service_registry state

Service

Service represents a registered on-chain service.

Reservation

Reservation holds a deregistered name for its former owner AND its original registrant, and EXPIRES (re-audit 2026-09-02): an eternal reservation let an attacker cycle register/deregister to lock the whole namespace forever, and a hostile transferee could strand a name against its original registrant permanently.

MaxServices

MaxServicesPerOwner

MaxNameLen

MaxTypeLen

MaxPkgPathLen

MaxDescriptionLen

MaxMetadataLen

pkgPathPrefix

ReservationPeriod

// 90 days

MaxRenderServices

renderDescLen

services

names

// insertion-ordered list for deterministic iteration

retired

ownerServices

pendingOwners

init.18

rejectStraySend

rejectStraySend aborts when coins are attached to a call (pearl audit Y2): this realm handles no funds, holds no banker and exposes no withdrawal, so an attached send would strand on the realm address forever. Aborting reverts the transfer back to the sender. Fails open for realm-routed calls, whose attached send lands on the intermediary realm, never here.

quotaAdd

quotaDrop

assertQuota

isValidName

validatePkgPath

validateFields

truncate

truncate shortens s to at most n runes without splitting a multibyte character. Applied to RAW text, never to escaped output — truncating after escaping could sever a \`\\x\` pair and leave a dangling backslash.

mustGet

RegisterService

RegisterService adds a new service to the registry. The caller becomes the owner. Name must be unique, lowercase alphanumeric/underscores. pkgPath is the realm the service lives at — the field integrators resolve — and must look like a gno.land package path. A name that was deregistered stays reserved for its former owner and its original registrant for ReservationPeriod. NOTE: this realm does NOT and cannot verify that pkgPath exists or that the caller controls it. See the INTEGRATOR CONTRACT on Resolve.

UpdateService

UpdateService modifies a service's pkgpath, description, type, and metadata. Only the registered owner can update. Name cannot change. An update MAY REPOINT the name at a different package path. That is a deliberate capability (services move, and versions supersede), but it also means a name an integrator trusts today can point elsewhere tomorrow. The ServiceUpdated event carries both the old and the new path specifically so a repoint is observable in the transaction log rather than something a consumer has to poll for.

TransferOwnership

TransferOwnership NOMINATES a new owner for a service entry; the nominee must call AcceptOwnership to take control (pearl audit Y4). The one-step form this replaces was a permanent-brick hazard: address.IsValid() only checks bech32 form, so a well-formed but unowned destination passed the check and committed immediately, after which the entry could never again be updated, transferred or deregistered — and because it could never be deregistered it could never enter the reservation window either, so the NAME became a permanent hole in a shared global namespace. Nomination changes nothing: the sitting owner keeps full control until the nominee consents. Passing "" clears a pending nomination.

AcceptOwnership

AcceptOwnership completes a nominated handoff. Only the nominee can accept, and the nominee's own quota is checked HERE — at consent — so a nomination can never push an account past MaxServicesPerOwner without that account agreeing to it.

CancelOwnershipTransfer

CancelOwnershipTransfer withdraws a pending nomination. Owner-only.

Deregister

Deregister removes a service from the registry. Only the owner can deregister. The name stays reserved for the former owner and the original registrant for ReservationPeriod — it cannot be re-registered by anyone else in that window, so integrators who still resolve it can never be silently redirected by a squatter.

Resolve

Resolve returns the pkgpath a service name points to — the primary integration query. Panics on unknown names so a consumer can never silently integrate against a missing entry. INTEGRATOR CONTRACT — read this before trusting a resolution: 1. A resolution is an ATTESTATION, NOT A PROOF. This realm records that some address claimed a name for some package path. It does NOT verify that the path exists, that it is deployed, or that the registrant controls it. Contrast r/demo/defi/grc20reg, which proves control by requiring the registered token object to originate from the calling realm; no equivalent proof exists for a bare path string, and requiring one would mean only realms — never their operators — could ever register a name, which is not this registry's model. 2. A NAME IS NOT AN AUTHORIZATION. Never grant a privilege, route a payment, or admit a caller because Resolve returned its path. Resolution answers "where does this name point", never "may this caller act". Derive authority from your own crossing entrypoint's cur.Previous(), or from an explicit access-control realm. 3. THE TARGET CAN CHANGE. The owner may repoint a name at any time via UpdateService, and ownership itself is transferable. Treat a resolution as valid only for the transaction that read it; cache it and you inherit whatever the name points at later. The ServiceUpdated and OwnershipTransferred events exist so movement is detectable.

TryResolve

TryResolve is the non-panicking variant for consumers that need to degrade gracefully when a name disappears (re-audit: a panicking-only read path bricks any consumer realm that calls it inline). The INTEGRATOR CONTRACT documented on Resolve applies here identically.

GetOwner

GetPendingOwner

GetPendingOwner returns the nominated-but-not-yet-accepted owner of a service, or "none" when no handoff is open.

ServiceCount

ServiceCount returns how many services are registered and the global cap, so a caller can check headroom without pulling the whole list.

OwnerServiceCount

OwnerServiceCount returns how many services an address currently holds and the per-owner cap.

GetService

GetService returns a formatted summary of a registered service. Free text is escaped for a single-line markdown slot.

ListServices

ListServices returns all registered service names as a comma-separated string in registration order. COST NOTE: this is O(MaxServices) and is deliberately NOT truncated — an integrator enumerating the registry needs the complete set, and the caller pays for its own read. Render, whose cost lands on third-party viewers instead, IS bounded.

ListByType

ListByType returns all service names matching a given type. Same cost note as ListServices.

Render

Render returns a markdown overview, bounded to MaxRenderServices rows (pearl audit Y3). Never panics. All free text goes through the ecosystem sanitizer rather than a bespoke escaper: the hand-rolled replacement of backticks and pipes it replaces left \`\[\`, \`]\`, \`(\`, \`)\` and \`!\` live, so any registrant could inject a working markdown link or image into a table cell and phish every viewer of this page.