@agenticprimitives/fabric 0.0.0-alpha.11 → 0.0.0-alpha.13

package/CLAUDE.md

@@ -39,6 +39,11 @@ interaction-aware ingress; on-chain `atl:gatewayRoot`; `A2aTaskDO`/`SessionStore
 - **Transport-agnostic core.** No Cloudflare/MCP/A2A-SDK imports in `src/` — `./cloudflare` is the
   only adapter and the only `@cloudflare/workers-types` consumer.
 
+- **The adoption ladder's mechanics are here** (`src/adoption.ts`, promoted in spec 399 §4): `AdoptionLedger`
+  types, `adoptionStage(ledger, op, env)` (the deployment's `GATEWAY_SHADOW` gates a shadow; `""` is unset),
+  `compareServed` / `classifyDivergence` (a race is not a divergence), `shouldShadow` sampling, the bounded
+  in-memory `recordDivergence`. The ledger VALUES — which op is on which rung, and why — stay with the product.
+
 ## Boundary
 `types`, `fulfillment`, `vault`, `audit`, `delegation`, `chain-state`, `tool-policy`, `agent-naming`
 (injected resolver) ← `fabric`; `fabric/cloudflare → orchestration` (adapter-only); `fabric →

package/dist/adoption.d.ts

@@ -0,0 +1,79 @@
+/** Which of the five candidate causes an op's move actually exercises. Naming it per op is the point of
+ *  moving one at a time: if an op diverges, its concerns say where to look, and where not to. */
+export type AdoptionConcern = 'auth' | 'projection' | 'ordering' | 'data-shape' | 'assistant';
+export type AdoptionStage = 'off' | 'shadow' | 'serving';
+export interface AdoptionEntry {
+    stage: AdoptionStage;
+    /** What moving this op puts at risk — read this first when its shadow diverges. */
+    concerns: readonly AdoptionConcern[];
+    /** Why this op is at this rung. Prose, because "it's next" and "it's blocked" look identical in a stage
+     *  field, and the difference is the whole state of the migration. */
+    note: string;
+    /**
+     * Fields that legitimately differ between the two planes because each computes them at its own instant.
+     * Declared PER OP and BEFORE evidence arrives — classifying noise after seeing a report is how a real
+     * divergence gets explained away as expected. An EMPTY list is a claim, not an omission: it asserts this
+     * op has no per-read computation, so any difference is either a race or a defect. Say why in `note`.
+     */
+    volatileFields: readonly string[];
+}
+/** The ledger: one place that says which plane serves what, so adoption is data rather than conditionals
+ *  spread across a serving object. An op absent from it is `off`: adoption is opt-in, because the failure
+ *  mode of opt-out is an op that moved because nobody remembered to stop it. */
+export type AdoptionLedger = Readonly<Record<string, AdoptionEntry>>;
+/**
+ * The stage an op runs at IN THIS DEPLOYMENT. The ledger says how far an op has climbed in the code; the
+ * deployment's `GATEWAY_SHADOW` says whether it is running the comparison at all. Both are required, and the
+ * env one defaults to OFF — constructing the gateway creates its tables, and an ungated shadow on a hot op
+ * would make that storage decision for every principal at once. Empty string is unset, not enabled
+ * (`wrangler`'s `VAR = ""` binds an empty string that `??` sails straight past).
+ */
+export declare function adoptionStage(ledger: AdoptionLedger, op: string, env?: {
+    GATEWAY_SHADOW?: string;
+}): AdoptionStage;
+export interface Divergence {
+    op: string;
+    at: string;
+    /** `equal` is recorded too. A shadow that only reports differences cannot distinguish "the planes agree"
+     *  from "the shadow never ran", and those justify opposite decisions about promoting. */
+    kind: 'equal' | 'value' | 'raced' | 'gateway-error' | 'shadow-skipped';
+    detail?: string;
+}
+/**
+ * Compare the two planes' answers. Canonical JSON with sorted keys: key ORDER is not a difference worth
+ * blocking a promotion on. Everything else counts, including `undefined` vs absent — a field that vanished
+ * is exactly the data-shape drift being watched for.
+ */
+export declare function compareServed(op: string, served: unknown, shadow: unknown, at: string): Divergence;
+/**
+ * Was an apparent divergence just the document moving between the two reads? After the shadow read, take
+ * the serving read AGAIN: `servedAgain` matches the shadow ⇒ the document moved — RACED, benign, evidence of
+ * nothing; `servedAgain` still matches the original and differs from the shadow ⇒ the planes really
+ * disagree. DELIBERATELY CONSERVATIVE: anything not provably a race stays `value`.
+ */
+export declare function classifyDivergence(input: {
+    op: string;
+    served: unknown;
+    shadow: unknown;
+    servedAgain: unknown;
+    at: string;
+}): Divergence;
+/**
+ * Should this call run its shadow? Shadowing doubles the delegated reads on the path being shadowed, so it
+ * is SAMPLED: at most one shadow per principal per `intervalMs`. Time-based rather than 1-in-N because it
+ * bounds the ADDED LOAD directly; a ratio bounds a proportion of a rate that varies with how many clients a
+ * principal has open. The first call always samples — a low-traffic principal must still contribute.
+ */
+export declare function shouldShadow(input: {
+    lastShadowAt: number | undefined;
+    now: number;
+    intervalMs: number;
+}): boolean;
+/** One shadow per principal per minute: enough to catch a systematic difference within a session, far below
+ *  a per-principal read limiter's budget even with several clients open. */
+export declare const SHADOW_INTERVAL_MS = 60000;
+/** How many divergences to keep — in MEMORY, not durable storage: diagnostics with a shelf life of one
+ *  investigation. Losing them on isolate recycle is the correct trade. */
+export declare const DIVERGENCE_BUFFER = 20;
+export declare function recordDivergence(buf: Divergence[], d: Divergence): Divergence[];
+//# sourceMappingURL=adoption.d.ts.map

package/dist/adoption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.d.ts","sourceRoot":"","sources":["../src/adoption.ts"],"names":[],"mappings":"AAiBA;iGACiG;AACjG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,CAAC;AAE9F,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,mFAAmF;IACnF,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC;yEACqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;gFAEgF;AAChF,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAIlH;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX;6FACyF;IACzF,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,eAAe,GAAG,gBAAgB,CAAC;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAKlG;AAoBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAQxI;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAGlH;AAED;4EAC4E;AAC5E,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC;0EAC0E;AAC1E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,CAG/E"}

package/dist/adoption.js

@@ -0,0 +1,95 @@
+// INCREMENTAL SERVING-PLANE ADOPTION — the LADDER (ADR-0060; ADR-0055 amendment). Promoted from the runtime
+// app in spec 399 W0 (§4): the ledger TYPES, the rung rule and the divergence/sampling mechanics are the
+// contract every product adopting `PrincipalGatewayDO` needs; the ledger VALUES (which op sits on which rung,
+// and why) stay with the product that owns those ops.
+//
+// THE LADDER. Every op climbs the same three rungs, and never skips one:
+//   `off`     — the incumbent plane serves. The gateway is not consulted.
+//   `shadow`  — the incumbent serves AND ITS ANSWER IS THE RESPONSE. The gateway runs alongside and the
+//               two are compared. Divergence is recorded; it never reaches the caller and never fails the
+//               request. This is the rung that converts "we think it matches" into evidence.
+//   `serving` — the gateway serves. Promotion is earned by a shadow run with no unexplained divergence,
+//               not by the code being finished.
+//
+// WHAT A RUNG DOES NOT DO. Shadowing proves the two planes AGREE; it does not prove either is right. An op
+// whose incumbent implementation is wrong will shadow perfectly clean while the gateway faithfully
+// reproduces the bug. Promotion is evidence of equivalence, not of correctness.
+/**
+ * The stage an op runs at IN THIS DEPLOYMENT. The ledger says how far an op has climbed in the code; the
+ * deployment's `GATEWAY_SHADOW` says whether it is running the comparison at all. Both are required, and the
+ * env one defaults to OFF — constructing the gateway creates its tables, and an ungated shadow on a hot op
+ * would make that storage decision for every principal at once. Empty string is unset, not enabled
+ * (`wrangler`'s `VAR = ""` binds an empty string that `??` sails straight past).
+ */
+export function adoptionStage(ledger, op, env) {
+    const stage = ledger[op]?.stage ?? 'off';
+    if (stage === 'shadow' && (env?.GATEWAY_SHADOW ?? '').trim().toLowerCase() !== 'on')
+        return 'off';
+    return stage;
+}
+/**
+ * Compare the two planes' answers. Canonical JSON with sorted keys: key ORDER is not a difference worth
+ * blocking a promotion on. Everything else counts, including `undefined` vs absent — a field that vanished
+ * is exactly the data-shape drift being watched for.
+ */
+export function compareServed(op, served, shadow, at) {
+    const a = canonical(served);
+    const b = canonical(shadow);
+    if (a === b)
+        return { op, at, kind: 'equal' };
+    return { op, at, kind: 'value', detail: firstDifference(a, b) };
+}
+function canonical(v) {
+    return JSON.stringify(v, (_k, val) => val && typeof val === 'object' && !Array.isArray(val)
+        ? Object.fromEntries(Object.entries(val).sort(([x], [y]) => x.localeCompare(y)))
+        : val) ?? 'undefined';
+}
+/** A bounded excerpt around the first difference. Bounded because a divergence report that embeds two whole
+ *  documents is a copy of the person's records in a diagnostic buffer — the thing the vault doctrine exists
+ *  to prevent, arrived at through the back door. */
+function firstDifference(a, b) {
+    let i = 0;
+    while (i < a.length && i < b.length && a[i] === b[i])
+        i++;
+    const w = 40;
+    return `@${i}: served=${JSON.stringify(a.slice(Math.max(0, i - 8), i + w))} shadow=${JSON.stringify(b.slice(Math.max(0, i - 8), i + w))}`;
+}
+/**
+ * Was an apparent divergence just the document moving between the two reads? After the shadow read, take
+ * the serving read AGAIN: `servedAgain` matches the shadow ⇒ the document moved — RACED, benign, evidence of
+ * nothing; `servedAgain` still matches the original and differs from the shadow ⇒ the planes really
+ * disagree. DELIBERATELY CONSERVATIVE: anything not provably a race stays `value`.
+ */
+export function classifyDivergence(input) {
+    const first = compareServed(input.op, input.served, input.shadow, input.at);
+    if (first.kind === 'equal')
+        return first;
+    const settled = compareServed(input.op, input.servedAgain, input.shadow, input.at);
+    if (settled.kind === 'equal') {
+        return { op: input.op, at: input.at, kind: 'raced', detail: 'document changed between the serving read and the shadow read' };
+    }
+    return first;
+}
+// ── Sampling ──────────────────────────────────────────────────────────────────────────────────────────
+/**
+ * Should this call run its shadow? Shadowing doubles the delegated reads on the path being shadowed, so it
+ * is SAMPLED: at most one shadow per principal per `intervalMs`. Time-based rather than 1-in-N because it
+ * bounds the ADDED LOAD directly; a ratio bounds a proportion of a rate that varies with how many clients a
+ * principal has open. The first call always samples — a low-traffic principal must still contribute.
+ */
+export function shouldShadow(input) {
+    if (input.lastShadowAt === undefined)
+        return true;
+    return input.now - input.lastShadowAt >= input.intervalMs;
+}
+/** One shadow per principal per minute: enough to catch a systematic difference within a session, far below
+ *  a per-principal read limiter's budget even with several clients open. */
+export const SHADOW_INTERVAL_MS = 60_000;
+/** How many divergences to keep — in MEMORY, not durable storage: diagnostics with a shelf life of one
+ *  investigation. Losing them on isolate recycle is the correct trade. */
+export const DIVERGENCE_BUFFER = 20;
+export function recordDivergence(buf, d) {
+    buf.push(d);
+    return buf.length > DIVERGENCE_BUFFER ? buf.slice(-DIVERGENCE_BUFFER) : buf;
+}
+//# sourceMappingURL=adoption.js.map

package/dist/adoption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.js","sourceRoot":"","sources":["../src/adoption.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,yGAAyG;AACzG,8GAA8G;AAC9G,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,wGAAwG;AACxG,0GAA0G;AAC1G,6FAA6F;AAC7F,wGAAwG;AACxG,gDAAgD;AAChD,EAAE;AACF,2GAA2G;AAC3G,mGAAmG;AACnG,gFAAgF;AA6BhF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAsB,EAAE,EAAU,EAAE,GAAiC;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;IACzC,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU,EAAE,MAAe,EAAE,MAAe,EAAE,EAAU;IACpF,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CACnC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC,CAAC,GAAG,CACR,IAAI,WAAW,CAAC;AACnB,CAAC;AAED;;oDAEoD;AACpD,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC1D,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5I,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyF;IAC1H,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IAChI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yGAAyG;AAEzG;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAA4E;IACvG,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC;AAC5D,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC;0EAC0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,gBAAgB,CAAC,GAAiB,EAAE,CAAa;IAC/D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9E,CAAC"}

package/dist/cloudflare/sql-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-vault.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sql-vault.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,KAAK,EAML,UAAU,EACX,MAAM,0BAA0B,CAAC;AA4ClC;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,KAAK,CAiFvF"}
+{"version":3,"file":"sql-vault.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sql-vault.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,KAAK,EAOL,UAAU,EACX,MAAM,0BAA0B,CAAC;AA4ClC;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,KAAK,CA4IvF"}

package/dist/cloudflare/sql-vault.js

@@ -93,6 +93,62 @@ export function createDurableObjectSqlVault(sql, wrapper) {
                 updatedAt: r.updated_at,
             }));
         },
+        /**
+         * Spec 356 §2.3 — the selector runs in the store, so only matching rows are opened.
+         *
+         * `resource IN (…)` for singletons, `resource LIKE 'prefix%'` for keyed families, `LIMIT` always. The
+         * alternative — list every resource and read each — moves an owner's whole record set through the
+         * caller to answer a question about a few of them.
+         *
+         * An EMPTY selector matches nothing and touches no rows: a query that quietly meant "everything" when
+         * its selector failed to compile is the bug this shape exists to make impossible. `LIKE` wildcards in a
+         * prefix are escaped — a resource prefix is caller-influenced, and a stray `%` would widen the match.
+         */
+        async query(req) {
+            const owner = req.owner.toLowerCase();
+            const clauses = [];
+            const binds = [owner];
+            const exact = (req.select.exact ?? []).filter((e) => e.length > 0);
+            if (exact.length) {
+                clauses.push(`resource IN (${exact.map(() => '?').join(', ')})`);
+                binds.push(...exact);
+            }
+            for (const prefix of (req.select.prefixes ?? []).filter((p) => p.length > 0)) {
+                clauses.push("resource LIKE ? ESCAPE '\\'");
+                binds.push(`${prefix.replace(/[\\%_]/g, (c) => `\\${c}`)}%`);
+            }
+            if (!clauses.length)
+                return [];
+            binds.push(Math.max(1, Math.min(req.limit ?? 200, 500)));
+            const rows = sql
+                .exec(`SELECT * FROM vault_objects
+            WHERE owner_address = ? AND deleted_at IS NULL AND (${clauses.join(' OR ')})
+            ORDER BY resource
+            LIMIT ?`, ...binds)
+                .toArray();
+            const out = [];
+            for (const row of rows) {
+                const data = await openEnvelope({
+                    envelope: {
+                        owner: row.owner_address,
+                        resource: row.resource,
+                        classification: row.classification,
+                        crypto: JSON.parse(row.crypto_meta),
+                    },
+                    ciphertext: b64decode(row.ciphertext_b64),
+                    wrappedDek: b64decode(row.wrapped_dek_b64),
+                    wrapper,
+                });
+                out.push({
+                    owner: row.owner_address,
+                    resource: row.resource,
+                    classification: row.classification,
+                    data: projectFields(data, req.fields),
+                    updatedAt: row.updated_at,
+                });
+            }
+            return out;
+        },
     };
 }
 //# sourceMappingURL=sql-vault.js.map

package/dist/cloudflare/sql-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"sql-vault.js","sourceRoot":"","sources":["../../src/cloudflare/sql-vault.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAErF,yEAAyE;AACzE,MAAM,YAAY,GAAG;;;;;;;;;;;EAWnB,CAAC;AACH,MAAM,YAAY,GAAG,8GAA8G,CAAC;AAcpI,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AACD,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,sBAAsB,GAAwB,UAAU,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAe,EAAE,OAAmB;IAC9E,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,IAAI,CAAc,GAAqB;YAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CACH,6FAA6F,EAC7F,KAAK,EACL,GAAG,CAAC,QAAQ,CACb;iBACA,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAI;gBACjC,QAAQ,EAAE;oBACR,KAAK,EAAE,GAAG,CAAC,aAAa;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;oBACzD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;iBACpC;gBACD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;gBACzC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;gBAC1C,OAAO;aACR,CAAC,CAAC;YACH,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,aAAa;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;gBACzD,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAM;gBAC1C,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,CAAc,GAAyB;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,IAAI,CACN,kIAAkI,EAClI,KAAK,EACL,GAAG,CAAC,QAAQ,CACb,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,sBAAsB,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9G,GAAG,CAAC,IAAI,CACN;;;;;;;;6BAQqB,EACrB,KAAK,EACL,GAAG,CAAC,QAAQ,EACZ,cAAc,EACd,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAC5B,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAa;YACtB,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CACH,iIAAiI,EACjI,KAAK,CAAC,WAAW,EAAE,CACpB;iBACA,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,cAAqC;gBACvD,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sql-vault.js","sourceRoot":"","sources":["../../src/cloudflare/sql-vault.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAErF,yEAAyE;AACzE,MAAM,YAAY,GAAG;;;;;;;;;;;EAWnB,CAAC;AACH,MAAM,YAAY,GAAG,8GAA8G,CAAC;AAcpI,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AACD,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,sBAAsB,GAAwB,UAAU,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAe,EAAE,OAAmB;IAC9E,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,IAAI,CAAc,GAAqB;YAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CACH,6FAA6F,EAC7F,KAAK,EACL,GAAG,CAAC,QAAQ,CACb;iBACA,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAI;gBACjC,QAAQ,EAAE;oBACR,KAAK,EAAE,GAAG,CAAC,aAAa;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;oBACzD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;iBACpC;gBACD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;gBACzC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;gBAC1C,OAAO;aACR,CAAC,CAAC;YACH,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,aAAa;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;gBACzD,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAM;gBAC1C,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,CAAc,GAAyB;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,IAAI,CACN,kIAAkI,EAClI,KAAK,EACL,GAAG,CAAC,QAAQ,CACb,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,sBAAsB,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9G,GAAG,CAAC,IAAI,CACN;;;;;;;;6BAQqB,EACrB,KAAK,EACL,GAAG,CAAC,QAAQ,EACZ,cAAc,EACd,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAC5B,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAa;YACtB,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CACH,iIAAiI,EACjI,KAAK,CAAC,WAAW,EAAE,CACpB;iBACA,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,cAAqC;gBACvD,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QAED;;;;;;;;;;WAUG;QACH,KAAK,CAAC,KAAK,CAAc,GAAsB;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAwB,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC7E,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CACH;kEACwD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;;oBAElE,EACV,GAAG,KAAK,CACT;iBACA,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAqB,EAAE,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAI;oBACjC,QAAQ,EAAE;wBACR,KAAK,EAAE,GAAG,CAAC,aAAa;wBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;wBACzD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;qBACpC;oBACD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;oBACzC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;oBAC1C,OAAO;iBACR,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC;oBACP,KAAK,EAAE,GAAG,CAAC,aAAa;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;oBACzD,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAM;oBAC1C,SAAS,EAAE,GAAG,CAAC,UAAU;iBAC1B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/email/index.d.ts

@@ -0,0 +1,75 @@
+/** What a provider needs to send one message. Deliberately small — no attachments, no templates. */
+export interface OutboundEmailV1 {
+    to: string;
+    subject: string;
+    text: string;
+    /** Optional HTML alternative. Providers that cannot send it fall back to `text`. */
+    html?: string;
+    /** Set when this mail continues a conversation, so replies thread in the recipient's mail client. */
+    inReplyTo?: string;
+}
+export interface EmailSendResultV1 {
+    ok: boolean;
+    /** The provider's own id for the message, when it gives one — kept so a thread can cite it. */
+    messageId?: string;
+    error?: string;
+    /** Which provider actually sent it. Recorded, because "the email went" is a different fact per rail. */
+    via?: string;
+}
+/**
+ * THE PORT. One method, and the implementations are leaves.
+ *
+ * `available` is separate from `send` on purpose: a surface must be able to say "email is not set up
+ * here" BEFORE offering somebody an email invitation, rather than accepting the address and failing.
+ */
+export interface EmailSenderPort {
+    readonly name: string;
+    available(): boolean;
+    send(msg: OutboundEmailV1): Promise<EmailSendResultV1>;
+}
+/**
+ * TWO INTEGRATIONS, ONE PORT — the first that is available sends.
+ *
+ * Not a fallback chain (ADR-0013): the order is a DEPLOYMENT PREFERENCE stated once, and a provider that
+ * is configured but fails returns an error rather than handing the message to the next one. Sending the
+ * same mail twice because the first attempt's response was slow is worse than not sending it.
+ */
+export declare function firstAvailableSender(senders: readonly EmailSenderPort[]): EmailSenderPort | null;
+/** An inbound message, already parsed. The adapter does the MIME; this is what the inbox needs. */
+export interface InboundEmailV1 {
+    /** What the mail was sent TO — the only routable fact in it. */
+    to: string;
+    /** What it CLAIMS to be from. Unverified by construction; shown as a claim, never resolved as identity. */
+    from: string;
+    subject: string;
+    text: string;
+    /** Provider message id, for de-duplication and for citing the mail this message came from. */
+    messageId?: string;
+    /** Names only. An attachment is announced, never admitted (rule 4). */
+    attachments?: Array<{
+        name: string;
+        size?: number;
+        contentType?: string;
+    }>;
+}
+/** The handle an address routes to: `alice@faithnet.me` → `alice`. Empty when the zone is not ours. */
+export declare function handleFromAddress(address: string, zones: readonly string[]): string;
+/** Is this a well-formed address at all? Shape only — nothing here says a mailbox exists. */
+export declare function isEmailAddress(v: string): boolean;
+export declare const EMAIL_BODY_LIMIT = 16000;
+/**
+ * An inbound email as the message a thread will hold.
+ *
+ * WHAT IT KEEPS: the words, who it says it is from, what it was about, and what came with it BY NAME.
+ * WHAT IT REFUSES: anything past the cap (truncated, and it says so — a body silently cut in half is a
+ * message that misleads), and every attachment's content.
+ *
+ * The result is deliberately plain text: a thread that renders remote HTML from an unverified sender is
+ * a phishing surface with a nice font.
+ */
+export declare function inboundEmailToMessage(mail: InboundEmailV1): {
+    bodyText: string;
+    subject: string;
+    claimedFrom: string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/email/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAwBA,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC;IACrB,IAAI,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,eAAe,GAAG,IAAI,CAEhG;AAED,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,2GAA2G;IAC3G,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E;AAED,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQnF;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAetH"}

package/dist/email/index.js

@@ -0,0 +1,77 @@
+// EMAIL AS A CHANNEL INTO THE INBOX — spec 365.
+//
+// A person's agent should be reachable by the address they already have, and an email they send or
+// receive should land in the SAME thread as everything else they say to that person. Two mailboxes for
+// one relationship is how half a conversation goes missing.
+//
+// FOUR RULES, and the whole design is these:
+//
+//   1. AN EMAIL IS NOT AUTHORITY (spec 309 §4.2). Inbound mail creates a MESSAGE and can never trigger
+//      an act. Nobody sends an email that moves money; the acts a person can take from a thread are the
+//      ones their own surface offers them, under their own mandate.
+//   2. THE SENDER IS AN UNVERIFIED CLAIM. `From:` is a header anyone can write, so routing is done by
+//      the address the mail was SENT TO (`<handle>@<zone>` → the naming service → an agent), never by
+//      who it says it is from. The claim travels with the message, labelled as a claim.
+//   3. PARSE IN MEMORY, STORE IN THE VAULT (spec 362 §6.2). The raw message is read into a message body
+//      the owner's vault holds and is never written to a serving-plane store — a mailbox is exactly the
+//      kind of durable private record ADR-0055 keeps out of DO storage.
+//   4. BOUNDED, ALWAYS. A body has a size cap and attachments are named, not admitted: an inbox that
+//      accepts whatever arrives is a way to fill somebody's vault from the outside.
+//
+// The SENDER PORT is here and the providers are not: a transport is a leaf binding that depends inward
+// (ADR-0057), and this package must not know whether the deployment sends through an HTTP API or a
+// platform binding.
+/**
+ * TWO INTEGRATIONS, ONE PORT — the first that is available sends.
+ *
+ * Not a fallback chain (ADR-0013): the order is a DEPLOYMENT PREFERENCE stated once, and a provider that
+ * is configured but fails returns an error rather than handing the message to the next one. Sending the
+ * same mail twice because the first attempt's response was slow is worse than not sending it.
+ */
+export function firstAvailableSender(senders) {
+    return senders.find((s) => s.available()) ?? null;
+}
+/** The handle an address routes to: `alice@faithnet.me` → `alice`. Empty when the zone is not ours. */
+export function handleFromAddress(address, zones) {
+    const at = address.trim().toLowerCase();
+    const m = /^([^@\s]+)@([^@\s]+)$/.exec(at);
+    if (!m)
+        return '';
+    const [, local = '', domain = ''] = m;
+    if (!zones.some((z) => domain === z.toLowerCase() || domain.endsWith(`.${z.toLowerCase()}`)))
+        return '';
+    // Plus-addressing is the person's own tag, not part of who they are: `alice+bills@` is alice.
+    return (local.split('+')[0] ?? '').trim();
+}
+/** Is this a well-formed address at all? Shape only — nothing here says a mailbox exists. */
+export function isEmailAddress(v) {
+    return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v.trim());
+}
+export const EMAIL_BODY_LIMIT = 16_000;
+/**
+ * An inbound email as the message a thread will hold.
+ *
+ * WHAT IT KEEPS: the words, who it says it is from, what it was about, and what came with it BY NAME.
+ * WHAT IT REFUSES: anything past the cap (truncated, and it says so — a body silently cut in half is a
+ * message that misleads), and every attachment's content.
+ *
+ * The result is deliberately plain text: a thread that renders remote HTML from an unverified sender is
+ * a phishing surface with a nice font.
+ */
+export function inboundEmailToMessage(mail) {
+    const body = (mail.text ?? '').trim();
+    const truncated = body.length > EMAIL_BODY_LIMIT;
+    const kept = truncated ? `${body.slice(0, EMAIL_BODY_LIMIT)}\n\n[…] this email was longer than ${EMAIL_BODY_LIMIT} characters and the rest was not kept.` : body;
+    const files = (mail.attachments ?? []).filter((a) => a.name);
+    const noted = files.length
+        ? `\n\n${files.length === 1 ? 'It came with a file' : `It came with ${files.length} files`}, which were not saved: ${files.map((f) => f.name).join(', ')}.`
+        : '';
+    return {
+        subject: (mail.subject ?? '').trim() || '(no subject)',
+        claimedFrom: (mail.from ?? '').trim(),
+        // WHO IT SAYS IT IS FROM, said as a claim. A person reading this must not be able to mistake an
+        // email address for a verified identity — that mistake is the whole of email fraud.
+        bodyText: `${kept}${noted}\n\n— sent by email from ${mail.from} (an email address, not a verified agent)`,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/email/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,4DAA4D;AAC5D,EAAE;AACF,6CAA6C;AAC7C,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,oEAAoE;AACpE,sGAAsG;AACtG,sGAAsG;AACtG,wFAAwF;AACxF,wGAAwG;AACxG,wGAAwG;AACxG,wEAAwE;AACxE,qGAAqG;AACrG,oFAAoF;AACpF,EAAE;AACF,uGAAuG;AACvG,mGAAmG;AACnG,oBAAoB;AAkCpB;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAmC;IACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC;AACpD,CAAC;AAgBD,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,KAAwB;IACzE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACxG,8FAA8F;IAC9F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,sCAAsC,gBAAgB,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjK,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM;QACxB,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,MAAM,QAAQ,2BAA2B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC3J,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc;QACtD,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACrC,gGAAgG;QAChG,oFAAoF;QACpF,QAAQ,EAAE,GAAG,IAAI,GAAG,KAAK,4BAA4B,IAAI,CAAC,IAAI,2CAA2C;KAC1G,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -37,4 +37,6 @@ export { buildDeliveryEnvelope, admitDeliveryEnvelope, deliveryToExchangeRecord,
 export type { DeliveryEnvelopeV1, DeliveryAdmission } from './delivery-envelope.js';
 export { emptyInboxData, parseInboxData, hydrateInboxStores, mergeContextRefs, upsertConversation, type InboxDataV1, } from './inbox-doc.js';
 export { RECORD_CATALOG, catalogEntryFor, type RecordCatalogEntry } from './record-catalog.js';
+export { adoptionStage, compareServed, classifyDivergence, shouldShadow, recordDivergence, SHADOW_INTERVAL_MS, DIVERGENCE_BUFFER } from './adoption.js';
+export type { AdoptionConcern, AdoptionStage, AdoptionEntry, AdoptionLedger, Divergence } from './adoption.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIhE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGrG,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACzF,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChG,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC/G,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACjG,YAAY,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAK/F,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAKlH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACpH,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,OAAO,EACL,2BAA2B,EAC3B,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAInC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAKjC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAI1E,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AAGrH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,cAAc,EACd,wBAAwB,EACxB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIpF,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIhE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGrG,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACzF,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChG,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC/G,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACjG,YAAY,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAK/F,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAKlH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACpH,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,OAAO,EACL,2BAA2B,EAC3B,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAInC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAKjC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAI1E,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AAGrH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,cAAc,EACd,wBAAwB,EACxB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIpF,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAI/F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACxJ,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -62,4 +62,7 @@ export { emptyInboxData, parseInboxData, hydrateInboxStores, mergeContextRefs, u
 // The registered record catalog (spec 322 §1) — resource pattern → type tag + ontology binding +
 // classification floor. The catalog, never the resource string, carries the semantics.
 export { RECORD_CATALOG, catalogEntryFor } from './record-catalog.js';
+// ── ADR-0060 / spec 399 §4 — the serving-plane adoption LADDER: ledger types, the rung rule, divergence and sampling.
+// The ledger's VALUES stay with the product whose ops they name.
+export { adoptionStage, compareServed, classifyDivergence, shouldShadow, recordDivergence, SHADOW_INTERVAL_MS, DIVERGENCE_BUFFER } from './adoption.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,sGAAsG;AACtG,oGAAoG;AACpG,8EAA8E;AAC9E,EAAE;AACF,qGAAqG;AACrG,oFAAoF;AAEpF,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAG7B,8FAA8F;AAC9F,oGAAoG;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,6GAA6G;AAC7G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAUzF,0GAA0G;AAC1G,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAQhG,0GAA0G;AAC1G,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAW3B,6FAA6F;AAC7F,sGAAsG;AACtG,0CAA0C;AAC1C,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAS7B,6GAA6G;AAC7G,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,aAAa,EAA2C,MAAM,6BAA6B,CAAC;AAE/G,sGAAsG;AACtG,yFAAyF;AACzF,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGjG,mGAAmG;AACnG,kGAAkG;AAClG,yFAAyF;AACzF,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,mGAAmG;AACnG,qGAAqG;AACrG,gEAAgE;AAChE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGpH,oGAAoG;AACpG,4EAA4E;AAC5E,OAAO,EACL,2BAA2B,EAC3B,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAOlC,oGAAoG;AACpG,iGAAiG;AACjG,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAkBnC,mGAAmG;AACnG,gGAAgG;AAChG,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAajC,uGAAuG;AACvG,sGAAsG;AACtG,iFAAiF;AACjF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAGzF,oGAAoG;AACpG,0GAA0G;AAC1G,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,yCAAyC,CAAC;AAGjD,wGAAwG;AACxG,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAU/B,2GAA2G;AAC3G,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAG9B,sFAAsF;AACtF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAGhC,mGAAmG;AACnG,yFAAyF;AACzF,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AAExB,iGAAiG;AACjG,uFAAuF;AACvF,OAAO,EAAE,cAAc,EAAE,eAAe,EAA2B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,sGAAsG;AACtG,oGAAoG;AACpG,8EAA8E;AAC9E,EAAE;AACF,qGAAqG;AACrG,oFAAoF;AAEpF,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAG7B,8FAA8F;AAC9F,oGAAoG;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,6GAA6G;AAC7G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAUzF,0GAA0G;AAC1G,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAQhG,0GAA0G;AAC1G,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAW3B,6FAA6F;AAC7F,sGAAsG;AACtG,0CAA0C;AAC1C,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAS7B,6GAA6G;AAC7G,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,aAAa,EAA2C,MAAM,6BAA6B,CAAC;AAE/G,sGAAsG;AACtG,yFAAyF;AACzF,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGjG,mGAAmG;AACnG,kGAAkG;AAClG,yFAAyF;AACzF,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,mGAAmG;AACnG,qGAAqG;AACrG,gEAAgE;AAChE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGpH,oGAAoG;AACpG,4EAA4E;AAC5E,OAAO,EACL,2BAA2B,EAC3B,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAOlC,oGAAoG;AACpG,iGAAiG;AACjG,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAkBnC,mGAAmG;AACnG,gGAAgG;AAChG,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAajC,uGAAuG;AACvG,sGAAsG;AACtG,iFAAiF;AACjF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAGzF,oGAAoG;AACpG,0GAA0G;AAC1G,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,yCAAyC,CAAC;AAGjD,wGAAwG;AACxG,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAU/B,2GAA2G;AAC3G,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAG9B,sFAAsF;AACtF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAGhC,mGAAmG;AACnG,yFAAyF;AACzF,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AAExB,iGAAiG;AACjG,uFAAuF;AACvF,OAAO,EAAE,cAAc,EAAE,eAAe,EAA2B,MAAM,qBAAqB,CAAC;AAE/F,uHAAuH;AACvH,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC"}

package/dist/interactions/grant-scopes.d.ts

@@ -0,0 +1,21 @@
+/** Ops the record-scope gate distinguishes: a tombstone (`delete`) is a DISTINCT op from `write`. */
+export type RecordScopeOp = 'read' | 'write' | 'delete';
+/** A group of resources granted the same ops, before a server is named. */
+export interface RecordScopeSpec {
+    resources: ReadonlyArray<string>;
+    ops: ReadonlyArray<RecordScopeOp>;
+}
+/** One group bound to an MCP server — structurally the delegation package's `VaultRecordScopeGrant`, so it
+ *  feeds `buildVaultRecordScopeCaveat` directly; fabric does not depend on delegation (ADR-0047 boundary). */
+export interface RecordScopeGroup {
+    server: string;
+    resources: string[];
+    ops: RecordScopeOp[];
+}
+export declare const INTERACTIONS_GRANT_CORE_SCOPES: ReadonlyArray<RecordScopeSpec>;
+/**
+ * The grant's scope groups for one MCP server: the core, then the product's extensions (its own app
+ * namespaces — read-only for the agent's grounding, read+write for steward seeding), in that order.
+ */
+export declare function interactionsGrantScopes(server: string, extensions?: ReadonlyArray<RecordScopeSpec>): RecordScopeGroup[];
+//# sourceMappingURL=grant-scopes.d.ts.map

package/dist/interactions/grant-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-scopes.d.ts","sourceRoot":"","sources":["../../src/interactions/grant-scopes.ts"],"names":[],"mappings":"AAgBA,qGAAqG;AACrG,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExD,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAAG,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAAE;AAExG;8GAC8G;AAC9G,MAAM,WAAW,gBAAgB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,aAAa,EAAE,CAAA;CAAE;AAE/F,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC,eAAe,CA8BzE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,GAAE,aAAa,CAAC,eAAe,CAAM,GAAG,gBAAgB,EAAE,CAE3H"}

package/dist/interactions/grant-scopes.js

@@ -0,0 +1,39 @@
+export const INTERACTIONS_GRANT_CORE_SCOPES = [
+    { resources: [
+            'vault:conversation.index', 'vault:conversation.topic:*', 'vault:message.body:topic:*',
+            'vault:inbox.data', 'vault:directory.data', 'vault:relationships.data', 'vault:member.profile:*',
+            'vault:org.membership:*', 'vault:org.applications', 'vault:impact-profile', 'vault:capabilities.data',
+            'vault:skills.data', 'vault:home.manifest', 'vault:control-events.data', 'vault:coordination.requests',
+            'vault:coordination.index', 'vault:coordination.endeavor:*', 'vault:content.*',
+            'vault:resolution.requests', 'vault:resolution.grants', 'vault:archetype.assignment', 'vault:payment.receipt:*',
+            'vault:household.data',
+            // Spec 370 P7 — the person's own recent asks, so "him" can mean whom they just meant.
+            'vault:conversation.recent',
+            // Spec 381 — a run's provenance, kept where the authority was spent (the DO copy is the rebuild).
+            'vault:run.provenance:*',
+            // Spec 391 — a step's raw result, too large for the run's record, kept where the run ran.
+            'vault:run.artifact:*',
+            // Spec 385 — the person's scoped confirmation memory (which "David", per word + capability + argument).
+            'vault:confirmation.preferences',
+            // Spec 394 — the person's standing instructions (a declared default per room + capability + argument).
+            'vault:standing.instructions',
+        ], ops: ['read', 'write'] },
+    // Spec 354 K3 — the PLAYBOOK may also be REMOVED, which is a real custodial act: an agent goes back to the
+    // bare harness. A tombstone is a DISTINCT op at the record-scope gate (spec 317 §3.2 / audit F1 — a
+    // write-only delegate must not be able to censor records), so the broad bucket above cannot express it.
+    { resources: ['vault:archetype.assignment'], ops: ['read', 'write', 'delete'] },
+    // Spec 322 W3f — dm bodies are READ-only here: the DO serves the owner's mail reads, while only the
+    // (write-only) delivery plane may create them. Planes stay disjoint on writes.
+    { resources: ['vault:message.body:dm:*'], ops: ['read'] },
+    // The org's own invitations, read-only — what makes membership-read's invited-member path live. Writes
+    // stay on the delivery plane.
+    { resources: ['vault:org.invite:*'], ops: ['read'] },
+];
+/**
+ * The grant's scope groups for one MCP server: the core, then the product's extensions (its own app
+ * namespaces — read-only for the agent's grounding, read+write for steward seeding), in that order.
+ */
+export function interactionsGrantScopes(server, extensions = []) {
+    return [...INTERACTIONS_GRANT_CORE_SCOPES, ...extensions].map((g) => ({ server, resources: [...g.resources], ops: [...g.ops] }));
+}
+//# sourceMappingURL=grant-scopes.js.map

package/dist/interactions/grant-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-scopes.js","sourceRoot":"","sources":["../../src/interactions/grant-scopes.ts"],"names":[],"mappings":"AA0BA,MAAM,CAAC,MAAM,8BAA8B,GAAmC;IAC5E,EAAE,SAAS,EAAE;YACX,0BAA0B,EAAE,4BAA4B,EAAE,4BAA4B;YACtF,kBAAkB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,wBAAwB;YAChG,wBAAwB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,yBAAyB;YACrG,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,6BAA6B;YACtG,0BAA0B,EAAE,+BAA+B,EAAE,iBAAiB;YAC9E,2BAA2B,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,yBAAyB;YAC/G,sBAAsB;YACtB,sFAAsF;YACtF,2BAA2B;YAC3B,kGAAkG;YAClG,wBAAwB;YACxB,0FAA0F;YAC1F,sBAAsB;YACtB,wGAAwG;YACxG,gCAAgC;YAChC,uGAAuG;YACvG,6BAA6B;SAC9B,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAC3B,2GAA2G;IAC3G,oGAAoG;IACpG,wGAAwG;IACxG,EAAE,SAAS,EAAE,CAAC,4BAA4B,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC/E,oGAAoG;IACpG,+EAA+E;IAC/E,EAAE,SAAS,EAAE,CAAC,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE;IACzD,uGAAuG;IACvG,8BAA8B;IAC9B,EAAE,SAAS,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE;CACrD,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,aAA6C,EAAE;IACrG,OAAO,CAAC,GAAG,8BAA8B,EAAE,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACnI,CAAC"}

package/dist/interactions/index.d.ts

@@ -12,4 +12,5 @@ export { type PresentationDefinitionRef, type CredentialFormat, type PermissionT
 export { type DataSensitivity, type ActionRiskMetadataV1, type RiskDisposition, type RiskEvaluationOpts, type RiskEvaluation, evaluateActionRisk, } from './risk.js';
 export { type ActionCardKind, type ActionDescriptorV1, type ActionCardV1, type CardValidationError, validateActionCard, } from './cards.js';
 export { type InteractionExchangeRecordV1, buildExchangeRecord, type RelationshipExchangePort, } from './relationship.js';
+export { INTERACTIONS_GRANT_CORE_SCOPES, interactionsGrantScopes, type RecordScopeOp, type RecordScopeSpec, type RecordScopeGroup, } from './grant-scopes.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/interactions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/interactions/index.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,YAAY,2CAA2C,CAAC;AACrE,eAAO,MAAM,cAAc,EAAG,qBAA8B,CAAC;AAC7D,eAAO,MAAM,QAAQ,4CAA4C,CAAC;AAElE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,WAAW,EACX,OAAO,GACR,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,KAAK,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,KAAK,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE3F,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,sBAAsB,EACtB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,iCAAiC,GAClC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,KAAK,wBAAwB,GAC9B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/interactions/index.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,YAAY,2CAA2C,CAAC;AACrE,eAAO,MAAM,cAAc,EAAG,qBAA8B,CAAC;AAC7D,eAAO,MAAM,QAAQ,4CAA4C,CAAC;AAElE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,WAAW,EACX,OAAO,GACR,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,KAAK,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,KAAK,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE3F,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,sBAAsB,EACtB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,iCAAiC,GAClC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,KAAK,wBAAwB,GAC9B,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/interactions/index.js

@@ -20,4 +20,7 @@ export { createPermissionTicket, isTicketExpired, checkPresentationAnswersChalle
 export { evaluateActionRisk, } from './risk.js';
 export { validateActionCard, } from './cards.js';
 export { buildExchangeRecord, } from './relationship.js';
+// The interactions grant's record scopes — one list the Home (issuing the grant) and the agent runtime
+// (a chartered child's genesis planes) both compose from; the product appends its own namespaces.
+export { INTERACTIONS_GRANT_CORE_SCOPES, interactionsGrantScopes, } from './grant-scopes.js';
 //# sourceMappingURL=index.js.map