permission_registry state

MaxResources

MaxResourcesPerAdmin

MaxPermissionsPerResource

MaxHoldersPerPermission

MaxNameLen

ReservationPeriod

// 90 days

MaxRenderResources

MaxRenderPermissions

MaxRenderHolders

Reservation

Reservation holds a deleted resource name for its former admin AND its original creator, and expires.

resources

resources maps a resource name to the admin address that controls it.

resourceNames

resourceNames tracks the insertion-ordered list of resource names so ListResources can iterate without scanning the map.

permissions

permissions maps resource -> permission -> address -> granted. Three-level nesting gives O(1) lookup for Has().

permList

permList tracks the ordered list of distinct permission names per resource, so GetPermissions can iterate without scanning the full map.

retired

retired maps a deleted resource name to its time-bounded reservation. Consumers authorize against resource names, so a freed name must not be claimable by an attacker while integrators may still reference it — but the hold expires so tombstones cannot lock the namespace forever.

resourceCreators

resourceCreators records each resource's ORIGINAL creator, immutable through admin transfers, so a hostile admin-transferee cannot permanently strand a name against the project that made it.

adminResources

adminResources counts the live resources each address administers, so MaxResourcesPerAdmin can be enforced in O(1). Entries are removed when the count reaches zero so the map tracks live admins only (R1).

pendingAdmins

pendingAdmins holds nominated-but-not-yet-accepted admins, keyed by resource name. Admin handoff is two-step (Y4): nominating is reversible, only the nominee's own acceptance is final.

init.18

mustBeAdmin

mustBeAdmin panics if who is not the admin of the resource. Y1 (audit 2026-09-21): identity is now passed in from the crossing entrypoint's own \`cur.Previous().Address()\` rather than recomputed by a non-crossing helper via unsafe.PreviousRealm(). The stack-walking form returned the correct address on every path this realm actually exposes, but nothing in the type system tied it to the immediate caller — a future non-crossing exported helper calling it would have silently resolved its importer's caller instead of its importer (security.md Class 2). Threading \`cur\` makes the binding structural.

rejectStraySend

rejectStraySend aborts a transaction that attaches coins. This realm has no banker, no payable path and no withdrawal function, so coins attached to any entrypoint would be permanently stranded at the realm address (Y5, security.md § operational).

releaseAdminSlot

releaseAdminSlot decrements an admin's live-resource count, deleting the entry when it reaches zero so adminResources never accumulates zero-valued keys.

isValidName

isValidName restricts resource and permission names to lowercase alphanumeric with underscores. Beyond hygiene this is a security property: names appear in composite trust decisions and rendered output, so no delimiter or markdown character may enter one.

nameRuleText

CreateResource

CreateResource registers a new named resource. The caller becomes its admin and is the only address that can grant or revoke permissions on it. A deleted resource name stays reserved for its former admin and its original creator until the reservation expires. Each address may administer at most MaxResourcesPerAdmin resources at once, and the registry holds at most MaxResources in total.

DeleteResource

DeleteResource removes a resource and every permission under it. Only the resource admin can call this. The name stays reserved for the caller and for the original creator: nobody else can re-create it and inherit its consumers until the reservation expires.

Grant

Grant gives an address a named permission on a resource. Only the resource admin can call this. Panics if the permission is already granted to avoid silent no-ops.

Revoke

Revoke removes a permission from an address. Only the resource admin can call this. Panics if the permission was not granted. A permission left with no holders is pruned from the resource's permission list.

TransferAdmin

TransferAdmin nominates a new admin for a resource. Only the current admin can call this, and the handoff does NOT take effect until the nominee calls AcceptAdmin. Y4 (audit 2026-09-21): the upstream one-step transfer made a well-formed-but-unowned destination permanently fatal. address.IsValid only checks bech32 form, so a mistyped address passed the check and left the resource with an admin nobody controls — it could never again be granted on, revoked from, transferred or deleted, and its slot was lost from both the global cap and the former admin's quota forever. Nomination is reversible; only the nominee's consent is final.

CancelAdminTransfer

CancelAdminTransfer withdraws a pending nomination. Only the current admin can call this.

AcceptAdmin

AcceptAdmin completes a pending handoff; only the nominee may call it. The nominee's quota is checked HERE — at consent time — so a nomination can never push an account past MaxResourcesPerAdmin without that account agreeing to carry the resource.

Has

Has returns true if addr holds the named permission on the resource. Returns false (never panics) for unknown resources or permissions. INTEGRATOR CONTRACT (Y7): Has takes the subject address explicitly and performs NO caller authentication — it answers "does this address hold this permission", not "may my caller do this". A consuming realm must derive addr from its own crossing entrypoint's cur.Previous().Address() and pass it in. Deriving it inside a non-crossing helper via unsafe.PreviousRealm() resolves the consumer's own caller's caller and is a Class-2 designation-forgery bug in the consumer.

GetPermissions

GetPermissions returns all permission names granted to addr on a resource, as a comma-separated string. Returns "none" if the address has no permissions.

ListResources

ListResources returns all registered resource names as a comma-separated string in registration order. Returns "none" if no resources exist.

GetAdmin

GetAdmin returns the admin address of a resource.

GetPendingAdmin

GetPendingAdmin returns the nominated admin awaiting acceptance for a resource, or "none".

Render

Render returns a markdown overview. Never panics. Output is bounded by MaxRenderResources / MaxRenderPermissions / MaxRenderHolders (Y3); truncated sections name the query to use for complete data.