@krischoichoi/channel-control 0.6.0

package/lib/access/materialize.js

@@ -0,0 +1,67 @@
+/** Keep the persisted policy aligned with its user-facing preset. */
+export function materializeAccessPolicy(policy) {
+    if (policy.preset === 'owner-only') {
+        const { defaultGroupRule: _defaultGroupRule, ...rest } = policy;
+        return { ...rest, dmPolicy: 'allowlist', allowFrom: policy.ownerId ? [policy.ownerId] : [], groupPolicy: 'disabled', groups: {} };
+    }
+    if (policy.preset === 'allowlist') {
+        const { defaultGroupRule: _defaultGroupRule, ...rest } = policy;
+        return { ...rest, dmPolicy: 'allowlist', groupPolicy: 'disabled', groups: {} };
+    }
+    return policy;
+}
+/** The canonical owner-only policy materialization. */
+export function ownerOnlyPolicy(ownerId) {
+    return {
+        version: 1,
+        preset: 'owner-only',
+        ownerId,
+        dmPolicy: 'allowlist',
+        allowFrom: [ownerId],
+        groupPolicy: 'disabled',
+        groups: {},
+    };
+}
+/**
+ * Private messages are platform-restricted to the bot creator. Group access
+ * remains disabled until the local operator explicitly configures it.
+ *
+ * Used only when the channel declares ownerDiscovery='platform': the upstream
+ * platform itself restricts the private-chat audience (e.g. QQ C2C is limited
+ * to the bot creator). `dmPolicy: 'open'` therefore means "accept every DM
+ * the platform can deliver", NOT "every platform user can start a DM".
+ */
+export function platformPrivatePolicy(ownerId) {
+    return {
+        version: 1,
+        preset: 'custom',
+        dmPolicy: 'open',
+        allowFrom: [],
+        ...(ownerId ? { ownerId } : {}),
+        groupPolicy: 'disabled',
+        groups: {},
+    };
+}
+/**
+ * Rebind a policy to a new owner identity. Returns a NEW policy
+ * object; the input is never mutated. When `newOwner` is empty this is a no-op
+ * returning the input unchanged (callers guard upstream).
+ */
+export function rebindOwner(policy, newOwner) {
+    if (!newOwner)
+        return policy;
+    if (policy.preset === 'owner-only') {
+        // Owner-only: the owner was the sole grantee — re-materialize allowFrom.
+        const { defaultGroupRule: _defaultGroupRule, ...base } = policy;
+        return {
+            ...base,
+            ownerId: newOwner,
+            allowFrom: [newOwner],
+            groupPolicy: 'disabled',
+            groups: {},
+        };
+    }
+    // allowlist / custom: only the ownerId changes; allowFrom/groups are preserved.
+    return { ...policy, ownerId: newOwner };
+}
+//# sourceMappingURL=materialize.js.map

package/lib/access/materialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize.js","sourceRoot":"","sources":["../../src/access/materialize.ts"],"names":[],"mappings":"AAaA,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,MAA2B;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpI,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,YAAY;QACpB,OAAO;QACP,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,CAAC,OAAO,CAAC;QACpB,WAAW,EAAE,UAAU;QACvB,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,WAAW,EAAE,UAAU;QACvB,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAA2B,EAC3B,QAAgB;IAEhB,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE7B,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACnC,yEAAyE;QACzE,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC"}

package/lib/access/owner-claim.d.ts

@@ -0,0 +1,91 @@
+/**
+ * OwnerClaimSessionManager — in-memory owner-claim lifecycle.
+ *
+ * When a channel declares `ownerDiscovery='claim'`, the local operator claims
+ * owner identity by beginning a session, showing the short `challengeCode`,
+ * then sending `/dsh-claim <challengeCode>` to the bot in a DM. The manager:
+ * - begins a session (challenge >= 128-bit, 5 minute TTL, one active per
+ *   channel/account),
+ * - observes inbound `message.received` events to capture a single valid
+ *   candidate from a DM,
+ * - confirms a candidate by persisting/rebinding the access policy owner.
+ *
+ * Security rules:
+ *   1. Only local Web/API may begin.
+ *   2. 16 random bytes / >=128-bit challenge, hex-encoded (>=32 chars).
+ *   3. 5 minute TTL.
+ *   4. Single-use: one challenge maps to at most one session, and only the
+ *      first valid candidate is captured.
+ *   5. Concurrent claims: one active claim per channel/account at a time —
+ *      a repeated local begin() resumes that session rather than replacing it.
+ *   6. Only DM conversations are accepted; group claims are silently ignored.
+ *   7. A valid canonical sender.id (non-empty, !== 'unknown') is required.
+ *   8. Exact challenge-code match.
+ *   9. Candidate does not automatically become owner — local confirm does.
+ *  10. Local confirm writes the owner.
+ *  11. The claim message is consumed here and never reaches Agent/Session/
+ *      Binding (the harness reserved gate also ensures this).
+ *  12. Owner changes write an audit log line.
+ *
+ * The challenge code is in-memory only, never persisted and NEVER logged.
+ */
+import type { ChannelEvent } from '@krischoichoi/channel-core';
+import { ChannelDefinitionRegistry } from '../definitions/registry.js';
+import type { PublicOwnerClaimSession } from '../types.js';
+import type { ChannelAccessPolicyStore } from './policy-store.js';
+export declare const OWNER_CLAIM_TTL_MS: number;
+export declare const OWNER_CLAIM_CHALLENGE_BYTES = 16;
+/** A minimal logger-like surface (the Control logger implements this). */
+export interface OwnerClaimLogger {
+    warn(message: string, ...args: unknown[]): void;
+    info(message: string, ...args: unknown[]): void;
+}
+export interface OwnerClaimSessionManagerOptions {
+    registry: ChannelDefinitionRegistry;
+    store: ChannelAccessPolicyStore;
+    logger: OwnerClaimLogger;
+    /** Injectable clock (ms since epoch). Defaults to Date.now. */
+    now?: () => number;
+}
+export declare class OwnerClaimSessionManager {
+    private readonly registry;
+    private readonly store;
+    private readonly logger;
+    private readonly now;
+    /** Active sessions keyed by `${channelId}:${accountId}`. */
+    private readonly sessions;
+    constructor(options: OwnerClaimSessionManagerOptions);
+    /** The (single) active claim key for a channel/account. */
+    private key;
+    private publicView;
+    /**
+     * Begin a NEW owner-claim session for a channel/account (local Web/API only).
+     * Rejects CLAIM_NOT_SUPPORTED when the channel does not declare
+     * `ownerDiscovery='claim'`. A repeated local begin for the same
+     * channel/account resumes the active session so a Web remount can recover
+     * its claim id without replacing the challenge or weakening single-use.
+     */
+    begin(channelId: string, accountId?: string): PublicOwnerClaimSession;
+    /** Read a session; marks + reports expiry (CLAIM_EXPIRED) when past TTL. */
+    get(channelId: string, claimId: string): PublicOwnerClaimSession;
+    /** Mark a session cancelled (idempotent). */
+    cancel(channelId: string, claimId: string): void;
+    /**
+     * Observe an inbound channel event. NO-OP for everything except
+     * `message.received`. Consumes a `/dsh-claim` command and, when every check
+     * passes, captures the FIRST valid candidate. NEVER throws — errors are
+     * caught and logged as warnings. Challenge codes are never logged.
+     */
+    observe(event: ChannelEvent): void;
+    /**
+     * Confirm a candidate, persisting/rebinding the owner, then mark
+     * the session confirmed. Requires phase === 'candidate' (a claim without a
+     * valid sender cannot be confirmed). Returns the public session.
+     */
+    confirm(channelId: string, claimId: string): Promise<PublicOwnerClaimSession>;
+    /** Persist/rebind the owner. */
+    private rebindOwner;
+    private findSession;
+    private isExpired;
+}
+//# sourceMappingURL=owner-claim.d.ts.map

package/lib/access/owner-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-claim.d.ts","sourceRoot":"","sources":["../../src/access/owner-claim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,4BAA4B,CAAC;AAGpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,KAAK,EAAmB,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAGlE,eAAO,MAAM,kBAAkB,QAAa,CAAC;AAC7C,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,yBAAyB,CAAC;IACpC,KAAK,EAAE,wBAAwB,CAAC;IAChC,MAAM,EAAE,gBAAgB,CAAC;IACzB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAQD,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;gBAE7D,OAAO,EAAE,+BAA+B;IAOpD,2DAA2D;IAC3D,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,UAAU;IAmBlB;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,uBAAuB;IA2CrE,4EAA4E;IAC5E,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,uBAAuB;IAShE,6CAA6C;IAC7C,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAWhD;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI;IAuClC;;;;OAIG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAuBnF,gCAAgC;YAClB,WAAW;IAgBzB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;CAGlB"}

package/lib/access/owner-claim.js

@@ -0,0 +1,200 @@
+import { collectText, isReservedClaimCommand, parseOwnerClaimCommand } from '@krischoichoi/channel-core';
+import { randomBytes } from 'node:crypto';
+import { ChannelDefinitionRegistry } from '../definitions/registry.js';
+import { ControlError } from '../errors.js';
+import { ownerOnlyPolicy, rebindOwner as rebindPolicyOwner } from './materialize.js';
+export const OWNER_CLAIM_TTL_MS = 5 * 60_000;
+export const OWNER_CLAIM_CHALLENGE_BYTES = 16;
+export class OwnerClaimSessionManager {
+    registry;
+    store;
+    logger;
+    now;
+    /** Active sessions keyed by `${channelId}:${accountId}`. */
+    sessions = new Map();
+    constructor(options) {
+        this.registry = options.registry;
+        this.store = options.store;
+        this.logger = options.logger;
+        this.now = options.now ?? Date.now;
+    }
+    /** The (single) active claim key for a channel/account. */
+    key(channelId, accountId) {
+        return `${channelId}:${accountId}`;
+    }
+    publicView(session) {
+        // Strip the internal challenge before it can cross the API boundary. The
+        // public DTO carries the SAME code (the browser shows it to the operator);
+        // only for already-consumed/invalid phases we hide it.
+        const challengeCode = session.phase === 'waiting-message' || session.phase === 'candidate'
+            ? session.challenge
+            : undefined;
+        return {
+            id: session.id,
+            channelId: session.channelId,
+            accountId: session.accountId,
+            phase: session.phase,
+            ...(challengeCode !== undefined ? { challengeCode } : {}),
+            expiresAt: session.expiresAt,
+            ...(session.candidate ? { candidate: session.candidate } : {}),
+        };
+    }
+    /**
+     * Begin a NEW owner-claim session for a channel/account (local Web/API only).
+     * Rejects CLAIM_NOT_SUPPORTED when the channel does not declare
+     * `ownerDiscovery='claim'`. A repeated local begin for the same
+     * channel/account resumes the active session so a Web remount can recover
+     * its claim id without replacing the challenge or weakening single-use.
+     */
+    begin(channelId, accountId = 'main') {
+        const definition = this.registry.get(channelId);
+        if (!definition) {
+            throw new ControlError('CLAIM_NOT_SUPPORTED', `channel '${channelId}' is not registered`);
+        }
+        if (definition.access.ownerDiscovery !== 'claim') {
+            throw new ControlError('CLAIM_NOT_SUPPORTED', `channel '${channelId}' does not use owner claim discovery`);
+        }
+        const key = this.key(channelId, accountId);
+        const existing = this.sessions.get(key);
+        if (existing) {
+            if (this.isExpired(existing)) {
+                existing.phase = 'expired';
+            }
+            else if (existing.phase === 'waiting-message' || existing.phase === 'candidate') {
+                this.logger.info(`[channel-control] owner claim resumed (channel=${channelId}, account=${accountId}, operation=claim-resume, phase=${existing.phase}, expiresAt=${existing.expiresAt})`);
+                return this.publicView(existing);
+            }
+        }
+        const challenge = randomBytes(OWNER_CLAIM_CHALLENGE_BYTES).toString('hex');
+        const now = this.now();
+        const session = {
+            id: cryptoRandomId(),
+            channelId,
+            accountId,
+            phase: 'waiting-message',
+            challenge,
+            expiresAt: now + OWNER_CLAIM_TTL_MS,
+            createdAt: now,
+        };
+        this.sessions.set(key, session);
+        this.logger.info(`[channel-control] owner claim started (channel=${channelId}, account=${accountId}, operation=claim-begin, expiresAt=${session.expiresAt})`);
+        return this.publicView(session);
+    }
+    /** Read a session; marks + reports expiry (CLAIM_EXPIRED) when past TTL. */
+    get(channelId, claimId) {
+        const session = this.findSession(channelId, claimId);
+        if (this.isExpired(session)) {
+            session.phase = 'expired';
+            throw new ControlError('CLAIM_EXPIRED', `owner claim '${claimId}' has expired`);
+        }
+        return this.publicView(session);
+    }
+    /** Mark a session cancelled (idempotent). */
+    cancel(channelId, claimId) {
+        const session = this.findSession(channelId, claimId);
+        if (session.phase === 'confirmed') {
+            // Confirmed claims are terminal facts; report as invalid rather than
+            // pretending to un-confirm.
+            throw new ControlError('CLAIM_INVALID', 'a confirmed owner claim cannot be cancelled');
+        }
+        session.phase = 'cancelled';
+        this.logger.info(`[channel-control] owner claim cancelled (channel=${channelId}, account=${session.accountId}, operation=claim-cancel)`);
+    }
+    /**
+     * Observe an inbound channel event. NO-OP for everything except
+     * `message.received`. Consumes a `/dsh-claim` command and, when every check
+     * passes, captures the FIRST valid candidate. NEVER throws — errors are
+     * caught and logged as warnings. Challenge codes are never logged.
+     */
+    observe(event) {
+        if (event.type !== 'message.received')
+            return;
+        try {
+            const text = collectText(event.message.content);
+            if (!isReservedClaimCommand(text))
+                return;
+            const parsed = parseOwnerClaimCommand(text);
+            if (!parsed?.code)
+                return;
+            // Look up an ACTIVE claim for this channel/account.
+            const key = this.key(event.channel, event.accountId);
+            const session = this.sessions.get(key);
+            if (!session)
+                return; // no active local claim — silently ignore.
+            // The observation must not reveal a consumed/finished claim's code.
+            if (this.isExpired(session)) {
+                session.phase = 'expired';
+                return;
+            }
+            if (session.phase !== 'waiting-message')
+                return; // already has candidate / done.
+            // Only DM conversations may claim; group claims are silently rejected.
+            if (event.conversation.type !== 'dm')
+                return;
+            // Require a valid canonical sender.id.
+            const senderId = typeof event.sender.id === 'string' ? event.sender.id.trim() : '';
+            if (!senderId || senderId === 'unknown')
+                return;
+            // Exact challenge match — no partial/fuzzy reveal of the code.
+            if (parsed.code !== session.challenge)
+                return;
+            // First valid candidate captured; subsequent candidates ignored.
+            session.candidate = { senderId };
+            session.phase = 'candidate';
+        }
+        catch (error) {
+            this.logger.warn('[channel-control] owner claim observe failed', error);
+        }
+    }
+    /**
+     * Confirm a candidate, persisting/rebinding the owner, then mark
+     * the session confirmed. Requires phase === 'candidate' (a claim without a
+     * valid sender cannot be confirmed). Returns the public session.
+     */
+    async confirm(channelId, claimId) {
+        const session = this.findSession(channelId, claimId);
+        if (this.isExpired(session)) {
+            session.phase = 'expired';
+            throw new ControlError('CLAIM_EXPIRED', `owner claim '${claimId}' has expired`);
+        }
+        if (session.phase !== 'candidate' || !session.candidate) {
+            throw new ControlError('CLAIM_INVALID', `owner claim '${claimId}' has no candidate to confirm`);
+        }
+        const ownerId = session.candidate.senderId;
+        await this.rebindOwner(channelId, session.accountId, ownerId);
+        session.phase = 'confirmed';
+        this.logger.info(`[channel-control] owner claimed for '${channelId}:${session.accountId}' (claim ${claimId})`);
+        return this.publicView(session);
+    }
+    /** Persist/rebind the owner. */
+    async rebindOwner(channelId, accountId, ownerId) {
+        const current = await this.store.get(channelId, accountId);
+        let next;
+        if (!current) {
+            // No policy: materialize a fresh owner-only.
+            next = ownerOnlyPolicy(ownerId);
+        }
+        else {
+            next = rebindPolicyOwner(current, ownerId);
+        }
+        await this.store.set(channelId, accountId, next);
+    }
+    findSession(channelId, claimId) {
+        // A claim id is globally unique; locate it among this channel's sessions
+        // regardless of account.
+        for (const session of this.sessions.values()) {
+            if (session.channelId === channelId && session.id === claimId) {
+                return session;
+            }
+        }
+        throw new ControlError('CLAIM_NOT_FOUND', `owner claim '${claimId}' not found for channel '${channelId}'`);
+    }
+    isExpired(session) {
+        return session.phase !== 'confirmed' && session.phase !== 'cancelled' && this.now() > session.expiresAt;
+    }
+}
+/** A short, URL-safe, unguessable claim id (not the challenge). */
+function cryptoRandomId() {
+    return randomBytes(12).toString('hex');
+}
+//# sourceMappingURL=owner-claim.js.map

package/lib/access/owner-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-claim.js","sourceRoot":"","sources":["../../src/access/owner-claim.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAE,eAAe,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAsB9C,MAAM,OAAO,wBAAwB;IAClB,QAAQ,CAA4B;IACpC,KAAK,CAA2B;IAChC,MAAM,CAAmB;IACzB,GAAG,CAAe;IAEnC,4DAA4D;IAC3C,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IAEzE,YAAY,OAAwC;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,2DAA2D;IACnD,GAAG,CAAC,SAAiB,EAAE,SAAiB;QAC9C,OAAO,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACrC,CAAC;IAEO,UAAU,CAAC,OAAkC;QACnD,yEAAyE;QACzE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,KAAK,iBAAiB,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW;YAClE,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAiB,EAAE,SAAS,GAAG,MAAM;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACpB,qBAAqB,EACrB,YAAY,SAAS,qBAAqB,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YACjD,MAAM,IAAI,YAAY,CACpB,qBAAqB,EACrB,YAAY,SAAS,sCAAsC,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;YAC7B,CAAC;iBAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,iBAAiB,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kDAAkD,SAAS,aAAa,SAAS,mCAAmC,QAAQ,CAAC,KAAK,eAAe,QAAQ,CAAC,SAAS,GAAG,CACvK,CAAC;gBACF,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAA8B;YACzC,EAAE,EAAE,cAAc,EAAE;YACpB,SAAS;YACT,SAAS;YACT,KAAK,EAAE,iBAAiB;YACxB,SAAS;YACT,SAAS,EAAE,GAAG,GAAG,kBAAkB;YACnC,SAAS,EAAE,GAAG;SACf,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,SAAS,aAAa,SAAS,sCAAsC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC9J,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,SAAiB,EAAE,OAAe;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,gBAAgB,OAAO,eAAe,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,SAAiB,EAAE,OAAe;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,qEAAqE;YACrE,4BAA4B;YAC5B,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,SAAS,aAAa,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC3I,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAmB;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC1C,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,IAAI;gBAAE,OAAO;YAE1B,oDAAoD;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,2CAA2C;YAEjE,oEAAoE;YACpE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,iBAAiB;gBAAE,OAAO,CAAC,gCAAgC;YAEjF,uEAAuE;YACvE,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO;YAE7C,uCAAuC;YACvC,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO;YAEhD,+DAA+D;YAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,SAAS;gBAAE,OAAO;YAE9C,iEAAiE;YACjE,OAAO,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,gBAAgB,OAAO,eAAe,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,gBAAgB,OAAO,+BAA+B,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;QAE3C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE9D,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,SAAS,IAAI,OAAO,CAAC,SAAS,YAAY,OAAO,GAAG,CAC7F,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,gCAAgC;IACxB,KAAK,CAAC,WAAW,CACvB,SAAiB,EACjB,SAAiB,EACjB,OAAe;QAEf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,IAAyB,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,6CAA6C;YAC7C,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAEO,WAAW,CAAC,SAAiB,EAAE,OAAe;QACpD,yEAAyE;QACzE,yBAAyB;QACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC9D,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,gBAAgB,OAAO,4BAA4B,SAAS,GAAG,CAChE,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,OAAkC;QAClD,OAAO,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1G,CAAC;CACF;AAED,mEAAmE;AACnE,SAAS,cAAc;IACrB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/lib/access/policy-store.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Access Policy Store — durable read/write of a channel's access policy.
+ *
+ * Policies live in the shared channel-domain KV namespace (`accessPolicyStorageKey`)
+ * over the SAME `ChannelStorage` that adapters and the harness resolver use, so
+ * the writer (channel-control) and the reader (channel-harness) never hard-code
+ * each other's key format.
+ *
+ * The store keeps the raw/full distinction explicit:
+ * - `get`      returns the parsed policy ONLY when it parses against the shared
+ *              `channelAccessPolicySchema` (malformed/missing both resolve to
+ *              `undefined`).
+ * - `getRaw`   returns the raw JSON string so a resolver (harness-side) can
+ *              distinguish MISSING (no raw) from INVALID (non-empty raw that
+ *              fails to parse) — the "missing vs invalid" distinction.
+ */
+import { type ChannelAccessPolicy, type ChannelStorage } from '@krischoichoi/channel-core';
+/** Durable access-policy store abstraction used by the control plane. */
+export interface ChannelAccessPolicyStore {
+    get(channelId: string, accountId: string): Promise<ChannelAccessPolicy | undefined>;
+    set(channelId: string, accountId: string, policy: ChannelAccessPolicy): Promise<void>;
+    delete(channelId: string, accountId: string): Promise<void>;
+}
+/**
+ * [ChannelStorageAccessPolicyStore] — a [ChannelAccessPolicyStore] backed by a
+ * [ChannelStorage]. Values are written as JSON strings under the shared
+ * versioned key. This store deliberately does NOT decide "invalid vs missing" —
+ * that policy lives in the harness-side resolver; here `get` simply returns the
+ * parsed policy when valid and `undefined` otherwise, and `getRaw` exposes the
+ * raw string so a caller can tell them apart.
+ */
+export declare class ChannelStorageAccessPolicyStore implements ChannelAccessPolicyStore {
+    private readonly getStorage;
+    constructor(getStorage: () => ChannelStorage);
+    private key;
+    get(channelId: string, accountId: string): Promise<ChannelAccessPolicy | undefined>;
+    /** The raw JSON string under the policy key, or undefined when absent. */
+    getRaw(channelId: string, accountId: string): Promise<string | undefined>;
+    set(channelId: string, accountId: string, policy: ChannelAccessPolicy): Promise<void>;
+    delete(channelId: string, accountId: string): Promise<void>;
+}
+/**
+ * In-memory access-policy store (tests / transient default). Keeps raw JSON
+ * strings so `getRaw` can still distinguish missing vs invalid when a caller
+ * needs that precision; state is lost on restart.
+ */
+export declare class MemoryAccessPolicyStore implements ChannelAccessPolicyStore {
+    private readonly values;
+    private key;
+    get(channelId: string, accountId: string): Promise<ChannelAccessPolicy | undefined>;
+    getRaw(channelId: string, accountId: string): Promise<string | undefined>;
+    set(channelId: string, accountId: string, policy: ChannelAccessPolicy): Promise<void>;
+    delete(channelId: string, accountId: string): Promise<void>;
+}
+//# sourceMappingURL=policy-store.d.ts.map

package/lib/access/policy-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.d.ts","sourceRoot":"","sources":["../../src/access/policy-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AAEpC,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IACpF,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAaD;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IAC9E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;gBAEtC,UAAU,EAAE,MAAM,cAAc;IAI5C,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAMzF,0EAA0E;IACpE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIzE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlE;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,wBAAwB;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAMnF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIzE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlE"}

package/lib/access/policy-store.js

@@ -0,0 +1,88 @@
+/**
+ * Access Policy Store — durable read/write of a channel's access policy.
+ *
+ * Policies live in the shared channel-domain KV namespace (`accessPolicyStorageKey`)
+ * over the SAME `ChannelStorage` that adapters and the harness resolver use, so
+ * the writer (channel-control) and the reader (channel-harness) never hard-code
+ * each other's key format.
+ *
+ * The store keeps the raw/full distinction explicit:
+ * - `get`      returns the parsed policy ONLY when it parses against the shared
+ *              `channelAccessPolicySchema` (malformed/missing both resolve to
+ *              `undefined`).
+ * - `getRaw`   returns the raw JSON string so a resolver (harness-side) can
+ *              distinguish MISSING (no raw) from INVALID (non-empty raw that
+ *              fails to parse) — the "missing vs invalid" distinction.
+ */
+import { accessPolicyStorageKey, channelAccessPolicySchema, } from '@krischoichoi/channel-core';
+function parseStoredPolicy(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    const parsed = channelAccessPolicySchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+/**
+ * [ChannelStorageAccessPolicyStore] — a [ChannelAccessPolicyStore] backed by a
+ * [ChannelStorage]. Values are written as JSON strings under the shared
+ * versioned key. This store deliberately does NOT decide "invalid vs missing" —
+ * that policy lives in the harness-side resolver; here `get` simply returns the
+ * parsed policy when valid and `undefined` otherwise, and `getRaw` exposes the
+ * raw string so a caller can tell them apart.
+ */
+export class ChannelStorageAccessPolicyStore {
+    getStorage;
+    constructor(getStorage) {
+        this.getStorage = getStorage;
+    }
+    key(channelId, accountId) {
+        return accessPolicyStorageKey(channelId, accountId);
+    }
+    async get(channelId, accountId) {
+        const raw = await this.getStorage().get(this.key(channelId, accountId));
+        if (raw === undefined)
+            return undefined;
+        return parseStoredPolicy(raw);
+    }
+    /** The raw JSON string under the policy key, or undefined when absent. */
+    async getRaw(channelId, accountId) {
+        return this.getStorage().get(this.key(channelId, accountId));
+    }
+    async set(channelId, accountId, policy) {
+        await this.getStorage().set(this.key(channelId, accountId), JSON.stringify(policy));
+    }
+    async delete(channelId, accountId) {
+        await this.getStorage().delete(this.key(channelId, accountId));
+    }
+}
+/**
+ * In-memory access-policy store (tests / transient default). Keeps raw JSON
+ * strings so `getRaw` can still distinguish missing vs invalid when a caller
+ * needs that precision; state is lost on restart.
+ */
+export class MemoryAccessPolicyStore {
+    values = new Map();
+    key(channelId, accountId) {
+        return accessPolicyStorageKey(channelId, accountId);
+    }
+    async get(channelId, accountId) {
+        const raw = this.values.get(this.key(channelId, accountId));
+        if (raw === undefined)
+            return undefined;
+        return parseStoredPolicy(raw);
+    }
+    async getRaw(channelId, accountId) {
+        return this.values.get(this.key(channelId, accountId));
+    }
+    async set(channelId, accountId, policy) {
+        this.values.set(this.key(channelId, accountId), JSON.stringify(policy));
+    }
+    async delete(channelId, accountId) {
+        this.values.delete(this.key(channelId, accountId));
+    }
+}
+//# sourceMappingURL=policy-store.js.map

package/lib/access/policy-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.js","sourceRoot":"","sources":["../../src/access/policy-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAG1B,MAAM,4BAA4B,CAAC;AASpC,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IACzB,UAAU,CAAuB;IAElD,YAAY,UAAgC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAEO,GAAG,CAAC,SAAiB,EAAE,SAAiB;QAC9C,OAAO,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,SAAiB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,SAAiB;QAC/C,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAA2B;QACzE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,SAAiB;QAC/C,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IACjB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,GAAG,CAAC,SAAiB,EAAE,SAAiB;QAC9C,OAAO,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,SAAiB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,SAAiB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAA2B;QACzE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,SAAiB;QAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;CACF"}

package/lib/access/validation.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Access Policy validation — the entry constrains what a policy may express
+ * against a channel's declared access descriptor.
+ *
+ * Validation is two-layered:
+ * 1. The shared `channelAccessPolicySchema` (version pinning, canonical id
+ *    trimming, strict unknown-key rejection, type checks).
+ * 2. Descriptor-relative rules (owner-only needs an ownerId, mentions/groups/
+ *    DM capability gating).
+ *
+ * Normalization performed on a validated policy: trim canonical ids and remove
+ * EXACT duplicates in every `allowFrom` list. Deliberately NO lowercase, no
+ * username resolution, no fuzzy matching — ids are opaque.
+ */
+import { type ChannelAccessPolicy } from '@krischoichoi/channel-core';
+import type { ChannelAccessDescriptor } from '../types.js';
+export type AccessValidationResult = {
+    ok: true;
+    policy: ChannelAccessPolicy;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Validate a candidate policy against a channel descriptor and, when valid,
+ * return a normalized copy (ids trimmed by the schema, `allowFrom` de-duplicated).
+ */
+export declare function validateAccessPolicy(input: ChannelAccessPolicy, descriptor: ChannelAccessDescriptor): AccessValidationResult;
+//# sourceMappingURL=validation.d.ts.map

package/lib/access/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/access/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAcjC;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,mBAAmB,EAC1B,UAAU,EAAE,uBAAuB,GAClC,sBAAsB,CAgExB"}