@immediately-run/preauth-core 0.1.6 → 0.1.7

package/dist/bootConsent.d.ts

@@ -20,6 +20,11 @@ export interface MintResult {
      *  requested) — the post-boot caller lifts the frame cap on this alone, even
      *  if a mount selection failed (matching its historical behavior). */
     netFetchOk: boolean;
+    /** Whether the plain app-scoped capability grant succeeded (vacuously true when
+     *  none was requested), R3-233. False when caps were requested but the store has
+     *  no `grantAppCapabilities` (fail-loud, never validate-then-drop) or the write
+     *  threw — the caller lifts those frame caps only on `true`. */
+    capabilitiesOk: boolean;
     /** Successfully minted per-selection space ids (for post-boot provisioning). */
     minted: {
         selection: ConsentSelection;
@@ -39,4 +44,10 @@ export type MintErrorSink = (ctx: string, err: unknown) => void;
  * records which §11.4 declared mount it satisfies, so a later boot re-provisions
  * it without re-consent.
  */
-export declare function mintConsentedGrants(store: MintStore, uid: string, appKey: string, selections: readonly ConsentSelection[], netFetchHosts: readonly NetFetchHost[], mintPath?: MintPath, onError?: MintErrorSink): Promise<MintResult>;
+export declare function mintConsentedGrants(store: MintStore, uid: string, appKey: string, selections: readonly ConsentSelection[], netFetchHosts: readonly NetFetchHost[], mintPath?: MintPath, onError?: MintErrorSink, 
+/** PLAIN app-scoped on/off capabilities to grant (R3-233) — `task:invoke`,
+ *  `llm:chat`, `contribute:self`, `diagnostics:read`. NOT `net:fetch` (host-
+ *  parameterized — granted via `netFetchHosts` above); the caller (`applyPreAuth`)
+ *  filters host-parameterized caps out. Defaults to none, so existing callers that
+ *  only mint mounts + hosts are unaffected. */
+capabilities?: readonly string[]): Promise<MintResult>;

package/dist/bootConsent.js

@@ -28,7 +28,13 @@ exports.mintConsentedGrants = mintConsentedGrants;
  * records which §11.4 declared mount it satisfies, so a later boot re-provisions
  * it without re-consent.
  */
-async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts, mintPath = 'interactive', onError) {
+async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts, mintPath = 'interactive', onError, 
+/** PLAIN app-scoped on/off capabilities to grant (R3-233) — `task:invoke`,
+ *  `llm:chat`, `contribute:self`, `diagnostics:read`. NOT `net:fetch` (host-
+ *  parameterized — granted via `netFetchHosts` above); the caller (`applyPreAuth`)
+ *  filters host-parameterized caps out. Defaults to none, so existing callers that
+ *  only mint mounts + hosts are unaffected. */
+capabilities = []) {
     let ok = true;
     let netFetchOk = true;
     if (netFetchHosts.length > 0) {
@@ -41,6 +47,27 @@ async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts
             netFetchOk = false;
         }
     }
+    // Plain app-scoped capability grants (R3-233). Fail LOUD if asked to mint caps but
+    // the adapter has no `grantAppCapabilities` — a silent skip would resurrect the
+    // exact validate-then-drop bug this fixes.
+    let capabilitiesOk = true;
+    if (capabilities.length > 0) {
+        if (!store.grantAppCapabilities) {
+            onError?.('capability grant unsupported by this store', new Error('grantAppCapabilities not implemented'));
+            ok = false;
+            capabilitiesOk = false;
+        }
+        else {
+            try {
+                await store.grantAppCapabilities({ uid, appKey, capabilities, mintPath });
+            }
+            catch (err) {
+                onError?.('capability grant failed', err);
+                ok = false;
+                capabilitiesOk = false;
+            }
+        }
+    }
     const minted = [];
     for (const sel of selections) {
         try {
@@ -63,5 +90,5 @@ async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts
             ok = false;
         }
     }
-    return { ok, netFetchOk, minted };
+    return { ok, netFetchOk, capabilitiesOk, minted };
 }

package/dist/capabilities.d.ts

@@ -49,6 +49,14 @@ export declare function isBaseline(cap: Capability): boolean;
  *  per decision #1.) */
 export declare const APP_SCOPED_CAPABILITIES: readonly Capability[];
 export declare function isAppScoped(cap: Capability): boolean;
+/** App-scoped caps whose durable authority is a PARAMETER SET minted on its own
+ *  path — today only `net:fetch` (its granted host set, §5.11). These are granted
+ *  by that path, never as a bare on/off capability: a bare `net:fetch` grant would
+ *  be UNBOUNDED (every origin), so the plain-capability mint (R3-233) MUST exclude
+ *  them. `task:invoke` is `parameterized` too but its bound is the app's manifest
+ *  `invokes` (§5.8), not a durable grant param, so it IS a plain on/off grant. */
+export declare const HOST_PARAMETERIZED_CAPABILITIES: readonly Capability[];
+export declare function isHostParameterized(cap: Capability): boolean;
 /** Compare dotted numeric versions: <0 if a<b, 0 if equal, >0 if a>b. Missing
  *  segments are treated as 0 ("1.2" === "1.2.0"); non-numeric segments as 0. */
 export declare function compareVersions(a: string, b: string): number;

package/dist/capabilities.js

@@ -9,11 +9,12 @@
 // with a view() projection on a channel (§8.3); actions are gated before the
 // handler (§8.4). Parameterized capabilities additionally bound an argument set.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_SCOPED_CAPABILITIES = exports.BASELINE_CAPABILITIES = exports.REGISTRY_VERSION = exports.CAPABILITIES = void 0;
+exports.HOST_PARAMETERIZED_CAPABILITIES = exports.APP_SCOPED_CAPABILITIES = exports.BASELINE_CAPABILITIES = exports.REGISTRY_VERSION = exports.CAPABILITIES = void 0;
 exports.isKnownCapability = isKnownCapability;
 exports.tierOf = tierOf;
 exports.isBaseline = isBaseline;
 exports.isAppScoped = isAppScoped;
+exports.isHostParameterized = isHostParameterized;
 exports.compareVersions = compareVersions;
 exports.isSupportedCapability = isSupportedCapability;
 exports.unsupportedCapabilities = unsupportedCapabilities;
@@ -234,6 +235,16 @@ exports.APP_SCOPED_CAPABILITIES = Object.keys(exports.CAPABILITIES).filter((c) =
 function isAppScoped(cap) {
     return exports.CAPABILITIES[cap].appScoped === true;
 }
+/** App-scoped caps whose durable authority is a PARAMETER SET minted on its own
+ *  path — today only `net:fetch` (its granted host set, §5.11). These are granted
+ *  by that path, never as a bare on/off capability: a bare `net:fetch` grant would
+ *  be UNBOUNDED (every origin), so the plain-capability mint (R3-233) MUST exclude
+ *  them. `task:invoke` is `parameterized` too but its bound is the app's manifest
+ *  `invokes` (§5.8), not a durable grant param, so it IS a plain on/off grant. */
+exports.HOST_PARAMETERIZED_CAPABILITIES = ['net:fetch'];
+function isHostParameterized(cap) {
+    return exports.HOST_PARAMETERIZED_CAPABILITIES.includes(cap);
+}
 // ── §5.11 capability version gate (threat T26) ──────────────────────────────
 //
 // Each capability declares the lowest registry version that knows it (`since`).

package/dist/docLayout.d.ts

@@ -59,3 +59,13 @@ export declare const mergeNetFetchHosts: (existing: readonly NetFetchHost[], inc
  *  grant time is stamped ONCE, on first mint, and `netFetchLastUsedAt` refreshes
  *  on every (re-)consent). */
 export declare const netFetchGrantFields: (mergedHosts: readonly NetFetchHost[], hadGrantedAt: boolean, s: MintSentinels) => Record<string, unknown>;
+/** Union granted PLAIN app-scoped capability names (set semantics; sorted for a
+ *  stable, byte-faithful document) — the "consent accumulates" merge for the
+ *  R3-233 capability grant, mirroring {@link mergeNetFetchHosts}. */
+export declare const mergeCapabilities: (existing: readonly string[], incoming: readonly string[]) => string[];
+/** `user-app-spaces/{uid}/apps/{appKey}` — the durable granted PLAIN app-scoped
+ *  capability set (merge), R3-233. Lives on the SAME appKey doc as the net:fetch
+ *  grant so one read (`getAppGrantDoc`) yields both. `capabilitiesGrantedAt` is
+ *  stamped ONCE (first mint); `capabilitiesLastUsedAt` refreshes on every
+ *  (re-)consent — the §8.15 90-day-unused expiry clock, identical to net:fetch. */
+export declare const appCapabilitiesGrantFields: (mergedCaps: readonly string[], hadGrantedAt: boolean, s: MintSentinels) => Record<string, unknown>;

package/dist/docLayout.js

@@ -16,7 +16,7 @@
 // `.set()`/`.update()` is the only thing each adapter does itself. Drift is then
 // impossible without editing a helper both consume.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.netFetchGrantFields = exports.mergeNetFetchHosts = exports.appSpaceGrantFields = exports.appKeyTouchFields = exports.appCountFields = exports.userCountFields = exports.ownerUserSpaceFields = exports.ownerMemberFields = exports.spaceDocFields = exports.appCountPath = exports.userCountPath = exports.appSpacePath = exports.appKeyPath = exports.userSpacePath = exports.memberPath = exports.spacePath = exports.defined = exports.granteeId = exports.GRANT_EXPIRY_MS = exports.grantKey = void 0;
+exports.appCapabilitiesGrantFields = exports.mergeCapabilities = exports.netFetchGrantFields = exports.mergeNetFetchHosts = exports.appSpaceGrantFields = exports.appKeyTouchFields = exports.appCountFields = exports.userCountFields = exports.ownerUserSpaceFields = exports.ownerMemberFields = exports.spaceDocFields = exports.appCountPath = exports.userCountPath = exports.appSpacePath = exports.appKeyPath = exports.userSpacePath = exports.memberPath = exports.spacePath = exports.defined = exports.granteeId = exports.GRANT_EXPIRY_MS = exports.grantKey = void 0;
 /** Stable per-user identifier for a grant `(appKey, spaceId)`, used as the value
  *  of a delegated grant's `parentGrantId`. `::` is delimiter-safe: `appKey` uses
  *  `__` separators and a Firestore `spaceId` is alphanumeric. */
@@ -158,3 +158,19 @@ const netFetchGrantFields = (mergedHosts, hadGrantedAt, s) => (0, exports.define
     netFetchLastUsedAt: s.serverTimestamp(),
 });
 exports.netFetchGrantFields = netFetchGrantFields;
+/** Union granted PLAIN app-scoped capability names (set semantics; sorted for a
+ *  stable, byte-faithful document) — the "consent accumulates" merge for the
+ *  R3-233 capability grant, mirroring {@link mergeNetFetchHosts}. */
+const mergeCapabilities = (existing, incoming) => [...new Set([...existing, ...incoming])].sort();
+exports.mergeCapabilities = mergeCapabilities;
+/** `user-app-spaces/{uid}/apps/{appKey}` — the durable granted PLAIN app-scoped
+ *  capability set (merge), R3-233. Lives on the SAME appKey doc as the net:fetch
+ *  grant so one read (`getAppGrantDoc`) yields both. `capabilitiesGrantedAt` is
+ *  stamped ONCE (first mint); `capabilitiesLastUsedAt` refreshes on every
+ *  (re-)consent — the §8.15 90-day-unused expiry clock, identical to net:fetch. */
+const appCapabilitiesGrantFields = (mergedCaps, hadGrantedAt, s) => (0, exports.defined)({
+    grantedCapabilities: [...mergedCaps],
+    capabilitiesGrantedAt: hadGrantedAt ? undefined : s.serverTimestamp(),
+    capabilitiesLastUsedAt: s.serverTimestamp(),
+});
+exports.appCapabilitiesGrantFields = appCapabilitiesGrantFields;

package/dist/m1PreAuth.d.ts

@@ -46,8 +46,17 @@ export interface PreAuthResult {
 }
 /**
  * The M1 write path: validate the requested capabilities against the §8.9 target
- * check, then — only if clean — mint the mounts + net:fetch hosts as durable
- * grants with `policy` provenance, through the same `mintConsentedGrants` M3 uses.
+ * check, then — only if clean — mint the mounts, net:fetch hosts, AND the plain
+ * app-scoped on/off capabilities (`task:invoke`, `llm:chat`, `contribute:self`,
+ * `diagnostics:read`) as durable grants with `policy` provenance, through the same
+ * `mintConsentedGrants` M3 uses.
+ *
+ * R3-233: the `grantable` app-scoped caps used to be VALIDATED and then silently
+ * DROPPED (only mounts + hosts were minted), so pre-authorizing `task:invoke` /
+ * `llm:chat` reported success but granted nothing and the gate kept refusing. They
+ * are now actually minted. `net:fetch` is excluded from the plain-cap mint — it is
+ * host-parameterized and granted via `netFetchHosts` (a bare grant would be
+ * unbounded).
  *
  * Refusal is terminal and silent of side effects: when any requested capability
  * is broad-elevated or unknown, the function mints NOTHING and returns the

package/dist/m1PreAuth.js

@@ -69,8 +69,17 @@ const isPreAuthClean = (plan) => plan.refused.length === 0;
 exports.isPreAuthClean = isPreAuthClean;
 /**
  * The M1 write path: validate the requested capabilities against the §8.9 target
- * check, then — only if clean — mint the mounts + net:fetch hosts as durable
- * grants with `policy` provenance, through the same `mintConsentedGrants` M3 uses.
+ * check, then — only if clean — mint the mounts, net:fetch hosts, AND the plain
+ * app-scoped on/off capabilities (`task:invoke`, `llm:chat`, `contribute:self`,
+ * `diagnostics:read`) as durable grants with `policy` provenance, through the same
+ * `mintConsentedGrants` M3 uses.
+ *
+ * R3-233: the `grantable` app-scoped caps used to be VALIDATED and then silently
+ * DROPPED (only mounts + hosts were minted), so pre-authorizing `task:invoke` /
+ * `llm:chat` reported success but granted nothing and the gate kept refusing. They
+ * are now actually minted. `net:fetch` is excluded from the plain-cap mint — it is
+ * host-parameterized and granted via `netFetchHosts` (a bare grant would be
+ * unbounded).
  *
  * Refusal is terminal and silent of side effects: when any requested capability
  * is broad-elevated or unknown, the function mints NOTHING and returns the
@@ -81,6 +90,9 @@ async function applyPreAuth(store, uid, appKey, request, onError) {
     if (!(0, exports.isPreAuthClean)(plan)) {
         return { ok: false, refused: plan.refused };
     }
-    const mint = await (0, bootConsent_1.mintConsentedGrants)(store, uid, appKey, request.mounts, request.netFetchHosts, 'policy', onError);
+    // The plain on/off caps to mint: every grantable cap EXCEPT the host-parameterized
+    // ones (net:fetch), which are minted as their host set via `netFetchHosts`.
+    const plainCaps = plan.grantable.filter((c) => !(0, capabilities_1.isHostParameterized)(c));
+    const mint = await (0, bootConsent_1.mintConsentedGrants)(store, uid, appKey, request.mounts, request.netFetchHosts, 'policy', onError, plainCaps);
     return { ok: mint.ok, refused: [], mint };
 }

package/dist/port.d.ts

@@ -68,6 +68,19 @@ export interface GrantNetFetchParams {
     appKey: string;
     hosts: readonly NetFetchHost[];
 }
+/** Parameters for `MintStore.grantAppCapabilities` — the durable §8.7 grant of a
+ *  set of PLAIN (on/off) app-scoped elevated capabilities for one (user, app):
+ *  `task:invoke`, `llm:chat`, `contribute:self`, `diagnostics:read` (R3-233). NOT
+ *  `net:fetch` — that is host-parameterized and granted via {@link GrantNetFetchParams};
+ *  a bare `net:fetch` grant would be unbounded. The set unions into the app's
+ *  granted-capability set (consent accumulates), mirroring net:fetch hosts. */
+export interface GrantAppCapabilitiesParams {
+    uid: string;
+    appKey: string;
+    capabilities: readonly string[];
+    /** §8.15 provenance; defaults to `interactive` when omitted. */
+    mintPath?: MintPath;
+}
 /**
  * The mint port: exactly the methods `mintConsentedGrants` calls. Every backend
  * (browser Firestore, admin Firestore, the in-memory test double) implements
@@ -81,4 +94,11 @@ export interface MintStore {
     grantSpaceToApp(params: GrantSpaceParams): Promise<void>;
     /** Union the given net:fetch hosts into the app's consented host set. */
     grantNetFetchHosts(params: GrantNetFetchParams): Promise<void>;
+    /** Union the given PLAIN app-scoped capabilities into the app's granted set
+     *  (R3-233). **Optional** so existing {@link MintStore} implementers (the backend
+     *  `AdminMintStore`) keep compiling; when a caller asks to mint plain caps and an
+     *  adapter does not implement this, `mintConsentedGrants` fails LOUD (reports
+     *  `capabilitiesOk:false`) rather than silently dropping them — the exact
+     *  validate-then-drop bug R3-233 fixes. */
+    grantAppCapabilities?(params: GrantAppCapabilitiesParams): Promise<void>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immediately-run/preauth-core",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "The shared §8.9 pre-auth target check + the single grant-mint path (mintConsentedGrants) + the capability vocabulary + the byte-faithful grant/space/net-fetch document layout. Consumed by site-main (browser Firestore) and the backend (admin Firestore) so there is ONE gate, ONE mint path, ONE wire layout.",
   "license": "UNLICENSED",
   "repository": {