@cotal-ai/core 0.48.1 → 0.49.0

package/dist/index.d.ts

@@ -50,7 +50,7 @@ export * from "./lease.js";
 export * from "./agent-file.js";
 export * from "./launch.js";
 export * from "./fs-safe.js";
-export * from "./secret-fs.js";
+export { hardenPrivate, mkSecretDir, writeSecretFile, writeSecretFileAtomic, writeSecretFileCreateOnly, } from "./secret-fs.js";
 export * from "./launch-material.js";
 export * from "./connector-config.js";
 export * from "./kv-scan.js";
@@ -79,4 +79,7 @@ export * from "./run-migration.js";
 export * from "./run-program.js";
 export * from "./run-driver-grants.js";
 export * from "./run-host.js";
+export * from "./issued-authority.js";
+export * from "./run-admission.js";
+export * from "./issuer-session.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAK7B,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -50,7 +50,11 @@ export * from "./lease.js";
 export * from "./agent-file.js";
 export * from "./launch.js";
 export * from "./fs-safe.js";
-export * from "./secret-fs.js";
+// Explicit, NOT `export *`, and deliberately so: a star export would put the test-only seam
+// `__setPublishLinkForTest` on this package's public root, where any dependent could swap the
+// publish primitive of the code that writes secrets. Everything a consumer legitimately needs is
+// named here; the seam stays reachable from the suite via a deep import of the module itself.
+export { hardenPrivate, mkSecretDir, writeSecretFile, writeSecretFileAtomic, writeSecretFileCreateOnly, } from "./secret-fs.js";
 export * from "./launch-material.js";
 export * from "./connector-config.js";
 export * from "./kv-scan.js";
@@ -79,4 +83,7 @@ export * from "./run-migration.js";
 export * from "./run-program.js";
 export * from "./run-driver-grants.js";
 export * from "./run-host.js";
+export * from "./issued-authority.js";
+export * from "./run-admission.js";
+export * from "./issuer-session.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,4FAA4F;AAC5F,8FAA8F;AAC9F,iGAAiG;AACjG,8FAA8F;AAC9F,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC"}

package/dist/issued-authority.d.ts

@@ -0,0 +1,168 @@
+import { type JetStreamManager } from "@nats-io/jetstream";
+import type { KV, Kvm } from "@nats-io/kv";
+import type { NatsConnection } from "@nats-io/transport-node";
+import { type EpCaller } from "./endpoint-subjects.js";
+export { assertGeneration, isIssuedCaller, EP_RAIL_V1, type IssuedCaller } from "./endpoint-subjects.js";
+/** The four caller coordinates plus the generation. `generation` is 32 lowercase hex characters
+ *  of issuer-chosen entropy (at least 128 bits); it is an identifier, never a bearer secret. */
+export interface IssuedAuthorityRef extends EpCaller {
+    readonly space: string;
+    readonly generation: string;
+}
+/** A fresh generation: 128 bits, hex. Chosen by the ISSUER, never by the client. */
+export declare function mintGeneration(): string;
+/** A fresh accepted-row token: same grammar, chosen by the party that will connect. */
+export declare function mintAcceptedToken(): string;
+/** One direction's allow set. Explicit: the native fragment's omitted or empty `allow` means
+ *  UNRESTRICTED, and a ceiling that read that as "nothing" would be exactly the inversion a
+ *  copied ledger row produces, so the mode is always spelled out. */
+export type IssuedSubjectAllow = {
+    readonly mode: "all";
+} | {
+    readonly mode: "none";
+} | {
+    readonly mode: "patterns";
+    readonly patterns: readonly string[];
+};
+export interface IssuedSubjectPermission {
+    readonly allow: IssuedSubjectAllow;
+    readonly deny: readonly string[];
+}
+/** The ceiling: what the credential may publish and subscribe, as the broker enforces it. */
+export interface IssuedSubjectPermissions {
+    readonly publish: IssuedSubjectPermission;
+    readonly subscribe: IssuedSubjectPermission;
+}
+/** Read a stored permission value back, refusing every shape but the explicit one. */
+export declare function readIssuedSubjectPermission(value: unknown): IssuedSubjectPermission;
+export declare function readIssuedSubjectPermissions(value: unknown): IssuedSubjectPermissions;
+/** The native NATS fragment (`{pub, sub}` with `allow`/`deny` lists) as the JWT carries it: an
+ *  omitted or empty allow is UNRESTRICTED subject to denies. This is the one importer, and it
+ *  takes the fragment, never a whole JWT: `resp` and queue-qualified rows need semantics of their
+ *  own and are refused rather than dropped. */
+export declare function importNativeSubjectPermissions(value: unknown): IssuedSubjectPermissions;
+/** Does the ceiling permit ONE concrete subject? Deny wins; `none` permits nothing. */
+export declare function issuedPermitsSubject(value: IssuedSubjectPermission, concrete: string): boolean;
+/** Does the ceiling permit a SUBSCRIPTION whose filter is `pattern` (which may carry wildcards)?
+ *  Every subject the filter could deliver must sit inside one allow entry, and no deny entry may
+ *  overlap it: a subscription is a claim over a set of subjects, so a partial cover is a refusal,
+ *  never a narrower grant invented on the caller's behalf. */
+export declare function issuedPermitsPattern(value: IssuedSubjectPermission, pattern: string): boolean;
+/** The immutable coordinate of a gate an issuance depends on: one KV row in one bucket. */
+export interface IssuedSourceRef {
+    readonly space: string;
+    readonly bucket: string;
+    readonly key: string;
+}
+/** What the issuer persisted, create-only, before any material was returned. `expiresAt` (unix
+ *  seconds) is REQUIRED when `sources` is empty: an issuance bound to no gate is a one-shot
+ *  credential's, and its liveness is its expiry. */
+export interface IssuedEvidence {
+    readonly version: 1;
+    readonly ref: IssuedAuthorityRef;
+    readonly sources: readonly IssuedSourceRef[];
+    readonly permissions: IssuedSubjectPermissions;
+    readonly expiresAt?: number;
+}
+export type IssuedAttemptState = "prepared" | "active" | "aborted" | "revoked";
+export interface IssuedResolution {
+    readonly evidence: IssuedEvidence;
+    /** The attempt row's revision at the second (linearizing) read. */
+    readonly revision: number;
+}
+/** The per-space evidence store. `allow_direct=false`: every read here is a fence (leader-served,
+ *  revision-pinned), and Direct Get's follower reads would defeat read-your-writes. */
+export declare function issuedBucket(space: string): string;
+/** The per-space accepted-row store. Its own bucket, and `allow_direct` ON: per-key scoping is
+ *  only expressible on a `DIRECT.GET` grant, and a stream-wide `STREAM.MSG.GET` on a shared bucket
+ *  would let a client read every other client's row. */
+export declare function acceptedBucket(space: string): string;
+export declare function issuedEvidenceKey(ref: IssuedAuthorityRef): string;
+export declare function issuedAttemptKey(ref: IssuedAuthorityRef): string;
+/** The reverse index prefix for one source: `bysource.v1.<sha256([1, space, bucket, key])>.`.
+ *  The digest keeps the key one token; the generation suffix on the full key is load-bearing, since
+ *  without it a reused root credential id would merge two issuances into one entry. */
+export declare function issuedSourcePrefix(source: IssuedSourceRef): string;
+export declare function issuedSourceIndexKey(source: IssuedSourceRef, ref: IssuedAuthorityRef): string;
+export interface PreparedIssuance {
+    readonly key: string;
+}
+/** The store bound to one space over one KV handle. The KV is the ISSUER's (a `issuer` or a
+ *  `issued-reader` credential); a peer holds no grant on this bucket. */
+export interface IssuedStore {
+    /** Persist the evidence and a `prepared` attempt, create-only. A generation that already exists
+     *  refuses before the CAS, and the CAS is the second line. Nothing is released here. */
+    stage(evidence: IssuedEvidence): Promise<PreparedIssuance>;
+    /** Run the existing finalizer, then activate by CAS at the revision the prepare observed. If
+     *  the finalizer succeeds and the activation loses, the issuance is retired and the call throws:
+     *  no material may be released on it. */
+    release(prepared: PreparedIssuance, finalizeExisting: () => Promise<void>): Promise<void>;
+    /** `prepared` becomes `aborted`, `active` becomes `revoked`; idempotent on a terminal state. */
+    retire(ref: IssuedAuthorityRef): Promise<IssuedAttemptState>;
+    /** The resolution a consumer acts on: evidence read, attempt `active`, every source live (or
+     *  the one-shot expiry not reached), and the attempt still `active` at the SAME revision on a
+     *  second read after the source await. That second read is the linearization point. A failed
+     *  read on either side is a refusal, never an absence of revocation. */
+    resolve(ref: IssuedAuthorityRef, sourceIsLive: (source: IssuedSourceRef) => Promise<boolean>, now?: () => number): Promise<IssuedResolution>;
+    /** Retire every issuance indexed under one source. The caller freezes the source gate FIRST. */
+    retireSource(source: IssuedSourceRef): Promise<number>;
+    /** A RENEWAL under an existing generation: the evidence must exist, its attempt must be
+     *  `active`, and its recorded ceiling must EQUAL `permissions`. A generation is reused only when
+     *  its immutable ceiling still matches (SPEC 13.15); a changed ceiling is a fresh issuance on a
+     *  fresh generation and a new connection, never an update of this one. */
+    confirm(ref: IssuedAuthorityRef, permissions: IssuedSubjectPermissions): Promise<void>;
+}
+/** What an issuing mint hands {@link mintCreds}: the store and accepted-row handles of an
+ *  `issuer` connection, the immutable source coordinates the evidence names, and the existing
+ *  finalizer (a ledger append) release runs BEFORE activation. `renew` reuses a generation whose
+ *  ceiling is unchanged and stages nothing. */
+export interface IssuanceSeam {
+    readonly mode: "issue" | "renew";
+    readonly store: IssuedStore;
+    readonly accepted: KV;
+    readonly sources: readonly IssuedSourceRef[];
+    readonly finalize?: (credentialId: string) => Promise<void>;
+}
+/** The broker-enforced part of every authority store's immutability (SPEC 13.12): no rollup
+ *  header, no message delete, no purge. The records store carries the same three. */
+export declare const AUTHORITY_STORE_IMMUTABLE_FLAGS: Readonly<{
+    allow_rollup_hdrs: false;
+    deny_delete: true;
+    deny_purge: true;
+}>;
+/** Write-once per key: one message per subject and `discard: new` applied per subject, so the
+ *  broker refuses the SECOND message on a key whatever it carries. Other keys are unaffected. */
+export declare const WRITE_ONCE_PER_KEY: Readonly<{
+    max_msgs_per_subject: 1;
+    discard: "new";
+    discard_new_per_subject: true;
+}>;
+/** Append-only per key: unlimited per-key history, nothing ever removed. A reader that wants the
+ *  row that was created reads the FIRST message on its key. */
+export declare const APPEND_ONLY_PER_KEY: Readonly<{
+    max_msgs_per_subject: -1;
+}>;
+/** Every field of `shape` must read back from the broker as set; the mismatches are named. */
+export declare function assertStoreShape(cfg: Record<string, unknown>, shape: Record<string, unknown>, bucket: string, spec: string): void;
+/** The two issued-authority streams, for the provisioner's create-or-verify inventory. */
+export declare function issuedStoreStreamNames(space: string): string[];
+export declare function openIssuedStore(kv: KV, jsm: JetStreamManager, space: string): IssuedStore;
+/** Create-or-verify the two issued-authority stores. Evidence: `allow_direct=false`, file,
+ *  no eviction. Accepted: `allow_direct=true`, file, no eviction. A drifted store fails loud. */
+export declare function ensureIssuedStores(jsm: JetStreamManager, kvm: Kvm, space: string): Promise<void>;
+export declare function acceptedKey(acceptedToken: string): string;
+/** The read grant an issued ceiling carries for exactly its own accepted row and nothing else. */
+export declare function acceptedReadGrant(space: string, acceptedToken: string): string;
+/** Written by the issuer at release, create-only: a token is redeemed once. */
+export declare function writeAcceptedRow(kv: KV, acceptedToken: string, ref: IssuedAuthorityRef): Promise<void>;
+/** Read by the CLIENT over its own connection: the reference the ISSUER wrote, so a client that
+ *  proposed or was told a different generation learns the accepted one here. The broker admits
+ *  the read only under the ceiling's per-key grant, which is what binds the answer to the
+ *  credential this connection presented. */
+export declare function readAcceptedRow(nc: NatsConnection, space: string, acceptedToken: string, timeoutMs?: number): Promise<IssuedAuthorityRef>;
+/** The named refusal an endpoint returns for a legacy (unversioned) invocation of a command
+ *  that requires issued authority (SPEC §13.15 compatibility). */
+/** `details[].kind` of the refusal a command requiring issued caller authority returns to a
+ *  LEGACY arrival: the request rode the unversioned rail, so no generation binds it (SPEC 13.15). */
+export declare const EP_UNBOUND_CALLER_AUTHORITY = "ai.cotal.ep.unbound-caller-authority";
+//# sourceMappingURL=issued-authority.d.ts.map

package/dist/issued-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issued-authority.d.ts","sourceRoot":"","sources":["../src/issued-authority.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAiB,KAAK,gBAAgB,EAAmB,MAAM,oBAAoB,CAAC;AAC3F,OAAO,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAI9D,OAAO,EAAiD,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKzG;gGACgG;AAChG,MAAM,WAAW,kBAAmB,SAAQ,QAAQ;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,oFAAoF;AACpF,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAYD;;qEAEqE;AACrE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAoCD,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAYnF;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAGrF;AAED;;;+CAG+C;AAC/C,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAWvF;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM9F;AAiCD;;;8DAG8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAM7F;AAID,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;oDAEoD;AACpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;uFACuF;AACvF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;wDAEwD;AACxD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAGjE;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAEhE;AAYD;;uFAEuF;AACvF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAGlE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAG7F;AAkBD,MAAM,WAAW,gBAAgB;IAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAE1D;yEACyE;AACzE,MAAM,WAAW,WAAW;IAC1B;4FACwF;IACxF,KAAK,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D;;6CAEyC;IACzC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,gGAAgG;IAChG,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7D;;;4EAGwE;IACxE,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7I,gGAAgG;IAChG,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD;;;8EAG0E;IAC1E,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxF;AAED;;;+CAG+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;qFACqF;AACrF,eAAO,MAAM,+BAA+B;;;;EAAmF,CAAC;AAChI;iGACiG;AACjG,eAAO,MAAM,kBAAkB;;;;EAAwG,CAAC;AACxI;+DAC+D;AAC/D,eAAO,MAAM,mBAAmB;;EAA8C,CAAC;AAE/E,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAIjI;AAED,0FAA0F;AAC1F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAE9D;AAMD,wBAAgB,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CA8IzF;AAED;iGACiG;AACjG,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BtG;AAID,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAG9E;AAED,+EAA+E;AAC/E,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5G;AAED;;;4CAG4C;AAC5C,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAU7I;AAED;kEACkE;AAClE;qGACqG;AACrG,eAAO,MAAM,2BAA2B,yCAAyC,CAAC"}