@guilz-dev/belay 0.3.0 → 0.6.0

package/dist/core/capability/approval-v3.js

@@ -0,0 +1,74 @@
+import { randomUUID } from 'node:crypto';
+import { hashCapabilityRequests } from './capability-request-hash.js';
+import { CAPABILITY_GRANT_VERSION } from './grant.js';
+export const APPROVAL_STATE_VERSION_V3 = 3;
+export function normalizeApprovalStateVersion(state) {
+    const version = state.version === APPROVAL_STATE_VERSION_V3
+        ? APPROVAL_STATE_VERSION_V3
+        : state.version === 2
+            ? 2
+            : 1;
+    return { ...state, version };
+}
+export function upgradeApprovalStateToV3(state) {
+    const normalized = normalizeApprovalStateVersion(state);
+    if (normalized.version === APPROVAL_STATE_VERSION_V3) {
+        return normalized;
+    }
+    return {
+        version: APPROVAL_STATE_VERSION_V3,
+        approvals: normalized.approvals.map((approval) => ({
+            ...approval,
+            capabilityRequestHash: approval.capabilityRequestHash ??
+                (approval.capabilityRequests?.length
+                    ? hashCapabilityRequests(approval.capabilityRequests)
+                    : undefined),
+        })),
+    };
+}
+export function attachCapabilityEnvelope(approval, capabilityRequests) {
+    if (!capabilityRequests?.length) {
+        return approval;
+    }
+    return {
+        ...approval,
+        capabilityRequests,
+        capabilityRequestHash: hashCapabilityRequests(capabilityRequests),
+    };
+}
+export function mintCapabilityGrant(params) {
+    const request = params.capabilityRequests[0];
+    if (!request) {
+        return null;
+    }
+    const expiresAt = params.approval.expiresAt;
+    return {
+        version: CAPABILITY_GRANT_VERSION,
+        grantId: `grant_${params.approval.approvalId}`,
+        principal: request.principal,
+        action: request.action,
+        resource: request.resource,
+        inputFingerprint: request.context.inputFingerprint,
+        issuedAt: params.approval.approvedAt ?? new Date().toISOString(),
+        expiresAt,
+        maxUses: params.maxUses ?? 1,
+        usesRemaining: params.maxUses ?? 1,
+        issuer: params.issuer ?? 'belay-approval-v3',
+    };
+}
+export function mintGrantForApprovedRecord(approval) {
+    if (approval.grant || !approval.capabilityRequests?.length) {
+        return approval;
+    }
+    const grant = mintCapabilityGrant({
+        approval,
+        capabilityRequests: approval.capabilityRequests,
+    });
+    if (!grant) {
+        return approval;
+    }
+    return { ...approval, grant };
+}
+export function newGrantId() {
+    return `grant_${randomUUID().replaceAll('-', '').slice(0, 16)}`;
+}

package/dist/core/capability/attestation.d.ts

@@ -0,0 +1,13 @@
+export declare const BOUNDARY_ATTESTATION_VERSION: 1;
+export type BoundaryDriverId = 'container' | 'cursor-sandbox' | 'seatbelt' | 'landlock' | 'host-integration';
+export interface BoundaryAttestation {
+    version: typeof BOUNDARY_ATTESTATION_VERSION;
+    driver: BoundaryDriverId;
+    probedAt: string;
+    expiresAt: string;
+    deniesUngrantedEffects: boolean;
+    materializesGrants: boolean;
+    probeSignals: string[];
+}
+export declare function validateBoundaryAttestation(value: unknown): value is BoundaryAttestation;
+export declare function isAttestationFresh(attestation: BoundaryAttestation, now?: number): boolean;

package/dist/core/capability/attestation.js

@@ -0,0 +1,55 @@
+export const BOUNDARY_ATTESTATION_VERSION = 1;
+const KNOWN_DRIVERS = new Set([
+    'container',
+    'cursor-sandbox',
+    'seatbelt',
+    'landlock',
+    'host-integration',
+]);
+export function validateBoundaryAttestation(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const record = value;
+    if (record.version !== BOUNDARY_ATTESTATION_VERSION) {
+        return false;
+    }
+    if (!KNOWN_DRIVERS.has(record.driver)) {
+        return false;
+    }
+    if (typeof record.probedAt !== 'string' || typeof record.expiresAt !== 'string') {
+        return false;
+    }
+    if (typeof record.deniesUngrantedEffects !== 'boolean') {
+        return false;
+    }
+    if (typeof record.materializesGrants !== 'boolean') {
+        return false;
+    }
+    if (!Array.isArray(record.probeSignals) ||
+        !record.probeSignals.every((s) => typeof s === 'string')) {
+        return false;
+    }
+    if (record.driver === 'host-integration' && record.materializesGrants) {
+        return false;
+    }
+    if (record.driver === 'container' &&
+        record.materializesGrants &&
+        !record.deniesUngrantedEffects) {
+        return false;
+    }
+    return true;
+}
+export function isAttestationFresh(attestation, now = Date.now()) {
+    const expires = Date.parse(attestation.expiresAt);
+    if (!Number.isFinite(expires)) {
+        return false;
+    }
+    if (expires <= now) {
+        return false;
+    }
+    if (attestation.driver === 'host-integration') {
+        return true;
+    }
+    return attestation.deniesUngrantedEffects;
+}

package/dist/core/capability/boundary-attestation-sign.d.ts

@@ -0,0 +1,21 @@
+import type { BoundaryAttestation } from './attestation.js';
+export type BoundaryAttestationFileFormat = 'signed' | 'legacy' | 'missing' | 'invalid';
+export interface SignedBoundaryAttestationFile {
+    version: 1;
+    repoRoot: string;
+    attestation: BoundaryAttestation;
+    signature: string;
+}
+export declare function signBoundaryAttestation(params: {
+    repoRoot: string;
+    attestation: BoundaryAttestation;
+    controlPlaneDir: string;
+}): Promise<SignedBoundaryAttestationFile>;
+export declare function verifySignedBoundaryAttestation(params: {
+    file: unknown;
+    expectedRepoRoot: string;
+    controlPlaneDir: string;
+}): Promise<BoundaryAttestation | null>;
+export declare function readSignedAttestationFile(filePath: string): Promise<unknown>;
+export declare function isLegacyAttestationFormat(file: unknown): file is BoundaryAttestation;
+export declare function inspectBoundaryAttestationFile(filePath: string): Promise<BoundaryAttestationFileFormat>;

package/dist/core/capability/boundary-attestation-sign.js

@@ -0,0 +1,84 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { access, readFile } from 'node:fs/promises';
+import { loadOrCreateApprovalSigningKey } from '../approval-token.js';
+import { canonicalStringify } from '../fingerprint.js';
+import { validateBoundaryAttestation } from './attestation.js';
+function signBody(repoRoot, attestation, key) {
+    const payload = canonicalStringify({ repoRoot, attestation });
+    return createHmac('sha256', key).update(payload).digest('base64url');
+}
+export async function signBoundaryAttestation(params) {
+    const key = await loadOrCreateApprovalSigningKey(params.controlPlaneDir);
+    const signature = signBody(params.repoRoot, params.attestation, key);
+    return {
+        version: 1,
+        repoRoot: params.repoRoot,
+        attestation: params.attestation,
+        signature,
+    };
+}
+export async function verifySignedBoundaryAttestation(params) {
+    if (!params.file || typeof params.file !== 'object') {
+        return null;
+    }
+    const record = params.file;
+    if (record.version !== 1 || typeof record.repoRoot !== 'string' || !record.attestation) {
+        return null;
+    }
+    if (record.repoRoot !== params.expectedRepoRoot) {
+        return null;
+    }
+    if (!validateBoundaryAttestation(record.attestation)) {
+        return null;
+    }
+    if (typeof record.signature !== 'string' || !record.signature) {
+        return null;
+    }
+    const key = await loadOrCreateApprovalSigningKey(params.controlPlaneDir);
+    const expected = signBody(record.repoRoot, record.attestation, key);
+    const actualBuffer = Buffer.from(record.signature);
+    const expectedBuffer = Buffer.from(expected);
+    if (actualBuffer.length !== expectedBuffer.length ||
+        !timingSafeEqual(actualBuffer, expectedBuffer)) {
+        return null;
+    }
+    return record.attestation;
+}
+export async function readSignedAttestationFile(filePath) {
+    return JSON.parse(await readFile(filePath, 'utf8'));
+}
+export function isLegacyAttestationFormat(file) {
+    if (!file || typeof file !== 'object') {
+        return false;
+    }
+    const record = file;
+    return (record.version === 1 &&
+        typeof record.driver === 'string' &&
+        !('signature' in record) &&
+        !('attestation' in record));
+}
+export async function inspectBoundaryAttestationFile(filePath) {
+    try {
+        await access(filePath);
+    }
+    catch {
+        return 'missing';
+    }
+    try {
+        const raw = await readSignedAttestationFile(filePath);
+        if (isLegacyAttestationFormat(raw)) {
+            return validateBoundaryAttestation(raw) ? 'legacy' : 'invalid';
+        }
+        const record = raw;
+        if (record.version === 1 &&
+            typeof record.repoRoot === 'string' &&
+            record.attestation &&
+            typeof record.signature === 'string') {
+            return 'signed';
+        }
+        return 'invalid';
+    }
+    catch {
+        return 'invalid';
+    }
+}

package/dist/core/capability/boundary-driver-container.d.ts

@@ -0,0 +1,7 @@
+import type { BoundaryDriver } from './boundary-driver.js';
+export declare function isDockerAvailable(): Promise<boolean>;
+export declare function createContainerBoundaryDriver(options?: {
+    image?: string;
+    egressProxyEnv?: Record<string, string>;
+    repoRoot?: string;
+}): BoundaryDriver;

package/dist/core/capability/boundary-driver-container.js

@@ -0,0 +1,122 @@
+import { spawn } from 'node:child_process';
+import { canonicalPath } from '../path-utils.js';
+import { dockerEnvArgs, dockerNetworkArgs, ensureBelayContainerNetwork } from './boundary-egress.js';
+import { materializeContainerBoundaryGrant } from './boundary-grant-materialize.js';
+const ATTESTATION_TTL_MS = 15 * 60_000;
+const DEFAULT_IMAGE = 'alpine:3.20';
+export async function isDockerAvailable() {
+    return new Promise((resolve) => {
+        const child = spawn('docker', ['info'], { stdio: 'ignore' });
+        child.on('error', () => resolve(false));
+        child.on('close', (code) => resolve(code === 0));
+    });
+}
+function containerAttestation(proxyEnv) {
+    const probedAt = new Date().toISOString();
+    const signals = ['docker', 'container-driver', 'repo-mount-ro-default'];
+    if (Object.keys(proxyEnv).length > 0) {
+        signals.push('egress-proxy-chokepoint');
+    }
+    else {
+        signals.push('network-none');
+    }
+    return {
+        version: 1,
+        driver: 'container',
+        probedAt,
+        expiresAt: new Date(Date.now() + ATTESTATION_TTL_MS).toISOString(),
+        deniesUngrantedEffects: true,
+        materializesGrants: true,
+        probeSignals: signals,
+    };
+}
+function runDockerProbe(image) {
+    return new Promise((resolve) => {
+        const child = spawn('docker', ['run', '--rm', '--network', 'none', image, 'echo', 'ok'], {
+            stdio: 'ignore',
+        });
+        child.on('error', () => resolve(false));
+        child.on('close', (code) => resolve(code === 0));
+    });
+}
+function runInContainer(image, command, cwd, timeoutMs, proxyEnv, mountReadOnly, repoRoot) {
+    const mount = canonicalPath(cwd);
+    const mountSpec = mountReadOnly ? `${mount}:${mount}:ro` : `${mount}:${mount}`;
+    const proxyActive = Object.keys(proxyEnv).length > 0;
+    const networkArgs = dockerNetworkArgs(proxyActive, repoRoot);
+    const args = [
+        'run',
+        '--rm',
+        ...networkArgs,
+        '-v',
+        mountSpec,
+        '-w',
+        mount,
+        ...dockerEnvArgs(proxyEnv),
+        image,
+        'sh',
+        '-c',
+        command,
+    ];
+    return new Promise((resolve) => {
+        const child = spawn('docker', args, { stdio: 'ignore' });
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGTERM');
+        }, timeoutMs);
+        child.on('error', () => {
+            clearTimeout(timer);
+            resolve({ exitCode: 1, signal: null, timedOut });
+        });
+        child.on('close', (exitCode, signal) => {
+            clearTimeout(timer);
+            resolve({
+                exitCode,
+                signal: signal ? String(signal) : null,
+                timedOut,
+            });
+        });
+    });
+}
+export function createContainerBoundaryDriver(options = {}) {
+    const image = options.image ?? DEFAULT_IMAGE;
+    const proxyEnv = options.egressProxyEnv ?? {};
+    const repoRoot = options.repoRoot;
+    let preparedNetwork = false;
+    return {
+        id: 'container',
+        async probe() {
+            if (!(await isDockerAvailable())) {
+                throw new Error('Docker is not available for container boundary driver');
+            }
+            if (!(await runDockerProbe(image))) {
+                throw new Error(`Docker probe failed for image ${image}`);
+            }
+            return containerAttestation(proxyEnv);
+        },
+        async prepare(context) {
+            if (context.egressProxyActive && context.repoRoot) {
+                await ensureBelayContainerNetwork(context.repoRoot);
+                preparedNetwork = true;
+            }
+        },
+        async run(command, cwd, timeoutMs, options) {
+            const mountReadOnly = options?.mountReadOnly !== false;
+            const proxyActive = Object.keys(proxyEnv).length > 0;
+            if (proxyActive && repoRoot && !preparedNetwork) {
+                await ensureBelayContainerNetwork(repoRoot);
+            }
+            return runInContainer(image, command, cwd, timeoutMs, proxyEnv, mountReadOnly, repoRoot);
+        },
+        materializeGrant(request, context) {
+            return materializeContainerBoundaryGrant(request, {
+                attestation: context.attestation,
+                mountRoot: context.mountRoot,
+                egressProxyActive: context.egressProxyActive,
+                existingGrants: context.existingGrants,
+                sensitivePaths: context.sensitivePaths,
+            });
+        },
+    };
+}

package/dist/core/capability/boundary-driver.d.ts

@@ -0,0 +1,29 @@
+import { type ShellRunResult } from '../transactional/git-worktree.js';
+import type { BoundaryAttestation, BoundaryDriverId } from './attestation.js';
+import type { BoundaryPrepareContext, BoundaryRunOptions } from './boundary-run.js';
+import type { CapabilityGrantV1 } from './grant.js';
+import type { CapabilityRequestV1 } from './request.js';
+export type { ShellRunResult as BoundaryRunResult };
+export interface BoundaryMaterializeContext {
+    attestation: BoundaryAttestation;
+    mountRoot: string;
+    egressProxyActive: boolean;
+    existingGrants?: CapabilityGrantV1[];
+    sensitivePaths?: string[];
+}
+export type { BoundaryRunOptions } from './boundary-run.js';
+export { boundaryMountReadOnlyFromPrediction } from './boundary-run.js';
+export interface BoundaryDriver {
+    id: BoundaryDriverId;
+    probe(): Promise<BoundaryAttestation>;
+    prepare?(context: BoundaryPrepareContext): Promise<void>;
+    run(command: string, cwd: string, timeoutMs: number, options?: BoundaryRunOptions): Promise<ShellRunResult>;
+    materializeGrant(request: CapabilityRequestV1, context: BoundaryMaterializeContext): CapabilityGrantV1 | null;
+}
+export interface BoundaryDriverOptions {
+    egressProxyEnv?: Record<string, string>;
+    image?: string;
+    repoRoot?: string;
+}
+export declare function createHostIntegrationDriver(): BoundaryDriver;
+export declare function getDefaultBoundaryDriver(driverId?: BoundaryDriverId, options?: BoundaryDriverOptions): BoundaryDriver;

package/dist/core/capability/boundary-driver.js

@@ -0,0 +1,43 @@
+import { runShellCommand } from '../transactional/git-worktree.js';
+import { createContainerBoundaryDriver } from './boundary-driver-container.js';
+export { boundaryMountReadOnlyFromPrediction } from './boundary-run.js';
+const ATTESTATION_TTL_MS = 15 * 60_000;
+function hostIntegrationAttestation(driver) {
+    const probedAt = new Date().toISOString();
+    return {
+        version: 1,
+        driver,
+        probedAt,
+        expiresAt: new Date(Date.now() + ATTESTATION_TTL_MS).toISOString(),
+        deniesUngrantedEffects: false,
+        materializesGrants: false,
+        probeSignals: ['host-integration', 'l3-policy-only'],
+    };
+}
+export function createHostIntegrationDriver() {
+    return {
+        id: 'host-integration',
+        async probe() {
+            return hostIntegrationAttestation('host-integration');
+        },
+        async prepare() {
+            // L3 host path has no runtime preparation.
+        },
+        run(command, cwd, timeoutMs) {
+            return runShellCommand(command, cwd, timeoutMs);
+        },
+        materializeGrant() {
+            return null;
+        },
+    };
+}
+export function getDefaultBoundaryDriver(driverId = 'host-integration', options = {}) {
+    if (driverId === 'container') {
+        return createContainerBoundaryDriver({
+            image: options.image,
+            egressProxyEnv: options.egressProxyEnv,
+            repoRoot: options.repoRoot,
+        });
+    }
+    return createHostIntegrationDriver();
+}

package/dist/core/capability/boundary-egress.d.ts

@@ -0,0 +1,21 @@
+import type { BelayConfigV4 } from '../config.js';
+import type { BoundaryDriverId } from './attestation.js';
+export declare function isEgressProxyActive(params: {
+    config: BelayConfigV4;
+    running: boolean;
+    foreignProxy?: boolean;
+    repoRootMismatch?: boolean;
+}): boolean;
+export declare function egressProxyEnvFromConfig(config: BelayConfigV4, proxyActive: boolean): Record<string, string>;
+/** Container workloads cannot reach 127.0.0.1 on the host; route via host.docker.internal. */
+export declare function egressProxyEnvForContainer(config: BelayConfigV4, proxyActive: boolean): Record<string, string>;
+export declare function resolveBoundaryEgressProxyEnv(params: {
+    driverId: BoundaryDriverId;
+    config: BelayConfigV4;
+    proxyActive: boolean;
+}): Record<string, string>;
+export declare function belayContainerNetworkName(repoRoot: string): string;
+export declare function isBelayContainerNetworkReady(repoRoot: string): Promise<boolean>;
+export declare function ensureBelayContainerNetwork(repoRoot: string): Promise<string>;
+export declare function dockerNetworkArgs(proxyActive: boolean, repoRoot?: string): string[];
+export declare function dockerEnvArgs(proxyEnv: Record<string, string>): string[];

package/dist/core/capability/boundary-egress.js

@@ -0,0 +1,109 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { recommendedProxyEnv } from '../egress/env.js';
+import { canonicalPath } from '../path-utils.js';
+export function isEgressProxyActive(params) {
+    if (!params.config.egress.enabled) {
+        return false;
+    }
+    return params.running && !params.foreignProxy && !params.repoRootMismatch;
+}
+function proxyHostForContainer(listenHost) {
+    if (listenHost === '127.0.0.1' || listenHost === 'localhost' || listenHost === '::1') {
+        return 'host.docker.internal';
+    }
+    return listenHost;
+}
+export function egressProxyEnvFromConfig(config, proxyActive) {
+    if (!proxyActive || !config.egress.enabled) {
+        return {};
+    }
+    return recommendedProxyEnv(config.egress);
+}
+/** Container workloads cannot reach 127.0.0.1 on the host; route via host.docker.internal. */
+export function egressProxyEnvForContainer(config, proxyActive) {
+    if (!proxyActive || !config.egress.enabled) {
+        return {};
+    }
+    const host = proxyHostForContainer(config.egress.listenHost);
+    const proxyUrl = `http://${host}:${config.egress.listenPort}`;
+    return {
+        HTTP_PROXY: proxyUrl,
+        HTTPS_PROXY: proxyUrl,
+        http_proxy: proxyUrl,
+        https_proxy: proxyUrl,
+        NO_PROXY: '127.0.0.1,localhost',
+        no_proxy: '127.0.0.1,localhost',
+    };
+}
+export function resolveBoundaryEgressProxyEnv(params) {
+    if (params.driverId === 'container') {
+        return egressProxyEnvForContainer(params.config, params.proxyActive);
+    }
+    return egressProxyEnvFromConfig(params.config, params.proxyActive);
+}
+export function belayContainerNetworkName(repoRoot) {
+    const hash = createHash('sha256').update(canonicalPath(repoRoot)).digest('hex').slice(0, 12);
+    return `belay-int-${hash}`;
+}
+function dockerNetworkInspect(name) {
+    return new Promise((resolve) => {
+        const child = spawn('docker', ['network', 'inspect', name], { stdio: 'ignore' });
+        child.on('error', () => resolve(false));
+        child.on('close', (code) => resolve(code === 0));
+    });
+}
+export async function isBelayContainerNetworkReady(repoRoot) {
+    return dockerNetworkInspect(belayContainerNetworkName(repoRoot));
+}
+function dockerNetworkCreateInternal(name) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('docker', ['network', 'create', '--internal', '--label', 'belay=1', name], {
+            stdio: 'ignore',
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(`Failed to create internal docker network ${name}`));
+        });
+    });
+}
+export async function ensureBelayContainerNetwork(repoRoot) {
+    const name = belayContainerNetworkName(repoRoot);
+    if (await dockerNetworkInspect(name)) {
+        return name;
+    }
+    try {
+        await dockerNetworkCreateInternal(name);
+    }
+    catch (error) {
+        if (await dockerNetworkInspect(name)) {
+            return name;
+        }
+        throw error;
+    }
+    return name;
+}
+export function dockerNetworkArgs(proxyActive, repoRoot) {
+    if (!proxyActive) {
+        return ['--network', 'none'];
+    }
+    if (!repoRoot) {
+        return ['--network', 'none'];
+    }
+    return [
+        '--add-host=host.docker.internal:host-gateway',
+        '--network',
+        belayContainerNetworkName(repoRoot),
+    ];
+}
+export function dockerEnvArgs(proxyEnv) {
+    const args = [];
+    for (const [key, value] of Object.entries(proxyEnv)) {
+        args.push('-e', `${key}=${value}`);
+    }
+    return args;
+}

package/dist/core/capability/boundary-grant-materialize.d.ts

@@ -0,0 +1,13 @@
+import type { BoundaryAttestation } from './attestation.js';
+import { type CapabilityGrantV1 } from './grant.js';
+import type { CapabilityRequestV1 } from './request.js';
+export declare const BOUNDARY_GRANT_ISSUER_CONTAINER: "boundary:container";
+export declare function isPathWithinBoundaryMount(request: CapabilityRequestV1): boolean;
+export interface MaterializeBoundaryGrantParams {
+    attestation: BoundaryAttestation;
+    mountRoot: string;
+    egressProxyActive: boolean;
+    existingGrants?: CapabilityGrantV1[];
+    sensitivePaths?: string[];
+}
+export declare function materializeContainerBoundaryGrant(request: CapabilityRequestV1, params: MaterializeBoundaryGrantParams): CapabilityGrantV1 | null;

package/dist/core/capability/boundary-grant-materialize.js

@@ -0,0 +1,78 @@
+import path from 'node:path';
+import { matchesSensitivePath } from '../glob.js';
+import { canonicalPath, pathWithinRoot } from '../path-utils.js';
+import { newGrantId } from './approval-v3.js';
+import { isAttestationFresh } from './attestation.js';
+import { CAPABILITY_GRANT_VERSION } from './grant.js';
+import { grantMatchesRequest } from './grant-match.js';
+const BOUNDARY_GRANT_TTL_MS = 15 * 60_000;
+export const BOUNDARY_GRANT_ISSUER_CONTAINER = 'boundary:container';
+function resolveCapabilityPath(targetPath, cwd) {
+    const joined = path.isAbsolute(targetPath) ? targetPath : path.join(cwd, targetPath);
+    return canonicalPath(joined);
+}
+export function isPathWithinBoundaryMount(request) {
+    if (request.resource.kind !== 'path') {
+        return true;
+    }
+    const mountRoot = canonicalPath(request.context.cwd);
+    const resolved = resolveCapabilityPath(request.resource.path, request.context.cwd);
+    return pathWithinRoot(mountRoot, resolved);
+}
+function mintBoundaryGrant(request, attestation, issuer) {
+    const now = Date.now();
+    const attestationExpiry = Date.parse(attestation.expiresAt);
+    const grantExpiry = now + BOUNDARY_GRANT_TTL_MS;
+    const expiresAt = new Date(Number.isFinite(attestationExpiry) ? Math.min(attestationExpiry, grantExpiry) : grantExpiry).toISOString();
+    return {
+        version: CAPABILITY_GRANT_VERSION,
+        grantId: newGrantId(),
+        principal: request.principal,
+        action: request.action,
+        resource: request.resource,
+        inputFingerprint: request.context.inputFingerprint,
+        issuedAt: new Date(now).toISOString(),
+        expiresAt,
+        maxUses: 1,
+        usesRemaining: 1,
+        issuer,
+    };
+}
+export function materializeContainerBoundaryGrant(request, params) {
+    if (!isAttestationFresh(params.attestation)) {
+        return null;
+    }
+    if (!params.attestation.materializesGrants || params.attestation.driver !== 'container') {
+        return null;
+    }
+    if (request.evidence.level !== 'certain') {
+        return null;
+    }
+    const repoRoot = canonicalPath(request.principal.repoRoot);
+    const mountRoot = canonicalPath(params.mountRoot);
+    if (request.action === 'fs.read' || request.action === 'fs.write') {
+        if (request.resource.kind !== 'path') {
+            return null;
+        }
+        const resolved = resolveCapabilityPath(request.resource.path, request.context.cwd);
+        if (!pathWithinRoot(repoRoot, resolved) || !pathWithinRoot(mountRoot, resolved)) {
+            return null;
+        }
+        const relative = resolved.slice(repoRoot.length).replace(/^[/\\]/, '');
+        if (params.sensitivePaths?.length && matchesSensitivePath(relative, params.sensitivePaths)) {
+            return null;
+        }
+        return mintBoundaryGrant(request, params.attestation, BOUNDARY_GRANT_ISSUER_CONTAINER);
+    }
+    if (request.action === 'network.connect' && request.resource.kind === 'network') {
+        if (!params.egressProxyActive) {
+            return null;
+        }
+        const approved = params.existingGrants?.some((grant) => grant.issuer !== BOUNDARY_GRANT_ISSUER_CONTAINER && grantMatchesRequest(grant, request));
+        if (!approved) {
+            return null;
+        }
+        return mintBoundaryGrant(request, params.attestation, BOUNDARY_GRANT_ISSUER_CONTAINER);
+    }
+    return null;
+}