@cotal-ai/core 0.11.6 → 0.13.0

package/dist/endpoint-binding.js

@@ -0,0 +1,753 @@
+/**
+ * v0.4 NATS + JetStream binding (SPEC §13.12) — the per-space control-surface resources and
+ * the §13.9 consumer-name grammar with the infrastructure consumer configs over them.
+ *
+ * Streams are space infrastructure: `STREAM.CREATE` is denied to agents, so
+ * {@link createEndpointStreams} runs once at space setup (like `createSpaceStreams`). It is the
+ * single source of the resource definitions — the table in §13.12 — so setup and every consumer
+ * of a stream name can never diverge. Consumer CONFIGS here are equally single-source: each is
+ * created by exactly one trusted principal (provisioner or the owning infra principal) and the
+ * §13.9 grant rows are generated against these same names and filters.
+ */
+import { AckPolicy, DeliverPolicy, RetentionPolicy, StorageType, } from "@nats-io/jetstream";
+import { nanos } from "@nats-io/transport-node";
+import { spacePrefix, token, assertInboxConnId } from "./subjects.js";
+import { endpointToken, assertIdToken, assertGrantId, assertPoolToken, assertLifecycleToken, callerTokens, } from "./endpoint-subjects.js";
+import { AUTHORITY_KIND_DEFS, callerReadableRecordKind } from "./endpoint-records.js";
+import { epjStreamName, epfStreamName, canonDurable } from "./endpoint-journal.js";
+import { recordsBucket } from "./endpoint-records.js";
+// Re-exported so the binding module presents the complete §13.12 name table even though the
+// journal/records helpers own the definitions their own logic is written against.
+export { epjStreamName, epfStreamName, canonDurable, recordsBucket };
+/** §13.12 stream names for the remaining per-space control-surface streams. */
+export function epeStreamName(space) { return `EPE_${token(space)}`; }
+export function eptReqStreamName(space) { return `EPT_REQ_${token(space)}`; }
+export function eptStreamName(space) { return `EPT_${token(space)}`; }
+export function eprStreamName(space) { return `EPR_${token(space)}`; }
+export function epwStreamName(space) { return `EPW_${token(space)}`; }
+export function epcStreamName(space) { return `EPC_${token(space)}`; }
+/** The CLOSED set of streams a §13.1 retirement may record a frontier cutoff over: exactly the
+ *  per-space streams that carry a retired lifecycle's durable data a later durable reader can
+ *  replay (facts EPF, work EPW, events EPE, and the records KV). A retirement intent's
+ *  `frontierStreams` must be a subset of this set; it is NOT a caller-selectable arbitrary stream
+ *  list. This is the ONE source consumed by both the intent validation and the barrier's
+ *  `STREAM.INFO` grant, so the frontier authority and the frontier-writable set never drift
+ *  (nats-server subject ACLs cannot scope INFO to an intent-selected name). The auth store is
+ *  deliberately absent: it is the control plane, never a lifecycle-data frontier. */
+export function retirementFrontierStreams(space) {
+    return [epfStreamName(space), epwStreamName(space), epeStreamName(space), recordsKvStreamName(space)];
+}
+/** The per-space auth store (§13.12): credential ledger + issuance/source gates + session
+ *  ledger. Trusted auth path ONLY — no agent/endpoint/observer/admin/host profile holds any
+ *  grant — and `allow_direct=false`: every fence on it is a leader-served revision-pinned CAS,
+ *  and Direct Get's follower/mirror reads would defeat read-your-writes (§13.1). */
+export function epAuthBucket(space) {
+    return `cotal_auth_${token(space)}`;
+}
+// ---- §13.12 retention knobs (documented defaults, overridable per space policy) ----
+/** EPJ duplicate window: the server MINIMUM (100 ms), set explicitly. A `0` is not accepted
+ *  (it normalizes to the 120 s default), and native dedupe is deliberately NOT relied upon —
+ *  submitters never set `Nats-Msg-Id`, and a wide window is exactly the cross-caller
+ *  suppression surface §13.4 refuses — so the window is pinned as small as the server allows. */
+export const EPJ_DUPLICATE_WINDOW_MS = 100;
+/** Default age bound on raw submissions (EPJ). The §13.12 floor is "≥ recovery/redelivery
+ *  lag" of the canonicalizer; 24 h covers any realistic canonicalizer outage while keeping the
+ *  untrusted log from growing unbounded. */
+export const EP_SUBMISSION_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Default age bound on events (EPE) — progress/catch-up telemetry, space policy. */
+export const EP_EVENT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Default age bound on the two writer-ingress streams (EPT_REQ, EPR). The floor is
+ *  "≥ writer recovery lag"; the same 24 h envelope as EPJ. */
+export const EP_INGRESS_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Default age bound on authoritative schedules + fires (EPT). The floor is
+ *  "≥ max deadline + margin": a schedule stored longer than this cannot outlive its stream
+ *  row, so the default admits deadlines up to ~30 days. */
+export const EP_TIMER_MAX_AGE_MS = 31 * 24 * 60 * 60 * 1000;
+/** Delete-marker TTL on the auth store — enables the stream's per-key TTL machinery
+ *  (`allow_msg_ttl`), which `cred.`/`bysrc.` rows use (per-key TTL ≤ credential TTL). The
+ *  bucket itself carries NO age retention: `gate.`/`srcgate.`/`session.` authority keys
+ *  persist until explicitly terminal (§13.12). */
+export const EP_AUTH_MARKER_TTL_MS = 60 * 60 * 1000;
+/**
+ * Create (idempotently) the §13.12 per-space control-surface resources: the seven JetStream
+ * streams, the work-pool WorkQueue, and the two KV buckets. Privileged — runs at space setup.
+ * `jsm.streams.add`/`kvm.create` are idempotent for an identical config and FAIL LOUD on a
+ * config delta, which is wanted: a drifted resource is an operator error, never silently adopted.
+ *
+ * Sessions (`eps`) are deliberately absent: core-only, never captured (§13.12).
+ */
+export async function createEndpointStreams(jsm, kvm, space, opts = {}) {
+    const p = spacePrefix(space);
+    // EPJ — raw submissions, untrusted, at-least-once. NO allow_direct (nothing reads it but the
+    // canonicalizer's durable and harness MSG.GET); duplicate window pinned to the server minimum.
+    await jsm.streams.add({
+        name: epjStreamName(space),
+        subjects: [`${p}.epj.>`],
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        max_age: nanos(opts.submissionMaxAgeMs ?? EP_SUBMISSION_MAX_AGE_MS),
+        duplicate_window: nanos(EPJ_DUPLICATE_WINDOW_MS),
+    });
+    // EPF — canonical facts; acceptance is create-only CAS; allow_direct serves the §13.9
+    // last-by-subject fact reads (trusted principals only; callers read via the mediator).
+    await jsm.streams.add({
+        name: epfStreamName(space),
+        subjects: [`${p}.epf.>`],
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        allow_direct: true,
+        ...(opts.factMaxAgeMs ? { max_age: nanos(opts.factMaxAgeMs) } : {}),
+    });
+    // EPE — events/progress.
+    await jsm.streams.add({
+        name: epeStreamName(space),
+        subjects: [`${p}.epe.>`],
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        max_age: nanos(opts.eventMaxAgeMs ?? EP_EVENT_MAX_AGE_MS),
+    });
+    // EPT_REQ — schedule REQUESTS. Message schedules DISABLED (the default; asserted by the
+    // smoke): a client-set scheduling header here cannot arm anything, which is what closes the
+    // ADR-51 confused deputy — only the timer writer's `.armed` publish (on EPT) schedules.
+    await jsm.streams.add({
+        name: eptReqStreamName(space),
+        subjects: [`${p}.ept.*.*.*.*.schedule`],
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        max_age: nanos(opts.ingressMaxAgeMs ?? EP_INGRESS_MAX_AGE_MS),
+    });
+    // EPR — record-write ingress, consumed only by the per-kind record writers.
+    await jsm.streams.add({
+        name: eprStreamName(space),
+        subjects: [`${p}.epr.>`],
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        max_age: nanos(opts.ingressMaxAgeMs ?? EP_INGRESS_MAX_AGE_MS),
+    });
+    // EPT — authoritative schedules (.armed) + fires (.fire). AllowMsgSchedules; each schedule
+    // targets its sibling `.fire` (ADR-51 forbids target = publish subject), and both patterns
+    // live on THIS stream because ADR-51 requires the target be captured by the same stream.
+    await jsm.streams.add({
+        name: eptStreamName(space),
+        subjects: [`${p}.ept.*.*.*.*.armed`, `${p}.ept.*.*.*.*.fire`],
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        allow_msg_schedules: true,
+        max_age: nanos(opts.timerMaxAgeMs ?? EP_TIMER_MAX_AGE_MS),
+    });
+    // EPW — work pools, one item per subject. NO allow_direct: the §13.6 reconciliation probe
+    // (an acked item leaves the WorkQueue, an in-flight one remains readable — exactly the
+    // predicate) is a FENCING read that gates the re-enqueue decision, so it goes leader-served
+    // STREAM.MSG.GET (SPEC 13.6:1797-1799), never a follower-servable Direct Get whose stale miss
+    // would re-arm settled work. Nothing else reads EPW: the pool workers drain it via the
+    // WorkQueue consumer (CONSUMER.MSG.NEXT), not by subject read.
+    await jsm.streams.add({
+        name: epwStreamName(space),
+        subjects: [`${p}.epw.>`],
+        retention: RetentionPolicy.Workqueue,
+        storage: StorageType.File,
+        allow_direct: false,
+    });
+    // EPC — content-addressed contract artifacts: one immutable message per digest subject,
+    // create-only mediated publication, NO age eviction (artifacts are permanent). allow_direct:
+    // the subject-scoped last-by-subject read IS the fetch path. Permanence is BROKER-ENFORCED,
+    // not just configured-by-omission: deny_delete/deny_purge reject the message-delete and purge
+    // APIs even from a stream-API-holding principal, so a digest subject cannot be emptied and
+    // re-created through them. Per §13.12 the flags alone are NOT the whole claim: permanence is
+    // their COMBINATION with the retention floor (no age eviction, no teardown), verify-on-read
+    // pinning WHAT a subject carries, and stream management held by no profile.
+    await jsm.streams.add({
+        name: epcStreamName(space),
+        subjects: [`${p}.epc.>`],
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        allow_direct: true,
+        deny_delete: true,
+        deny_purge: true,
+    });
+    await ensureAuthorityStores(jsm, kvm, space);
+}
+/**
+ * Ensure the two per-space AUTHORITY stores exist with their normative shape (§13.12):
+ *
+ *  - **Records KV** (`cotal_records_<space>`) — per-key CAS; rows are never deleted.
+ *    deny_delete/deny_purge close stream-API erasure as defense in depth (a raw KV subject grant
+ *    can still emit a DEL marker, which every reader treats as corruption); rollups off. Fenced
+ *    reads stay leader-served STREAM.MSG.GET (§13.9).
+ *  - **Auth KV** (`cotal_auth_<space>`) — leader-served only (`allow_direct=false`); per-key TTL
+ *    machinery on (`cred.`/`bysrc.` rows), NO bucket age.
+ *
+ * Create-or-verify, so it is safe at EVERY authority-daemon boot (not only first setup): a fresh
+ * space gets both stores created; an existing store is verified against the exact flags above and
+ * a drift FAILS LOUD naming the store — a drifted authority store is an operator error, never
+ * silently adopted (§13.12: the flags are load-bearing for deny-new and the barrier CAS fences).
+ */
+export async function ensureAuthorityStores(jsm, kvm, space) {
+    // CREATE-IF-ABSENT then UNCONDITIONALLY VERIFY: `Kvm.create` opens an existing stream WITHOUT
+    // comparing its config (a drifted pre-existing stream is the NORMAL success path, not an error),
+    // so the create call proves nothing. Both the just-created and the pre-existing store flow
+    // through the SAME final `streams.info` + full normative verify — a drifted authority store is
+    // an operator error, never silently adopted (§13.12: the flags + store-binding are load-bearing
+    // for deny-new and the barrier CAS fences).
+    const recordBucket = recordsBucket(space);
+    const recordStream = `KV_${recordBucket}`;
+    if (await jsm.streams.info(recordStream).catch(() => undefined) === undefined) {
+        await kvm.create(recordBucket, { allow_direct: true });
+        const recordConfig = (await jsm.streams.info(recordStream)).config;
+        await jsm.streams.update(recordStream, { ...recordConfig, allow_rollup_hdrs: false, deny_delete: true, deny_purge: true });
+    }
+    const recordCfg = (await jsm.streams.info(recordStream)).config;
+    if (recordCfg.allow_direct !== true || recordCfg.allow_rollup_hdrs !== false || recordCfg.deny_delete !== true || recordCfg.deny_purge !== true)
+        throw new Error(`the records store ${recordBucket} has a drifted shape (allow_direct=${String(recordCfg.allow_direct)}, allow_rollup_hdrs=${String(recordCfg.allow_rollup_hdrs)}, deny_delete=${String(recordCfg.deny_delete)}, deny_purge=${String(recordCfg.deny_purge)}); an authority store is never silently adopted - reprovision it (SPEC 13.12)`);
+    assertAuthorityStoreBinding(recordCfg, recordBucket);
+    const authBucket = epAuthBucket(space);
+    const authStream = `KV_${authBucket}`;
+    if (await jsm.streams.info(authStream).catch(() => undefined) === undefined)
+        await kvm.create(authBucket, { allow_direct: false, markerTTL: EP_AUTH_MARKER_TTL_MS });
+    const authCfg = (await jsm.streams.info(authStream)).config;
+    if (authCfg.allow_direct !== false || authCfg.allow_msg_ttl !== true)
+        throw new Error(`the auth store ${authBucket} has a drifted shape (allow_direct=${String(authCfg.allow_direct)}, allow_msg_ttl=${String(authCfg.allow_msg_ttl)}); an authority store is never silently adopted - reprovision it (SPEC 13.12)`);
+    assertAuthorityStoreBinding(authCfg, authBucket);
+}
+/** The store-BINDING half of the verify (SPEC 13.12): a stream wearing an authority bucket's name
+ *  must BE that KV bucket — exactly the one `$KV.<bucket>.>` subject (an extra captured subject
+ *  would put foreign bodies inside every body-selected MSG.GET grant on the stream) and durable
+ *  file storage (a memory store forgets fences and revocations on restart). */
+function assertAuthorityStoreBinding(cfg, bucket) {
+    const expected = `$KV.${bucket}.>`;
+    if (!Array.isArray(cfg.subjects) || cfg.subjects.length !== 1 || cfg.subjects[0] !== expected)
+        throw new Error(`the store ${bucket} does not carry exactly the subject ${expected} (got ${JSON.stringify(cfg.subjects)}); a stream that captures anything else is not this KV bucket - reprovision it (SPEC 13.12)`);
+    if (cfg.storage !== "file")
+        throw new Error(`the store ${bucket} has storage ${JSON.stringify(cfg.storage)}, not file; a non-durable authority store forgets fences and revocations on restart - reprovision it (SPEC 13.12)`);
+}
+// ---- §13.9 consumer-name grammar (normative; dash-form, collision-free by construction) ----
+/** `poolD = pool_<e>_<pool>` — parses uniquely from its LAST `_` because a pool token contains
+ *  no `_` (`[a-z0-9-]`) while `<e>` may. */
+export function poolDurable(endpoint, pool) {
+    return `pool_${endpointToken(endpoint)}_${assertPoolToken(pool)}`;
+}
+/** `timerD = timerw_<space>` — the space's single timer-writer durable. */
+export function timerWriterDurable(space) {
+    return `timerw_${token(space)}`;
+}
+/** `recwD-k = recw_<space>-<kind>` — ONE record-writer durable per record kind (§13.9's writer
+ *  separation). Parses from its LAST `-`? No — from the FIRST `-` after the fixed prefix is
+ *  ambiguous when the space token contains `-`; the collision-freedom argument is simpler: the
+ *  durable exists once per (space, kind) pair inside a per-space stream, so only the `<kind>`
+ *  tail must be unique within one space, and kinds are unique by the registry. The kind token
+ *  is the `epr` subject's kind token (id grammar, dot-free). */
+export function recordWriterDurable(space, kind) {
+    return `recw_${token(space)}-${assertIdToken(kind, "record kind")}`;
+}
+/** `effD = eff_<e>` — the endpoint's ONE shared effects durable (instances pull-compete). */
+export function effectsDurable(endpoint) {
+    return `eff_${endpointToken(endpoint)}`;
+}
+/** `decD = dec_<uid>-<e>` — a caller's decision-reader durable (one per journal capability).
+ *  Parses from its FIRST `-`: `<uid>` is `[a-z0-9]` and contains none. */
+export function decisionReaderDurable(uid, endpoint) {
+    return `dec_${assertLifecycleToken(uid)}-${endpointToken(endpoint)}`;
+}
+/** `goalD = goal_<uid>-<e>` — a caller's goal-result durable (one per action capability). */
+export function goalReaderDurable(uid, endpoint) {
+    return `goal_${assertLifecycleToken(uid)}-${endpointToken(endpoint)}`;
+}
+/** `eveD = eve_<uid>-<e>-<gid>-<n>` — one per granted event subtree: `<gid>` is the mint-time
+ *  grant id, `<n>` the subtree's zero-based index within THAT grant. INJECTIVE by construction:
+ *  `<uid>` is `-`-free (leading), `<n>` is digits (trailing), `<gid>` is separator-free
+ *  (`assertGrantId`), so `<e>` is the ONLY `-`-bearing component and its extent is unambiguous
+ *  (parse `<n>` and `<gid>` off the right, `<uid>` off the left, `<e>` is what remains). Without
+ *  the separator-free `<gid>` the two soft components `<e>` and `<gid>` would collide
+ *  (`eve_<uid>-a-b-c-0` = endpoint `a-b`/gid `c` OR endpoint `a`/gid `b-c`, §13.9). */
+export function eventReaderDurable(uid, endpoint, grantId, n) {
+    if (!Number.isInteger(n) || n < 0)
+        throw new Error(`event-reader subtree index must be a non-negative integer, got ${n}`);
+    return `eve_${assertLifecycleToken(uid)}-${endpointToken(endpoint)}-${assertGrantId(grantId)}-${n}`;
+}
+/** `recD = rec_<uid>-<gid>-<n>` — one per granted record subtree (grammar as {@link eventReaderDurable};
+ *  `<gid>` separator-free, `<uid>` `-`-free, `<n>` digits, so the single soft component is bounded). */
+export function recordReaderDurable(uid, grantId, n) {
+    if (!Number.isInteger(n) || n < 0)
+        throw new Error(`record-reader subtree index must be a non-negative integer, got ${n}`);
+    return `rec_${assertLifecycleToken(uid)}-${assertGrantId(grantId)}-${n}`;
+}
+const FAMILY = new WeakMap();
+function family(stream, cfg) {
+    FAMILY.set(cfg, { stream, durable: cfg.durable_name, filter: cfg.filter_subject });
+    return cfg;
+}
+function assertFamilyPair(stream, cfg, what) {
+    const bond = FAMILY.get(cfg);
+    if (bond === undefined)
+        throw new Error(`${what} requires a consumer config minted by a §13.9 family builder, not a raw config (durable ${JSON.stringify(cfg.durable_name ?? "")})`);
+    if (bond.stream !== stream)
+        throw new Error(`${what}: durable ${JSON.stringify(cfg.durable_name ?? "")} belongs to stream ${JSON.stringify(bond.stream)}, not ${JSON.stringify(stream)} (§13.9: no cross-family pairing)`);
+    if (cfg.durable_name !== bond.durable || cfg.filter_subject !== bond.filter)
+        throw new Error(`${what}: the config's durable/filter diverged from the tuple its family builder minted (minted ${JSON.stringify(bond.durable)} on ${JSON.stringify(bond.filter)}, now ${JSON.stringify(cfg.durable_name ?? "")} on ${JSON.stringify(cfg.filter_subject ?? "")}); a mutated config is not §13.9 authority`);
+    // §13.9 pre-created consumers are PULL-only: a create's delivery target is body-set and
+    // unconfined, so a post-mint deliver_subject would fan the stream out to an arbitrary subject.
+    if (cfg.deliver_subject !== undefined)
+        throw new Error(`${what}: the config carries a deliver_subject; §13.9 family consumers are PULL-only, a push delivery target is unconfined`);
+}
+/** The canonicalizer's durable on EPJ (`canon_<e>`): every raw submission to one endpoint.
+ *  Acks only after the durable decision (and, for pool routes, after the enqueue), §13.4. */
+export function canonConsumerConfig(space, endpoint, opts = {}) {
+    return family(epjStreamName(space), {
+        durable_name: canonDurable(endpoint),
+        filter_subject: `${spacePrefix(space)}.epj.${endpointToken(endpoint)}.>`,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+        max_ack_pending: opts.maxAckPending ?? 1000,
+    });
+}
+/** The endpoint's ONE shared effects durable on EPF (`eff_<e>`, filter `epf.<e>.dec.>`):
+ *  instances pull-compete so each accepted decision effects exactly once live (at-least-once);
+ *  ack ONLY after the effect is durably recorded (§13.9 ack barrier). */
+export function effectsConsumerConfig(space, endpoint, opts = {}) {
+    return family(epfStreamName(space), {
+        durable_name: effectsDurable(endpoint),
+        filter_subject: `${spacePrefix(space)}.epf.${endpointToken(endpoint)}.dec.>`,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+        max_ack_pending: opts.maxAckPending ?? 1000,
+    });
+}
+/** A record kind's writer durable on EPR (`recw_<space>-<kind>`) — one principal and one
+ *  consumer PER KIND, never a single writer draining every kind (§13.9). The filter is DERIVED
+ *  from the kind's qualifier arity: a NATS `>` matches one-or-more tokens (it does NOT match a
+ *  bare parent), so a kind with ≥1 qualifier filters `…<kind>.>` while a ZERO-qualifier kind
+ *  (a single space-wide record) filters exactly `…<kind>` — else the writer would miss every
+ *  write for that registered grammar. Takes the RecordKindDef so the arity cannot be guessed. */
+export function recordWriterConsumerConfig(space, def, opts = {}) {
+    const kind = assertIdToken(def.kind, "record kind");
+    const tail = def.qualifiers.length > 0 ? `.${kind}.>` : `.${kind}`;
+    return family(eprStreamName(space), {
+        durable_name: recordWriterDurable(space, def.kind),
+        filter_subject: `${spacePrefix(space)}.epr.*.*.*${tail}`,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+    });
+}
+/** The timer writer's durable on EPT_REQ (`timerw_<space>`, full-tail filter on `.schedule`).
+ *  The writer validates each request (rejecting any client scheduling header and any
+ *  stale-generation request) before publishing the authoritative `.armed` on EPT. */
+export function timerWriterConsumerConfig(space, opts = {}) {
+    return family(eptReqStreamName(space), {
+        durable_name: timerWriterDurable(space),
+        filter_subject: `${spacePrefix(space)}.ept.*.*.*.*.schedule`,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+    });
+}
+/** A pool's durable on the EPW WorkQueue (`pool_<e>_<pool>`, exact filter
+ *  `epw.<e>.<pool>.>`) — provisioner-pre-created; the owning endpoint binds it (§13.5). Exact
+ *  per-pool filters keep WorkQueue consumers non-overlapping by construction. `ack_wait` is
+ *  ONLY the broker's redelivery-to-owner timer; the authoritative lease deadline lives in the
+ *  owner's lease record (§13.12). */
+export function poolConsumerConfig(space, endpoint, pool, opts = {}) {
+    return family(epwStreamName(space), {
+        durable_name: poolDurable(endpoint, pool),
+        filter_subject: `${spacePrefix(space)}.epw.${endpointToken(endpoint)}.${assertPoolToken(pool)}.>`,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        // UNLIMITED delivery, pinned EXPLICITLY (not left to the server default): the §13.6 virtual
+        // admission fence counts pool occupancy as num_pending + num_ack_pending, and a message that
+        // exhausts a FINITE max_deliver stays stored but leaves both counters, silently falsifying
+        // the count. MaxDeliver is editable post-create, so the occupancy reader ALSO fails closed
+        // on any reported value other than -1 (readPoolOccupancy); this pin makes intent explicit
+        // and the drift check enforceable.
+        max_deliver: -1,
+    });
+}
+/** A caller's decision-reader durable on EPF (`dec_<uid>-<e>`, exact filter on the caller's
+ *  own `dec` triple) — pre-created PULL by the provisioner at capability mint; owned and bound
+ *  by the READ MEDIATOR, never the caller (§13.9 mediated reads). */
+export function decisionReaderConfig(space, endpoint, caller, opts = {}) {
+    return family(epfStreamName(space), {
+        durable_name: decisionReaderDurable(caller.uid, endpoint),
+        filter_subject: `${spacePrefix(space)}.epf.${endpointToken(endpoint)}.dec.${callerTokens(caller).join(".")}.>`,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+    });
+}
+/** A caller's goal-result durable on EPF (`goal_<uid>-<e>`; grammar as {@link decisionReaderConfig}). */
+export function goalReaderConfig(space, endpoint, caller, opts = {}) {
+    return family(epfStreamName(space), {
+        durable_name: goalReaderDurable(caller.uid, endpoint),
+        filter_subject: `${spacePrefix(space)}.epf.${endpointToken(endpoint)}.goal.${callerTokens(caller).join(".")}.>`,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+    });
+}
+/** Assert a granted subtree filter is a full tail under `prefix` (§13.9 "JetStream API tails
+ *  are always spelled in FULL"): a relative tail matches nothing, and a bare `prefix` or one
+ *  climbing outside it would widen the reader past its capability. Tokens are literal or full
+ *  `*` wildcards (whole-token `*` is NORMATIVE in granted subtrees — the per-goal event row
+ *  wildcards the instanceId/epoch positions, §13.9; mint-time literalness constrains the
+ *  DURABLE name, not the filter interior), with at most ONE trailing `.>` and never `>` alone
+ *  (a whole-plane read is a trusted-reader grant family, not a caller capability). Returns the
+ *  tail tokens (after `prefix.`) for provenance checks. */
+function assertFullTail(filter, prefix, what) {
+    if (!filter.startsWith(`${prefix}.`))
+        throw new Error(`${what} filter ${JSON.stringify(filter)} must be a full tail under ${JSON.stringify(prefix)} (§13.9)`);
+    const toks = filter.slice(prefix.length + 1).split(".");
+    toks.forEach((t, i) => {
+        if (t === "*")
+            return;
+        if (t === ">" && i === toks.length - 1 && i > 0)
+            return; // one trailing subtree wildcard, never the whole tail
+        if (t.length === 0 || /[*>\s]/.test(t))
+            throw new Error(`${what} filter ${JSON.stringify(filter)} token ${JSON.stringify(t)} is not a literal token, a full "*" token, or one trailing ">" (§13.9)`);
+    });
+    return toks;
+}
+/** `eveD = eve_<uid>-<e>-<gid>-<n>` — one per GRANTED event subtree (§13.9): a PULL durable the
+ *  provisioner pre-creates with the capability's EXACT full-tail event filter, bound by the read
+ *  mediator (never the caller). `subtree` is the granted `cotal.<space>.epe.…` tail verbatim
+ *  (`<n>` is its zero-based index within the grant, sorted at mint). Live event progress is the
+ *  caller's own core subscription; this durable is the mediator's catch-up reader. */
+export function eventReaderConfig(space, args, opts = {}) {
+    const tail = assertFullTail(args.subtree, `${spacePrefix(space)}.epe`, "event-reader subtree");
+    // Durable and filter must carry ONE provenance: the durable's `<e>` names the endpoint the
+    // grant was minted for, so a subtree addressing a DIFFERENT endpoint's events would let the
+    // attributed durable read outside its mint scope.
+    if (tail[0] !== endpointToken(args.endpoint))
+        throw new Error(`event-reader subtree ${JSON.stringify(args.subtree)} names endpoint token ${JSON.stringify(tail[0])} but the durable is minted for ${JSON.stringify(endpointToken(args.endpoint))} (§13.9: durable and filter provenance must agree)`);
+    return family(epeStreamName(space), {
+        durable_name: eventReaderDurable(args.uid, args.endpoint, args.grantId, args.index),
+        filter_subject: args.subtree,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+    });
+}
+/** PRIVATE frozen `kind → authority-head arity` snapshot, built ONCE at module load from the
+ *  canonical (runtime-frozen) {@link AUTHORITY_KIND_DEFS}. The reader seam consults THIS map,
+ *  never the live export, on every call: the public collection is frozen for contract honesty,
+ *  and the seam's guard additionally survives even a hypothetical defeat of that freeze (the
+ *  panel's identity-vs-integrity closure: single-source provenance is not post-construction
+ *  integrity; the seam reads a private immutable copy). */
+const AUTHORITY_HEAD_ARITY = new Map(AUTHORITY_KIND_DEFS.map((d) => [d.kind, 1 + d.qualifiers.length]));
+/** `recD = rec_<uid>-<gid>-<n>` — one per GRANTED record subtree (§13.9): a PULL durable over the
+ *  records KV stream (`KV_cotal_records_<space>`), pre-created by the provisioner with the
+ *  capability's EXACT full `$KV.cotal_records_<space>.…` subtree tail, bound by the read
+ *  mediator. `<n>` is the subtree's zero-based index within the grant. */
+export function recordReaderConfig(space, args, opts = {}) {
+    const tail = assertFullTail(args.subtree, `$KV.${recordsBucket(space)}`, "record-reader subtree");
+    const kind = tail[0];
+    // The grant family is a per-kind subtree: the kind token pins it. A `*` kind would read
+    // across every registered kind — a trusted-reader grant family, not a caller capability.
+    if (kind === "*")
+        throw new Error(`record-reader subtree ${JSON.stringify(args.subtree)} must pin its record kind (a cross-kind read is not a caller capability, §13.9)`);
+    // ENFORCED partition, ALLOWLIST not deny-list (panel + freelance a559d9c re-verify, #8274): the
+    // kind MUST be a registered CALLER-readable record kind. This refuses every AUTHORITY-CONTROL
+    // kind (oblig, the sealed records scanner's EXCLUSIVE domain, plus uid/govern/policy/frontier)
+    // AND any UNREGISTERED kind, both of which a reader durable would durably EXPORT past revoke. It
+    // consumes the same canonical {@link AUTHORITY_KIND_DEFS} the registry is built from, so a new
+    // authority kind is excluded by construction: no parallel list to drift. The two refusals are
+    // DISTINCT messages (the ux review): an authority kind is forbidden by design with no recourse,
+    // while an unregistered kind is usually a typo or a missing registerRecordKind and the caller
+    // needs that next step, not the forbidden-kinds list.
+    if (!callerReadableRecordKind(kind)) {
+        if (AUTHORITY_HEAD_ARITY.has(kind)) {
+            const authorityKinds = AUTHORITY_KIND_DEFS.filter((d) => !callerReadableRecordKind(d.kind)).map((d) => d.kind).join("/");
+            throw new Error(`record-reader subtree ${JSON.stringify(args.subtree)} targets the authority-control kind ${JSON.stringify(kind)}; authority-control kinds (${authorityKinds}) are never caller reader capabilities by design: their keys are the auth process's own authority state, enumerated only by its sealed scanner (§13.9, nats-server#8274)`);
+        }
+        throw new Error(`record-reader subtree ${JSON.stringify(args.subtree)} targets ${JSON.stringify(kind)}, which is not a registered record kind; check the kind for a typo, or register it (registerRecordKind, §13.7) before granting a reader over it`);
+    }
+    // DUAL-token head-disjointness: a kind that is caller-readable AND also carries an authority head
+    // (only `lifecycle` today: its atomic HEAD `lifecycle.<owner>.<actor>` is the authority mapping,
+    // while `lifecycle.<owner>.<actor>.<uid>.{spec,status}` is the caller audit detail). A reader
+    // admits ONLY filters STRICTLY DEEPER than the head (§13.9): never one that can match the atomic
+    // head key itself (that key IS the authority mapping), and never a fully-concrete filter
+    // SHALLOWER than the head, which can match no record at all (the head is exactly head-arity
+    // tokens and the audit detail is deeper), so a dead reader grant refuses loud at mint time.
+    // The arity comes from the PRIVATE module-load snapshot, never the live export.
+    const headLen = AUTHORITY_HEAD_ARITY.get(kind);
+    if (headLen !== undefined) {
+        const endsWild = tail[tail.length - 1] === ">";
+        const concreteLen = endsWild ? tail.length - 1 : tail.length;
+        // A trailing `>` matches subjects of length >= concreteLen+1, so it can match the headLen-token
+        // head iff concreteLen < headLen; a fully-concrete filter matches iff its length equals headLen.
+        const canMatchHead = endsWild ? concreteLen < headLen : tail.length === headLen;
+        if (canMatchHead)
+            throw new Error(`record-reader subtree ${JSON.stringify(args.subtree)} can match the authority HEAD key ${JSON.stringify(kind)}.<${headLen - 1} token(s)>; a caller reader may read only the deeper per-UID audit detail, never the ${JSON.stringify(kind)} authority head (§13.9, nats-server#8274)`);
+        if (!endsWild && tail.length < headLen)
+            throw new Error(`record-reader subtree ${JSON.stringify(args.subtree)} is SHALLOWER than the ${JSON.stringify(kind)} authority head (${headLen} tokens); it can match no record (the caller-readable audit detail is strictly deeper than the head), so the grant would be dead; deepen the filter to the per-UID audit subtree (§13.9)`);
+    }
+    return family(recordsKvStreamName(space), {
+        durable_name: recordReaderDurable(args.uid, args.grantId, args.index),
+        filter_subject: args.subtree,
+        ack_policy: AckPolicy.Explicit,
+        ack_wait: nanos(opts.ackWaitMs ?? 60_000),
+        deliver_policy: DeliverPolicy.All,
+    });
+}
+/** The backing JetStream STREAM of the records KV (its grant rows key on `KV_<bucket>`, §13.9). */
+export function recordsKvStreamName(space) { return `KV_${recordsBucket(space)}`; }
+// ---- §13.9 JetStream API grant rows (the single source: derived from the SAME stream + config) ----
+// permissionsFor folds these into a profile's `pub.allow`. Every CONSUMER.CREATE row pins the
+// EXACT full-tail filter from the consumer config, so a holder can only create the consumer the
+// matrix names, never a body-filter-selectable one; a bind-only holder gets INFO/MSG.NEXT/ACK
+// with NO create and NO delete. The rows and the consumer configs come from one place here, so
+// "the grant and the consumer cannot diverge" is structural, not a convention.
+const JSAPI = "$JS.API";
+/** A grant NAME component (stream or durable) occupies ONE token of an emitted permission row:
+ *  it must be a literal wildcard-free name, or the row silently broadens to every stream/durable
+ *  the wildcard matches (a `*` durable grants INFO/MSG.NEXT/ACK on ALL durables of the stream).
+ *  Every grammar in this module emits `[A-Za-z0-9_-]`, so anything else is refused loudly. */
+function assertGrantName(v, what) {
+    if (!/^[A-Za-z0-9_-]+$/.test(v))
+        throw new Error(`${what} ${JSON.stringify(v)} must be a literal wildcard-free name component ([A-Za-z0-9_-]+)`);
+    return v;
+}
+/** A consume-create row embeds the consumer's filter verbatim, so the filter's tokens become
+ *  permission tokens: each must be a literal token, a full `*` token (the matrix's principal
+ *  wildcards, e.g. the record writer's `epr.*.*.*`), or ONE trailing `>` — a malformed or
+ *  mid-filter `>` token would broaden the row past the §13.9 matrix. */
+function assertGrantFilter(filter, what) {
+    const toks = filter.split(".");
+    toks.forEach((t, i) => {
+        if (t === "*")
+            return;
+        if (t === ">" && i === toks.length - 1 && i > 0)
+            return; // never the WHOLE filter
+        if (t.length === 0 || /[*>\s]/.test(t))
+            throw new Error(`${what} filter ${JSON.stringify(filter)} token ${JSON.stringify(t)} is not a literal token, a full "*" token, or one trailing ">"`);
+    });
+    return filter;
+}
+function consumeCreateRow(stream, cfg) {
+    // A create row is AUTHORITY: only a (config, stream) pair minted together by a §13.9 family
+    // builder may become one — syntax checks alone cannot stop a raw config carrying a broad or
+    // foreign-family filter under a legitimate stream + durable.
+    assertFamilyPair(stream, cfg, "a consume-create grant");
+    if (!cfg.durable_name || !cfg.filter_subject)
+        throw new Error("a consume-create grant needs a durable_name and a full-tail filter_subject");
+    // The extended-create form embeds the stored-subject filter tail verbatim (§13.9): pinning it
+    // is what stops a body-selected filter.
+    return `${JSAPI}.CONSUMER.CREATE.${assertGrantName(stream, "grant stream")}.${assertGrantName(cfg.durable_name, "grant durable")}.${assertGrantFilter(cfg.filter_subject, "consume-create")}`;
+}
+function consumeBindRows(stream, durable) {
+    assertGrantName(stream, "grant stream");
+    assertGrantName(durable, "grant durable");
+    return [
+        `${JSAPI}.CONSUMER.INFO.${stream}.${durable}`,
+        `${JSAPI}.CONSUMER.MSG.NEXT.${stream}.${durable}`,
+        `$JS.ACK.${stream}.${durable}.>`,
+    ];
+}
+function consumeDeleteRow(stream, durable) {
+    return `${JSAPI}.CONSUMER.DELETE.${assertGrantName(stream, "grant stream")}.${assertGrantName(durable, "grant durable")}`;
+}
+/** The canonicalizer principal's EPJ rows: it OWNS its durable (create) and consumes + acks it. */
+export function canonicalizerGrants(space, endpoint) {
+    const stream = epjStreamName(space);
+    const cfg = canonConsumerConfig(space, endpoint);
+    return [consumeCreateRow(stream, cfg), ...consumeBindRows(stream, cfg.durable_name)];
+}
+/** The canonicalizer principal's POOL-ROUTE rows (§13.9 matrix "Work-pool enqueue" +
+ *  "Work-pool reconciliation probe"): the `epw.<e>.>` enqueue publish (create-per-subject rides
+ *  the `Nats-Expected-Last-Subject-Sequence: 0` header, §13.6) and the FENCING leader-served
+ *  `STREAM.MSG.GET` reconciliation read the §13.6 predicate and the enqueue's CAS-loser
+ *  byte-identity check both require (EPW is `allow_direct=false`, so this is the ONLY read
+ *  path). The MSG.GET form is BODY-selected (no per-subject confinement in the grant), so these
+ *  rows are TRUSTED-canonicalizer-only: never on the pool owner (bind-only,
+ *  {@link poolOwnerBindGrants}), never on any caller, observer, or admin profile. The full
+ *  canonicalizer aggregate for an endpoint with pool routes is
+ *  `[...canonicalizerGrants(...), ...canonicalizerWorkGrants(...)]`. */
+export function canonicalizerWorkGrants(space, endpoint) {
+    return [
+        `${spacePrefix(space)}.epw.${endpointToken(endpoint)}.>`,
+        `${JSAPI}.STREAM.MSG.GET.${epwStreamName(space)}`,
+    ];
+}
+/** A serving instance's effects rows: BIND-ONLY on the provisioner-pre-created shared `eff_<e>`
+ *  (INFO/MSG.NEXT/ACK, never create) — instances pull-compete, none owns the durable (§13.9). */
+export function effectsBindGrants(space, endpoint) {
+    return consumeBindRows(epfStreamName(space), effectsDurable(endpoint));
+}
+/** A per-kind record-writer principal's EPR rows: owns + consumes + acks its `recw_<space>-<kind>`. */
+export function recordWriterGrants(space, def) {
+    const stream = eprStreamName(space);
+    const cfg = recordWriterConsumerConfig(space, def);
+    return [consumeCreateRow(stream, cfg), ...consumeBindRows(stream, cfg.durable_name)];
+}
+/** The timer-writer principal's EPT_REQ rows: owns + consumes + acks its `timerw_<space>`. */
+export function timerWriterGrants(space) {
+    const stream = eptReqStreamName(space);
+    const cfg = timerWriterConsumerConfig(space);
+    return [consumeCreateRow(stream, cfg), ...consumeBindRows(stream, cfg.durable_name)];
+}
+/** A pool-owning endpoint's EPW rows: BIND-ONLY on the provisioner-pre-created `pool_<e>_<pool>`
+ *  (INFO/MSG.NEXT/ACK, never create — the bare create form is body-filter-selectable, §13.5/§13.9). */
+export function poolOwnerBindGrants(space, endpoint, pool) {
+    return consumeBindRows(epwStreamName(space), poolDurable(endpoint, pool));
+}
+/** The read mediator's BIND-ONLY rows for one caller-scoped reader durable, on the stream the
+ *  durable lives on (EPF for dec/goal, EPE for eve, `KV_cotal_records_<space>` for rec). */
+export function readerBindGrants(stream, cfg) {
+    assertFamilyPair(stream, cfg, "a reader bind grant");
+    if (!cfg.durable_name)
+        throw new Error("a reader bind grant needs a durable_name");
+    return consumeBindRows(stream, cfg.durable_name);
+}
+/** The provisioner's rows for a batch of pre-created durables (§13.9): the exact full-tail
+ *  CONSUMER.CREATE for every one it pre-creates, plus the matching CONSUMER.DELETE for
+ *  deprovisioning — and nothing else (it never consumes; owners bind). The create pins each
+ *  filter, so the provisioner can create ONLY the matrix's durables, not an arbitrary consumer. */
+export function provisionerConsumerGrants(durables) {
+    const rows = [];
+    for (const d of durables) {
+        rows.push(consumeCreateRow(d.stream, d.config), consumeDeleteRow(d.stream, d.config.durable_name));
+    }
+    return rows;
+}
+/** The ADMISSION MEDIATOR principal's rows (§13.9 matrix "Acceptance obligation", §13.8): the
+ *  ONE writer of ITS endpoint's `oblig.` subtree (create-only winner + revision-pinned CAS;
+ *  the target position is a principal wildcard, the endpoint token is LITERAL) plus the
+ *  terminal-REJECTION publish on its own endpoint's create-only decision subjects, the fencing
+ *  leader reads (records / EPF / EPW `STREAM.MSG.GET`), and the §13.12 bind-time shape proof
+ *  (records `STREAM.INFO`). The reply inbox is connection-scoped (`_INBOX_<connId>.>`, never the
+ *  account-wide default): every JS API call is request/reply, so an account-wide inbox would
+ *  receive other principals' API replies.
+ *
+ *  NO `CONSUMER.CREATE` on the records stream (SPEC 13.9, site 3 — nats-server#8274). A
+ *  consumer-create request BODY is not subject-ACL confinable: the extended
+ *  `CONSUMER.CREATE.<records>.<name>.<oblig filter>` row this profile used to hold still admitted a
+ *  `durable_name` + PUSH `deliver_subject` body — a durable exporter of the endpoint's whole
+ *  `oblig.` subtree that SURVIVES this credential's connection and revoke (reproduced live). So the
+ *  mediator's drain-to-quiescence enumeration runs on the SEALED records scanner
+ *  ({@link ../../implementations/auth/src/records-scanner.ts openRecordsScanner}), a separate
+ *  self-minted credential the trusted process never hands out — this profile holds no consumer
+ *  lifecycle on the records stream at all.
+ *
+ *  D32 residuals, EXPLICIT (accepted only for this trusted per-endpoint profile): (1) the
+ *  decision publish is payload-blind, so a compromised mediator can forge an ACCEPTANCE within
+ *  its own endpoint — an escalation to injecting executed work, never merely reject/stall —
+ *  because rejection-only is not subject-expressible (both decisions MUST share the create-only
+ *  decision subject for first-wins settlement); it can never forge beyond its endpoint. (2) its
+ *  own-endpoint `$KV...oblig` subject grant cannot enforce create-only/monotonic CAS: it can
+ *  overwrite a row to valid `terminal` and hide cleanup debt, or emit DEL/PURGE markers (the
+ *  latter fail loud as corruption; stream-level erasure is denied). (3) the body-selected
+ *  `STREAM.MSG.GET` fencing reads expose the records/EPF/EPW streams space-wide, and raw JS API
+ *  requests carry a caller-selected reply subject, so a compromised mediator can direct fetched
+ *  API/message bytes onto a foreign rail (confused-deputy injection, not foreign read access).
+ *  The former consumer-create durable-export reach is CLOSED: enumeration moved to the sealed
+ *  records scanner and this profile holds no records-stream CREATE. */
+export function admissionMediatorGrants(space, endpoint, connId) {
+    const e = endpointToken(endpoint);
+    const stream = recordsKvStreamName(space);
+    const obligFilter = `$KV.${recordsBucket(space)}.oblig.*.${e}.>`;
+    const publish = [
+        obligFilter,
+        `${spacePrefix(space)}.epf.${e}.dec.>`,
+        `${JSAPI}.STREAM.MSG.GET.${stream}`,
+        `${JSAPI}.STREAM.MSG.GET.${epfStreamName(space)}`,
+        `${JSAPI}.STREAM.MSG.GET.${epwStreamName(space)}`,
+        `${JSAPI}.STREAM.INFO.${stream}`,
+        `${JSAPI}.INFO`,
+    ];
+    return { publish, subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`] };
+}
+/** The RETIREMENT CLEANER principal's rows (§13.9 matrix "Terminal pool cleanup", §13.1
+ *  barrier): minted per (retirement op × endpoint) with the EXACT pools the op intent
+ *  enumerates — never a pool wildcard, never space-wide EPW rights. Per listed pool: BIND-ONLY
+ *  on the provisioner-pre-created durable (INFO/MSG.NEXT/ACK, never create/update/delete). Plus
+ *  the leader-served EPF `STREAM.MSG.GET` its terminal-observe and acceptance re-bind reads
+ *  require — a STREAM-level grant whose read exposure is space-wide; that residual is EXPLICIT
+ *  per D32 and accepted only for this trusted, bounded-lived, per-op profile. The cleaner holds
+ *  NO terminal-publish or lease authority: the op-bounded executor CASes the lease and publishes
+ *  its derived terminal, and the cleaner re-reads it before ACK. D32 residuals: raw ACK cannot be
+ *  conditioned on a prior terminal, so compromise can suppress listed-pool work terminal-free;
+ *  the space-wide EPF `STREAM.MSG.GET` exposes fact content, and its caller-selected reply can
+ *  inject fetched API/message bytes onto a foreign rail. The reply inbox is
+ *  connection-scoped (`_INBOX_<connId>.>`, never the account-wide default). NO `epw.>` publish,
+ *  NO consumer create/update/delete, NO raw stream DELETE. The profile is revoked and its
+ *  principal cluster-verified-evicted by the barrier BEFORE any frontier records (§13.1). */
+export function retirementCleanerGrants(space, endpoint, pools, connId) {
+    if (!Array.isArray(pools) || pools.length === 0)
+        throw new Error("a retirement-cleaner grant lists at least one exact pool (SPEC 13.9: the op intent enumerates them; a poolless cleaner is no cleaner)");
+    endpointToken(endpoint);
+    const publish = [];
+    for (const pool of pools) {
+        const p = assertPoolToken(pool);
+        publish.push(...consumeBindRows(epwStreamName(space), poolDurable(endpoint, p)));
+    }
+    publish.push(`${JSAPI}.STREAM.MSG.GET.${epfStreamName(space)}`, `${JSAPI}.INFO`);
+    return { publish, subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`] };
+}
+/** The endpoint's COMMIT PRINCIPAL rows (§13.9 matrix "Result/receipt/terminal/resume facts" +
+ *  "Claim / action / checkpoint commits"): the enumerated commit fact families on its OWN
+ *  endpoint — `goal.*.*.*.*.result` (the goal terminal; the `.bind` leaf under `goal.>` is the
+ *  canonicalizer's), `eff.>`, `receipt.>`, `wrk.>`, `cp.>` — and **never `dec.>`/`quar.>`**
+ *  (canonicalizer-only; structurally absent from these rows, not merely unused), plus its own
+ *  record keys per the §13.7 writer table (`goal.<e>.>`, `cp.<e>.>`, `lease.<e>.>`; the endpoint
+ *  qualifier is the FIRST qualifier of all three kinds, so the prefix is subject-expressible).
+ *  Read-back is FENCING and therefore leader-served (§13.9 read service): body-selected
+ *  `STREAM.MSG.GET` on `EPF_<space>` (create-only CAS emission + idempotent re-commit decisions
+ *  over exactly its five fact families) and on `KV_cotal_records_<space>` (the terminal-commit's
+ *  spec read and the epoch/deadline currency reads) — the follower-served `DIRECT.GET` forms are
+ *  deliberately NOT granted. The reply inbox is connection-scoped (`_INBOX_<connId>.>`, never
+ *  the account-wide default).
+ *
+ *  D32 residuals, EXPLICIT (accepted only for this trusted per-endpoint profile): (1) every
+ *  fact publish is payload-blind create-only, so a compromised commit principal can forge an
+ *  in-endpoint `wrk`/`goal…result` terminal or `cp` resume for work that never ran — an
+ *  escalation to fabricating completed work within its own endpoint, never beyond it; (2) its
+ *  raw `$KV` subject grants cannot enforce the per-key CAS/monotonic discipline, so it can
+ *  overwrite its own endpoint's goal/cp/lease rows (DEL/PURGE markers fail loud as corruption;
+ *  stream-level erasure is denied by the store shape, §13.12); (3) the two body-selected
+ *  `STREAM.MSG.GET` fencing reads expose the EPF and records streams space-wide, and a raw JS
+ *  API request carries a caller-selected reply subject, so compromise can direct fetched
+ *  API/message bytes onto a foreign rail (confused-deputy injection, not foreign write). */
+export function commitPrincipalGrants(space, endpoint, connId) {
+    const e = endpointToken(endpoint);
+    const p = spacePrefix(space);
+    const records = recordsBucket(space);
+    const publish = [
+        `${p}.epf.${e}.goal.*.*.*.*.result`,
+        `${p}.epf.${e}.eff.>`,
+        `${p}.epf.${e}.receipt.>`,
+        `${p}.epf.${e}.wrk.>`,
+        `${p}.epf.${e}.cp.>`,
+        `$KV.${records}.goal.${e}.>`,
+        `$KV.${records}.cp.${e}.>`,
+        `$KV.${records}.lease.${e}.>`,
+        `${JSAPI}.STREAM.MSG.GET.${epfStreamName(space)}`,
+        `${JSAPI}.STREAM.MSG.GET.${recordsKvStreamName(space)}`,
+        `${JSAPI}.INFO`,
+    ];
+    return { publish, subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`] };
+}
+/** The CONTRACT PUBLISHER principal's rows (§13.9 matrix "Contract-artifact publication" +
+ *  the trusted-infra half of "Contract-artifact read"): publish `epc.*` (the digest-hex is ONE
+ *  subject token; create-only rides `Nats-Expected-Last-Subject-Sequence: 0` at the typed path,
+ *  §13.7 — the grant cannot express it, the broker CAS enforces it) and the subject-confined
+ *  follower read-back `DIRECT.GET.EPC_<space>.cotal.<space>.epc.>` (NON-fencing by design:
+ *  artifacts are content-addressed and verify-on-read is the tamper boundary, §13.7, so a
+ *  stale replica serves nothing forgeable). NO `STREAM.INFO`: the deny_delete/deny_purge shape
+ *  proof is the provisioner's (§13.12), not this profile's. The reply inbox is
+ *  connection-scoped (`_INBOX_<connId>.>`, never the account-wide default).
+ *
+ *  D32 residuals, EXPLICIT: (1) the `epc.*` publish is payload-blind — a compromised publisher
+ *  can flood NEW digest subjects with garbage artifacts (verify-on-read refuses to SERVE
+ *  non-canonical or digest-mismatched bytes, and an existing digest subject is CAS-protected,
+ *  so it can waste storage but never corrupt or replace a published artifact); (2) the raw JS
+ *  API request carries a caller-selected reply subject (the same confused-deputy injection
+ *  class as every API-holding profile). */
+export function contractPublisherGrants(space, connId) {
+    const publish = [
+        `${spacePrefix(space)}.epc.*`,
+        `${JSAPI}.DIRECT.GET.${epcStreamName(space)}.${spacePrefix(space)}.epc.>`,
+        `${JSAPI}.INFO`,
+    ];
+    return { publish, subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`] };
+}
+//# sourceMappingURL=endpoint-binding.js.map