@cotal-ai/registry 0.0.0-stage → 0.135.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/answer.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The registry's `endpoints` answer (SPEC 13.20), over an injected read seam so the logic is the
+ * same whichever process hosts it. On an authed mesh the caller's generation comes from the
+ * broker-authenticated subject, its recorded ceiling from a disclosure read of the issued evidence,
+ * and each registered endpoint's commands from its digest-verified root cluster document. Endpoints
+ * the ceiling covers no command of are left out before anything is returned. A failed read reaches
+ * the caller as a fixed message; its detail goes to the registry's log.
+ */
+import { type EpServeContext, type IssuedAuthorityRef, type IssuedEvidence, type RegistryEndpointsInput, type RegistryEndpointsOutput } from "@cotal-ai/core";
+/** What the answer reads. Every method reads live state; nothing is cached across requests here
+ *  except what the seam itself caches by an immutable key (a contract artifact by its digest). */
+export interface RegistryReads {
+    /** The recorded ceiling of a live generation (`IssuedStore.observe`); throws when it is not one. */
+    observe(ref: IssuedAuthorityRef): Promise<IssuedEvidence>;
+    /** Every registered `(endpoint, instanceId)`, from the records store's key list. */
+    instances(): Promise<{
+        endpoint: string;
+        instanceId: string;
+    }[]>;
+    /** The instance's registered cluster closure digests, or `undefined` when its record is gone. */
+    clusterDigests(endpoint: string, instanceId: string): Promise<string[] | undefined>;
+    /** The instance's recorded serving state, or `null` when it has none. */
+    state(endpoint: string, instanceId: string): Promise<string | null>;
+    /** A contract artifact's JSON value by digest, or `undefined` when the store has none. Throws
+     *  {@link ContractInvalidError} when the store holds bytes for the digest that do not verify. */
+    artifact(digest: string): Promise<unknown>;
+}
+export interface RegistryAnswerOptions {
+    space: string;
+    /** `open`: no permission system, every registered endpoint is callable. */
+    mode: "authed" | "open";
+    reads: RegistryReads;
+    /** Where a failed read's detail goes. The caller is told only that the read failed. */
+    log: (line: string) => void;
+}
+/** The most bytes one page is built to. The serve layer also caps it at the connection's ceiling. */
+export declare const REGISTRY_PAGE_BYTES: number;
+/**
+ * Answer one `endpoints` request. A legacy-rail request on an authed mesh carries no generation
+ * and is refused, as a command requiring issued caller authority refuses it (SPEC 13.15).
+ */
+export declare function answerEndpoints(opts: RegistryAnswerOptions, ctx: Pick<EpServeContext, "subject" | "replyFits">, input: RegistryEndpointsInput): Promise<RegistryEndpointsOutput>;
+//# sourceMappingURL=answer.d.ts.map

package/dist/answer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer.d.ts","sourceRoot":"","sources":["../src/answer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAYL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAGnB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AAExB;kGACkG;AAClG,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D,oFAAoF;IACpF,SAAS,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACjE,iGAAiG;IACjG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACpF,yEAAyE;IACzE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE;qGACiG;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,KAAK,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,QAAa,CAAC;AA+E9C;;;GAGG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwCtL"}

package/dist/answer.js

@@ -0,0 +1,140 @@
+/**
+ * The registry's `endpoints` answer (SPEC 13.20), over an injected read seam so the logic is the
+ * same whichever process hosts it. On an authed mesh the caller's generation comes from the
+ * broker-authenticated subject, its recorded ceiling from a disclosure read of the issued evidence,
+ * and each registered endpoint's commands from its digest-verified root cluster document. Endpoints
+ * the ceiling covers no command of are left out before anything is returned. A failed read reaches
+ * the caller as a fixed message; its detail goes to the registry's log.
+ */
+import { canonicalJson, ContractInvalidError, CoverageLimitError, EpEnvelopeError, EP_UNBOUND_CALLER_AUTHORITY, isIssuedCaller, projectCommandCoverage, REGISTRY_PAGE_LIMIT, verifyClusterManifest, verifyClusterRoot, } from "@cotal-ai/core";
+/** The most bytes one page is built to. The serve layer also caps it at the connection's ceiling. */
+export const REGISTRY_PAGE_BYTES = 512 * 1024;
+/** `undefined` when the instance's record is gone (deregistered between the key list and the read). */
+async function declarations(reads, endpoint, instanceId) {
+    const digests = await reads.clusterDigests(endpoint, instanceId);
+    if (digests === undefined)
+        return undefined;
+    const commands = [];
+    try {
+        for (const digest of digests) {
+            const manifest = await reads.artifact(digest.replace(/^sha256:/, ""));
+            if (manifest === undefined)
+                return { commands: [], artifacts: "missing" };
+            const root = verifyClusterManifest(digest, manifest).root;
+            const document = await reads.artifact(root.replace(/^sha256:/, ""));
+            if (document === undefined)
+                return { commands: [], artifacts: "missing" };
+            commands.push(...verifyClusterRoot(root, document).commands);
+        }
+    }
+    catch (e) {
+        if (e instanceof ContractInvalidError)
+            return { commands: [], artifacts: "invalid" };
+        throw e;
+    }
+    // A name declared in two of its clusters is an ambiguous surface, which never authorizes (SPEC 13.7).
+    if (new Set(commands.map((c) => c.name)).size !== commands.length)
+        return { commands: [], artifacts: "invalid" };
+    return { commands, artifacts: "verified" };
+}
+async function endpointRow(opts, endpoint, instanceIds, ceiling, caller) {
+    const instances = [];
+    // Keyed by name and by what coverage reads: instances may declare one name differently.
+    const declared = new Map();
+    for (const instanceId of instanceIds) {
+        const found = await declarations(opts.reads, endpoint, instanceId);
+        if (found === undefined)
+            continue;
+        instances.push({ instanceId, state: await opts.reads.state(endpoint, instanceId), artifacts: found.artifacts });
+        for (const command of found.commands) {
+            const key = canonicalJson([command.name, command.class, command.targeted, [...(command.modes ?? [])].sort()]);
+            const seen = declared.get(key);
+            if (seen)
+                seen.instances.push(instanceId);
+            else
+                declared.set(key, { command, instances: [instanceId] });
+        }
+    }
+    const commands = [];
+    const unprojected = new Set();
+    const ordered = [...declared.values()].sort((a, b) => a.command.name.localeCompare(b.command.name) || a.instances[0].localeCompare(b.instances[0]));
+    for (const { command, instances: by } of ordered) {
+        const name = command.name;
+        const partial = by.length < instances.length ? { instances: by } : {};
+        if (ceiling === undefined) {
+            commands.push({ name, class: command.class, forms: [], ...partial });
+            continue;
+        }
+        try {
+            const forms = projectCommandCoverage(opts.space, ceiling.evidence.permissions.publish, {
+                endpoint, command, caller, generation: ceiling.generation, instances: by,
+            });
+            if (forms.length > 0)
+                commands.push({ name, class: command.class, forms: forms.map((f) => ({ ...f, literals: { ...f.literals }, covered: f.covered.map((c) => ({ ...c })) })), ...partial });
+        }
+        catch (e) {
+            if (!(e instanceof CoverageLimitError))
+                throw e;
+            if (e.covered)
+                unprojected.add(name);
+        }
+    }
+    if (instances.length === 0)
+        return undefined;
+    // An unprojected command's forms are not listed, whichever of its declarations went past the limit.
+    const listed = commands.filter((c) => !unprojected.has(c.name));
+    if (ceiling !== undefined && listed.length === 0 && unprojected.size === 0)
+        return undefined;
+    return { endpoint, instances, commands: listed, ...(unprojected.size ? { unprojected: [...unprojected].sort() } : {}) };
+}
+const detail = (e) => (e instanceof Error ? e.message : String(e));
+/**
+ * Answer one `endpoints` request. A legacy-rail request on an authed mesh carries no generation
+ * and is refused, as a command requiring issued caller authority refuses it (SPEC 13.15).
+ */
+export async function answerEndpoints(opts, ctx, input) {
+    const caller = ctx.subject.caller;
+    const triple = { owner: caller.owner, actor: caller.actor, uid: caller.uid };
+    let ceiling;
+    if (opts.mode === "authed") {
+        if (!isIssuedCaller(caller))
+            throw new EpEnvelopeError("permission-denied", "the endpoints listing rides the versioned rail under a listing or issued generation; this credential has no listing binding (SPEC 13.15)", [{ kind: EP_UNBOUND_CALLER_AUTHORITY, owner: caller.owner, actor: caller.actor, uid: caller.uid }]);
+        try {
+            ceiling = { evidence: await opts.reads.observe({ space: opts.space, ...triple, generation: caller.generation }), generation: caller.generation };
+        }
+        catch (e) {
+            opts.log(`registry: the ceiling read failed: ${detail(e)}`);
+            if (e instanceof EpEnvelopeError && e.code === "permission-denied")
+                throw new EpEnvelopeError("permission-denied", "this connection's listing generation is not live; a new credential gets a fresh one");
+            throw new EpEnvelopeError("unavailable", "the registry could not read this connection's recorded ceiling");
+        }
+    }
+    const recordsFailed = (e) => {
+        opts.log(`registry: a records read failed: ${detail(e)}`);
+        throw new EpEnvelopeError("unavailable", "the registry could not read the space's endpoint records; nothing is listed");
+    };
+    const limit = input.limit ?? REGISTRY_PAGE_LIMIT;
+    const byEndpoint = new Map();
+    for (const { endpoint, instanceId } of await opts.reads.instances().catch(recordsFailed))
+        byEndpoint.set(endpoint, [...(byEndpoint.get(endpoint) ?? []), instanceId]);
+    const names = [...byEndpoint.keys()].filter((name) => input.after === undefined || name > input.after).sort();
+    const source = opts.mode === "authed" ? "recorded-ceiling" : "no-permission-system";
+    const rows = [];
+    for (let i = 0; i < names.length; i++) {
+        const name = names[i];
+        if (rows.length === limit)
+            return { rows, next: rows[rows.length - 1].endpoint, source };
+        const row = await endpointRow(opts, name, byEndpoint.get(name).sort(), ceiling, triple).catch(recordsFailed);
+        if (row === undefined)
+            continue;
+        const page = { rows: [...rows, row], next: name, source };
+        if (ctx.replyFits !== undefined && !ctx.replyFits(page, REGISTRY_PAGE_BYTES)) {
+            if (rows.length === 0)
+                throw new EpEnvelopeError("resource-exhausted", `the row for ${name} does not fit in one reply`);
+            return { rows, next: rows[rows.length - 1].endpoint, source };
+        }
+        rows.push(row);
+    }
+    return { rows, source };
+}
+//# sourceMappingURL=answer.js.map

package/dist/answer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer.js","sourceRoot":"","sources":["../src/answer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,2BAA2B,EAC3B,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAUlB,MAAM,gBAAgB,CAAC;AA2BxB,qGAAqG;AACrG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AAK9C,uGAAuG;AACvG,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,QAAgB,EAAE,UAAkB;IACpF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,oBAAoB;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACrF,MAAM,CAAC,CAAC;IACV,CAAC;IACD,sGAAsG;IACtG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACjH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAA2B,EAC3B,QAAgB,EAChB,WAAqB,EACrB,OAAqE,EACrE,MAAqD;IAErD,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,wFAAwF;IACxF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAChH,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9G,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,IAAI;gBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;;gBACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACtJ,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE;gBACrF,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE;aACzE,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,EAA8B,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAkC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACxO,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC;gBAAE,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,OAAO;gBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,oGAAoG;IACpG,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1H,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA2B,EAAE,GAAkD,EAAE,KAA6B;IAClJ,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7E,IAAI,OAAqE,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YACzB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,0IAA0I,EACvL,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QACnJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,sCAAsC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;gBAChE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,qFAAqF,CAAC,CAAC;YACxI,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,gEAAgE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,CAAU,EAAS,EAAE;QAC1C,IAAI,CAAC,GAAG,CAAC,oCAAoC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,6EAA6E,CAAC,CAAC;IAC1H,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACtK,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAA2B,CAAC,CAAC,CAAC,sBAA+B,CAAC;IACtG,MAAM,IAAI,GAA0B,EAAE,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9G,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,eAAe,IAAI,4BAA4B,CAAC,CAAC;YACxH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./answer.js";
+export * from "./reads.js";
+export * from "./serve.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from "./answer.js";
+export * from "./reads.js";
+export * from "./serve.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/reads.d.ts

@@ -0,0 +1,4 @@
+import type { NatsConnection } from "@nats-io/transport-node";
+import type { RegistryReads } from "./answer.js";
+export declare function natsRegistryReads(nc: NatsConnection, space: string): Promise<RegistryReads>;
+//# sourceMappingURL=reads.d.ts.map

package/dist/reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reads.d.ts","sourceRoot":"","sources":["../src/reads.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAkB9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA2DjG"}

package/dist/reads.js

@@ -0,0 +1,76 @@
+/**
+ * The registry's reads over one connection holding the `registry` credential (SPEC Appendix B):
+ * the records store's key list by `STREAM.INFO` (keys outside `svc` are never read), each `svc`
+ * spec and status by per-key `DIRECT.GET`, contract artifacts by digest, and the disclosure read of
+ * issued evidence. A failed read is an error, never an absence.
+ */
+import { jetstream, jetstreamManager } from "@nats-io/jetstream";
+import { Kvm } from "@nats-io/kv";
+import { assertLifecycleToken, ContractInvalidError, ContractStoreCorruptError, contractStoreContext, EpEnvelopeError, endpointNameOf, endpointToken, assertIssuedStoreConfig, fetchContractArtifact, issuedBucket, openIssuedStore, parseServiceSpec, parseServiceStatus, recordsBucket, } from "@cotal-ai/core";
+const dec = new TextDecoder("utf-8", { fatal: true });
+export async function natsRegistryReads(nc, space) {
+    const jsm = await jetstreamManager(nc, { checkAPI: false });
+    // The evidence store's shape is verified before any first-message read is trusted (SPEC 13.15).
+    assertIssuedStoreConfig((await jsm.streams.info(`KV_${issuedBucket(space)}`)).config, space, issuedBucket(space));
+    const store = openIssuedStore(await new Kvm(jetstream(nc, { checkAPI: false })).open(issuedBucket(space)), jsm, space);
+    const bucket = recordsBucket(space);
+    const prefix = `$KV.${bucket}.`;
+    const contracts = await contractStoreContext(nc, space);
+    const artifacts = new Map();
+    /** One `svc` key, read per key. `undefined`: never written, deleted or purged. */
+    const svcKey = async (key) => {
+        const reply = await nc.request(`$JS.API.DIRECT.GET.KV_${bucket}.${prefix}${key}`, new Uint8Array(0), { timeout: 3000 });
+        const code = reply.headers?.code ?? 0;
+        const status = reply.headers?.get("Status") ?? "";
+        if (code === 404 || status.startsWith("404"))
+            return undefined;
+        if (code >= 400 || status !== "")
+            throw new EpEnvelopeError("unavailable", `the registry read of ${key} failed (${code || status})`);
+        if (reply.headers?.get("KV-Operation"))
+            return undefined;
+        return JSON.parse(dec.decode(reply.data));
+    };
+    return {
+        observe: async (ref) => (await store.observe(ref)).evidence,
+        instances: async () => {
+            const info = await jsm.streams.info(`KV_${bucket}`, { subjects_filter: `${prefix}svc.*.*.spec` });
+            const out = [];
+            for (const subject of Object.keys(info.state.subjects ?? {})) {
+                const [kind, token, instanceId, part, extra] = subject.slice(prefix.length).split(".");
+                if (!subject.startsWith(prefix) || kind !== "svc" || !token || !instanceId || part !== "spec" || extra !== undefined)
+                    throw new EpEnvelopeError("internal", "the records store listed a service key outside its grammar; the listing was not inferred");
+                endpointToken(endpointNameOf(token));
+                out.push({ endpoint: endpointNameOf(token), instanceId: assertLifecycleToken(instanceId, "instanceId") });
+            }
+            return out;
+        },
+        clusterDigests: async (endpoint, instanceId) => {
+            const raw = await svcKey(`svc.${endpointToken(endpoint)}.${instanceId}.spec`);
+            return raw === undefined ? undefined : parseServiceSpec(raw, { endpoint }).clusterDigests;
+        },
+        state: async (endpoint, instanceId) => {
+            const raw = await svcKey(`svc.${endpointToken(endpoint)}.${instanceId}.status`);
+            return raw === undefined ? null : parseServiceStatus(raw).state;
+        },
+        artifact: async (hex) => {
+            if (artifacts.has(hex))
+                return artifacts.get(hex);
+            let bytes;
+            try {
+                bytes = await fetchContractArtifact(contracts, hex, { lastOnly: true });
+            }
+            catch (e) {
+                // Bytes at the digest that do not verify are an invalid declaration, not a failed read.
+                if (e instanceof ContractStoreCorruptError)
+                    throw new ContractInvalidError(e.message);
+                throw e;
+            }
+            if (bytes === undefined)
+                return undefined;
+            const value = JSON.parse(dec.decode(bytes));
+            artifacts.set(hex, value);
+            return value;
+        },
+    };
+}
+//# sourceMappingURL=reads.js.map

package/dist/reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reads.js","sourceRoot":"","sources":["../src/reads.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GAEd,MAAM,gBAAgB,CAAC;AAGxB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAkB,EAAE,KAAa;IACvE,MAAM,GAAG,GAAqB,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,gGAAgG;IAChG,uBAAuB,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,MAAM,GAAG,CAAC;IAChC,MAAM,SAAS,GAAyB,MAAM,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE7C,kFAAkF;IAClF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAoB,EAAE;QACrD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,yBAAyB,MAAM,IAAI,MAAM,GAAG,GAAG,EAAE,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxH,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/D,IAAI,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,wBAAwB,GAAG,YAAY,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;QACrI,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ;QAC3D,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC,CAAC;YAClG,MAAM,GAAG,GAA+C,EAAE,CAAC;YAC3D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvF,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;oBAClH,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,0FAA0F,CAAC,CAAC;gBACpI,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YAC7C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,UAAU,OAAO,CAAC,CAAC;YAC9E,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC;QAC5F,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,UAAU,SAAS,CAAC,CAAC;YAChF,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAClE,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACtB,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,KAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,wFAAwF;gBACxF,IAAI,CAAC,YAAY,yBAAyB;oBAAE,MAAM,IAAI,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtF,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,CAAC;YACvD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/serve.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The registry's served commands over a registry-authorized serve grant (SPEC 13.9). Both rails are
+ * subscribed, as for any endpoint; `answerEndpoints` refuses the legacy rail on an authed mesh.
+ * `describe` is public: it names the one command and its contract, which every caller may see.
+ */
+import type { NatsConnection } from "@nats-io/transport-node";
+import { type EpCommandDef, type EpServeGrant, type EpServeHandle } from "@cotal-ai/core";
+import { type RegistryAnswerOptions } from "./answer.js";
+export declare function registryCommandDefs(opts: RegistryAnswerOptions): EpCommandDef[];
+export declare function serveRegistry(nc: NatsConnection, grant: EpServeGrant, opts: RegistryAnswerOptions): EpServeHandle;
+//# sourceMappingURL=serve.d.ts.map

package/dist/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE1E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,YAAY,EAAE,CAM/E;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,qBAAqB,GAAG,aAAa,CAGjH"}

package/dist/serve.js

@@ -0,0 +1,15 @@
+import { REGISTRY_CONTRACTS, REGISTRY_ENDPOINT, REGISTRY_ENDPOINTS_COMMAND, serveEndpoint, } from "@cotal-ai/core";
+import { answerEndpoints } from "./answer.js";
+export function registryCommandDefs(opts) {
+    return [{
+            command: REGISTRY_ENDPOINTS_COMMAND,
+            contract: REGISTRY_CONTRACTS[REGISTRY_ENDPOINTS_COMMAND],
+            handler: (ctx) => answerEndpoints(opts, ctx, (ctx.request.args ?? {})),
+        }];
+}
+export function serveRegistry(nc, grant, opts) {
+    if (grant.endpoint !== REGISTRY_ENDPOINT)
+        throw new Error(`a registry serves "${REGISTRY_ENDPOINT}", not "${grant.endpoint}"`);
+    return serveEndpoint(nc, opts.space, grant, registryCommandDefs(opts), { public: true });
+}
+//# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,GAKd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAA8B,MAAM,aAAa,CAAC;AAE1E,MAAM,UAAU,mBAAmB,CAAC,IAA2B;IAC7D,OAAO,CAAC;YACN,OAAO,EAAE,0BAA0B;YACnC,QAAQ,EAAE,kBAAkB,CAAC,0BAA0B,CAAE;YACzD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;SACjG,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAkB,EAAE,KAAmB,EAAE,IAA2B;IAChG,IAAI,KAAK,CAAC,QAAQ,KAAK,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,iBAAiB,WAAW,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC/H,OAAO,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3F,CAAC"}

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "@cotal-ai/registry",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "description": "Cotal registry: the registered endpoint that answers discovery questions, starting with the endpoints a caller's recorded grants cover.",
+  "version": "0.135.0",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Cotal-AI/Cotal.git",
+    "directory": "implementations/registry"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@cotal-ai/core": "0.135.0",
+    "@nats-io/jetstream": "^3.4.0",
+    "@nats-io/transport-node": "^3.4.0",
+    "@nats-io/kv": "^3.4.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@cotal-ai/smoke-kit": "0.0.0"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.smoke.json",
+    "build": "tsc -p tsconfig.json",
+    "test": "tsx smoke/registry-answer-live.smoke.ts && tsx smoke/registry-listing-e2e-live.smoke.ts"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.