/** The `lifecycle..` head value (§13.1, amended). One incarnation of an alias. * `mappingRevision` is NOT here: it is the head key's STORE revision (§13.1), returned beside * the mapping by the leader read. `currentCredentialId` stays ABSENT until the (3) normative * ledger mints under the reopened gate (an active head naming a released credential before the * ledger exists would be exactly the unledgered mint §13.1 forbids). */ export interface LifecycleMapping { owner: string; actor: string; /** The never-reused, space-globally reserved lifecycle UID of THIS incarnation. */ lifecycleUid: string; /** The minting/supervising authority. */ managerInstance: string; /** The fenced process epoch (§13.1: live authority binds it; advanced only by the takeover * barrier). */ processEpoch: number; /** `active` is the ONLY current state. `retiring` = the terminal barrier's op-bound * containment phase (non-current, NOT replaceable). `retired` = terminal AND asserts the * completed barrier (only then may activation replace the alias, with a fresh UID). */ state: "active" | "retiring" | "retired"; /** The public credential fingerprint + authority epoch — absent until the ledger slice. */ currentCredentialId?: string; /** The opId of the takeover operation that LAST advanced this epoch (SPEC 13.1: the epoch * advance and its op stamp are ONE CAS, so a completion is bound to exactly one operation). * A resuming barrier confirms the completed head carries ITS opId; a LOSING concurrent * takeover finds a foreign opId and refuses, never claiming the winner's completion. Absent * at initial activation (epoch 1), present from the first takeover. */ lastTakeoverOpId?: string; /** REQUIRED at `retiring` (the retirement operation's durable intent); absent otherwise. */ op?: { opId: string; kind: "retirement"; }; } export declare const LIFECYCLE_HEAD_STATES: ReadonlySet; /** The head key `lifecycle..` (§13.7: one atomic unsplit key). */ export declare function lifecycleHeadKey(owner: string, actor: string): string; /** The space-global reservation key `uid.` (§13.7: create-only, never-deleted). */ export declare function uidReservationKey(lifecycleUid: string): string; /** Validate a head value at the consuming boundary — CLOSED schema (nested `op` included), and * the embedded owner/actor MUST agree with the key so a key-mismatched row never authorizes. */ export declare function parseLifecycleHead(raw: Uint8Array, key: string, owner: string, actor: string): LifecycleMapping; /** The agent-family issuance gate row (§13.1, amended): `frozen` MUST carry the durable op * intent; the embedded uid MUST agree with the key. (The disjoint ENDPOINT family * `epgate..` is separate.) */ export interface EpGateRow { lifecycleUid: string; state: "open" | "frozen" | "retired"; /** Mint generation: born 0 under the activation freeze, first mintable generation is 1 (the * activation's reopen), and every barrier reopen advances it. */ generation: number; /** REQUIRED at `frozen` (which operation owns this freeze and may advance it) AND at * `retired` (the terminalizing op, audit + same-op idempotence); absent at `open`. * `successor` is a per-kind summary token (SPEC 13.1): only `takeover`/`registration` * may carry one (their authoritative successor artifacts live under `stage..`); * `activation`/`retirement` never do. */ op?: { opId: string; kind: "activation" | "takeover" | "registration" | "retirement"; successor?: string; }; } export declare const ISSUANCE_GATE_STATES: ReadonlySet; export declare const ISSUANCE_GATE_OP_KINDS: ReadonlySet; /** The gate key `gate.` (§13.7). */ export declare function issuanceGateKey(lifecycleUid: string): string; /** Validate a gate row at the consuming boundary — CLOSED schema; key/uid agreement; the * per-kind STATE x KIND transition invariants (§13.1). */ export declare function parseIssuanceGate(raw: Uint8Array, key: string, lifecycleUid: string): EpGateRow; export declare function assertKeySegment(v: unknown, what: string): string; /** A credential id: one or more KV-safe segments (dots allowed BETWEEN segments — the session * families use `.c` / `.s` — but never wildcards or empty segments). */ export declare function assertCredentialIdTail(v: unknown, what: string): string; /** A holder principal `.` with a REAL owner (derived `u_…` or the dev owner) — * eviction is BY PRINCIPAL, so a row that cannot name an evictable principal never ledgers. */ export declare function assertHolderPrincipal(v: unknown, what: string): string; export declare const SOURCE_ROOT = "root"; /** Validate ONE sourceChain member — `root`, `handle..`, or * `session.` (SPEC 13.1) — and return its parsed shape. */ export declare function parseSourceMember(member: unknown): { kind: "root"; } | { kind: "handle"; issuerKeyId: string; id: string; } | { kind: "session"; sessionId: string; }; export declare function assertSourceChain(v: unknown, what: string): string[]; /** The agent-family ledger key `cred..`. */ export declare function credRowKey(lifecycleUid: string, credentialId: string): string; /** The endpoint-family ledger key `epcred...` (disjoint by * explicit prefix, never arity, SPEC 13.1). */ export declare function epcredRowKey(endpoint: string, instanceId: string, credentialId: string): string; /** The endpoint-family ledger KEY PREFIX `epcred..` (no credentialId tail) — * the exact family a barrier enumerates and a key-pinned executor grant scopes to (`…​.>`). Built * from the core tokenizers so a grant never spells the prefix by hand (guard-the-core). */ export declare function epcredFamilyPrefix(endpoint: string, instanceId: string): string; /** Durable interrupted-repair cursor for ONE frozen registration (`eprepair..`). * Distinct from the closed-schema gate and from `epcred` rows: those cannot carry a verification * journal. Bound to the freeze op, freeze token, and current holder set so old liveness evidence * is never reused for a different repair. */ export declare function eprepairKey(endpoint: string, instanceId: string): string; export interface EndpointRepairCursor { v: 1; opId: string; freezeToken: number; /** Sorted unique holders this freeze must verify-evict. */ holders: string[]; /** Holders whose eviction was already verified under THIS binding. Subset of `holders`. */ verified: string[]; } export declare function parseEndpointRepairCursor(raw: Uint8Array, key: string): EndpointRepairCursor; /** The ENDPOINT-instance issuance gate row (§13.1: a DISJOINT family from the agent * `gate.`, distinguished by explicit PREFIX and never token arity; it carries the * endpoint fence coordinates of §13.5/§13.7). Closed schema; `frozen`/`retired` are op-bound * exactly like the agent family. Lifted to core (guarded-core: ONE encoder shared by the auth * session ledger and the manager's endpoint-serve wiring; a second dialect is the dual-encoder * drift this module bans). */ export interface EndpointGateRow { state: "open" | "frozen" | "retired"; generation: number; processEpoch: number; registrationRevision: number; nameAuthorityRevision: number; /** The serving instance's CONNZ-attributable connection principal (`.` dot-form) * — the eviction target when the endpoint is taken over or a serving credential is revoked * (§13.1: eviction is BY PRINCIPAL). Recorded at endpoint registration; the serving ledger * rows (`epcred.`) copy it as their `holderPrincipal`, so the endpoint KEY identity * (`endpoint`) and the evictable principal stay disjoint. */ principal: string; op?: { opId: string; kind: "activation" | "takeover" | "registration" | "retirement"; successor?: string; }; } /** The endpoint gate key `epgate..` (an instanceId is unique ONLY within * `(space, endpoint)`, so the key is endpoint-qualified — equal instanceIds under two endpoints * never collide on the gate or the credential family, §13.1/§13.6). */ export declare function epgateKey(endpoint: string, instanceId: string): string; /** Validate an endpoint gate row at the consuming boundary — CLOSED schema; a real owner-grammar * serving principal; the per-kind STATE x KIND + successor invariants (§13.1). Byte-for-byte the * parser the auth session ledger carried (fact H3 lift), now shared. */ export declare function parseEndpointGate(raw: Uint8Array, key: string): EndpointGateRow; /** The §13.1 credential-ledger row, closed. `lifecycleUid` is the HOLDER's KEY identity * component: the managed agent's lifecycle UID in the `cred.` family, the endpoint instance's * `instanceId` in the `epcred.` family (SPEC 13.1: `instanceId` is to an endpoint what * `lifecycleUid` is to a managed agent). `endpoint` is present ONLY in the `epcred.` family * (it forms the key there and is absent in `cred.`), so the KEY identity is never conflated * with the eviction target. `holderPrincipal` is who the barrier KICKs: ALWAYS a CONNZ- * attributable `.` dot-form (the caller principal in the `cred.` family; the * serving instance's own connection principal in the `epcred.` family, recorded from the * endpoint gate), NEVER the endpoint name (which CONNZ cannot attribute). */ export interface CredentialLedgerRow { credentialId: string; holderPrincipal: string; lifecycleUid: string; /** The endpoint NAME whose token forms the `epcred.` key; present iff this is an endpoint- * family row, absent in the `cred.` family (which the lifecycleUid keys). */ endpoint?: string; /** The FULL verified lineage at mint: `root` | `handle..`… | * `session.` (SPEC 13.1 — for a handle redemption EVERY handle in the presented * chain, never only the leaf). */ sourceChain: string[]; /** Monotonic: `active → revoked` only; a revoked row is never deleted. */ state: "active" | "revoked"; exp: number; } /** Parse + validate a ledger row at its consuming boundary — closed schema, and the embedded * identity MUST rebuild the row's own key, so a key-mismatched or family-swapped poison row * never authorizes (SPEC 13.1/13.3). */ export declare function parseLedgerRow(raw: Uint8Array, key: string): CredentialLedgerRow; /** Phases of one static managed slot: the F3 outer spawn intent (`provisioning`, persisted * BEFORE head activation), the owned slot (`active`), the terminal in flight (`terminalizing`), * and the completed terminal (`retired` — the row is never deleted; a same-alias successor * CASes over it). */ export declare const STATIC_SLOT_PHASES: ReadonlySet; export type StaticSlotPhase = "provisioning" | "active" | "terminalizing" | "retired"; /** The static manager's durable alias -> (owner, actor, lifecycleUid) slot mapping (Unit B, * the F5-bind split-coordinates design): the ALIAS is routing/display, protected by this * name-keyed row plus the uid reservation and the manager's freeSlot hold; the AUTHORITY * coordinate is the incarnation-unique wire `actor` (the nkey) recorded here as DATA. The row * lives in the records store — the same durability domain as the head — and survives manager * restart (the boot sweep re-drives any non-retired phase). `credentialIds` is the incarnation's * full mint set (root + renewals): the terminal's B1 revoke enumerates from HERE (recorded * BEFORE each mint), never from a store listing. */ export interface StaticManagedSlotRow { owner: string; /** The manager-visible agent name (routing identity; never sufficient authority, SPEC 13.1). */ alias: string; /** The incarnation-unique wire principal actor (the connection nkey) — the authority coordinate. */ actor: string; lifecycleUid: string; phase: StaticSlotPhase; /** Every credentialId minted for this incarnation, recorded BEFORE its mint (crash-safe: * a cred never exists without its id recorded here and its ledger row appended first). */ credentialIds: string[]; /** The minting/supervising authority (the manager's own per-PROCESS incarnation uid — audit only). */ managerInstance: string; /** The owning LOGICAL manager instance id (P2 item 3 slice 3b-2): stable across manager restart, so * the boot reconcile filters to rows THIS logical instance owns and never sweep-terminalizes a * SIBLING manager's rows (multi-manager-per-space). Optional for backward-compat: a legacy row * (written before 3b-2, no owner recorded) predates multi-manager, so a reconciling manager treats * it as its own (the single-manager past). An orphaned sibling row is claimed only by an explicit * operator CAS takeover (ruling 1), never auto-adopted. */ ownerInstanceId?: string; /** Set true, on the `terminalizing` row, once the terminal's footprint cleanup has finished and * BEFORE the final CAS to `retired`. It lets a resumed terminal tell "cleanup already completed" * (the process died between cleanup and the `retired` CAS) from "cleanup never ran or was in * flight", so the resume skips a completed cleanup instead of re-running it as the only total * option. Absent on a legacy row and on every phase before the cleanup step, which a resume reads * as not-known-complete and re-runs the idempotent cleanup — the totality-preserving default. */ cleanupComplete?: boolean; /** The runtime's durable reference to the incarnation's process custody (an `AgentHandle.reference`), * recorded when the slot goes `active` and re-recorded when a same-lifecycle restart or resume binds * a new handle. A successor's terminal reaps the orphaned OS process through it, so a manager crash * never leaves a seat running outside every manager. Absent for a runtime without durable custody * (nothing to reap by reference) and on a row written before this field existed. */ runtime?: { kind: string; id: string; }; } /** The slot key prefix in the records store. Core-owned so permission builders and the manager * share ONE encoder (a second literal is the drift class this module bans). */ export declare const STATIC_SLOT_PREFIX = "mgrslot"; /** The slot key `mgrslot..`. */ export declare function staticSlotKey(owner: string, alias: string): string; export declare function parseStaticSlotRow(raw: Uint8Array, key: string): StaticManagedSlotRow; //# sourceMappingURL=lifecycle-state.d.ts.map