@mnmal-ai/cortext 1.0.0-alpha.11 → 1.0.0-alpha.12

package/dist/bootstrap.js

@@ -1,4 +1,4 @@
-import { D as isMonotonicAuth, T as DEFAULT_AUTH, t as createCortextPlugin } from "./src-DJA6hyG-.js";
+import { D as isMonotonicAuth, T as DEFAULT_AUTH, t as createCortextPlugin } from "./src-4GYqbw6S.js";
 import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE } from "./plugin-BtBVkZpZ.js";
 import "./kernel.js";
 import { defineBootstrap } from "@mnmal-ai/substrate/sdk";

package/dist/index.js

@@ -1,4 +1,4 @@
-import { C as registerCompactRoute, D as isMonotonicAuth, E as buildAuthPolicies, S as buildClaudeNamespace, T as DEFAULT_AUTH, _ as TASK_STATUS_VOCAB, a as classSatisfies, b as TODO_STATUS_IMPLIES, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_RESOLUTION_ALIASES, w as runCompact, x as buildArchitectureNamespace, y as TODO_STATUS_ALIASES } from "./src-DJA6hyG-.js";
+import { C as registerCompactRoute, D as isMonotonicAuth, E as buildAuthPolicies, S as buildClaudeNamespace, T as DEFAULT_AUTH, _ as TASK_STATUS_VOCAB, a as classSatisfies, b as TODO_STATUS_IMPLIES, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_RESOLUTION_ALIASES, w as runCompact, x as buildArchitectureNamespace, y as TODO_STATUS_ALIASES } from "./src-4GYqbw6S.js";
 import { _ as AGENT_MESSAGE_STATUS_VOCAB } from "./plugin-BtBVkZpZ.js";
 import "./kernel.js";
 

package/dist/participants.d.ts

@@ -11,7 +11,15 @@
  * An operator is an identity granted `admin` (or `*`) in this namespace.
  */
 import type { NamespaceInstallContext, RegistryEntryResolver, RequestContext } from '@mnmal-ai/substrate/sdk';
-/** Whether the caller holds `admin` (or `*`) in the namespace it is calling. */
+/**
+ * Whether `identity` is an operator: it holds `admin` (or `*`) in `namespace`,
+ * or the deployment admin capability (`SUBSTRATE_ADMIN_CAPABILITY`, default
+ * `admin`) in `_system`, as substrate's own admin gate reads it.
+ */
+export declare function isOperatorIdentity(identity: RequestContext['identity'], namespace: string, env?: {
+    SUBSTRATE_ADMIN_CAPABILITY?: string;
+}): boolean;
+/** Whether the caller is an operator in the namespace it is calling. */
 export declare function isOperator(ctx: RequestContext): boolean;
 /**
  * AgentMessage update/delete: the sender, the recipient, or an operator.

package/dist/{src-DJA6hyG-.js → src-4GYqbw6S.js}

@@ -1,5 +1,5 @@
 import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE, _ as AGENT_MESSAGE_STATUS_VOCAB, b as TODO_RESOLUTION_VOCAB, j as CORTEXT_PROMOTED_COLUMNS, k as CORTEXT_COORDINATOR_NAME, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_LIFECYCLE_VOCAB, y as TODO_PRIORITY_VOCAB } from "./plugin-BtBVkZpZ.js";
-import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, and, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
+import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, SYSTEM_NAMESPACE, and, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
 
 //#region src/auth-policy.ts
 /**
@@ -40,6 +40,154 @@ function buildAuthPolicies(auth) {
 	return [];
 }
 
+//#endregion
+//#region src/participants.ts
+/**
+* Whether `identity` is an operator: it holds `admin` (or `*`) in `namespace`,
+* or the deployment admin capability (`SUBSTRATE_ADMIN_CAPABILITY`, default
+* `admin`) in `_system`, as substrate's own admin gate reads it.
+*/
+function isOperatorIdentity(identity, namespace, env = process.env) {
+	const grant = grantOf(identity);
+	const caps = grantedIn(grant, namespace);
+	if (caps.includes("admin") || caps.includes("*")) return true;
+	const adminCap = env.SUBSTRATE_ADMIN_CAPABILITY || "admin";
+	const system = grantedIn(grant, SYSTEM_NAMESPACE);
+	return system.includes(adminCap) || system.includes("*");
+}
+/** Whether the caller is an operator in the namespace it is calling. */
+function isOperator(ctx) {
+	return isOperatorIdentity(ctx.identity, ctx.namespace);
+}
+function rowId(args) {
+	const raw = args.params?.id;
+	return typeof raw === "string" || typeof raw === "number" ? raw : void 0;
+}
+function callerKid(ctx) {
+	const id = ctx.identity?.id;
+	return typeof id === "string" && id !== "" ? id : null;
+}
+/**
+* AgentMessage update/delete: the sender, the recipient, or an operator.
+* The sender is the key that signed the send (`_metadata.createdBy`); the
+* recipient is the kid on the addressed directory row. Archiving someone
+* else's mail hides it from their inbox, and deleting it destroys it, so
+* neither is a bystander's call.
+*/
+function messageParticipantsOnly(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const id = rowId(args);
+		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
+		const ds = args.dataset ?? installCtx.dataset;
+		const message = await resolveEntityRow(ds, "AgentMessage", id);
+		if (message === null) return inner(ctx, args);
+		const caller = callerKid(ctx);
+		const sender = message._metadata?.createdBy?.id;
+		let recipient = null;
+		if (typeof message.recipient === "string" && message.recipient !== "") {
+			const { rows } = await ds.read("AgentIdentity", { id: message.recipient });
+			recipient = rows[0]?.kid ?? null;
+		}
+		if (caller !== null && (caller === sender || caller === recipient)) return inner(ctx, args);
+		throw new ResolverFrameError("not_participant", `${name}: only this message's sender ('${String(sender ?? "unknown")}') or recipient ('${String(recipient ?? "unknown")}'), or an operator, may change or delete it`, { id: message.id });
+	};
+}
+/**
+* Whether `host` names the machine in `kid`'s `@host` part, ignoring case.
+* A kid with no `@` names no machine, so it may carry no host.
+*/
+function hostMatchesKid(host, kid) {
+	if (host === void 0 || host === null) return true;
+	if (typeof kid !== "string" || !kid.includes("@")) return false;
+	return String(host).toLowerCase() === kid.slice(kid.lastIndexOf("@") + 1).toLowerCase();
+}
+function refuseForeignHost(name, host, kid) {
+	if (hostMatchesKid(host, kid)) return;
+	throw new ResolverFrameError("operator_only", `${name}: 'host' must be the machine in the kid ('${String(kid)}'); only an operator may set another`, { field: "host" });
+}
+/**
+* AgentIdentity create: a non-operator may not file a row whose `host` is a
+* machine other than the one its kid names. The fleet audit trusts `host`
+* (and `roaming` on that host) when it decides who may write a host's
+* HostInstall rows.
+*/
+function identityCreateGuard(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const params = args.params ?? {};
+		if (!isOperator(ctx)) refuseForeignHost(name, params.host, params.kid);
+		if (typeof params.kid === "string") {
+			const { rows } = await (args.dataset ?? installCtx.dataset).read("AgentIdentity", {
+				where: { kid: { eq: params.kid } },
+				limit: 1
+			});
+			if (rows.length > 0) throw new ResolverFrameError("duplicate_kid", `${name}: an AgentIdentity row for '${params.kid}' already exists; update it instead`, { field: "kid" });
+		}
+		return inner(ctx, args);
+	};
+}
+/**
+* AgentIdentity update: the identity itself (the caller's kid is the row's
+* kid) or an operator. `kid` is the row's identity, so changing it is an
+* operator act even on your own row: otherwise a row could be renamed onto a
+* kid whose mail it would then receive. `host` must stay the kid's machine,
+* and reactivating a retired row is an operator act.
+*/
+function identitySelfOnly(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const id = rowId(args);
+		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
+		const ds = args.dataset ?? installCtx.dataset;
+		const row = await resolveEntityRow(ds, "AgentIdentity", id);
+		if (row === null) return inner(ctx, args);
+		const params = args.params ?? {};
+		if ("kid" in params && params.kid !== row.kid) throw new ResolverFrameError("operator_only", `${name}: 'kid' is the row's identity and only an operator may change it`, { field: "kid" });
+		if (callerKid(ctx) === row.kid) {
+			if ("host" in params || "roaming" in params || "project" in params) refuseForeignHost(name, "host" in params ? params.host : row.host, row.kid);
+			if (params.active === true && row.active === false) throw new ResolverFrameError("operator_only", `${name}: a retired identity may only be reactivated by an operator`, { field: "active" });
+			return inner(ctx, args);
+		}
+		throw new ResolverFrameError("not_self", `${name}: only '${String(row.kid)}' itself, or an operator, may edit this identity row`, { id: row.id });
+	};
+}
+/**
+* Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
+* Todo carries none. A resolution with a live resulting status is refused,
+* and moving a Todo back to a live status clears the one it had.
+*/
+function todoResolutionGuard(installCtx, name, inner, statusAliases) {
+	const canon = (v) => {
+		const s = String(v).trim().toLowerCase();
+		return statusAliases[s] ?? s;
+	};
+	return async (ctx, args) => {
+		const params = { ...args.params ?? {} };
+		const statusGiven = params.status !== void 0 && params.status !== null;
+		let resulting = statusGiven ? canon(params.status) : null;
+		let current = null;
+		const id = rowId(args);
+		if (id !== void 0) {
+			const ds = args.dataset ?? installCtx.dataset;
+			current = await resolveEntityRow(ds, "Todo", id);
+			if (resulting === null && current !== null) resulting = canon(current.status);
+		}
+		if (resulting === null) resulting = "open";
+		if (resulting === "closed") return inner(ctx, args);
+		if (params.resolution !== void 0 && params.resolution !== null) throw new ResolverFrameError("resolution_on_live_todo", `${name}: 'resolution' is for closed Todos; this one would be '${resulting}'`, { field: "resolution" });
+		if (statusGiven && current !== null && current.resolution != null && !("resolution" in params)) params.resolution = null;
+		return inner(ctx, {
+			...args,
+			params
+		});
+	};
+}
+/** AgentIdentity delete: operators only. Mail hangs off these rows. */
+function operatorOnly(name, inner) {
+	return async (ctx, args) => {
+		if (isOperator(ctx)) return inner(ctx, args);
+		throw new ResolverFrameError("operator_only", `${name}: only an operator may delete an identity row; retire it with active: false instead`, {});
+	};
+}
+
 //#endregion
 //#region src/compact.ts
 /**
@@ -173,10 +321,9 @@ function parseBody(req) {
 function registerCompactRoute(router, ctx, retention, namespace, auth = DEFAULT_AUTH) {
 	router.post("/compact", async (req) => {
 		if (auth.writes === "identity") {
-			const caps = grantedIn(grantOf(req.identity ?? null), namespace);
-			if (!caps.includes("admin") && !caps.includes("*")) return jsonResponse(403, {
+			if (!isOperatorIdentity(req.identity ?? null, namespace)) return jsonResponse(403, {
 				code: "operator_only",
-				message: `POST /compact archives across every project and needs an operator (admin in '${namespace}')`
+				message: `POST /compact archives across every project and needs an operator (admin in '${namespace}', or the deployment admin)`
 			});
 		}
 		const parsed = parseBody(req);
@@ -258,142 +405,6 @@ function reportUncoveredNamespaces(cfg, metric, warn = console.warn) {
 	return uncovered;
 }
 
-//#endregion
-//#region src/participants.ts
-/** Whether the caller holds `admin` (or `*`) in the namespace it is calling. */
-function isOperator(ctx) {
-	const caps = grantedIn(grantOf(ctx.identity), ctx.namespace);
-	return caps.includes("admin") || caps.includes("*");
-}
-function rowId(args) {
-	const raw = args.params?.id;
-	return typeof raw === "string" || typeof raw === "number" ? raw : void 0;
-}
-function callerKid(ctx) {
-	const id = ctx.identity?.id;
-	return typeof id === "string" && id !== "" ? id : null;
-}
-/**
-* AgentMessage update/delete: the sender, the recipient, or an operator.
-* The sender is the key that signed the send (`_metadata.createdBy`); the
-* recipient is the kid on the addressed directory row. Archiving someone
-* else's mail hides it from their inbox, and deleting it destroys it, so
-* neither is a bystander's call.
-*/
-function messageParticipantsOnly(installCtx, name, inner) {
-	return async (ctx, args) => {
-		const id = rowId(args);
-		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
-		const ds = args.dataset ?? installCtx.dataset;
-		const message = await resolveEntityRow(ds, "AgentMessage", id);
-		if (message === null) return inner(ctx, args);
-		const caller = callerKid(ctx);
-		const sender = message._metadata?.createdBy?.id;
-		let recipient = null;
-		if (typeof message.recipient === "string" && message.recipient !== "") {
-			const { rows } = await ds.read("AgentIdentity", { id: message.recipient });
-			recipient = rows[0]?.kid ?? null;
-		}
-		if (caller !== null && (caller === sender || caller === recipient)) return inner(ctx, args);
-		throw new ResolverFrameError("not_participant", `${name}: only this message's sender ('${String(sender ?? "unknown")}') or recipient ('${String(recipient ?? "unknown")}'), or an operator, may change or delete it`, { id: message.id });
-	};
-}
-/**
-* Whether `host` names the machine in `kid`'s `@host` part, ignoring case.
-* A kid with no `@` names no machine, so it may carry no host.
-*/
-function hostMatchesKid(host, kid) {
-	if (host === void 0 || host === null) return true;
-	if (typeof kid !== "string" || !kid.includes("@")) return false;
-	return String(host).toLowerCase() === kid.slice(kid.lastIndexOf("@") + 1).toLowerCase();
-}
-function refuseForeignHost(name, host, kid) {
-	if (hostMatchesKid(host, kid)) return;
-	throw new ResolverFrameError("operator_only", `${name}: 'host' must be the machine in the kid ('${String(kid)}'); only an operator may set another`, { field: "host" });
-}
-/**
-* AgentIdentity create: a non-operator may not file a row whose `host` is a
-* machine other than the one its kid names. The fleet audit trusts `host`
-* (and `roaming` on that host) when it decides who may write a host's
-* HostInstall rows.
-*/
-function identityCreateGuard(installCtx, name, inner) {
-	return async (ctx, args) => {
-		const params = args.params ?? {};
-		if (!isOperator(ctx)) refuseForeignHost(name, params.host, params.kid);
-		if (typeof params.kid === "string") {
-			const { rows } = await (args.dataset ?? installCtx.dataset).read("AgentIdentity", {
-				where: { kid: { eq: params.kid } },
-				limit: 1
-			});
-			if (rows.length > 0) throw new ResolverFrameError("duplicate_kid", `${name}: an AgentIdentity row for '${params.kid}' already exists; update it instead`, { field: "kid" });
-		}
-		return inner(ctx, args);
-	};
-}
-/**
-* AgentIdentity update: the identity itself (the caller's kid is the row's
-* kid) or an operator. `kid` is the row's identity, so changing it is an
-* operator act even on your own row: otherwise a row could be renamed onto a
-* kid whose mail it would then receive. `host` must stay the kid's machine,
-* and reactivating a retired row is an operator act.
-*/
-function identitySelfOnly(installCtx, name, inner) {
-	return async (ctx, args) => {
-		const id = rowId(args);
-		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
-		const ds = args.dataset ?? installCtx.dataset;
-		const row = await resolveEntityRow(ds, "AgentIdentity", id);
-		if (row === null) return inner(ctx, args);
-		const params = args.params ?? {};
-		if ("kid" in params && params.kid !== row.kid) throw new ResolverFrameError("operator_only", `${name}: 'kid' is the row's identity and only an operator may change it`, { field: "kid" });
-		if (callerKid(ctx) === row.kid) {
-			if ("host" in params || "roaming" in params || "project" in params) refuseForeignHost(name, "host" in params ? params.host : row.host, row.kid);
-			if (params.active === true && row.active === false) throw new ResolverFrameError("operator_only", `${name}: a retired identity may only be reactivated by an operator`, { field: "active" });
-			return inner(ctx, args);
-		}
-		throw new ResolverFrameError("not_self", `${name}: only '${String(row.kid)}' itself, or an operator, may edit this identity row`, { id: row.id });
-	};
-}
-/**
-* Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
-* Todo carries none. A resolution with a live resulting status is refused,
-* and moving a Todo back to a live status clears the one it had.
-*/
-function todoResolutionGuard(installCtx, name, inner, statusAliases) {
-	const canon = (v) => {
-		const s = String(v).trim().toLowerCase();
-		return statusAliases[s] ?? s;
-	};
-	return async (ctx, args) => {
-		const params = { ...args.params ?? {} };
-		const statusGiven = params.status !== void 0 && params.status !== null;
-		let resulting = statusGiven ? canon(params.status) : null;
-		let current = null;
-		const id = rowId(args);
-		if (id !== void 0) {
-			const ds = args.dataset ?? installCtx.dataset;
-			current = await resolveEntityRow(ds, "Todo", id);
-			if (resulting === null && current !== null) resulting = canon(current.status);
-		}
-		if (resulting === null) resulting = "open";
-		if (resulting === "closed") return inner(ctx, args);
-		if (params.resolution !== void 0 && params.resolution !== null) throw new ResolverFrameError("resolution_on_live_todo", `${name}: 'resolution' is for closed Todos; this one would be '${resulting}'`, { field: "resolution" });
-		if (statusGiven && current !== null && current.resolution != null && !("resolution" in params)) params.resolution = null;
-		return inner(ctx, {
-			...args,
-			params
-		});
-	};
-}
-/** AgentIdentity delete: operators only. Mail hangs off these rows. */
-function operatorOnly(name, inner) {
-	return async (ctx, args) => {
-		if (isOperator(ctx)) return inner(ctx, args);
-		throw new ResolverFrameError("operator_only", `${name}: only an operator may delete an identity row; retire it with active: false instead`, {});
-	};
-}
-
 //#endregion
 //#region src/mailbox.ts
 const TYPE = "AgentMessage";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnmal-ai/cortext",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.12",
   "description": "Cortext: the agent-neutral coordination context store for Substrate (Todos, Decisions, SessionLogs, AgentRules, Memory, Concepts, Councils, …) plus architecture findings. One package carrying two plugins: the coordinator that registers the namespaces, and the kernel plugin that owns their Postgres invariants.",
   "license": "Apache-2.0",
   "repository": {