@open-everywhere/core 0.1.0

package/dist/agent/access/admin-read-venue.js

@@ -0,0 +1,109 @@
+// The venue fence for org-wide admin memory reads: an ARMED governance channel or the asker's own DM gets the org-wide view, any other room is narrowed to its own domain, and otherwise the answer is redirected with no substance rendered. It only ever REMOVES reach, and membership is never standing.
+import { appendAudit } from "../audit/audit.js";
+import { bindFrom } from "../identity/binding.js";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { getConfig } from "./config.js";
+import { domainForChannel, isGovernanceChannel } from "../memory/domain.js";
+import { attestGovernanceChannel } from "./audience-floor.js";
+import { governanceRedirectTarget, PaneRedirectError } from "./pane-venue.js";
+/** The `adminControlRoles` role meaning "org admin" (control/auth.ts's ROLE CONVENTION). */
+const ORG_ROLE = "admin";
+const DOMAIN_ROLE_PREFIX = "domain:";
+/** The pure venue decision: an armed governance channel, then the asker's DM, then this room's explicit domain when the asker administers it, else a redirect. A breached floor is an ordinary room, and step 3 narrows an org admin to exactly `domain:<room>`. */
+export function classifyAdminReadVenue(input) {
+    if (input.isGovernanceChannel && input.attestation?.armed) {
+        return { placement: "org-wide", via: "governance-channel", roles: input.roles };
+    }
+    if (input.isRequesterDm) {
+        return { placement: "org-wide", via: "requester-dm", roles: input.roles };
+    }
+    const room = input.roomDomain;
+    if (room !== undefined && room.length > 0) {
+        const covers = input.roles.includes(ORG_ROLE) || input.roles.includes(`${DOMAIN_ROLE_PREFIX}${room}`);
+        if (covers)
+            return { placement: "domain-scoped", domain: room, roles: [`${DOMAIN_ROLE_PREFIX}${room}`] };
+    }
+    if (input.governanceChannel)
+        return { placement: "redirect", target: "governance-channel", channel: input.governanceChannel };
+    return { placement: "redirect", target: "requester-dm" };
+}
+/** The model-facing copy for a room that may hear nothing this asker holds. Never carries substance. */
+function adminReadRedirectDirective(target, channel, kind) {
+    const where = target === "governance-channel"
+        ? `Ask again in the governance channel ${channel}, or in a DM with me`
+        : "Ask again in a DM with me (or configure a governance domain to give the whole admin team a shared venue)";
+    return (`that's org-wide admin memory output (${kind}) — a map of memory beyond this room's own domain — so it can't be answered here, ` +
+        `whatever standing you hold. ${where}. Reply here only with that pointer, and render NONE of the substance in this channel ` +
+        `(partial disclosure is still disclosure).`);
+}
+/** The note a NARROWED answer carries, so the model never presents a partial map as the whole one. */
+function adminReadNarrowedNote(domain, target, channel) {
+    const where = target === "governance-channel" ? `the governance channel ${channel}` : "a DM with me";
+    return (`Narrowed to this room's own domain ("${domain}") — this is NOT the org-wide view, and other domains' silos are omitted. ` +
+        `Say so when you answer, and point at ${where} for the org-wide map.`);
+}
+/** Classify this turn's venue for an admin memory read; it never throws and never audits. `principalId` is passed in rather than re-derived, because re-reading the binding could pick a DIFFERENT person from the one whose roles were checked. */
+async function resolveAdminReadVenue(ctx, input) {
+    const domains = getConfig().loadDomains();
+    const b = bindFrom(ctx);
+    const part = resolvePartition(ctx);
+    const coords = { org: part.org, platform: part.platform, workspace: part.workspace, surface: part.surface };
+    // The GOVERNANCE check reads `surfaceKey` — the same grain access/pane-venue.ts uses, and the
+    // fail-CLOSED one: a Discord thread under a governance channel does not itself resolve as the
+    // governance room, so it narrows rather than widening.
+    const isGov = isGovernanceChannel(part.surfaceKey, domains);
+    const attestation = isGov ? await attestGovernanceChannel(part.surfaceKey, domains, { ...coords, principalId: b.principalId }) : undefined;
+    // The ROOM'S DOMAIN reads the DOMAIN grain (`domainKeyOf` — a Discord thread resolves via its
+    // parent channel), matching access/roles.ts's own channelKey. This one may only NARROW, so the
+    // wider grain costs nothing: it decides which single domain the answer is cut down to.
+    const roomDomain = domainForChannel(domainKeyOf(part), domains)?.name;
+    // ONE resolution of the redirect target, shared with access/pane-venue.ts — including its
+    // `OE_ACCESS_ADMIN_CHANNEL` fallback — so both planes always point at the same room.
+    const governanceChannel = governanceRedirectTarget(domains);
+    const decision = classifyAdminReadVenue({
+        roles: input.roles,
+        isRequesterDm: b.mode === "dm",
+        isGovernanceChannel: isGov,
+        attestation,
+        roomDomain,
+        governanceChannel,
+    });
+    return { decision, channelKey: part.surfaceKey, principalId: input.principalId, coords, governanceChannel };
+}
+/** The venue half of the gate — call it right AFTER the role gate; that composition IS the dual gate. It returns the EFFECTIVE roles the read may spend, always a subset of what was passed in, and throws {@link PaneRedirectError} when the room may hear nothing. */
+export async function requireAdminReadVenue(ctx, input) {
+    const r = await resolveAdminReadVenue(ctx, input);
+    const decision = r.decision;
+    if (decision.placement === "redirect") {
+        await auditAdminReadVenue(r, input.kind);
+        throw new PaneRedirectError(adminReadRedirectDirective(decision.target, decision.channel, input.kind), decision.target, decision.channel);
+    }
+    if (decision.placement === "domain-scoped") {
+        await auditAdminReadVenue(r, input.kind);
+        const target = r.governanceChannel ? "governance-channel" : "requester-dm";
+        return { roles: decision.roles, decision, note: adminReadNarrowedNote(decision.domain, target, r.governanceChannel) };
+    }
+    return { roles: decision.roles, decision };
+}
+/** Stamp the audit row for a fenced admin read. TWO actions, because they are two different events: a redirect renders nothing and reuses pane-venue's `governance.redirected`, while a narrowed read renders real content at a smaller grain and gets its own `governance.narrowed`. */
+async function auditAdminReadVenue(r, kind) {
+    const decision = r.decision;
+    if (decision.placement === "domain-scoped") {
+        await appendAudit({
+            ...r.coords,
+            principalId: r.principalId,
+            action: "governance.narrowed",
+            detail: { kind, from: r.channelKey, domain: decision.domain, roles: decision.roles },
+        });
+        return;
+    }
+    if (decision.placement !== "redirect")
+        return; // an org-wide venue fences nothing — nothing to stamp
+    await appendAudit({
+        ...r.coords,
+        principalId: r.principalId,
+        action: "governance.redirected",
+        detail: { kind, from: r.channelKey, to: decision.target, ...(decision.channel ? { channel: decision.channel } : {}) },
+    });
+}
+//# sourceMappingURL=admin-read-venue.js.map

package/dist/agent/access/admin-read-venue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-read-venue.js","sourceRoot":"","sources":["../../../agent/access/admin-read-venue.ts"],"names":[],"mappings":"AAAA,4SAA4S;AAE5S,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAwB,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAyB,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,OAAO,CAAC;AACzB,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAyBrC,oQAAoQ;AACpQ,MAAM,UAAU,sBAAsB,CAAC,KAA0B;IAC/D,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAC1D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,kBAAkB,GAAG,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,MAAM;YAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB;QAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IAC9H,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED,wGAAwG;AACxG,SAAS,0BAA0B,CAAC,MAA6C,EAAE,OAA2B,EAAE,IAAY;IAC1H,MAAM,KAAK,GACT,MAAM,KAAK,oBAAoB;QAC7B,CAAC,CAAC,uCAAuC,OAAO,sBAAsB;QACtE,CAAC,CAAC,0GAA0G,CAAC;IACjH,OAAO,CACL,wCAAwC,IAAI,oFAAoF;QAChI,+BAA+B,KAAK,wFAAwF;QAC5H,2CAA2C,CAC5C,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,qBAAqB,CAAC,MAAc,EAAE,MAA6C,EAAE,OAA2B;IACvH,MAAM,KAAK,GAAG,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACrG,OAAO,CACL,wCAAwC,MAAM,4EAA4E;QAC1H,wCAAwC,KAAK,wBAAwB,CACtE,CAAC;AACJ,CAAC;AAYD,oPAAoP;AACpP,KAAK,UAAU,qBAAqB,CAClC,GAAoB,EACpB,KAA2E;IAE3E,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAE5G,8FAA8F;IAC9F,8FAA8F;IAC9F,uDAAuD;IACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,8FAA8F;IAC9F,+FAA+F;IAC/F,uFAAuF;IACvF,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;IACtE,0FAA0F;IAC1F,qFAAqF;IACrF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI;QAC9B,mBAAmB,EAAE,KAAK;QAC1B,WAAW;QACX,UAAU;QACV,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAC9G,CAAC;AAED,wQAAwQ;AACxQ,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAoB,EACpB,KAAkG;IAElG,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QAC3C,MAAM,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,MAAM,GAA0C,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC;QAClH,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,yRAAyR;AACzR,KAAK,UAAU,mBAAmB,CAAC,CAA2B,EAAE,IAAY;IAC1E,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC;YAChB,GAAG,CAAC,CAAC,MAAM;YACX,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;SACrF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,CAAC,sDAAsD;IACrG,MAAM,WAAW,CAAC;QAChB,GAAG,CAAC,CAAC,MAAM;QACX,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACtH,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/access/admin-standing.d.ts

@@ -0,0 +1,16 @@
+import { type BindableContext, type SurfaceBinding } from "../identity/binding.js";
+export type AdminSubject = {
+    readonly ok: true;
+    readonly principalId: string;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/**
+ * WHOSE standing this turn may spend on an admin-only action. Call this instead of
+ * `actingPrincipalId(binding)` anywhere an id is about to be matched against an admin roster.
+ */
+export declare function adminStandingSubject(binding: SurfaceBinding, ctx?: BindableContext): AdminSubject;
+/** The subject to serve a several-askers turn under when EVERY candidate holds org-admin standing, or `undefined`, which refuses. Fail-closed at every step: fewer than two candidates, no `org` pseudo-domain, an empty roster, one candidate the roster does not admit, or an unreadable config all answer `undefined`. */
+export declare function sharedOrgAdminSubject(binding: SurfaceBinding, acting: string | undefined, candidates: readonly string[] | undefined): string | undefined;
+//# sourceMappingURL=admin-standing.d.ts.map

package/dist/agent/access/admin-standing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-standing.d.ts","sourceRoot":"","sources":["../../../agent/access/admin-standing.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoC,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMrH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AA+BlI;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,eAAe,GAAG,YAAY,CA4BjG;AAED,6TAA6T;AAC7T,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CAkBpB"}

package/dist/agent/access/admin-standing.js

@@ -0,0 +1,89 @@
+// An admin gate checks the standing of the VERIFIED REQUESTER, not the acting principal, and refuses when it cannot name them; the refusal says the caller could not be verified, never "you are not an admin". One exception: when EVERY candidate asker of a coalesced turn is on the `org` admins roster the answer is identical whichever asked, so the turn is served under a deterministic pick of them.
+// The ACTING principal is the subject on ONE seat only — the `open` seat, which is a per-surface session, a script, or the control plane, and any context the classifier cannot place. Every other seat can be woken by more than one person, so an absent record there refuses rather than falling back to whichever delivery's auth the turn carries.
+import { actingPrincipalId, currentTurnId } from "../identity/binding.js";
+import { requesterThisTurn, seatServesManyAskers } from "./requester-identity.js";
+import { rosterHasPrincipal } from "../identity/principal-key.js";
+import { criteriaDomain } from "../memory/domain.js";
+import { getConfig } from "./config.js";
+/** The refusal when nobody is acting. One string, so an operator meets the same sentence at every
+ *  admin gate (identity/link-tenant.ts's convention). */
+const ADMIN_NO_ACTING_MESSAGE = "No verified sender id on this turn — no acting principal resolved, so there is no caller to check admin standing for.";
+/** The reason a turn that left NO requester record at all carries. The capture is best-effort
+ *  (hooks/requester-identity.ts swallows its own failures) and TURN-KEYED (requesterThisTurn drops a
+ *  record another turn wrote), so "no record" is reachable on a live seat and means exactly one
+ *  thing: nothing on this turn says whose ask it is. */
+const ADMIN_NO_RECORD_REASON = "nothing on this turn recorded who asked, and this seat can be woken by more than one person, so the only id left is whichever delivery's auth the turn happens to carry";
+/** The remedy for a COALESCED turn: the room settling is what un-coalesces it. */
+const COALESCED_TAIL = "Ask again on its own — in a thread, or once the other work in this room has settled.";
+/** The remedy for a MISSING record. Deliberately NOT the coalesced tail: a record that was never
+ *  written does not appear when the room goes quiet, so sending the caller to wait it out is a loop.
+ *  The capture is host-side, so a repeat is an operator's problem, not the asker's. */
+const NO_RECORD_TAIL = "Ask again in a fresh message. If it keeps happening, tell an operator — this one is the host's to fix, not yours.";
+/** The refusal when somebody IS acting but the gate cannot tie this turn to their ask. */
+function adminUnverifiedMessage(reason, tail = COALESCED_TAIL) {
+    return (`this action needs to know who asked, and this turn cannot say: ${reason}. ` +
+        "Admin standing is checked against the person who asked, never against whoever else this session was serving, so it is refused rather than guessed. " +
+        tail);
+}
+/**
+ * WHOSE standing this turn may spend on an admin-only action. Call this instead of
+ * `actingPrincipalId(binding)` anywhere an id is about to be matched against an admin roster.
+ */
+export function adminStandingSubject(binding, ctx) {
+    // principal-gate: presence — a HUMAN must be here, acting. A fire must NOT satisfy this, whatever
+    // its rendered envelope names, so the ACTING principal is read first and its absence refuses
+    // outright (OPE-269).
+    const acting = actingPrincipalId(binding);
+    if (!acting)
+        return { ok: false, message: ADMIN_NO_ACTING_MESSAGE };
+    // The ctx is passed so the verdict can be TURN-KEYED — see requesterThisTurn. A caller that has
+    // no ctx (the matrix tests) simply gets the unkeyed read, which is what it had before.
+    const requester = requesterThisTurn(ctx === undefined ? undefined : currentTurnId(ctx));
+    if (requester.kind === "requester")
+        return { ok: true, principalId: requester.principalId };
+    if (requester.kind === "unverified") {
+        const shared = sharedOrgAdminSubject(binding, acting, requester.candidates);
+        if (shared !== undefined)
+            return { ok: true, principalId: shared };
+        return { ok: false, message: adminUnverifiedMessage(requester.reason) };
+    }
+    // 🔴 `none` — NO record for this turn, which is NOT the same as "one asker, so the acting
+    // principal is them". requesterVerdictFor already refuses on a `child`, `worker` or `room` seat,
+    // so a `none` HERE means the record is missing or belongs to another turn: the capture threw, or
+    // the tool ran on a turn no `message.received` opened. Serving that under the acting principal is
+    // the OPE-673 escalation itself — a standing seat's auth is one delivery's, and an admin who spoke
+    // on the window earlier is exactly whose id it carries. Only an `open` seat serves ONE asker, so
+    // only there is the acting principal an honest answer. A caller with no ctx (the matrix tests)
+    // keeps the unkeyed read it had before.
+    // 🔴 `seatServesManyAskers`, NOT `requesterSeatOf`: this runs inside a tool's execute, where
+    // `ctx.channel` is absent, so the plain classifier would read every window seat as `open` and this
+    // fence would never fire on the road it exists for.
+    if (ctx !== undefined && seatServesManyAskers(ctx))
+        return { ok: false, message: adminUnverifiedMessage(ADMIN_NO_RECORD_REASON, NO_RECORD_TAIL) };
+    return { ok: true, principalId: acting };
+}
+/** The subject to serve a several-askers turn under when EVERY candidate holds org-admin standing, or `undefined`, which refuses. Fail-closed at every step: fewer than two candidates, no `org` pseudo-domain, an empty roster, one candidate the roster does not admit, or an unreadable config all answer `undefined`. */
+export function sharedOrgAdminSubject(binding, acting, candidates) {
+    if (candidates === undefined || candidates.length < 2)
+        return undefined;
+    let admins;
+    try {
+        admins = criteriaDomain("org", getConfig().loadDomains())?.admins;
+    }
+    catch {
+        return undefined; // no registered config (a unit caller) — decline, never guess
+    }
+    if (admins === undefined || admins.length === 0)
+        return undefined;
+    // 🔴 EXACT-ID, EXACT-WORKSPACE — the same roster primitive access/roles.ts uses, so this rule can
+    // never admit an id shape the ordinary admin gate would reject.
+    for (const id of candidates) {
+        if (!rosterHasPrincipal(admins, binding.platform, binding.workspace, id))
+            return undefined;
+    }
+    // Deterministic pick. The acting principal is the candidate whose delivery the turn's auth
+    // carries, so it is the most truthful of the equals; the sorted first id is the stable fallback.
+    const sorted = [...candidates].sort();
+    return acting !== undefined && candidates.includes(acting) ? acting : sorted[0];
+}
+//# sourceMappingURL=admin-standing.js.map

package/dist/agent/access/admin-standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-standing.js","sourceRoot":"","sources":["../../../agent/access/admin-standing.ts"],"names":[],"mappings":"AAAA,+YAA+Y;AAC/Y,wVAAwV;AAExV,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAA6C,MAAM,wBAAwB,CAAC;AACrH,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC;yDACyD;AACzD,MAAM,uBAAuB,GAC3B,uHAAuH,CAAC;AAE1H;;;wDAGwD;AACxD,MAAM,sBAAsB,GAC1B,yKAAyK,CAAC;AAE5K,kFAAkF;AAClF,MAAM,cAAc,GAAG,sFAAsF,CAAC;AAE9G;;uFAEuF;AACvF,MAAM,cAAc,GAAG,mHAAmH,CAAC;AAE3I,0FAA0F;AAC1F,SAAS,sBAAsB,CAAC,MAAc,EAAE,IAAI,GAAW,cAAc;IAC3E,OAAO,CACL,kEAAkE,MAAM,IAAI;QAC5E,qJAAqJ;QACrJ,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB,EAAE,GAAqB;IACjF,kGAAkG;IAClG,6FAA6F;IAC7F,sBAAsB;IACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACpE,gGAAgG;IAChG,uFAAuF;IACvF,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;IAC5F,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,0FAA0F;IAC1F,iGAAiG;IACjG,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,+FAA+F;IAC/F,wCAAwC;IACxC,6FAA6F;IAC7F,mGAAmG;IACnG,oDAAoD;IACpD,IAAI,GAAG,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,CAAC,sBAAsB,EAAE,cAAc,CAAC,EAAE,CAAC;IAClJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,6TAA6T;AAC7T,MAAM,UAAU,qBAAqB,CACnC,OAAuB,EACvB,MAA0B,EAC1B,UAAyC;IAEzC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,8DAA8D;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,kGAAkG;IAClG,gEAAgE;IAChE,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IAC7F,CAAC;IACD,2FAA2F;IAC3F,iGAAiG;IACjG,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,CAAC,CAAY,CAAC;AAC9F,CAAC"}

package/dist/agent/access/analytics-scope.d.ts

@@ -0,0 +1,24 @@
+import { type BindableContext } from "../identity/binding.js";
+/** What the verified caller may see — the compiled query's non-bypassable envelope. */
+export interface AnalyticsScope {
+    /** From resolvePartition(ctx) — the tenant. NEVER a model input. */
+    readonly org: string;
+    readonly grain: "org" | "domain" | "self";
+    /** The PLATFORM of the verified caller, off the binding and never a model field. Load-bearing on the `self` grain: the stored `principal_id` is a bare vendor id, so the predicate needs the namespace that id lives in. */
+    readonly platform: string;
+    /** grain "domain": the resolved domain name (its channel list is expanded host-side in compile). */
+    readonly domain?: string;
+    /** grain "self": the verified caller — the only principal whose rows they may read. */
+    readonly principalId?: string;
+    /** May this scope list RAW rows (not just aggregates)? Member domain grain = false. */
+    readonly rowMode: boolean;
+    /** May audit `detail` (free JSON) be returned? Org-admin standing only. */
+    readonly auditDetail: boolean;
+    /** May DM surfaces appear UNBUCKETED? Org admin asking from their own DM only. */
+    readonly dmUnmasked: boolean;
+}
+/** Resolve the caller's analytics scope for a requested grain. Throws a model-friendly, fail-closed Error when the standing is not met: org grain without org-admin, a domain grain that resolves to no domain, or no verified principal. */
+export declare function resolveAnalyticsScope(ctx: BindableContext, requested: "org" | "domain" | "self"): AnalyticsScope;
+/** Is THIS turn an ambient, non-addressed supervisor wake? Rows mode degrades to aggregates on one, and that degrade is the only narrowing this predicate drives. Only a standing seat whose wake carried no `direct-mention` is ambient; a DM, native mention, thread seat or one-shot task is a direct interaction. */
+export declare function isAmbientNonAddressedTurn(ctx: BindableContext): boolean;
+//# sourceMappingURL=analytics-scope.d.ts.map

package/dist/agent/access/analytics-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-scope.d.ts","sourceRoot":"","sources":["../../../agent/access/analytics-scope.ts"],"names":[],"mappings":"AAMA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9G,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1C,4NAA4N;IAC5N,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,6OAA6O;AAC7O,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,cAAc,CA2ChH;AAED,yTAAyT;AACzT,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CASvE"}

package/dist/agent/access/analytics-scope.js

@@ -0,0 +1,62 @@
+// `org`, `grain`, `platform`, `domain` and `principalId` all derive from the webhook-verified binding and the sender's standing, never from a model field; a model filter can only AND further conjuncts onto the host-injected scope, never widen it. `dmUnmasked` is true only for an org admin asking at org grain from their own DM — the room is the audience, and domain and self grains never unmask.
+import { resolvePartition } from "../memory/partition.js";
+import { resolveRole, requireOrgAdmin } from "./roles.js";
+import { resolveSkillDomainDetailed } from "../skills/domain-skills.js";
+import { reportDomainRefusalMessage } from "../spend/reporting.js";
+import { bindFrom, currentTurnAddressing, windowGrainOf } from "../identity/binding.js";
+/** Resolve the caller's analytics scope for a requested grain. Throws a model-friendly, fail-closed Error when the standing is not met: org grain without org-admin, a domain grain that resolves to no domain, or no verified principal. */
+export function resolveAnalyticsScope(ctx, requested) {
+    const org = resolvePartition(ctx).org;
+    const role = resolveRole(ctx);
+    // The namespace the acting principal's id lives in — a SURFACE fact off the verified binding,
+    // never inferred from the id's shape (identity/principal-key.ts's standing rule). `role.principalId`
+    // is the acting principal ON THIS SURFACE, so the binding's platform is the one that qualifies it.
+    const platform = bindFrom(ctx).platform;
+    // principal-gate: presence — `Role.principalId` is ALREADY the acting principal (roles.ts
+    // roleForBinding computes it with actingPrincipalId), so this refuses an unattended fire, and that
+    // is the right answer: analytics is about PEOPLE, and every grain here — `self` included — is
+    // defined relative to whoever is asking. A fire has a creator to name but nobody asking.
+    if (!role.principalId) {
+        // Fail-closed: analytics-about-people needs a verified sender (roles.ts NO_ROLE posture). Every
+        // grain — self included — depends on knowing WHO is asking.
+        throw new Error("Analytics needs a verified sender on this turn — none was resolved, so no analytics scope is available.");
+    }
+    if (requested === "self") {
+        // The caller's OWN rows. Injected as principal_id = <ctx principal> host-side; an injected turn
+        // can't widen it beyond the caller (the model is the caller's agent). DM rows stay bucketed for
+        // the room's benefit (dmUnmasked false).
+        return { org, platform, grain: "self", principalId: role.principalId, rowMode: true, auditDetail: false, dmUnmasked: false };
+    }
+    if (requested === "org") {
+        requireOrgAdmin(ctx); // throws a named, model-friendly error otherwise
+        const inOwnDm = bindFrom(ctx).mode === "dm";
+        return { org, platform, grain: "org", rowMode: true, auditDetail: true, dmUnmasked: inOwnDm };
+    }
+    // Resolving a domain IS the read gate at domain grain. Org admins and domain admins also get rows mode and a plain member gets aggregates only; DM surfaces are excluded from domain filtering entirely, so `dmUnmasked` is moot here.
+    const resolved = resolveSkillDomainDetailed(ctx);
+    if (resolved.domain === null)
+        throw new Error(reportDomainRefusalMessage(resolved.reason));
+    return {
+        org,
+        platform,
+        grain: "domain",
+        domain: resolved.domain,
+        rowMode: role.isDomainAdmin, // org admins are domain admins everywhere (roles.ts)
+        auditDetail: role.isOrgAdmin,
+        dmUnmasked: false,
+    };
+}
+/** Is THIS turn an ambient, non-addressed supervisor wake? Rows mode degrades to aggregates on one, and that degrade is the only narrowing this predicate drives. Only a standing seat whose wake carried no `direct-mention` is ambient; a DM, native mention, thread seat or one-shot task is a direct interaction. */
+export function isAmbientNonAddressedTurn(ctx) {
+    let grain;
+    try {
+        grain = windowGrainOf(ctx);
+    }
+    catch {
+        return false; // can't classify — don't over-block (taint + scope standing are the primary gates)
+    }
+    if (grain !== "standing")
+        return false;
+    return currentTurnAddressing(ctx) !== "direct-mention";
+}
+//# sourceMappingURL=analytics-scope.js.map

package/dist/agent/access/analytics-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-scope.js","sourceRoot":"","sources":["../../../agent/access/analytics-scope.ts"],"names":[],"mappings":"AAAA,6YAA6Y;AAE7Y,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AAqB9G,6OAA6O;AAC7O,MAAM,UAAU,qBAAqB,CAAC,GAAoB,EAAE,SAAoC;IAC9F,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,8FAA8F;IAC9F,qGAAqG;IACrG,mGAAmG;IACnG,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAExC,0FAA0F;IAC1F,mGAAmG;IACnG,8FAA8F;IAC9F,yFAAyF;IACzF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,gGAAgG;QAChG,4DAA4D;QAC5D,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IAED,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,gGAAgG;QAChG,gGAAgG;QAChG,yCAAyC;QACzC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/H,CAAC;IAED,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,iDAAiD;QACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAChG,CAAC;IAED,uOAAuO;IACvO,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,OAAO;QACL,GAAG;QACH,QAAQ;QACR,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,qDAAqD;QAClF,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED,yTAAyT;AACzT,MAAM,UAAU,yBAAyB,CAAC,GAAoB;IAC5D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,mFAAmF;IACnG,CAAC;IACD,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,qBAAqB,CAAC,GAAG,CAAC,KAAK,gBAAgB,CAAC;AACzD,CAAC"}

package/dist/agent/access/approval-dedupe.d.ts

@@ -0,0 +1,29 @@
+import type { Approval } from "eve/tools/approval";
+import type { ApprovalPolicy } from "eve/tools/approval";
+/** Namespace prefix — keeps this guard's keys out of any other `event_dedupe` caller's space. */
+export declare const DUPLICATE_APPROVAL_KEY_PREFIX = "approval-pending:";
+/** See the module header's WINDOW note. 5 minutes: comfortably covers a mid-approval follow-up
+ *  message, well under the 10-minute precedent set by the Slack/Teams inbound fronts. */
+export declare const DUPLICATE_APPROVAL_WINDOW_MS: number;
+/** The `hasEventSeen` shape {@link withDuplicateApprovalGuard} depends on (the operational
+ *  store's READ-ONLY twin of `markEventSeen`). Injectable for tests. */
+export type HasEventSeen = (org: string, key: string, atIso: string, ttlMs: number) => Promise<boolean>;
+/** The `markEventSeen` shape {@link recordApprovalRaised} depends on (the operational store's).
+ *  Injectable for tests. */
+export type MarkEventSeen = (org: string, key: string, atIso: string, ttlMs: number) => Promise<boolean>;
+export interface DuplicateApprovalGuardOptions {
+    readonly windowMs?: number;
+    readonly now?: () => number;
+    readonly hasEventSeen?: HasEventSeen;
+}
+/** Wrap an eve `approval` policy so a SECOND ask for the identical (session, tool, input) within the window is DENIED instead of raising a second, independently-approvable card. */
+export declare function withDuplicateApprovalGuard<TInput = Record<string, unknown>>(policy: ApprovalPolicy<TInput>, opts?: DuplicateApprovalGuardOptions): ApprovalPolicy<TInput>;
+export declare function withDuplicateApprovalGuard<TInput = Record<string, unknown>>(policy: Approval<TInput>, opts?: DuplicateApprovalGuardOptions): Approval<TInput>;
+export interface RecordApprovalRaisedOptions {
+    readonly windowMs?: number;
+    readonly now?: () => number;
+    readonly markEventSeen?: MarkEventSeen;
+}
+/** Mark a fingerprint as an OPEN card; the one caller is hooks/approval-raised.ts on eve's `input.requested`, and it must never be called from inside an `approval()` policy. Best-effort: losing a mark lets a later duplicate through as a second card, never a silent denial. */
+export declare function recordApprovalRaised(sessionId: string, toolName: string, toolInput: unknown, opts?: RecordApprovalRaisedOptions): Promise<void>;
+//# sourceMappingURL=approval-dedupe.d.ts.map

package/dist/agent/access/approval-dedupe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-dedupe.d.ts","sourceRoot":"","sources":["../../../agent/access/approval-dedupe.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAmC,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIzD,iGAAiG;AACjG,eAAO,MAAM,6BAA6B,sBAAsB,CAAC;AAEjE;yFACyF;AACzF,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAEvD;wEACwE;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAExG;4BAC4B;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AA0CzG,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAED,qLAAqL;AACrL,wBAAgB,0BAA0B,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAC9B,IAAI,CAAC,EAAE,6BAA6B,GACnC,cAAc,CAAC,MAAM,CAAC,CAAC;AAC1B,wBAAgB,0BAA0B,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EACxB,IAAI,CAAC,EAAE,6BAA6B,GACnC,QAAQ,CAAC,MAAM,CAAC,CAAC;AA+CpB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,oRAAoR;AACpR,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,IAAI,GAAE,2BAAgC,GACrC,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/agent/access/approval-dedupe.js

@@ -0,0 +1,99 @@
+// Denies a SECOND ask for the identical (session, tool, input) within a window, so one action cannot yield two clickable cards; an unrelated re-ask inside the window is denied too. This half only READS the store — the write is in hooks/approval-raised.ts, never inside `approval()` — and it FAILS OPEN.
+import { createHash } from "node:crypto";
+import { deploymentOrg } from "../identity/binding.js";
+import { getOperationalStore } from "../operational/provider.js";
+/** Namespace prefix — keeps this guard's keys out of any other `event_dedupe` caller's space. */
+export const DUPLICATE_APPROVAL_KEY_PREFIX = "approval-pending:";
+/** See the module header's WINDOW note. 5 minutes: comfortably covers a mid-approval follow-up
+ *  message, well under the 10-minute precedent set by the Slack/Teams inbound fronts. */
+export const DUPLICATE_APPROVAL_WINDOW_MS = 5 * 60_000;
+/** Deterministic (sorted-key) JSON so two calls with the same input in different field order
+ *  still fingerprint identically. */
+function stableStringify(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(",")}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+/** Mirrors eve's `resolveToolCallInputObject` (pinned 0.33.3): null, undefined and a blank string resolve to `{}`, a JSON-encoded string is parsed, and anything else passes through. The ONE place both the guard's read and the raise hook's write normalise before fingerprinting. */
+function resolveApprovalFingerprintInput(value) {
+    if (value === null || value === undefined)
+        return {};
+    if (typeof value === "string") {
+        if (value.trim() === "")
+            return {};
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            // Not valid JSON — eve's own resolver would throw here (a malformed tool call). Fingerprint
+            // the raw string itself instead: still deterministic, still distinguishes genuinely
+            // different malformed inputs, and never throws out of a function the guard fail-opens around.
+            return value;
+        }
+    }
+    return value;
+}
+/** The (session, tool, input) fingerprint a duplicate ask must match exactly — a re-proposal with genuinely different input is a different action and is never suppressed. The ONE key builder, so the guard's read and the hook's write cannot drift. */
+function approvalFingerprintKey(sessionId, toolName, toolInput) {
+    const material = `${sessionId}\x00${toolName}\x00${stableStringify(resolveApprovalFingerprintInput(toolInput))}`;
+    const digest = createHash("sha256").update(material).digest("hex");
+    return `${DUPLICATE_APPROVAL_KEY_PREFIX}${digest}`;
+}
+/** True when a decision from an `Approval` function is one that would actually raise a card. */
+function decisionPrompts(decision) {
+    if (decision === true || decision === "user-approval")
+        return true;
+    return typeof decision === "object" && decision !== null && decision.type === "user-approval";
+}
+// approval-chain: exempt — a PASS-THROUGH guard. It authors no verdict of its own: it forwards the
+// wrapped policy's answer and, on a genuine prompt it has already seen, denies the duplicate. So it
+// can only ever narrow, never park a run that the wrapped policy did not already park, and the
+// attendedness question belongs to that policy. `connectorApprovalPolicy` wraps this around
+// `withUnattendedConnectorFence`, which is where the derivation lives (lint:principal-gate rule 5,
+// shape E — OPE-1273).
+export function withDuplicateApprovalGuard(policy, opts = {}) {
+    const windowMs = opts.windowMs ?? DUPLICATE_APPROVAL_WINDOW_MS;
+    const nowFn = opts.now ?? Date.now;
+    const peek = opts.hasEventSeen ?? ((org, key, atIso, ttlMs) => getOperationalStore().hasEventSeen(org, key, atIso, ttlMs));
+    // eve 0.34.0 widened `Approval` from a bare policy function to
+    // `ApprovalPolicy | ApprovalConfiguration`. Guard the REQUEST half of either shape, and hand a
+    // configuration back as a configuration so its optional `response` policy survives the wrap —
+    // flattening to a bare function here would silently drop the responder check.
+    const request = typeof policy === "function" ? policy : policy.request;
+    const guarded = async (ctx) => {
+        const decision = await request(ctx);
+        if (!decisionPrompts(decision))
+            return decision; // only guard a genuine prompt
+        let alreadyOpen = false;
+        try {
+            const key = approvalFingerprintKey(ctx.session.id, ctx.toolName, ctx.toolInput);
+            alreadyOpen = await peek(deploymentOrg(), key, new Date(nowFn()).toISOString(), windowMs);
+        }
+        catch {
+            // FAIL-OPEN: an unresolvable fingerprint (a bare test ctx, a store outage) must never
+            // turn a real request into a silent denial — let the original decision stand.
+            alreadyOpen = false;
+        }
+        if (!alreadyOpen)
+            return decision;
+        return {
+            type: "denied",
+            reason: "An identical action is already awaiting approval on an earlier card. Answer that card " +
+                "(or wait a few minutes and ask again) instead of raising a second, separate one.",
+        };
+    };
+    return typeof policy === "function" ? guarded : { ...policy, request: guarded };
+}
+/** Mark a fingerprint as an OPEN card; the one caller is hooks/approval-raised.ts on eve's `input.requested`, and it must never be called from inside an `approval()` policy. Best-effort: losing a mark lets a later duplicate through as a second card, never a silent denial. */
+export async function recordApprovalRaised(sessionId, toolName, toolInput, opts = {}) {
+    const windowMs = opts.windowMs ?? DUPLICATE_APPROVAL_WINDOW_MS;
+    const nowFn = opts.now ?? Date.now;
+    const mark = opts.markEventSeen ?? ((org, key, atIso, ttlMs) => getOperationalStore().markEventSeen(org, key, atIso, ttlMs));
+    const key = approvalFingerprintKey(sessionId, toolName, toolInput);
+    await mark(deploymentOrg(), key, new Date(nowFn()).toISOString(), windowMs);
+}
+//# sourceMappingURL=approval-dedupe.js.map

package/dist/agent/access/approval-dedupe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-dedupe.js","sourceRoot":"","sources":["../../../agent/access/approval-dedupe.ts"],"names":[],"mappings":"AAAA,+SAA+S;AAE/S,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,iGAAiG;AACjG,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE;yFACyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,MAAM,CAAC;AAUvD;qCACqC;AACrC,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC7F,CAAC;AAED,yRAAyR;AACzR,SAAS,+BAA+B,CAAC,KAAc;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,oFAAoF;YACpF,8FAA8F;YAC9F,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0PAA0P;AAC1P,SAAS,sBAAsB,CAAC,SAAiB,EAAE,QAAgB,EAAE,SAAkB;IACrF,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,QAAQ,OAAO,eAAe,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IACjH,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,GAAG,6BAA6B,GAAG,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,gGAAgG;AAChG,SAAS,eAAe,CAAC,QAAwB;IAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC;AAChG,CAAC;AAiBD,mGAAmG;AACnG,oGAAoG;AACpG,+FAA+F;AAC/F,4FAA4F;AAC5F,mGAAmG;AACnG,uBAAuB;AACvB,MAAM,UAAU,0BAA0B,CACxC,MAAwB,EACxB,IAAI,GAAkC,EAAE;IAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,4BAA4B,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,MAAM,IAAI,GACR,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAEhH,+DAA+D;IAC/D,+FAA+F;IAC/F,8FAA8F;IAC9F,8EAA8E;IAC9E,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,EAAE,GAA4B,EAA2B,EAAE;QAC9E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,8BAA8B;QAE/E,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAChF,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;YACtF,8EAA8E;YAC9E,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EACJ,wFAAwF;gBACxF,kFAAkF;SACrF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClF,CAAC;AAQD,oRAAoR;AACpR,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,QAAgB,EAChB,SAAkB,EAClB,IAAI,GAAgC,EAAE;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,4BAA4B,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,MAAM,IAAI,GACR,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC"}