@immediately-run/preauth-core 0.1.12 → 0.1.14

package/dist/capabilities.d.ts

@@ -1,6 +1,6 @@
 export type CapabilityKind = 'read' | 'action';
 export type CapabilityTier = 'baseline' | 'elevated' | 'first-party-only';
-export type Capability = 'theme:read' | 'theme:set' | 'auth:status' | 'auth:identity' | 'route:read' | 'formFactor:read' | 'chrome:read' | 'mounts:read' | 'mounts:registry' | 'spaces:app' | 'spaces:user' | 'spaces:admin' | 'settings:app' | 'settings:fork' | 'settings:all' | 'contribute:self' | 'contribute:any' | 'contribute:direct' | 'editor:read' | 'editor:open' | 'editor:write' | 'editor:document' | 'editor:requestEdit' | 'vcs:read' | 'vcs:reset' | 'dnd:source' | 'catalog:read' | 'commands:read' | 'commands:run' | 'ipc' | 'task:invoke' | 'net:fetch' | 'secrets:add' | 'secrets:list' | 'secrets:revoke' | 'agent:session' | 'diagnostics:read' | 'llm:chat' | 'authoring:run' | 'analytics:emit';
+export type Capability = 'theme:read' | 'theme:set' | 'auth:status' | 'auth:identity' | 'route:read' | 'formFactor:read' | 'chrome:read' | 'mounts:read' | 'mounts:registry' | 'spaces:app' | 'spaces:user' | 'spaces:admin' | 'settings:app' | 'settings:fork' | 'settings:all' | 'contribute:self' | 'contribute:any' | 'contribute:direct' | 'editor:read' | 'editor:open' | 'editor:reveal' | 'editor:write' | 'editor:document' | 'editor:requestEdit' | 'vcs:read' | 'vcs:reset' | 'dnd:source' | 'catalog:read' | 'commands:read' | 'commands:run' | 'ipc' | 'task:invoke' | 'net:fetch' | 'feed:fetch' | 'secrets:add' | 'secrets:list' | 'secrets:revoke' | 'agent:session' | 'diagnostics:read' | 'llm:chat' | 'authoring:run' | 'analytics:emit';
 export interface CapabilityDef {
     kind: CapabilityKind;
     tier: CapabilityTier;
@@ -31,13 +31,21 @@ export interface CapabilityDef {
     maximallyExplicit?: boolean;
 }
 export declare const CAPABILITIES: Record<Capability, CapabilityDef>;
-/** The current registry/vocabulary version (§5.11). Bumped to 1.7.0 with the baseline
- *  state read `chrome:read` (PRESENT_MODE_CHROME_SPEC §6 — R3-191), mirroring
- *  capabilities.json. (1.6.0 added the elevated, app-scoped, parameterized
- *  `analytics:emit`; 1.5.0 added the first-party-only `mounts:registry`; 1.4.0 added
- *  `authoring:run`; 1.3.0 added the provider-agnostic `llm:chat` slot; 1.2.0 added the
- *  per-user settings-space capabilities.) */
-export declare const REGISTRY_VERSION = "1.7.0";
+/** The current registry/vocabulary version (§5.11). Bumped to 1.8.0 with the elevated,
+ *  app-scoped, host-parameterized `feed:fetch` (`CONNECTOR_EGRESS_FIXING_SPEC` §2 —
+ *  R3-227), mirroring capabilities.json. (1.7.0 added the baseline state read
+ *  `chrome:read`; 1.6.0 added `analytics:emit`; 1.5.0 added the first-party-only
+ *  `mounts:registry`; 1.4.0 added `authoring:run`; 1.3.0 added the provider-agnostic
+ *  `llm:chat` slot; 1.2.0 added the per-user settings-space capabilities.)
+ *
+ *  `feed:fetch` takes its OWN version rather than joining 1.7.0, even though both land
+ *  close together: 1.7.0 is already published (0.1.12, with `chrome:read`), so reusing it
+ *  would mean two different published vocabularies both answering "1.7.0" — and a
+ *  registry version that does not identify a vocabulary is not much of a version gate.
+ *  A host older than 1.8.0 therefore refuses a binding that requests `feed:fetch` (T26)
+ *  rather than mounting half-working, which is the right outcome: a host that cannot
+ *  enforce target-fixing must not run a connector that assumes it. */
+export declare const REGISTRY_VERSION = "1.9.0";
 /** Is `cap` a known host-core capability? (Closed vocabulary — §5.12.) */
 export declare function isKnownCapability(cap: string): cap is Capability;
 export declare function tierOf(cap: Capability): CapabilityTier;
@@ -51,11 +59,14 @@ export declare function isBaseline(cap: Capability): boolean;
 export declare const APP_SCOPED_CAPABILITIES: readonly Capability[];
 export declare function isAppScoped(cap: Capability): boolean;
 /** App-scoped caps whose durable authority is a PARAMETER SET minted on its own
- *  path — today only `net:fetch` (its granted host set, §5.11). These are granted
- *  by that path, never as a bare on/off capability: a bare `net:fetch` grant would
- *  be UNBOUNDED (every origin), so the plain-capability mint (R3-233) MUST exclude
- *  them. `task:invoke` is `parameterized` too but its bound is the app's manifest
- *  `invokes` (§5.8), not a durable grant param, so it IS a plain on/off grant. */
+ *  path: `net:fetch` (its granted host set, §5.11) and `feed:fetch` (its compiled
+ *  request templates, `CONNECTOR_EGRESS_FIXING_SPEC` §2). These are granted by that
+ *  path, never as a bare on/off capability: a bare `net:fetch` grant would be
+ *  UNBOUNDED (every origin), and a bare `feed:fetch` grant would be unbounded the
+ *  same way (no template, hence no fixed target), so the plain-capability mint
+ *  (R3-233) MUST exclude them. `task:invoke` is `parameterized` too but its bound is
+ *  the app's manifest `invokes` (§5.8), not a durable grant param, so it IS a plain
+ *  on/off grant. */
 export declare const HOST_PARAMETERIZED_CAPABILITIES: readonly Capability[];
 export declare function isHostParameterized(cap: Capability): boolean;
 /** Compare dotted numeric versions: <0 if a<b, 0 if equal, >0 if a>b. Missing

package/dist/capabilities.js

@@ -74,6 +74,23 @@ exports.CAPABILITIES = {
     // validates the path and drives Sandpack. Elevated — it moves the host's focus,
     // so a previewed app must not hold it; only a consented/build-default binding.
     'editor:open': { kind: 'action', tier: 'elevated', since: '1.0.0' },
+    // Bring the user TO the editor across an activity boundary (R3-389,
+    // TOOLS_ACTIVITY_SPEC §5.2). Strictly more than `editor:open`, which opens a file
+    // in whatever column the editor already occupies: an activity that owns the main
+    // pane UNMOUNTS the editor, so a surface there must be able to switch the active
+    // activity for its click to be visible at all.
+    //
+    // That is an attention move, so it is the parameterized ESCALATION of `open`
+    // (§8.4): `open({ reveal: true })` requires THIS instead of `editor:open`, and a
+    // frame holding only `editor:open` is refused rather than silently downgraded to a
+    // no-op reveal (T11).
+    //
+    // Elevated, and it buys no new REACH — the caller names a path, never an activity;
+    // the host resolves which activity owns the editor from its own state, reads its
+    // OWN `navigator.userActivation` (an app cannot forge it, and the gate fails closed
+    // without it), and rate-limits. The authority is "may ask", not "may decide where
+    // the user goes".
+    'editor:reveal': { kind: 'action', tier: 'elevated', since: '1.9.0' },
     // Mutate the editor session's working tree — create/delete/rename/upload a file
     // (migrate-sidebars Phase 04, EDITOR_AS_APP_SPEC §5.2). A NARROW, per-path gated
     // action: the file explorer NAMES a path and the HOST performs the COW write
@@ -163,6 +180,24 @@ exports.CAPABILITIES = {
     // by the app's manifest `invokes` declaration (§5.8), enforced in the handler.
     'task:invoke': { kind: 'action', tier: 'elevated', since: '1.0.0', parameterized: true, appScoped: true },
     'net:fetch': { kind: 'action', tier: 'elevated', since: '1.0.0', parameterized: true, appScoped: true },
+    // Fire a host-constructed request TEMPLATE derived from trusted feed config
+    // (`CONNECTOR_EGRESS_FIXING_SPEC` §2, D2). Deliberately a DISTINCT capability from
+    // `net:fetch` rather than a narrower grant of it, because the two differ in what the
+    // app supplies, not in how much: `net:fetch` takes a URL and checks it against an
+    // allowlist, so within the allowed host set the app still picks the host, the path and
+    // the body on every call. `feed:fetch` takes a feed-instance id and a typed param
+    // object — there is no URL surface at all, so a connector steered by the bytes it
+    // fetched (the metacircular-interpreter threat, `REPORTING_SPREADSHEET §3.2` RB-1) has
+    // nothing to steer WITH.
+    //
+    // Holding both would erase that: a realm granted `feed:fetch` must NOT be granted
+    // `net:fetch`, which is a property of what the connector's manifest declares, and is
+    // why this is its own row rather than a flag on that one.
+    //
+    // Parameterized and host-parameterized: its durable authority IS the compiled template
+    // set (origin + path + method + typed slots), so a bare on/off grant would be unbounded
+    // in exactly the way a bare `net:fetch` grant would.
+    'feed:fetch': { kind: 'action', tier: 'elevated', since: '1.8.0', parameterized: true, appScoped: true },
     // Host-owned secret store (SECRETS_SPEC §4). All elevated; the value is never
     // readable by any app (`secrets:list` exposes metadata only). `secrets:add`
     // opens a host-drawn modal; `secrets:revoke` deletes + cascades use-grants. The
@@ -243,13 +278,21 @@ exports.CAPABILITIES = {
     // never reads it is indistinguishable from one that does.
     'chrome:read': { kind: 'read', tier: 'baseline', since: '1.7.0' },
 };
-/** The current registry/vocabulary version (§5.11). Bumped to 1.7.0 with the baseline
- *  state read `chrome:read` (PRESENT_MODE_CHROME_SPEC §6 — R3-191), mirroring
- *  capabilities.json. (1.6.0 added the elevated, app-scoped, parameterized
- *  `analytics:emit`; 1.5.0 added the first-party-only `mounts:registry`; 1.4.0 added
- *  `authoring:run`; 1.3.0 added the provider-agnostic `llm:chat` slot; 1.2.0 added the
- *  per-user settings-space capabilities.) */
-exports.REGISTRY_VERSION = '1.7.0';
+/** The current registry/vocabulary version (§5.11). Bumped to 1.8.0 with the elevated,
+ *  app-scoped, host-parameterized `feed:fetch` (`CONNECTOR_EGRESS_FIXING_SPEC` §2 —
+ *  R3-227), mirroring capabilities.json. (1.7.0 added the baseline state read
+ *  `chrome:read`; 1.6.0 added `analytics:emit`; 1.5.0 added the first-party-only
+ *  `mounts:registry`; 1.4.0 added `authoring:run`; 1.3.0 added the provider-agnostic
+ *  `llm:chat` slot; 1.2.0 added the per-user settings-space capabilities.)
+ *
+ *  `feed:fetch` takes its OWN version rather than joining 1.7.0, even though both land
+ *  close together: 1.7.0 is already published (0.1.12, with `chrome:read`), so reusing it
+ *  would mean two different published vocabularies both answering "1.7.0" — and a
+ *  registry version that does not identify a vocabulary is not much of a version gate.
+ *  A host older than 1.8.0 therefore refuses a binding that requests `feed:fetch` (T26)
+ *  rather than mounting half-working, which is the right outcome: a host that cannot
+ *  enforce target-fixing must not run a connector that assumes it. */
+exports.REGISTRY_VERSION = '1.9.0';
 /** Is `cap` a known host-core capability? (Closed vocabulary — §5.12.) */
 function isKnownCapability(cap) {
     return Object.prototype.hasOwnProperty.call(exports.CAPABILITIES, cap);
@@ -271,12 +314,15 @@ function isAppScoped(cap) {
     return exports.CAPABILITIES[cap].appScoped === true;
 }
 /** App-scoped caps whose durable authority is a PARAMETER SET minted on its own
- *  path — today only `net:fetch` (its granted host set, §5.11). These are granted
- *  by that path, never as a bare on/off capability: a bare `net:fetch` grant would
- *  be UNBOUNDED (every origin), so the plain-capability mint (R3-233) MUST exclude
- *  them. `task:invoke` is `parameterized` too but its bound is the app's manifest
- *  `invokes` (§5.8), not a durable grant param, so it IS a plain on/off grant. */
-exports.HOST_PARAMETERIZED_CAPABILITIES = ['net:fetch'];
+ *  path: `net:fetch` (its granted host set, §5.11) and `feed:fetch` (its compiled
+ *  request templates, `CONNECTOR_EGRESS_FIXING_SPEC` §2). These are granted by that
+ *  path, never as a bare on/off capability: a bare `net:fetch` grant would be
+ *  UNBOUNDED (every origin), and a bare `feed:fetch` grant would be unbounded the
+ *  same way (no template, hence no fixed target), so the plain-capability mint
+ *  (R3-233) MUST exclude them. `task:invoke` is `parameterized` too but its bound is
+ *  the app's manifest `invokes` (§5.8), not a durable grant param, so it IS a plain
+ *  on/off grant. */
+exports.HOST_PARAMETERIZED_CAPABILITIES = ['net:fetch', 'feed:fetch'];
 function isHostParameterized(cap) {
     return exports.HOST_PARAMETERIZED_CAPABILITIES.includes(cap);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immediately-run/preauth-core",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "The shared §8.9 pre-auth target check + the single grant-mint path (mintConsentedGrants) + the capability vocabulary + the byte-faithful grant/space/net-fetch document layout. Consumed by site-main (browser Firestore) and the backend (admin Firestore) so there is ONE gate, ONE mint path, ONE wire layout.",
   "license": "UNLICENSED",
   "repository": {