@canonmsg/backend-contracts 5.0.0 → 5.2.0

package/README.md

@@ -16,7 +16,7 @@ Node.js 18+. Ships both ESM and CommonJS builds — Cloud Functions consume the
 
 ## What is in it
 
-**The verb contract.** `canon.verbs.v1` (`verbContract.ts`) is the plaintext *intent* schema — sixteen verbs, their input and result schemas, byte limits, and rate limits. `canon.verb-wire.v1` (`verbWire.ts`) is what actually crosses the network: a server-readable envelope plus a body that is either `{ encoding: 'json', value }` or `{ encoding: 'mls', … }`. `projectVerbIntentToWire` and `mergeVerbWireToIntent` are the two halves of that split, so bindings and the server never disagree about which fields are envelope and which are content.
+**The verb contract.** `canon.verbs.v1` (`verbContract.ts`) is the plaintext *intent* schema — seventeen verbs, their input and result schemas, byte limits, and rate limits. `canon.verb-wire.v1` (`verbWire.ts`) is what actually crosses the network: a server-readable envelope plus a body that is either `{ encoding: 'json', value }` or `{ encoding: 'mls', … }`. `projectVerbIntentToWire` and `mergeVerbWireToIntent` are the two halves of that split, so bindings and the server never disagree about which fields are envelope and which are content.
 
 ```ts
 import {
@@ -34,6 +34,8 @@ The JSON Schemas are also emitted as files for non-JavaScript consumers: `@canon
 
 **Behavior policy and contact requests.** The participation evaluator the stream service runs before dispatching a turn, and the contact-request serializer both sides validate against.
 
+**Server-side normalizers.** `readCanonicalPolicy` resolves a stored `inboundPolicy` / `groupJoinPolicy` field to the access triplet's three values, defaulting to `approval-required` rather than widening to `open`. `serializeSelfContext` is the agent-facing projection of a stored self-context. `readModerationStatus` is the single definition of an ejected account. All take plain document-shaped data — the package still performs no I/O.
+
 **Environments.** `CANON_ENVIRONMENT_CONTRACTS` binds `canon-dev-v1` and `canon-prod-v1` to their project and region; `getCanonEnvironmentContract` rejects anything else rather than defaulting.
 
 **Diff redaction.** Approval diffs carry pre-image context into a message every conversation member can read, so secret-shaped paths and tokens are suppressed before send — by the emitting host, and again defensively by the server.

package/dist/accessPolicy.d.ts

@@ -0,0 +1,9 @@
+/** The canonical access triplet's policy values (`inboundPolicy`, `groupJoinPolicy`). */
+export type CanonicalPolicy = 'open' | 'approval-required' | 'owner-only';
+/**
+ * Read a stored policy field, defaulting to the value Canon assigns on account
+ * creation. Anything unrecognized — missing, misspelled, or the retired
+ * `'private'` enum — reads as 'approval-required'. This must never widen to
+ * 'open'.
+ */
+export declare function readCanonicalPolicy(value: unknown): CanonicalPolicy;

package/dist/accessPolicy.js

@@ -0,0 +1,12 @@
+/**
+ * Read a stored policy field, defaulting to the value Canon assigns on account
+ * creation. Anything unrecognized — missing, misspelled, or the retired
+ * `'private'` enum — reads as 'approval-required'. This must never widen to
+ * 'open'.
+ */
+export function readCanonicalPolicy(value) {
+    if (value === 'open' || value === 'approval-required' || value === 'owner-only') {
+        return value;
+    }
+    return 'approval-required';
+}

package/dist/agentBehaviorPolicy.d.ts

@@ -1,4 +1,13 @@
+/** Conversation scope a policy is resolved for. Absent means "agent scope". */
+export type PolicyConversationType = 'direct' | 'group' | 'unknown';
 export type ParticipationStyle = 'natural' | 'collaborative' | 'mention-first' | 'approval-gated' | 'handoff-only' | 'observer';
+/**
+ * The stored/parsed shape. This is the RETURN type of
+ * {@link parseAgentBehaviorSettings} and {@link normalizeStoredAgentBehaviorPolicy},
+ * so its optional fields deliberately stay `T | undefined` — widening them to
+ * `T | null` would be a breaking change for every reader of those results.
+ * Parameter positions take {@link AgentBehaviorSettingsInput} instead.
+ */
 export interface AgentBehaviorSettingsRecord {
     participationStyle?: ParticipationStyle;
     allowAgentToAgent?: boolean;
@@ -7,15 +16,30 @@ export interface AgentBehaviorSettingsRecord {
     maxConsecutiveAgentTurns?: number | null;
     instructions?: string | null;
 }
+/**
+ * The input shape accepted by {@link resolveAgentBehaviorPolicy}. Every field
+ * additionally accepts an explicit `null` (an editor clearing a value), which
+ * coalesces exactly like `undefined` — the field falls through to the next
+ * layer. {@link AgentBehaviorSettingsRecord} is assignable to this type.
+ */
+export interface AgentBehaviorSettingsInput {
+    participationStyle?: ParticipationStyle | null;
+    allowAgentToAgent?: boolean | null;
+    allowLongRunningCollaboration?: boolean | null;
+    requireMentionForGroupReplies?: boolean | null;
+    maxConsecutiveAgentTurns?: number | null;
+    instructions?: string | null;
+}
+export interface ParticipationPolicy {
+    style: ParticipationStyle;
+    allowAgentToAgent: boolean;
+    allowHumanToAgent: boolean;
+    allowLongRunningCollaboration: boolean;
+    requireMentionForGroupReplies: boolean;
+    maxConsecutiveAgentTurns?: number | null;
+}
 export interface ResolvedAgentBehaviorPolicyRecord {
-    participation: {
-        style: ParticipationStyle;
-        allowAgentToAgent: boolean;
-        allowHumanToAgent: boolean;
-        allowLongRunningCollaboration: boolean;
-        requireMentionForGroupReplies: boolean;
-        maxConsecutiveAgentTurns?: number | null;
-    };
+    participation: ParticipationPolicy;
     instructions: string[];
     source: {
         hasAgentDefault: boolean;
@@ -23,15 +47,27 @@ export interface ResolvedAgentBehaviorPolicyRecord {
     };
 }
 export interface ParticipationDecisionInput {
-    conversationType: 'direct' | 'group' | 'unknown';
+    conversationType: PolicyConversationType;
     senderType: 'human' | 'ai_agent';
     isOwner: boolean;
     mentionedAgent: boolean;
     recentHumanCount?: number;
+    /**
+     * Consecutive agent turns already in the streak, NOT counting the message
+     * being evaluated. The message itself adds one more when its sender is an
+     * agent, and a delivery would add a further one — see the turn-cap check in
+     * {@link evaluateParticipationPolicy}.
+     */
     consecutiveAgentTurns?: number;
     currentAgentStreakStartedByHuman?: boolean;
 }
+export interface ParticipationDecision {
+    allow: boolean;
+    reasonCode: string;
+    reason: string;
+}
 export interface ParticipationHistoryMessage {
+    id?: string;
     senderId: string;
     senderType: 'human' | 'ai_agent';
     metadata?: unknown;
@@ -44,16 +80,51 @@ export interface ParticipationHistorySnapshot {
     currentAgentStreakStartedByHuman: boolean;
 }
 export declare const PARTICIPATION_HISTORY_FETCH_LIMIT = 50;
+/**
+ * Safety backstop for groups with no explicit turn cap: at most this many
+ * consecutive agent turns before a human has to speak again.
+ *
+ * This is a backstop, not the steering wheel — agents are expected to stop on
+ * their own. Direct conversations deliberately stay unlimited: only a non-agent
+ * message resets the streak, so a default cap in a pure agent-to-agent DM would
+ * halt the room permanently instead of merely bounding a loop.
+ *
+ * The same caveat applies to the one group shape this default does cover: a
+ * group whose members are all agents (reachable — agent-created groups need no
+ * human member) has nothing that resets the streak, so it stops auto-replying
+ * for good once the cap is reached. That is deliberate: an unattended room is
+ * where a runaway loop is most expensive. Recovery needs a human member — the
+ * per-conversation `null` opt-out is writable only by a group owner or admin,
+ * who must be a member. Teaching the resolver "does this room contain a
+ * human?" would mean loading member types at every resolution site, including
+ * the stream gate, which does not read them today.
+ */
+export declare const DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS = 4;
 export declare function parseAgentBehaviorSettings(raw: unknown): AgentBehaviorSettingsRecord;
 export declare function normalizeStoredAgentBehaviorPolicy(raw: Record<string, unknown> | undefined): AgentBehaviorSettingsRecord | null;
 export declare function normalizeAgentBehaviorInstructions(value: string | null | undefined): string | null;
+/**
+ * The scope-independent participation defaults. `maxConsecutiveAgentTurns` is
+ * `null` here because the turn cap is scope-dependent — a group with no stored
+ * setting resolves to {@link DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS}. Use
+ * {@link resolveAgentBehaviorPolicy} with a `conversationType` to learn what a
+ * given conversation actually enforces.
+ */
+export declare function getDefaultParticipationPolicy(): ParticipationPolicy;
+/**
+ * Coalesce agent defaults and a conversation override into the resolved record
+ * every runtime reads. `conversationType` selects the Canon-wide fallbacks that
+ * differ per scope — today only the turn cap, which defaults to
+ * {@link DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS} in groups and to unlimited
+ * everywhere else. Omit it when resolving for the agent scope (no conversation);
+ * an absent or unknown type always resolves to the unlimited default, so a call
+ * site that forgets to thread it can never invent a cap.
+ */
 export declare function resolveAgentBehaviorPolicy(params?: {
-    agentDefault?: AgentBehaviorSettingsRecord | null;
-    conversationOverride?: AgentBehaviorSettingsRecord | null;
+    agentDefault?: AgentBehaviorSettingsInput | null;
+    conversationOverride?: AgentBehaviorSettingsInput | null;
+    conversationType?: PolicyConversationType;
 }): ResolvedAgentBehaviorPolicyRecord;
 export declare function buildParticipationHistorySnapshot(messages: ParticipationHistoryMessage[], agentId?: string): ParticipationHistorySnapshot;
 export declare function appendParticipationHistoryMessage(snapshot: ParticipationHistorySnapshot, message: ParticipationHistoryMessage, limit?: number): ParticipationHistorySnapshot;
-export declare function evaluateParticipationPolicy(policy: ResolvedAgentBehaviorPolicyRecord, input: ParticipationDecisionInput): {
-    allow: boolean;
-    reason: string;
-};
+export declare function evaluateParticipationPolicy(policy: ResolvedAgentBehaviorPolicyRecord | null | undefined, input: ParticipationDecisionInput): ParticipationDecision;

package/dist/agentBehaviorPolicy.js

@@ -1,5 +1,30 @@
-import { resolveTurnMessageSemantics } from './turnProtocol.js';
+import { shouldTriggerAgentTurn } from './turnProtocol.js';
 export const PARTICIPATION_HISTORY_FETCH_LIMIT = 50;
+/**
+ * Safety backstop for groups with no explicit turn cap: at most this many
+ * consecutive agent turns before a human has to speak again.
+ *
+ * This is a backstop, not the steering wheel — agents are expected to stop on
+ * their own. Direct conversations deliberately stay unlimited: only a non-agent
+ * message resets the streak, so a default cap in a pure agent-to-agent DM would
+ * halt the room permanently instead of merely bounding a loop.
+ *
+ * The same caveat applies to the one group shape this default does cover: a
+ * group whose members are all agents (reachable — agent-created groups need no
+ * human member) has nothing that resets the streak, so it stops auto-replying
+ * for good once the cap is reached. That is deliberate: an unattended room is
+ * where a runaway loop is most expensive. Recovery needs a human member — the
+ * per-conversation `null` opt-out is writable only by a group owner or admin,
+ * who must be a member. Teaching the resolver "does this room contain a
+ * human?" would mean loading member types at every resolution site, including
+ * the stream gate, which does not read them today.
+ */
+export const DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS = 4;
+function defaultMaxConsecutiveAgentTurns(conversationType) {
+    return conversationType === 'group'
+        ? DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS
+        : null;
+}
 const VALID_PARTICIPATION_STYLES = new Set([
     'natural',
     'collaborative',
@@ -119,6 +144,25 @@ export function normalizeAgentBehaviorInstructions(value) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : null;
 }
+/**
+ * The scope-independent participation defaults. `maxConsecutiveAgentTurns` is
+ * `null` here because the turn cap is scope-dependent — a group with no stored
+ * setting resolves to {@link DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS}. Use
+ * {@link resolveAgentBehaviorPolicy} with a `conversationType` to learn what a
+ * given conversation actually enforces.
+ */
+export function getDefaultParticipationPolicy() {
+    return { ...DEFAULT_POLICY.participation };
+}
+/**
+ * Coalesce agent defaults and a conversation override into the resolved record
+ * every runtime reads. `conversationType` selects the Canon-wide fallbacks that
+ * differ per scope — today only the turn cap, which defaults to
+ * {@link DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS} in groups and to unlimited
+ * everywhere else. Omit it when resolving for the agent scope (no conversation);
+ * an absent or unknown type always resolves to the unlimited default, so a call
+ * site that forgets to thread it can never invent a cap.
+ */
 export function resolveAgentBehaviorPolicy(params) {
     const agentDefault = params?.agentDefault ?? null;
     const conversationOverride = params?.conversationOverride ?? null;
@@ -137,7 +181,7 @@ export function resolveAgentBehaviorPolicy(params) {
                 ? conversationOverride.maxConsecutiveAgentTurns ?? null
                 : agentDefault?.maxConsecutiveAgentTurns !== undefined
                     ? agentDefault.maxConsecutiveAgentTurns ?? null
-                    : DEFAULT_POLICY.participation.maxConsecutiveAgentTurns,
+                    : defaultMaxConsecutiveAgentTurns(params?.conversationType),
         },
         instructions: [
             ...(defaultInstructions ? [defaultInstructions] : []),
@@ -149,14 +193,22 @@ export function resolveAgentBehaviorPolicy(params) {
         },
     };
 }
+/**
+ * The streak counts exactly the agent messages that can trigger another agent —
+ * the only messages a loop can be built from. Reusing the trigger gate keeps the
+ * two in lockstep: it admits `control` messages that do not suppress auto-reply
+ * (hand-crafted runtime metadata can otherwise drive an uncounted loop) and
+ * still drops chunk parts, interim progress, card round-trips and media/failure
+ * notices, none of which trigger anyone and none of which should burn a slot.
+ */
 function toHistorySenderType(message) {
     if (message.senderType !== 'ai_agent') {
         return 'human';
     }
-    return resolveTurnMessageSemantics({
-        senderType: message.senderType,
+    return shouldTriggerAgentTurn({
+        senderType: 'ai_agent',
         metadata: message.metadata,
-    }) === 'turn_complete'
+    }).allow
         ? 'ai_agent'
         : null;
 }
@@ -195,37 +247,71 @@ export function appendParticipationHistoryMessage(snapshot, message, limit = PAR
     ].slice(0, limit));
 }
 export function evaluateParticipationPolicy(policy, input) {
-    const consecutiveAgentTurns = Math.max(input.consecutiveAgentTurns ?? (input.senderType === 'ai_agent' ? 1 : 0), input.senderType === 'ai_agent' ? 1 : 0);
+    const resolved = policy ?? resolveAgentBehaviorPolicy({ conversationType: input.conversationType });
+    const participation = resolved.participation;
+    const priorAgentTurns = Math.max(input.consecutiveAgentTurns ?? 0, 0);
+    /** Streak length once the message being evaluated is counted. */
+    const agentTurnsWithCurrent = priorAgentTurns
+        + (input.senderType === 'ai_agent' ? 1 : 0);
+    /**
+     * The long-running-collaboration brake reads "more than the current turn",
+     * so it keeps its historical floor rather than the exact streak length.
+     */
+    const consecutiveAgentTurns = Math.max(priorAgentTurns, input.senderType === 'ai_agent' ? 1 : 0);
     const currentAgentStreakStartedByHuman = input.currentAgentStreakStartedByHuman === true;
     if (input.conversationType === 'group'
-        && policy.participation.requireMentionForGroupReplies
+        && participation.requireMentionForGroupReplies
         && !input.mentionedAgent) {
         return {
             allow: false,
+            reasonCode: 'group_mention_required',
             reason: 'group replies require a direct mention',
         };
     }
     if (input.isOwner) {
-        return { allow: true, reason: 'owner messages pass through outside mention-required group turns' };
+        return {
+            allow: true,
+            reasonCode: 'owner_sender',
+            reason: 'owner messages pass through outside mention-required group turns',
+        };
     }
     if (input.senderType !== 'ai_agent') {
-        return { allow: true, reason: 'latest sender is human' };
+        return { allow: true, reasonCode: 'human_sender', reason: 'latest sender is human' };
     }
-    if (!policy.participation.allowAgentToAgent) {
-        return { allow: false, reason: 'agent-to-agent participation disabled by policy' };
+    if (!participation.allowAgentToAgent) {
+        return {
+            allow: false,
+            reasonCode: 'agent_to_agent_disabled',
+            reason: 'agent-to-agent participation is disabled by policy',
+        };
     }
-    if (!policy.participation.allowLongRunningCollaboration
+    if (!participation.allowLongRunningCollaboration
         && (consecutiveAgentTurns > 1
             || !currentAgentStreakStartedByHuman)) {
         return {
             allow: false,
+            reasonCode: 'human_reset_required',
             reason: 'a fresh human steer is required before continuing agent collaboration',
         };
     }
-    if (typeof policy.participation.maxConsecutiveAgentTurns === 'number'
-        && policy.participation.maxConsecutiveAgentTurns >= 0
-        && consecutiveAgentTurns > policy.participation.maxConsecutiveAgentTurns) {
-        return { allow: false, reason: 'maximum consecutive agent turns reached' };
+    // `maxConsecutiveAgentTurns: N` means at most N consecutive agent turns
+    // without a human in between. Delivering this message triggers turn
+    // `agentTurnsWithCurrent + 1`, so it is suppressed as soon as the streak has
+    // already reached N.
+    if (typeof participation.maxConsecutiveAgentTurns === 'number'
+        && participation.maxConsecutiveAgentTurns >= 0
+        && agentTurnsWithCurrent >= participation.maxConsecutiveAgentTurns) {
+        return {
+            allow: false,
+            reasonCode: 'agent_turn_limit_reached',
+            reason: 'maximum consecutive agent turns reached',
+        };
     }
-    return { allow: true, reason: 'agent-to-agent participation allowed by policy' };
+    return {
+        allow: true,
+        reasonCode: input.conversationType === 'group' ? 'group_agent_allowed' : 'direct_agent_allowed',
+        reason: participation.requireMentionForGroupReplies
+            ? 'policy allows this directly mentioned group reply'
+            : 'agent-to-agent participation allowed by policy',
+    };
 }

package/dist/agentSearch.d.ts

@@ -0,0 +1,17 @@
+/** The indexable fields a stored agent contributes to `searchPrefixes`. */
+export interface AgentSearchIndexFields {
+    displayName?: string | null;
+    description?: string | null;
+}
+/** The agent shape a directory filter reads. */
+export interface AgentSearchProfile {
+    displayName?: string | null;
+    agentConfig?: {
+        description?: string | null;
+    } | null;
+}
+/** Tolerant: non-string input normalises to ''. */
+export declare function normalizeAgentDirectoryQuery(value: unknown): string;
+export declare function getAgentDirectoryQueryTokens(query: string): string[];
+export declare function buildAgentSearchPrefixes(input: AgentSearchIndexFields): string[];
+export declare function matchesAgentSearchQuery(profile: AgentSearchProfile, query: string): boolean;

package/dist/agentSearch.js

@@ -0,0 +1,58 @@
+// The single agent-directory search implementation, shared by Cloud Functions
+// (which writes `users/{agentId}.searchPrefixes` and filters discovery reads)
+// and `@canonmsg/chat-domain` (which filters the same agents client-side in the
+// app and on web). The server index and the client filter must agree, so both
+// sides derive from these bodies rather than from hand-synced copies.
+//
+// Pure ECMAScript: no imports, no Node built-ins, no Firestore types — safe in
+// CJS, in the browser bundle, and on Hermes.
+const MAX_QUERY_LENGTH = 64;
+const MAX_TOKEN_PREFIX_LENGTH = 32;
+const MAX_SEARCH_PREFIXES = 256;
+const TOKEN_PATTERN = /[\p{L}\p{N}]+/gu;
+function tokenizeAgentSearchValue(value) {
+    const normalized = value
+        .normalize('NFKD')
+        .toLowerCase()
+        .trim();
+    return normalized.match(TOKEN_PATTERN) ?? [];
+}
+/** Tolerant: non-string input normalises to ''. */
+export function normalizeAgentDirectoryQuery(value) {
+    if (typeof value !== 'string')
+        return '';
+    return tokenizeAgentSearchValue(value).join(' ').slice(0, MAX_QUERY_LENGTH);
+}
+export function getAgentDirectoryQueryTokens(query) {
+    return tokenizeAgentSearchValue(query).map((token) => token.slice(0, MAX_QUERY_LENGTH));
+}
+export function buildAgentSearchPrefixes(input) {
+    const seen = new Set();
+    for (const token of tokenizeAgentSearchValue([input.displayName, input.description].filter(Boolean).join(' '))) {
+        const normalizedToken = token.slice(0, MAX_QUERY_LENGTH);
+        const prefixLength = Math.min(normalizedToken.length, MAX_TOKEN_PREFIX_LENGTH);
+        for (let index = 1; index <= prefixLength; index += 1) {
+            seen.add(normalizedToken.slice(0, index));
+            if (seen.size >= MAX_SEARCH_PREFIXES) {
+                return [...seen];
+            }
+        }
+        if (normalizedToken.length > MAX_TOKEN_PREFIX_LENGTH) {
+            seen.add(normalizedToken);
+            if (seen.size >= MAX_SEARCH_PREFIXES) {
+                return [...seen];
+            }
+        }
+    }
+    return [...seen];
+}
+export function matchesAgentSearchQuery(profile, query) {
+    const tokens = getAgentDirectoryQueryTokens(query);
+    if (tokens.length === 0)
+        return true;
+    const prefixes = new Set(buildAgentSearchPrefixes({
+        displayName: profile.displayName,
+        description: profile.agentConfig?.description,
+    }));
+    return tokens.every((token) => prefixes.has(token));
+}

package/dist/canon-verb-wire.schema.json

@@ -32,7 +32,8 @@
         "leave_conversation",
         "list_contacts",
         "list_contact_requests",
-        "list_conversations"
+        "list_conversations",
+        "no_reply"
       ]
     },
     "envelope": {
@@ -506,7 +507,8 @@
             "leave_conversation",
             "list_contacts",
             "list_contact_requests",
-            "list_conversations"
+            "list_conversations",
+            "no_reply"
           ]
         },
         "result": {

package/dist/canon-verbs.limits.json

@@ -45,7 +45,8 @@
     "maxApprovalTimeoutMs": 259200000,
     "turnIdChars": 128,
     "reactionEmojiChars": 64,
-    "groupNameChars": 100
+    "groupNameChars": 100,
+    "noReplyReasonChars": 500
   },
   "rateLimits": {
     "senderMessagesPer5Min": 300,

package/dist/canon-verbs.schema.json

@@ -1891,6 +1891,40 @@
           }
         }
       }
+    },
+    "no_reply_input": {
+      "type": "object",
+      "description": "End this turn without posting anything to the conversation. Nothing is rendered and no other member or agent is triggered.",
+      "additionalProperties": false,
+      "properties": {
+        "conversationId": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_.:-]{1,160}$"
+        },
+        "reason": {
+          "type": "string",
+          "maxLength": 500,
+          "description": "Never rendered; logged only."
+        }
+      }
+    },
+    "no_reply_result": {
+      "type": "object",
+      "required": [
+        "status"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "status": {
+          "const": "acknowledged"
+        },
+        "conversationId": {
+          "type": "string"
+        },
+        "note": {
+          "type": "string"
+        }
+      }
     }
   }
 }

package/dist/cjs/accessPolicy.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readCanonicalPolicy = readCanonicalPolicy;
+/**
+ * Read a stored policy field, defaulting to the value Canon assigns on account
+ * creation. Anything unrecognized — missing, misspelled, or the retired
+ * `'private'` enum — reads as 'approval-required'. This must never widen to
+ * 'open'.
+ */
+function readCanonicalPolicy(value) {
+    if (value === 'open' || value === 'approval-required' || value === 'owner-only') {
+        return value;
+    }
+    return 'approval-required';
+}