@casimesh/contracts 0.1.0 → 0.2.0

package/index.js

@@ -27,7 +27,10 @@ var ID_PREFIX = {
   principal: "prn",
   roleBinding: "rol",
   apiKey: "key",
-  task: "tsk"
+  task: "tsk",
+  token: "tok",
+  audit: "aud",
+  revocation: "rev"
 };
 var ULID_PATTERN = "[0-9A-HJKMNP-TV-Z]{26}";
 var prefixedId = (kind) => z.string().regex(new RegExp(`^${ID_PREFIX[kind]}_${ULID_PATTERN}$`), `Expected a ${kind} id (${ID_PREFIX[kind]}_<ULID>)`).meta({ description: `${kind} identifier`, example: `${ID_PREFIX[kind]}_01J9Z3K7Q8R5T2V4W6X8Y0A1B2` });
@@ -40,6 +43,10 @@ var CommandId = prefixedId("command");
 var PrincipalId = prefixedId("principal");
 var RoleBindingId = prefixedId("roleBinding");
 var TaskId = prefixedId("task");
+var TokenId = prefixedId("token");
+var AuditId = prefixedId("audit");
+var RevocationId = prefixedId("revocation");
+var ApiKeyId = prefixedId("apiKey");
 
 // src/agent.ts
 var AgentKind = z.enum(["standard", "mesh"]);
@@ -70,6 +77,53 @@ var UpdateAgentRequest = z.object({
   model: z.string().max(100).nullable().optional(),
   metadata: Metadata.optional()
 }).refine((body) => Object.keys(body).length > 0, "At least one field must be provided").meta({ id: "UpdateAgentRequest" });
+var AuditKind = z.enum([
+  "authorization",
+  "authentication",
+  "credential",
+  "principal",
+  "policy",
+  "replication"
+]);
+var AuditOutcome = z.enum(["allowed", "denied", "done"]);
+var AuditTarget = z.object({
+  nodeId: z.string().optional(),
+  organizationId: z.string().optional(),
+  /** The entity, credential or event concerned, when there is one. */
+  id: z.string().optional()
+});
+var AuditEntry = z.object({
+  /** 1, 2, 3… with no gaps: a missing number is a removed entry. */
+  seq: z.int().min(1),
+  id: AuditId,
+  at: Timestamp,
+  kind: AuditKind,
+  /** What was attempted or done, e.g. `agent.create`, `token.issue`, `event.refused`. */
+  action: z.string().max(64),
+  outcome: AuditOutcome,
+  principalId: PrincipalId.nullable(),
+  credentialId: z.string().nullable(),
+  target: AuditTarget,
+  detail: z.string().max(500),
+  /** SHA-256 (hex) of the previous entry; 64 zeros for the first. */
+  prevHash: z.string().regex(/^[0-9a-f]{64}$/),
+  /** SHA-256 (hex) of this entry's canonical JSON without `hash` and `sig`. */
+  hash: z.string().regex(/^[0-9a-f]{64}$/),
+  /** The node key's Ed25519 signature over `hash`. */
+  sig: z.string(),
+  /** The node key that signed (keys rotate; ADR-0025). Not part of `hash`; null for entries from before rotation. */
+  signer: z.string().nullable()
+}).meta({ id: "AuditEntry", description: "One signed, hash-chained record of the node's audit log." });
+var AuditVerification = z.object({
+  valid: z.boolean(),
+  entries: z.int().min(0),
+  /** The first entry that failed, or null when the whole chain holds. */
+  brokenAt: z.int().nullable(),
+  reason: z.string().nullable(),
+  /** The node's current key; entries may also be signed by its earlier keys. */
+  publicKey: z.string()
+}).meta({ id: "AuditVerification" });
+var GENESIS_HASH = "0".repeat(64);
 var PrincipalKind = z.enum(["user", "service"]);
 var Principal = z.object({
   id: PrincipalId,
@@ -78,7 +132,12 @@ var Principal = z.object({
   publicKey: z.string().nullable(),
   createdAt: Timestamp
 }).meta({ id: "Principal", description: "A user or service that can be authenticated and granted roles." });
-var Role = z.enum(["node_owner", "org_owner"]);
+var Role = z.enum(["node_owner", "org_owner", "viewer", "auditor", "agent_operator"]);
+var NODE_ROLES = ["node_owner", "viewer", "auditor"];
+var ORGANIZATION_ROLES = ["org_owner", "agent_operator"];
+var OWNER_ROLES = ["node_owner", "org_owner"];
+var TokenScope = z.enum(["read", "write", "admin"]);
+var ALL_SCOPES = ["read", "write", "admin"];
 var RoleScope = z.discriminatedUnion("type", [
   z.object({ type: z.literal("node"), nodeId: NodeId }),
   z.object({ type: z.literal("organization"), organizationId: OrganizationId, nodeId: NodeId })
@@ -90,10 +149,15 @@ var RoleBinding = z.object({
   scope: RoleScope,
   createdAt: Timestamp
 }).refine(
-  (b) => b.role === "node_owner" ? b.scope.type === "node" : b.scope.type === "organization",
-  "node_owner must be node-scoped and org_owner organization-scoped"
+  (b) => NODE_ROLES.includes(b.role) ? b.scope.type === "node" : b.scope.type === "organization",
+  "node_owner, viewer and auditor are node-scoped; org_owner and agent_operator organization-scoped"
 ).meta({ id: "RoleBinding" });
 var GrantOwnerRequest = z.object({ principalId: PrincipalId }).meta({ id: "GrantOwnerRequest" });
+var RoleTarget = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("node"), nodeId: NodeId }),
+  z.object({ type: z.literal("organization"), organizationId: OrganizationId })
+]);
+var GrantRoleRequest = z.object({ principalId: PrincipalId, role: Role, target: RoleTarget }).meta({ id: "GrantRoleRequest" });
 var TransportKind = z.enum(["memory", "ws-peer", "tcp", "mqtt", "meshtastic", "meshcore"]);
 var LinkState = z.enum(["requested", "up", "down"]);
 var LinkQuality = z.object({
@@ -111,6 +175,29 @@ var Link = z.object({
   ...EntityAudit
 }).refine((link) => link.aNodeId !== link.bNodeId, "A link must connect two different nodes").meta({ id: "Link", description: "Transport-level adjacency between two nodes \u2014 the edges of the topology." });
 var CreateLinkRequest = z.object({ aNodeId: NodeId, bNodeId: NodeId, transport: TransportKind }).refine((body) => body.aNodeId !== body.bNodeId, "A link must connect two different nodes").meta({ id: "CreateLinkRequest" });
+var Ed25519Key = z.string().startsWith("ed25519:");
+var NodeCertificate = z.object({
+  v: z.literal(1),
+  nodeId: NodeId,
+  publicKey: Ed25519Key,
+  issuedAt: Timestamp,
+  expiresAt: Timestamp,
+  /** The mesh root's public key. */
+  rootKey: Ed25519Key,
+  /** The root's signature over the canonical JSON of every other field. */
+  sig: z.string()
+}).meta({ id: "NodeCertificate", description: "A node key certified by the mesh root (ADR-0025)." });
+var KeyRevocation = z.object({
+  v: z.literal(1),
+  publicKey: Ed25519Key,
+  nodeId: NodeId,
+  revokedAt: Timestamp,
+  reason: z.string().max(500),
+  rootKey: Ed25519Key,
+  sig: z.string()
+}).meta({ id: "KeyRevocation", description: "A node key revoked by the mesh root (ADR-0025)." });
+
+// src/node.ts
 var NodeStatus = z.enum(["online", "degraded", "offline"]);
 var Node = z.object({
   id: NodeId,
@@ -121,6 +208,8 @@ var Node = z.object({
   status: NodeStatus,
   metadata: Metadata,
   lastSeenAt: Timestamp.nullable(),
+  /** The mesh root's certificate for `publicKey`, in a rooted mesh (ADR-0025). */
+  certificate: NodeCertificate.nullable().default(null),
   ...EntityAudit
 }).meta({ id: "Node", description: "A physical or virtual endpoint connected to the mesh." });
 var UpdateNodeRequest = z.object({
@@ -128,12 +217,75 @@ var UpdateNodeRequest = z.object({
   endpoint: z.url().nullable().optional(),
   metadata: Metadata.optional()
 }).refine((body) => Object.keys(body).length > 0, "At least one field must be provided").meta({ id: "UpdateNodeRequest" });
+var Effect = z.enum(["allow", "deny"]);
+var NamePattern = z.string().regex(/^(\*|[a-z][a-z0-9_-]*(?:\.[a-z][a-z0-9_-]*)*(?:\.\*)?)$/i, "An exact name, `prefix.*` or `*`").max(100);
+var CapabilityRule = z.object({
+  effect: Effect,
+  capability: NamePattern,
+  organizationId: OrganizationId.optional(),
+  nodeId: NodeId.optional()
+});
+var ToolRule = z.object({ effect: Effect, tool: NamePattern, agentId: AgentId.optional() });
+var section = (rule) => z.object({ default: Effect.default("allow"), rules: z.array(rule).max(100).default([]) });
+var OrganizationPolicy = z.object({
+  inbound: section(CapabilityRule).default({ default: "allow", rules: [] }),
+  outbound: section(CapabilityRule).default({ default: "allow", rules: [] }),
+  tools: section(ToolRule).default({ default: "allow", rules: [] })
+}).meta({
+  id: "OrganizationPolicy",
+  description: "Who may request which capabilities, whom its agents may ask, and which tools they may use."
+});
+var OPEN_POLICY = {
+  inbound: { default: "allow", rules: [] },
+  outbound: { default: "allow", rules: [] },
+  tools: { default: "allow", rules: [] }
+};
+function matchesPattern(pattern, name) {
+  if (pattern === "*") return true;
+  if (pattern.endsWith(".*")) return name.startsWith(pattern.slice(0, -1));
+  return pattern === name;
+}
+function decide(policySection, matches) {
+  const matching = policySection.rules.filter(matches);
+  const deny = matching.find((r) => r.effect === "deny");
+  if (deny) return { allowed: false, rule: deny };
+  const allow = matching.find((r) => r.effect === "allow");
+  if (allow) return { allowed: true, rule: allow };
+  return { allowed: policySection.default === "allow", rule: void 0 };
+}
+var party = (rule, other) => (rule.organizationId === void 0 || rule.organizationId === other.organizationId) && (rule.nodeId === void 0 || rule.nodeId === other.nodeId);
+function mayRequest(requester, provider, capability) {
+  if (requester.id === provider.id) return { allowed: true, rule: void 0 };
+  const outbound = decide(
+    requester.policy.outbound,
+    (r) => matchesPattern(r.capability, capability) && party(r, { organizationId: provider.id, nodeId: provider.nodeId })
+  );
+  if (!outbound.allowed) return outbound;
+  return decide(
+    provider.policy.inbound,
+    (r) => matchesPattern(r.capability, capability) && party(r, { organizationId: requester.id, nodeId: requester.nodeId })
+  );
+}
+function inboundAllows(provider, requester, capability) {
+  if (requester.organizationId === provider.id) return { allowed: true, rule: void 0 };
+  return decide(provider.policy.inbound, (r) => matchesPattern(r.capability, capability) && party(r, requester));
+}
+function mayUseTool(organization, agentId, tool) {
+  return decide(
+    organization.policy.tools,
+    (r) => matchesPattern(r.tool, tool) && (r.agentId === void 0 || r.agentId === agentId)
+  );
+}
+
+// src/organization.ts
 var Organization = z.object({
   id: OrganizationId,
   nodeId: NodeId,
   name: DisplayName,
   slug: Slug,
   metadata: Metadata,
+  /** Capability and tool policy (ADR-0023). Organizations from before it have the open policy. */
+  policy: OrganizationPolicy.default(OPEN_POLICY),
   ...EntityAudit
 }).meta({ id: "Organization", description: "A logical boundary on a node that owns policies, identities and agents." });
 var CreateOrganizationRequest = z.object({
@@ -146,7 +298,8 @@ var CreateOrganizationRequest = z.object({
 }).meta({ id: "CreateOrganizationRequest" });
 var UpdateOrganizationRequest = z.object({
   name: DisplayName.optional(),
-  metadata: Metadata.optional()
+  metadata: Metadata.optional(),
+  policy: OrganizationPolicy.optional()
 }).refine((body) => Object.keys(body).length > 0, "At least one field must be provided").meta({ id: "UpdateOrganizationRequest" });
 var TaskStatus = z.enum(["requested", "accepted", "completed", "failed"]);
 var TERMINAL_TASK_STATUSES = ["completed", "failed"];
@@ -192,7 +345,9 @@ var CapabilityProvider = z.object({
   organizationName: z.string(),
   nodeId: NodeId,
   /** Running, on a node that is not offline — i.e. a task could be routed to it now. */
-  available: z.boolean()
+  available: z.boolean(),
+  /** Whether both organizations' policies let the agent named by `forAgent` ask this provider (ADR-0023); null without it. */
+  permitted: z.boolean().nullable()
 }).meta({ id: "CapabilityProvider" });
 
 // src/events.ts
@@ -203,6 +358,7 @@ var AgentSubject = subject("agent", AgentId);
 var LinkSubject = subject("link", LinkId);
 var RoleBindingSubject = subject("roleBinding", RoleBindingId);
 var TaskSubject = subject("task", TaskId);
+var RevocationSubject = subject("revocation", RevocationId);
 var event = (type, subjectSchema, payload) => z.object({ type: z.literal(type), subject: subjectSchema, payload });
 var AgentRegistration = z.object({
   meshAgentId: AgentId,
@@ -259,6 +415,7 @@ var TaskRequested = event("task.requested", TaskSubject, z.object({ task: Task }
 var TaskAccepted = event("task.accepted", TaskSubject, z.object({ task: Task }));
 var TaskCompleted = event("task.completed", TaskSubject, z.object({ task: Task }));
 var TaskFailed = event("task.failed", TaskSubject, z.object({ task: Task }));
+var MeshKeyRevoked = event("mesh.key_revoked", RevocationSubject, z.object({ revocation: KeyRevocation }));
 var DomainEvent = z.discriminatedUnion("type", [
   NodeCreated,
   NodeUpdated,
@@ -284,7 +441,8 @@ var DomainEvent = z.discriminatedUnion("type", [
   TaskRequested,
   TaskAccepted,
   TaskCompleted,
-  TaskFailed
+  TaskFailed,
+  MeshKeyRevoked
 ]).meta({ id: "DomainEvent" });
 var DOMAIN_EVENT_TYPES = DomainEvent.options.map((o) => o.shape.type.value);
 var ENVELOPE_VERSION = 1;
@@ -310,13 +468,37 @@ var HealthResponse = z.object({
   uptimeSeconds: z.number().nonnegative(),
   timestamp: z.iso.datetime()
 }).meta({ id: "HealthResponse", description: "Liveness and version information for a Node Server." });
-var Me = z.object({ principal: Principal, roles: z.array(RoleBinding) }).meta({ id: "Me", description: "The authenticated principal and its role bindings." });
+var Me = z.object({
+  principal: Principal,
+  roles: z.array(RoleBinding),
+  /** What the credential used for this request may do (ADR-0022). */
+  scopes: z.array(TokenScope)
+}).meta({ id: "Me", description: "The authenticated principal and its role bindings." });
 var CreatePrincipalRequest = z.object({ name: DisplayName, kind: PrincipalKind.default("user") }).meta({ id: "CreatePrincipalRequest" });
 var Credential = z.discriminatedUnion("type", [
   z.object({ type: z.literal("token"), token: z.string(), expiresAt: Timestamp }),
   z.object({ type: z.literal("apiKey"), apiKey: z.string() })
 ]).meta({ id: "Credential" });
 var CreatePrincipalResponse = z.object({ principal: Principal, credential: Credential }).meta({ id: "CreatePrincipalResponse" });
+var MAX_TOKEN_TTL_SECONDS = 365 * 24 * 60 * 60;
+var IssueTokenRequest = z.object({
+  /** Defaults to all scopes the caller's own credential has. */
+  scopes: z.array(TokenScope).min(1).optional(),
+  ttlSeconds: z.int().min(60).max(MAX_TOKEN_TTL_SECONDS).default(30 * 24 * 60 * 60),
+  label: z.string().trim().max(120).optional()
+}).meta({ id: "IssueTokenRequest" });
+var IssuedToken = z.object({ id: TokenId, token: z.string(), scopes: z.array(TokenScope), expiresAt: Timestamp }).meta({ id: "IssuedToken" });
+var CredentialInfo = z.object({
+  id: z.union([TokenId, ApiKeyId]),
+  type: z.enum(["token", "apiKey"]),
+  principalId: PrincipalId,
+  scopes: z.array(TokenScope),
+  label: z.string().nullable(),
+  createdAt: Timestamp,
+  expiresAt: Timestamp.nullable(),
+  revokedAt: Timestamp.nullable(),
+  lastUsedAt: Timestamp.nullable()
+}).meta({ id: "CredentialInfo" });
 var MeshCursor = z.record(NodeId, z.int().min(0)).meta({ id: "MeshCursor" });
 var MeshSnapshot = z.object({
   nodes: z.array(Node),
@@ -394,6 +576,8 @@ function project(event2) {
     case "task.completed":
     case "task.failed":
       return { op: "upsert", kind: "task", entity: event2.payload.task };
+    case "mesh.key_revoked":
+      return { op: "upsert", kind: "revocation", entity: { ...event2.payload.revocation, id: event2.subject.id } };
     // Registration is implied by organization membership; heartbeats are handled by the presence detector.
     case "mesh_agent.agent_registered":
     case "mesh_agent.agent_deregistered":
@@ -402,6 +586,55 @@ function project(event2) {
   }
 }
 
+// src/writers.ts
+var owner = (...nodeIds) => ({ kind: "owner", nodeIds });
+var ANY = { kind: "any" };
+function writersOf(event2) {
+  switch (event2.type) {
+    case "node.created":
+    case "node.updated":
+      return owner(event2.payload.node.id);
+    case "node.heartbeat":
+      return owner(event2.payload.nodeId);
+    case "organization.created":
+    case "organization.updated":
+      return owner(event2.payload.organization.nodeId);
+    case "agent.created":
+    case "agent.updated":
+    case "agent.status_changed":
+      return owner(event2.payload.agent.nodeId);
+    case "mesh_agent.agent_registered":
+      return owner(event2.payload.nodeId);
+    case "link.up":
+    case "link.updated":
+    case "link.down":
+      return owner(event2.payload.link.aNodeId);
+    case "link.requested":
+      return owner(event2.payload.link.aNodeId, event2.payload.link.bNodeId);
+    case "role.granted":
+      return owner(event2.payload.binding.scope.nodeId);
+    case "task.requested":
+      return owner(event2.payload.task.requester.nodeId);
+    case "task.accepted":
+    case "task.completed":
+    case "task.failed":
+      return owner(event2.payload.task.assignee.nodeId);
+    case "node.removed":
+    case "node.status_changed":
+    case "organization.removed":
+    case "agent.removed":
+    case "mesh_agent.agent_deregistered":
+    case "link.removed":
+    case "role.revoked":
+    case "mesh.key_revoked":
+      return ANY;
+  }
+}
+function isAuthorizedWriter(event2, originNodeId) {
+  const writers = writersOf(event2);
+  return writers.kind === "any" || writers.nodeIds.includes(originNodeId);
+}
+
 // src/mesh-state.ts
 var byId = (items) => Object.fromEntries(items.map((item) => [item.id, item]));
 function meshStateFromSnapshot(snapshot) {
@@ -419,6 +652,7 @@ function applyMeshEvent(state, event2) {
   const seen = state.cursor[event2.origin.nodeId] ?? 0;
   if (event2.seq <= seen) return state;
   const cursor = { ...state.cursor, [event2.origin.nodeId]: event2.seq };
+  if (!isAuthorizedWriter(event2, event2.origin.nodeId)) return { ...state, cursor };
   const op = project(event2);
   switch (op.op) {
     case "upsert":
@@ -432,6 +666,7 @@ function applyMeshEvent(state, event2) {
         case "link":
           return { ...state, cursor, links: { ...state.links, [op.entity.id]: op.entity } };
         case "roleBinding":
+        case "revocation":
           return { ...state, cursor };
         case "task": {
           const current = state.tasks[op.entity.id];
@@ -474,7 +709,7 @@ var ProblemDetails = z.object({
   code: z.string().meta({ description: "Stable machine-readable error code" }),
   errors: z.array(z.object({ path: z.string(), message: z.string() })).optional()
 }).meta({ id: "ProblemDetails" });
-var Topic = z.enum(["node", "organization", "agent", "link", "roleBinding", "task"]);
+var Topic = z.enum(["node", "organization", "agent", "link", "roleBinding", "task", "revocation"]);
 var ClientMessage = z.discriminatedUnion("type", [
   z.object({
     type: z.literal("hello"),
@@ -497,10 +732,12 @@ var RealtimeCloseCode = {
   goingAway: 1001,
   badMessage: 4400,
   unauthenticated: 4401,
+  /** Authenticated, but without a role on this node (ADR-0022). */
+  forbidden: 4403,
   helloTimeout: 4408,
   resyncRequired: 4409
 };
 
-export { Agent, AgentCreated, AgentId, AgentKind, AgentRemoved, AgentStatus, AgentStatusChanged, AgentUpdated, Capability, CapabilityName, CapabilityProvider, ClientMessage, CommandId, CreateAgentRequest, CreateLinkRequest, CreateOrganizationRequest, CreatePrincipalRequest, CreatePrincipalResponse, Credential, DOMAIN_EVENT_TYPES, DisplayName, DomainEvent, ENVELOPE_VERSION, EntityAudit, EnvelopeMeta, EventId, GrantOwnerRequest, HealthResponse, ID_PREFIX, Link, LinkDown, LinkId, LinkQuality, LinkRemoved, LinkRequested, LinkState, LinkUp, LinkUpdated, Me, MeshAgentAgentDeregistered, MeshAgentAgentRegistered, MeshCursor, MeshEvent, MeshSnapshot, MeshStats, Metadata, Node, NodeCreated, NodeDetail, NodeHeartbeat, NodeId, NodeRemoved, NodeStatus, NodeStatusChanged, NodeUpdated, Organization, OrganizationCreated, OrganizationId, OrganizationRemoved, OrganizationUpdated, Page, PageQuery, Principal, PrincipalId, PrincipalKind, ProblemDetails, RealtimeCloseCode, RequestTaskRequest, Role, RoleBinding, RoleBindingId, RoleGranted, RoleRevoked, RoleScope, ServerMessage, Slug, TERMINAL_TASK_STATUSES, Task, TaskAccepted, TaskAssignee, TaskCompleted, TaskError, TaskFailed, TaskId, TaskParty, TaskRequested, TaskStatus, TaskStep, Timestamp, Topic, TransportKind, ULID_PATTERN, UpdateAgentRequest, UpdateNodeRequest, UpdateOrganizationRequest, Version, applyMeshEvent, decodeCursor, encodeCursor, meshStateFromSnapshot, prefixedId, project };
+export { ALL_SCOPES, Agent, AgentCreated, AgentId, AgentKind, AgentRemoved, AgentStatus, AgentStatusChanged, AgentUpdated, ApiKeyId, AuditEntry, AuditId, AuditKind, AuditOutcome, AuditTarget, AuditVerification, Capability, CapabilityName, CapabilityProvider, CapabilityRule, ClientMessage, CommandId, CreateAgentRequest, CreateLinkRequest, CreateOrganizationRequest, CreatePrincipalRequest, CreatePrincipalResponse, Credential, CredentialInfo, DOMAIN_EVENT_TYPES, DisplayName, DomainEvent, ENVELOPE_VERSION, Effect, EntityAudit, EnvelopeMeta, EventId, GENESIS_HASH, GrantOwnerRequest, GrantRoleRequest, HealthResponse, ID_PREFIX, IssueTokenRequest, IssuedToken, KeyRevocation, Link, LinkDown, LinkId, LinkQuality, LinkRemoved, LinkRequested, LinkState, LinkUp, LinkUpdated, MAX_TOKEN_TTL_SECONDS, Me, MeshAgentAgentDeregistered, MeshAgentAgentRegistered, MeshCursor, MeshEvent, MeshKeyRevoked, MeshSnapshot, MeshStats, Metadata, NODE_ROLES, NamePattern, Node, NodeCertificate, NodeCreated, NodeDetail, NodeHeartbeat, NodeId, NodeRemoved, NodeStatus, NodeStatusChanged, NodeUpdated, OPEN_POLICY, ORGANIZATION_ROLES, OWNER_ROLES, Organization, OrganizationCreated, OrganizationId, OrganizationPolicy, OrganizationRemoved, OrganizationUpdated, Page, PageQuery, Principal, PrincipalId, PrincipalKind, ProblemDetails, RealtimeCloseCode, RequestTaskRequest, RevocationId, Role, RoleBinding, RoleBindingId, RoleGranted, RoleRevoked, RoleScope, RoleTarget, ServerMessage, Slug, TERMINAL_TASK_STATUSES, Task, TaskAccepted, TaskAssignee, TaskCompleted, TaskError, TaskFailed, TaskId, TaskParty, TaskRequested, TaskStatus, TaskStep, Timestamp, TokenId, TokenScope, ToolRule, Topic, TransportKind, ULID_PATTERN, UpdateAgentRequest, UpdateNodeRequest, UpdateOrganizationRequest, Version, applyMeshEvent, decodeCursor, encodeCursor, inboundAllows, isAuthorizedWriter, matchesPattern, mayRequest, mayUseTool, meshStateFromSnapshot, prefixedId, project, writersOf };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map