAU,iBAAiB,CAAC,IAAuB,EAAE,OAA+C,EAAE;IACzG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9I,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC3G,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9M,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAuB,EAAoB,EAAE;YACvE,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBACrE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iBAAiB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,iEAAiE,CAAC,CAAC;YAChK,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAC3D,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9D,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;QACvE,CAAC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;IAClH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAI,IAAuB,EAAE,EAA0C;IAC5G,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA+D;IAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,iBAAkB,CAAC;IAC/D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,8DAA8D,MAAM,iBAAiB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IAE3H,MAAM,IAAI,GAAG,IAAI,GAAG,EAAQ,CAAC;IAC7B,IAAI,OAAkC,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,iCAAiC,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC;IACjH,CAAC,CAAC;IACF,8FAA8F;IAC9F,MAAM,KAAK,GAAG,CAAC,CAAO,EAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/H,MAAM,MAAM,GAAG,CAAC,CAAO,EAAQ,EAAE;QAC/B,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;YAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3K,MAAM,CAAC,GAAS,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;QAC/H,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,KAAK,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YACjC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,SAAS,CAAC;YACR,YAAY,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAO,CAAC;YACZ,IAAI,CAAC;gBACH,CAAC,GAAG,MAAM,OAAO,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,OAAO,KAAK,OAAO;oBAAE,OAAO,GAAG,SAAS,CAAC;gBAC7C,MAAM,CAAC,CAAC;YACV,CAAC;YACD,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,OAAO;gBAAE,OAAO,GAAG,SAAS,CAAC;YAC7C,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAChB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;YAC1B,CAAC,CAAC,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;oBAAS,CAAC;gBACT,IAAI,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO;oBAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/provision.js

@@ -112,7 +112,7 @@ export const CREDENTIAL_LIFETIMES = {
     "run-driver": { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "manager", note: "one workflow run's driver, per takeover attempt (SPEC 14.6): the hosting manager mints it when it takes the run over and re-mints for the SAME nkey on renewal; a new takeover mints a new one" },
     "run-mediator": { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "manager", note: "trusted workflow host operations, bound to one run and attempt; kept on the hosting process's connection" },
     "run-operator": { class: "one-shot", defaultTtlSeconds: 60, note: "one served run-status / run-ps / run-answer call (SPEC 14.3): the hosting manager mints it per call on its own connection, never the serve rails; 60s bounds a copied cred to a minute" },
-    issuer: { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "one issuance's evidence stage/release or one lifecycle terminal's issuance retirement (SPEC 13.15)" },
+    issuer: { class: "mixed", defaultTtlSeconds: FIVE_MINUTES, renewalOwner: "auth-service", note: "renewed as the auth plane's held session for connect-time issuance (re-minted before exp, closed with the plane); one-shot for every other issuance window and for a lifecycle terminal's issuance retirement (SPEC 13.15)" },
     "run-admitter": { class: "one-shot", defaultTtlSeconds: 60, note: "one hosted run's admission record create, or its revocation marker (SPEC 14.8); 60s bounds a copied cred to a minute" },
     "transfer-writer": { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "one carried resume per CLI call: one object's chunk and meta subjects in one instance's transfer bucket" },
     "transfer-reader": { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "one transcript-receive or sweep over the minting instance's own transfer bucket" },