@open-everywhere/core 0.1.0

package/dist/agent/access/bundle.js

@@ -0,0 +1,454 @@
+// The access-bundle data model: a named bundle groups connections, connectors, work surfaces, repos, plugins and instructions, and a binding attaches it to a scope. resolver.ts turns a request plus the bundle set into one session's effective access.
+import { preApprovalRuleProblems } from "./pre-approval-rules.js";
+import { repoCapabilityProblems } from "./repo-capabilities.js";
+import { resourceGrantProblems } from "./resource-grant.js";
+import { isQualifiedPrincipalKey } from "../identity/principal-key.js";
+import { tenantRungRemedy } from "./tenant-admission.js";
+import { isValidLinkSetRef } from "../identity/link-set-ref.js";
+/**
+ * ONE normalised egress host — the single spelling every plane compares by. The egress policy keys the credential on the host alone, so two modules normalising differently would hide a collision from the guard that refuses it.
+ * A wildcard label SURVIVES: this normalises a spelling, it does not expand a pattern.
+ */
+export function normaliseEgressHost(host) {
+    return host.trim().toLowerCase();
+}
+/**
+ * Can these two host patterns ever name ONE destination? String equality is not that test: `*.vendor.com` and `api.vendor.com` are two map keys and one destination, so equality lets two connections claim it and the firewall's matching order then decides which credential is stamped.
+ * The relation is symmetric and one wildcard form is expanded — a LEADING `*.`, which covers subdomains but not the apex.
+ * 🔴 That is the only wildcard spelling config may carry, refused elsewhere by `assertBundlesValid`, so this grammar is total over what can reach it.
+ */
+export function egressHostsOverlap(a, b) {
+    if (a === b)
+        return true;
+    return wildcardCovers(a, b) || wildcardCovers(b, a);
+}
+/** Does the leftmost-label wildcard `pattern` match everything `other` can name? */
+function wildcardCovers(pattern, other) {
+    if (!pattern.startsWith("*."))
+        return false;
+    const suffix = pattern.slice(1); // "*.vendor.com" → ".vendor.com"
+    return other.endsWith(suffix) && other.length > suffix.length;
+}
+/** The allowlist `assertBundlesValid` validates a declared origin against (fail-loud on config). */
+const KNOWN_CONTENT_ORIGINS = new Set(["internal", "external"]);
+/** The Eve connection slug a grant names, whichever form it is written in. Every consumer that
+ *  wants "which connectors does this bundle grant" goes through this — there is deliberately no
+ *  second place that knows the two shapes. */
+export function connectorGrantName(grant) {
+    return typeof grant === "string" ? grant : grant.name;
+}
+/** The content origin a grant DECLARES, or `undefined` when it declares nothing. `undefined` is not
+ *  `"external"` — see the plane header. */
+export function connectorGrantContentOrigin(grant) {
+    return typeof grant === "string" ? undefined : grant.contentOrigin;
+}
+/** The credential id a grant NAMES, or `undefined` for the bare-slug form that names none. Every
+ *  consumer that asks "as which identity?" goes through this, exactly as `connectorGrantName` is the
+ *  only reader of the two shapes' slug. `undefined` here is not a default — it is a grant
+ *  `assertBundlesValid` refuses and the resolver resolves to nothing. */
+export function connectorGrantCredential(grant) {
+    return typeof grant === "string" ? undefined : grant.credential;
+}
+/**
+ * Resolve a spec to ONE origin for one BARE tool name — the only place that knows the scalar-versus-object shapes.
+ * `Object.hasOwn` rather than a bare index, so a tool named `__proto__` reads the operator's declaration or nothing; an unvalidated override falls back to `default`, because `undefined` at this seam would erase a declaration the operator did write.
+ */
+export function contentOriginForTool(spec, bareToolName) {
+    if (typeof spec === "string")
+        return spec;
+    const override = Object.hasOwn(spec.except, bareToolName) ? spec.except[bareToolName] : undefined;
+    return override === "internal" || override === "external" ? override : spec.default;
+}
+/** Every connector slug a bundle grants, in declaration order (duplicates are a config error the
+ *  load-time assert rejects, so this does not dedupe). */
+export function bundleConnectorNames(bundle) {
+    return (bundle.connectors ?? []).map(connectorGrantName);
+}
+/** The "owner/name" a repo grant names, whichever spelling it is written in. Every consumer that
+ *  asks "which repos does this bundle grant" goes through this — there is deliberately no second
+ *  place that knows the two shapes (the `connectorGrantName` convention). */
+export function repoGrantName(grant) {
+    return typeof grant === "string" ? grant : grant.repo;
+}
+/** The capability sets a repo grant opts into — EMPTY for the bare string, which is what makes the
+ *  back-compatible spelling mean "today's defaults" rather than "unspecified". */
+export function repoGrantCapabilities(grant) {
+    return typeof grant === "string" ? [] : (grant.capabilities ?? []);
+}
+/**
+ * The package-registry hosts, offered as a named constant a bundle grants in one reviewed line (`domains: [...PACKAGE_REGISTRY_HOSTS]`).
+ * 🔴 Deliberately NOT a compiled-in default: a default would widen every deployment's egress with no diff to review, reach domains scoped to nothing on purpose, and make `compileNetworkPolicy`'s `deny-all` branch unreachable.
+ */
+export const PACKAGE_REGISTRY_HOSTS = [
+    "registry.npmjs.org",
+    "jsr.io",
+    "npm.jsr.io",
+    "pypi.org",
+    "files.pythonhosted.org",
+    "crates.io",
+    "static.crates.io",
+    "proxy.golang.org",
+    "sum.golang.org",
+];
+// Identity-with-types helpers (Eve's define* convention; return unchanged).
+export function defineBundle(bundle) {
+    return bundle;
+}
+export function defineBinding(binding) {
+    return binding;
+}
+// These asserts pin the SEMANTICS the resolver depends on but the compiler cannot see, once at config load, throwing with every problem listed — a silent misconfiguration here IS the security bug.
+// Every check is an objective misconfig (the config cannot mean anything), never a policy opinion; the resolver's broad-grant warnings own the judgement calls.
+/** GitHub repo grants are `owner/name` — exactly one slash, no URL/branch/whitespace. */
+const REPO_FORM = /^[\w.-]+\/[\w.-]+$/u;
+/** An IAM role ARN: `arn:aws[-partition]:iam::<12-digit account>:role/<path>`. Partition
+ *  segment tolerates aws / aws-cn / aws-us-gov. */
+const ROLE_ARN_FORM = /^arn:aws[\w-]*:iam::\d{12}:role\/.+$/u;
+/** An AWS region: a two-letter group, one or more lowercase words, then a number
+ *  (e.g. eu-west-2, ap-southeast-1, us-gov-east-1). The `(-[a-z]+)+` middle admits the
+ *  extra segment gov/ISO partitions carry, and stays loose on new region names. */
+const AWS_REGION_FORM = /^[a-z]{2}(?:-[a-z]+)+-\d+$/u;
+/** Overly-broad egress pattern: bare "*" (any host) or a single-label wildcard like
+ *  "*.com" (an entire TLD). Wildcards are for one org's subdomains ("*.googleapis.com"). */
+function isOverlyBroadHost(pattern) {
+    return pattern === "*" || /^\*\.[^.]+$/u.test(pattern);
+}
+/**
+ * A wildcard this tree does not speak: any `*` that is not a single leading `*.`. Every other spelling is compared as a LITERAL, so the one-credential-per-host rungs read it as a destination of its own — and whether the sandbox proxy globs it is not established here, which makes refusing the same answer either way.
+ * It is a deliberate config break: an operator whose own bundles carry such a spelling now fails the boot assertion rather than deploying a pattern that means nothing.
+ */
+function isUnexpandableWildcardHost(pattern) {
+    if (!pattern.includes("*"))
+        return false;
+    // The one admitted form, in full: a single leading `*.` and no other star anywhere.
+    return !(pattern.startsWith("*.") && !pattern.slice(2).includes("*"));
+}
+/** Flag every unusable pattern in one host list (shared by both egress surfaces): the overly-broad
+ *  ones, and the wildcard spellings this tree never expands. */
+function broadHostProblems(bundleName, field, hosts) {
+    const problems = [];
+    for (const h of hosts) {
+        if (isOverlyBroadHost(h)) {
+            problems.push(`  bundle "${bundleName}" ${field} pattern "${h}" is overly broad (matches ${h === "*" ? "every host" : "an entire TLD"}) — name real hosts, wildcard only one org's subdomains (e.g. "*.googleapis.com")`);
+            continue; // one verdict per pattern: a bare "*" is both, and the broader message is the useful one
+        }
+        if (isUnexpandableWildcardHost(h)) {
+            problems.push(`  bundle "${bundleName}" ${field} pattern "${h}" spells a wildcard this deployment cannot expand — the ONLY wildcard form is a ` +
+                `single LEADING "*." (e.g. "*.vendor.com"). Every other spelling is compared as a literal, so the one-credential-per-host ` +
+                `rungs read it as a destination of its own and never pair it with the hosts you meant (OPE-1685). Name the real hosts, or ` +
+                `use a leading "*." over the suffix they share.`);
+        }
+    }
+    return problems;
+}
+/** Is this a bundle name a CODEMOD writes (`grants:` / `agent:`) rather than one a human writes? Both codemods refuse a declared connector grant on their own input path, so the prefixes are the only way to tell "nobody could ever declare here" from "an operator omitted it" — an exemption from a hole. */
+function isMachineWrittenBundleName(name) {
+    return name.startsWith("grants:") || name.startsWith("agent:");
+}
+/**
+ * Every problem with one grant's `contentOrigin`, in either spelling; empty = valid.
+ * Fail-LOUD on anything unrecognised at every depth: a typo that booted to "declares nothing" would read as fail-closed while the operator believed they had vouched. An `except` map must also be non-empty.
+ */
+function contentOriginProblems(bundleName, connector, spec) {
+    const known = [...KNOWN_CONTENT_ORIGINS].map((t) => JSON.stringify(t)).join(", ");
+    const where = `bundle "${bundleName}" connector "${connector}"`;
+    // The MANDATORY case gets its own message rather than falling into "unknown value: undefined" —
+    // an operator who omitted the field needs to be told what to write, not what they got wrong.
+    if (spec === undefined) {
+        return [
+            `  ${where} has no \`contentOrigin\` — say who authors the bytes it returns: ` +
+                `contentOrigin: "internal" (only org members can write what it returns) or "external" (anyone can), ` +
+                `or contentOrigin: { default: "internal", except: { "<bare-tool-name>": "external" } } when only some of its tools reach outside content`,
+        ];
+    }
+    if (typeof spec === "string" || spec === null || typeof spec !== "object") {
+        if (KNOWN_CONTENT_ORIGINS.has(spec))
+            return [];
+        return [
+            `  ${where} declares unknown contentOrigin ${JSON.stringify(spec)} — known: ${known}, or { default, except } for per-tool grain (omit the field entirely to declare nothing)`,
+        ];
+    }
+    const obj = spec;
+    const bad = [];
+    if (!KNOWN_CONTENT_ORIGINS.has(obj.default)) {
+        bad.push(`  ${where} declares contentOrigin.default ${JSON.stringify(obj.default)} — known: ${known}`);
+    }
+    if (obj.except === null || typeof obj.except !== "object" || Array.isArray(obj.except)) {
+        bad.push(`  ${where} declares a contentOrigin object whose \`except\` is not a { toolName: origin } map — got ${JSON.stringify(obj.except)}`);
+        return bad;
+    }
+    const except = obj.except;
+    const toolNames = Object.keys(except);
+    if (toolNames.length === 0) {
+        bad.push(`  ${where} declares contentOrigin \`except: {}\` — an empty exception map is just ${JSON.stringify(obj.default)}; write the scalar, or name the tools that differ`);
+    }
+    for (const tool of toolNames) {
+        if (tool.trim() === "") {
+            bad.push(`  ${where} declares a contentOrigin exception for an empty tool name — name the BARE tool the override applies to`);
+            continue;
+        }
+        // The one objectively-wrong spelling, and the mistake an operator reading a transcript will
+        // make: copying the eve-mounted `<connection>__<tool>` name in. It would never match (the seam
+        // strips the prefix before looking up), so the tool would silently stay on `default` — a silent
+        // wrong answer about taint is exactly what this field exists to prevent.
+        if (tool.startsWith(`${connector}__`)) {
+            bad.push(`  ${where} declares a contentOrigin exception for "${tool}" — \`except\` keys are BARE tool names; drop the "${connector}__" prefix (write "${tool.slice(connector.length + 2)}")`);
+        }
+        if (!KNOWN_CONTENT_ORIGINS.has(except[tool])) {
+            bad.push(`  ${where} declares contentOrigin exception "${tool}" as ${JSON.stringify(except[tool])} — known: ${known}`);
+        }
+    }
+    return bad;
+}
+/** Validate the bundle DEFINITIONS at config load and fail loud, listing every problem. Pairs with {@link assertBindingsValid}, the binding side. */
+export function assertBundlesValid(bundles) {
+    const bad = [];
+    const seen = new Set();
+    // Rule ids are unique across the WHOLE config, not per bundle — the id is what an
+    // `approval.judge.verdict` row cites, so a duplicate makes an auto-allow untraceable (OPE-512).
+    const seenRuleIds = new Set();
+    for (const b of bundles) {
+        bad.push(...preApprovalRuleProblems(b.name, b.preApprovalRules, seenRuleIds));
+        if (seen.has(b.name))
+            bad.push(`  bundle name "${b.name}" is defined more than once (bindings reference bundles by name — names must be unique)`);
+        seen.add(b.name);
+        for (const c of b.connections ?? []) {
+            if (c.allowedWebsites.length === 0) {
+                bad.push(`  bundle "${b.name}" connection "${c.id}" has an empty allowedWebsites — the credential can be sent nowhere; name the host(s) it may reach`);
+            }
+            bad.push(...broadHostProblems(b.name, `connection "${c.id}" allowedWebsites`, c.allowedWebsites));
+        }
+        bad.push(...broadHostProblems(b.name, "domains", b.domains ?? []));
+        const connectors = new Set();
+        for (const grant of b.connectors ?? []) {
+            // Validated at RUNTIME, not only by the compiler: bundles also arrive from JSON the codemods parse and from a deployer's own app tree, so an unknown origin must be a boot error rather than a value that silently reads as "declares nothing".
+            // This is the ONLY place the bare-slug spelling is rejected, and the message carries both accepted shapes because whoever reaches it has not read the connector-plane docs.
+            if (typeof grant === "string") {
+                bad.push(`  bundle "${b.name}" grants connector "${grant}" as a bare slug — a grant names the identity it reaches the connector as: ` +
+                    `{ name: "${grant}", credential: "<a credential id from the connector's catalogue>", contentOrigin: "internal" | "external" }. ` +
+                    `The machine-written overlays write { name, credential } and omit contentOrigin; every other bundle declares all three.`);
+            }
+            else if (grant === null || typeof grant !== "object" || typeof grant.name !== "string" || grant.name.trim() === "") {
+                bad.push(`  bundle "${b.name}" has a connector grant that is not a { name, credential, contentOrigin } object — got ${JSON.stringify(grant)}`);
+                continue; // no usable name — nothing to duplicate-check against
+            }
+            else {
+                const g = grant;
+                // The credential is mandatory on EVERY grant, machine-written overlays included, unlike `contentOrigin`: a content origin is an operator assertion a codemod may not invent, while a credential is a choice the requester already made at propose time and the codemod only writes through.
+                if (typeof g.credential !== "string" || g.credential.trim() === "") {
+                    bad.push(`  bundle "${b.name}" grants connector "${g.name}" with no \`credential\` — name which configured identity this scope reaches it as, ` +
+                        `e.g. { name: "${g.name}", credential: "team-key", contentOrigin: "external" }. The ids come from that connector's credential catalogue ` +
+                        `(agent/access/connector-credentials.ts); \`npm run lint:connections\` fails a grant naming one that is not configured.`);
+                }
+                // Machine-written overlays are EXEMPT from `contentOrigin`, the one carve-out: both codemods refuse a declared origin so that nothing on that path is model-authored past propose time, so those grants declare nothing and stay on the fail-closed default. An operator who wants one grants the same connector from a reviewed code bundle.
+                if (g.contentOrigin !== undefined || !isMachineWrittenBundleName(b.name)) {
+                    bad.push(...contentOriginProblems(b.name, g.name, g.contentOrigin));
+                }
+            }
+            // Duplicate check is by NAME, and it runs even for a grant that already failed above (via
+            // `connectorGrantName`, which knows both spellings) so a tree with several problems reports
+            // ALL of them in one pass rather than one per fix-and-rerun cycle.
+            const name = connectorGrantName(grant);
+            if (connectors.has(name))
+                bad.push(`  bundle "${b.name}" grants connector "${name}" more than once — remove the duplicate`);
+            connectors.add(name);
+        }
+        // connectorOps: OBJECTIVE misconfigs only (the file's stated rule). Whether the connector is
+        // also granted here is NOT checked — a raise on an ungranted connector cannot widen anything,
+        // and the join is deployment-wide anyway (connector-op-gating.ts), so refusing it would be a
+        // policy opinion, not a "this config cannot mean anything".
+        const gatedConnectors = new Set();
+        for (const g of b.connectorOps ?? []) {
+            const key = g.connector.trim().toLowerCase();
+            if (key === "") {
+                bad.push(`  bundle "${b.name}" has a connectorOps entry with an empty connector name — name the connector its ops belong to`);
+                continue;
+            }
+            if (gatedConnectors.has(key)) {
+                bad.push(`  bundle "${b.name}" declares connectorOps for "${g.connector}" more than once — merge the entries (two entries for one connector make the declaration ambiguous)`);
+            }
+            gatedConnectors.add(key);
+            const ops = [...(g.gated ?? []), ...(g.destructive ?? [])];
+            if (ops.length === 0) {
+                bad.push(`  bundle "${b.name}" connectorOps entry for "${g.connector}" names no ops — it raises nothing; list ops under gated/destructive or drop the entry`);
+            }
+            if (ops.some((op) => op.trim() === "")) {
+                bad.push(`  bundle "${b.name}" connectorOps entry for "${g.connector}" has an empty op name — every entry must name a real operation (or "*" for all of them)`);
+            }
+        }
+        // REPO GRANTS (OPE-1024): both spellings validated in one pass. Runtime shape checks, not just
+        // the compiler's, because bundles also arrive from JSON the codemods parse and from a
+        // deployer's own app tree — an unknown capability must be a boot error, never an expansion that
+        // silently reads as the narrow default until a mint 403s in production.
+        const repoNames = new Set();
+        for (const grant of b.repos ?? []) {
+            if (grant === null || (typeof grant !== "string" && typeof grant !== "object") || Array.isArray(grant)) {
+                bad.push(`  bundle "${b.name}" has a repo grant that is neither "owner/name" nor a { repo, capabilities } object — got ${JSON.stringify(grant)}`);
+                continue;
+            }
+            const name = repoGrantName(grant);
+            if (typeof name !== "string" || !REPO_FORM.test(name)) {
+                bad.push(`  bundle "${b.name}" repo ${JSON.stringify(name)} must be bare owner/name form (e.g. "acme/web") — not a URL, a bare owner, or an owner/name/extra path`);
+            }
+            // A repo declared twice in one bundle makes "which capabilities does this grant carry?"
+            // depend on declaration order — the same ambiguity the connector duplicate check refuses.
+            if (repoNames.has(name)) {
+                bad.push(`  bundle "${b.name}" grants repo ${JSON.stringify(name)} more than once — merge the entries (two entries for one repo make its capabilities ambiguous)`);
+            }
+            repoNames.add(name);
+            if (typeof grant === "object") {
+                for (const k of Object.keys(grant)) {
+                    if (k !== "repo" && k !== "capabilities") {
+                        bad.push(`  bundle "${b.name}" repo grant ${JSON.stringify(name)} has unknown field "${k}" — a repo grant carries { repo, capabilities } only`);
+                    }
+                }
+                bad.push(...repoCapabilityProblems(`bundle "${b.name}" repo ${JSON.stringify(name)}`, grant.capabilities));
+            }
+        }
+        // RESOURCE GRANTS (OPE-1064): the same runtime-shape discipline the repo grants above take, and
+        // for the same reason — a bundle can arrive from parsed JSON, where the compiler proves nothing.
+        // An unknown connector, a malformed address or an unknown capability is a BOOT error, never a
+        // row that reads as a working grant until a member watches the tool refuse.
+        bad.push(...resourceGrantProblems(`bundle "${b.name}"`, b.resourceGrants));
+        const roleArns = new Set();
+        for (const grant of b.awsRoles ?? []) {
+            if (!ROLE_ARN_FORM.test(grant.roleArn)) {
+                bad.push(`  bundle "${b.name}" awsRoles roleArn "${grant.roleArn}" must be an IAM role ARN (e.g. "arn:aws:iam::123456789012:role/oe-agent")`);
+            }
+            if (roleArns.has(grant.roleArn)) {
+                bad.push(`  bundle "${b.name}" grants awsRole "${grant.roleArn}" more than once — remove the duplicate`);
+            }
+            roleArns.add(grant.roleArn);
+            if (grant.region !== undefined && !AWS_REGION_FORM.test(grant.region)) {
+                bad.push(`  bundle "${b.name}" awsRoles region "${grant.region}" is not a well-formed AWS region (e.g. "eu-west-2")`);
+            }
+            // allow is REQUIRED (OPE-296 §8): absent-or-empty used to mean unrestricted, which made an
+            // omitted narrowing and a deliberate decision not to narrow indistinguishable in review.
+            // Unrestricted must now be a reviewed line: allow: ["*"].
+            if (grant.allow === undefined || grant.allow.length === 0) {
+                bad.push(`  bundle "${b.name}" awsRoles grant "${grant.roleArn}" has no \`allow\` list — REQUIRED: spell unrestricted access explicitly as allow: ["*"] (an absent narrowing and a decision not to narrow must not look the same; at runtime an allow-less grant REFUSES, never passes through)`);
+            }
+            const seenAllow = new Set();
+            for (const entry of grant.allow ?? []) {
+                if (entry.trim() === "") {
+                    bad.push(`  bundle "${b.name}" awsRoles allow entry for "${grant.roleArn}" is empty/whitespace — an allow entry must be a "service" (e.g. "logs") or "service:operation" (e.g. "s3:cp")`);
+                    continue;
+                }
+                const colons = entry.split(":").length - 1;
+                if (colons > 1) {
+                    bad.push(`  bundle "${b.name}" awsRoles allow entry "${entry}" (role "${grant.roleArn}") is malformed — an entry has at most one ":" ("service" or "service:operation")`);
+                    continue;
+                }
+                if (colons === 1) {
+                    const [service, operation] = entry.split(":");
+                    if (service.trim() === "" || operation.trim() === "") {
+                        bad.push(`  bundle "${b.name}" awsRoles allow entry "${entry}" (role "${grant.roleArn}") is malformed — both sides of the ":" must be non-empty ("service:operation", e.g. "s3:cp")`);
+                        continue;
+                    }
+                }
+                // Dedupe on the same normal form the runtime matcher uses (service lowercased,
+                // operation lowercased with `-`/`_` unified) — "S3:cp" and "s3:cp" are one entry.
+                const [svc, op] = entry.split(":");
+                const norm = op === undefined ? svc.trim().toLowerCase() : `${svc.trim().toLowerCase()}:${op.trim().toLowerCase().replace(/_/gu, "-")}`;
+                if (seenAllow.has(norm)) {
+                    bad.push(`  bundle "${b.name}" awsRoles allow lists "${entry}" (role "${grant.roleArn}") more than once — remove the duplicate`);
+                }
+                seenAllow.add(norm);
+            }
+        }
+        // Objective misconfigs only: an approver name must be non-empty and unique within the bundle (the row's `resolvedBy` is `custom:<name>`), and the element must be callable.
+        // `mayAllow` is refused on an operator-authored element — it is the clamp escape for connector and remote sources, and an operator element already holds the full verdict range.
+        const approverNames = new Set();
+        for (const a of b.approvers ?? []) {
+            const name = a.name?.trim() ?? "";
+            if (name === "") {
+                bad.push(`  bundle "${b.name}" has an approver with an empty name — the audit row's resolvedBy is "custom:<name>", so every element needs one`);
+                continue;
+            }
+            if (approverNames.has(name))
+                bad.push(`  bundle "${b.name}" declares approver "${name}" more than once — names must be unique within a bundle (resolvedBy would be ambiguous)`);
+            approverNames.add(name);
+            if (typeof a.approve !== "function")
+                bad.push(`  bundle "${b.name}" approver "${name}" has no callable approve() — an element that cannot answer is config that means nothing`);
+            if (a.mayAllow === true && (a.source === undefined || a.source === "operator")) {
+                bad.push(`  bundle "${b.name}" approver "${name}" sets mayAllow on an operator-authored element — mayAllow is the clamp escape for source:"connector"/"remote" elements only (an operator element already holds the full verdict range)`);
+            }
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: invalid access bundle(s):\n" + bad.join("\n") + "\n(access/bundle.ts / docs/how-it-works/access-and-scoping.md)");
+    }
+}
+const LEVEL_FIELD = {
+    org: null,
+    tenant: "tenant",
+    domain: "domain",
+    surface: "surface",
+    group: "group",
+    principal: "principal",
+};
+/** `platform/<tenant-id>` — exactly two non-empty, slash-free segments. */
+export const TENANT_KEY = /^[^/\s]+\/[^/\s]+$/u;
+/** `platform/<tenant-id>/<container-id>` — three+ segments; only the container may hold a "/".
+ *  The one authority on the surface-key form: bindings (assertBindingsValid), the
+ *  access-request delta (delta.ts) and the grants codemod all test against THIS. */
+export const SURFACE_KEY = /^[^/\s]+\/[^/\s]+\/\S+$/u;
+/**
+ * Validate the BINDINGS at config load (fail loud): a known bundle, exactly the level's one address field, qualified tenant/surface/principal keys, and bare domain and group names. Pairs with {@link assertBundlesValid}.
+ * 🔴 The group registry is an ARGUMENT, not a lookup: existence is a joint property of two config files, so the check belongs to the app tier's merged validation — and `undefined` SKIPS the existence check, it does not silently approve.
+ */
+export function assertBindingsValid(bindings, bundles, groups) {
+    const known = new Set(bundles.map((b) => b.name));
+    const knownGroups = groups === undefined ? undefined : new Set(groups.map((g) => g.name));
+    const bad = [];
+    for (const b of bindings) {
+        const where = `binding "${b.bundle}" (${b.scope.level} scope)`;
+        if (!known.has(b.bundle))
+            bad.push(`  ${where} references unknown bundle "${b.bundle}" — define it in the bundles list or fix the name`);
+        const { level, tenant, domain, surface, group, principal } = b.scope;
+        const required = LEVEL_FIELD[level];
+        if (required === undefined) {
+            bad.push(`  ${where} has an unknown scope.level "${level}" — the levels are org | tenant | domain | surface | group | principal`);
+            continue;
+        }
+        for (const [field, value] of [["tenant", tenant], ["domain", domain], ["surface", surface], ["group", group], ["principal", principal]]) {
+            if (field === required) {
+                if (!value)
+                    bad.push(`  ${where} needs scope.${field} — a ${level}-level binding can never match without one`);
+            }
+            else if (value !== undefined) {
+                bad.push(`  ${where} also sets scope.${field} — a ${level}-level scope carries ${required ? `only scope.${required}` : "no address field"}; drop it or change the level`);
+            }
+        }
+        if (tenant && !TENANT_KEY.test(tenant)) {
+            bad.push(`  ${where} scope.tenant "${tenant}" must be the PLATFORM-QUALIFIED tenant key "platform/<tenant-id>" (e.g. "slack/T0123ABC", "discord/1300000000000000100", "github/acme") — a bare vendor id has no platform and will NEVER match`);
+        }
+        if (surface && !SURFACE_KEY.test(surface)) {
+            bad.push(`  ${where} scope.surface "${surface}" must be the fully-qualified surface key "platform/<tenant-id>/<container-id>" (e.g. "slack/T0123ABC/C0123ABC") — the SAME form memory domains' \`channels\` use; a bare channel id will NEVER match`);
+        }
+        if (domain?.includes("/")) {
+            bad.push(`  ${where} scope.domain "${domain}" contains "/" — a domain scope takes the BARE domain name from memory/config/domains.ts ("payments"), deliberately NOT tenant-qualified: domains are cross-platform, so one grant is one binding`);
+        }
+        // A group address is a BARE name, like a domain's, for the same reason: a set of humans spans
+        // platforms, so qualifying it by one would need N bindings for one grant. The only objective
+        // misconfig checkable without the registry is emptiness (whitespace can never name a group);
+        // EXISTENCE needs both files and is checked just below, when the caller supplied the registry.
+        if (group !== undefined && group.trim().length === 0) {
+            bad.push(`  ${where} scope.group is empty — a group-level binding takes the BARE group name from agent/identity/groups.ts (e.g. "payments-team")`);
+        }
+        else if (group !== undefined && knownGroups !== undefined && !knownGroups.has(group)) {
+            bad.push(`  ${where} scope.group "${group}" is not a declared person-group — define it with defineGroup() in agent/identity/groups.ts (or fix the name). A binding onto a group nobody declared can never match, so it is refused rather than ignored.`);
+        }
+        // A `principal` address is EITHER the qualified `platform/<principal-id>` key OR a `linkSet:<id>` reference; anything else is the pre-P0 bare form, which cannot match what the resolver composes.
+        // Fail-loud rather than a lint, because the config cannot mean what it says; the `dm:` sentinel gets its own message because its author needs a different instruction.
+        if (principal !== undefined && !isQualifiedPrincipalKey(principal) && !isValidLinkSetRef(principal)) {
+            bad.push(principal.startsWith("dm:")
+                ? `  ${where} scope.principal "${principal}" still carries the old \`workspace: "dm:<id>"\` sentinel — the DM universe is the first-class \`principal\` level now, so drop the "dm:" prefix and write the PLATFORM-QUALIFIED key "platform/<principal-id>" (e.g. "slack/U0123ABC")`
+                : `  ${where} scope.principal "${principal}" must be the qualified principal key "platform/<principal-id>" — or, on a tenant-scoped platform, "platform/<tenant-id>/<principal-id>" (e.g. "slack/T0AB1CD2E/U0123ABC", "discord/300000000000000104") — or a link-set reference "linkSet:<link-set-id>" (one human across their confirmed accounts). A BARE member id has no platform namespace and will NEVER match, and on Slack a key missing its workspace has no tenant namespace and will never match either (identity/principal-key.ts, identity/link-set-ref.ts).${tenantRungRemedy(principal)}`);
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: invalid access binding(s):\n" + bad.join("\n") + "\n(access/bundle.ts / docs/how-it-works/access-and-scoping.md)");
+    }
+}
+//# sourceMappingURL=bundle.js.map

package/dist/agent/access/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../../agent/access/bundle.ts"],"names":[],"mappings":"AAAA,0PAA0P;AAG1P,OAAO,EAAE,uBAAuB,EAAwB,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAuB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAsB,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAsEhE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,CAAS;IACrD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC;IAClE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAChE,CAAC;AA0CD,oGAAoG;AACpG,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAyB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAE7G;;8CAE8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;2CAC2C;AAC3C,MAAM,UAAU,2BAA2B,CAAC,KAAyB;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;AACrE,CAAC;AAED;;;yEAGyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,KAAyB;IAChE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgC,EAAE,YAAoB;IACzF,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AACtF,CAAC;AAED;0DAC0D;AAC1D,MAAM,UAAU,oBAAoB,CAAC,MAAkC;IACrE,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAyDD;;6EAE6E;AAC7E,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAyDD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,oBAAoB;IACpB,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,wBAAwB;IACxB,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;CACjB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qMAAqM;AACrM,gKAAgK;AAEhK,yFAAyF;AACzF,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC;mDACmD;AACnD,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D;;mFAEmF;AACnF,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD;4FAC4F;AAC5F,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,OAAO,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,OAAe;IACjD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,oFAAoF;IACpF,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;gEACgE;AAChE,SAAS,iBAAiB,CAAC,UAAkB,EAAE,KAAa,EAAE,KAAwB;IACpF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,aAAa,UAAU,KAAK,KAAK,aAAa,CAAC,8BAA8B,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,mFAAmF,CAC3M,CAAC;YACF,SAAS,CAAC,yFAAyF;QACrG,CAAC;QACD,IAAI,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CACX,aAAa,UAAU,KAAK,KAAK,aAAa,CAAC,kFAAkF;gBAC/H,2HAA2H;gBAC3H,2HAA2H;gBAC3H,gDAAgD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iTAAiT;AACjT,SAAS,0BAA0B,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,UAAkB,EAAE,SAAiB,EAAE,IAAa;IACjF,MAAM,KAAK,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,WAAW,UAAU,gBAAgB,SAAS,GAAG,CAAC;IAChE,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,KAAK,oEAAoE;gBAC5E,qGAAqG;gBACrG,yIAAyI;SAC5I,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1E,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAc,CAAC;YAAE,OAAO,EAAE,CAAC;QACzD,OAAO;YACL,KAAK,KAAK,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,KAAK,0FAA0F;SAC9K,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAA+C,CAAC;IAC5D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAiB,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,mCAAmC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,6FAA6F,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9I,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,2EAA2E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAChL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,yGAAyG,CAAC,CAAC;YAC9H,SAAS;QACX,CAAC;QACD,4FAA4F;QAC5F,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,IAAI,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,4CAA4C,IAAI,sDAAsD,SAAS,sBAAsB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAChM,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,sCAAsC,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qJAAqJ;AACrJ,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,kFAAkF;IAClF,gGAAgG;IAChG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,yFAAyF,CAAC,CAAC;QAClJ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,EAAE,oGAAoG,CAAC,CAAC;YACzJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QACpG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACvC,gPAAgP;YAChP,4KAA4K;YAC5K,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,IAAI,CACN,aAAa,CAAC,CAAC,IAAI,uBAAuB,KAAK,6EAA6E;oBAC1H,YAAY,KAAK,+GAA+G;oBAChI,wHAAwH,CAC3H,CAAC;YACJ,CAAC;iBAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAwB,CAAC,IAAI,KAAK,QAAQ,IAAK,KAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC7J,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,0FAA0F,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC/I,SAAS,CAAC,sDAAsD;YAClE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,KAAuB,CAAC;gBAClC,4RAA4R;gBAC5R,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACnE,GAAG,CAAC,IAAI,CACN,aAAa,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC,IAAI,sFAAsF;wBACpI,iBAAiB,CAAC,CAAC,IAAI,kHAAkH;wBACzI,wHAAwH,CAC3H,CAAC;gBACJ,CAAC;gBACD,8UAA8U;gBAC9U,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzE,GAAG,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YACD,0FAA0F;YAC1F,4FAA4F;YAC5F,mEAAmE;YACnE,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,uBAAuB,IAAI,yCAAyC,CAAC,CAAC;YAC5H,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,4DAA4D;QAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,gGAAgG,CAAC,CAAC;gBAC9H,SAAS;YACX,CAAC;YACD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,SAAS,qGAAqG,CAAC,CAAC;YAChL,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,SAAS,wFAAwF,CAAC,CAAC;YAChK,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,SAAS,0FAA0F,CAAC,CAAC;YAClK,CAAC;QACH,CAAC;QACD,+FAA+F;QAC/F,sFAAsF;QACtF,gGAAgG;QAChG,wEAAwE;QACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,6FAA6F,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClJ,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAsB,CAAC,CAAC;YACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACtK,CAAC;YACD,wFAAwF;YACxF,0FAA0F;YAC1F,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;YACrK,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;wBACzC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,sDAAsD,CAAC,CAAC;oBAClJ,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAG,KAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC5H,CAAC;QACH,CAAC;QACD,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,4EAA4E;QAC5E,GAAG,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,uBAAuB,KAAK,CAAC,OAAO,4EAA4E,CAAC,CAAC;YAChJ,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,qBAAqB,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;YAC3G,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,sBAAsB,KAAK,CAAC,MAAM,sDAAsD,CAAC,CAAC;YACxH,CAAC;YACD,2FAA2F;YAC3F,yFAAyF;YACzF,0DAA0D;YAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CACN,aAAa,CAAC,CAAC,IAAI,qBAAqB,KAAK,CAAC,OAAO,kOAAkO,CACxR,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;YACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACxB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,+BAA+B,KAAK,CAAC,OAAO,gHAAgH,CAAC,CAAC;oBAC1L,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3C,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;oBACf,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,2BAA2B,KAAK,YAAY,KAAK,CAAC,OAAO,mFAAmF,CAAC,CAAC;oBAC1K,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjB,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC9C,IAAI,OAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,SAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;wBACvD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,2BAA2B,KAAK,YAAY,KAAK,CAAC,OAAO,+FAA+F,CAAC,CAAC;wBACtL,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,+EAA+E;gBAC/E,kFAAkF;gBAClF,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,GAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC1I,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,2BAA2B,KAAK,YAAY,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;gBACnI,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,4KAA4K;QAC5K,iLAAiL;QACjL,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,kHAAkH,CAAC,CAAC;gBAChJ,SAAS;YACX,CAAC;YACD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,wBAAwB,IAAI,yFAAyF,CAAC,CAAC;YAChL,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU;gBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,eAAe,IAAI,0FAA0F,CAAC,CAAC;YAChL,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,eAAe,IAAI,yLAAyL,CAAC,CAAC;YAC5O,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,gEAAgE,CACnI,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,MAAM,WAAW,GAAyD;IACxE,GAAG,EAAE,IAAI;IACT,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAG,qBAAqB,CAAC;AAChD;;oFAEoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA4B,EAAE,OAA0B,EAAE,MAAyB;IACrH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,+BAA+B,CAAC,CAAC,MAAM,mDAAmD,CAAC,CAAC;QACzI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;QACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,gCAAgC,KAAK,wEAAwE,CAAC,CAAC;YAClI,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAU,EAAE,CAAC;YACjJ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC,KAAK;oBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,gBAAgB,KAAK,QAAQ,KAAK,4CAA4C,CAAC,CAAC;YACjH,CAAC;iBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,GAAG,CAAC,IAAI,CACN,KAAK,KAAK,oBAAoB,KAAK,QAAQ,KAAK,wBAAwB,QAAQ,CAAC,CAAC,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,+BAA+B,CAChK,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CACN,KAAK,KAAK,kBAAkB,MAAM,kMAAkM,CACrO,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CACN,KAAK,KAAK,mBAAmB,OAAO,uMAAuM,CAC5O,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,KAAK,KAAK,kBAAkB,MAAM,mMAAmM,CACtO,CAAC;QACJ,CAAC;QACD,8FAA8F;QAC9F,6FAA6F;QAC7F,6FAA6F;QAC7F,+FAA+F;QAC/F,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,8HAA8H,CAAC,CAAC;QACrJ,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,IAAI,CACN,KAAK,KAAK,iBAAiB,KAAK,8MAA8M,CAC/O,CAAC;QACJ,CAAC;QACD,mMAAmM;QACnM,uKAAuK;QACvK,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,IAAI,CACN,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,CAAC,CAAC,KAAK,KAAK,qBAAqB,SAAS,yOAAyO;gBACnR,CAAC,CAAC,KAAK,KAAK,qBAAqB,SAAS,+fAA+f,gBAAgB,CAAC,SAAS,CAAC,EAAE,CACzkB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,gEAAgE,CACpI,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/agent/access/capabilities.d.ts

@@ -0,0 +1,5 @@
+/** Is the standing-WINDOW apparatus armed for this deployment? The shipped default is OFF and must stay OFF — it is the default for everyone who clones the repo, and a unified window is a wider data blast radius. A deployment arms it by declaring `window: { topology: true }` in its own `agent/settings.ts`; there is no env route, and the agent has none. */
+export declare const WINDOW_TOPOLOGY_ENABLED: boolean;
+/** The runtime resolver every window gate calls. Precedence is the deployment's registered settings, then the shipped default, read PER CALL so a settings change takes effect on the next call rather than the next cold start. */
+export declare function windowTopologyEnabled(): boolean;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/agent/access/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../agent/access/capabilities.ts"],"names":[],"mappings":"AAIA,sWAAsW;AACtW,eAAO,MAAM,uBAAuB,EAAE,OAA0C,CAAC;AAEjF,oOAAoO;AACpO,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}

package/dist/agent/access/capabilities.js

@@ -0,0 +1,9 @@
+// Deployment-pinned security switches: a wide blast-radius capability is never something the running agent can turn on for itself. The switches are NOT uniform — read each one's own doc block for where its authority lives, and each precedence is pinned by a test.
+import { SETTINGS, getSettings } from "../settings/settings.js";
+/** Is the standing-WINDOW apparatus armed for this deployment? The shipped default is OFF and must stay OFF — it is the default for everyone who clones the repo, and a unified window is a wider data blast radius. A deployment arms it by declaring `window: { topology: true }` in its own `agent/settings.ts`; there is no env route, and the agent has none. */
+export const WINDOW_TOPOLOGY_ENABLED = SETTINGS.window.topology.shipped;
+/** The runtime resolver every window gate calls. Precedence is the deployment's registered settings, then the shipped default, read PER CALL so a settings change takes effect on the next call rather than the next cold start. */
+export function windowTopologyEnabled() {
+    return getSettings().window.topology;
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/agent/access/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../agent/access/capabilities.ts"],"names":[],"mappings":"AAAA,wQAAwQ;AAExQ,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEhE,sWAAsW;AACtW,MAAM,CAAC,MAAM,uBAAuB,GAAY,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;AAEjF,oOAAoO;AACpO,MAAM,UAAU,qBAAqB;IACnC,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;AACvC,CAAC"}

package/dist/agent/access/chat-dm-grant.d.ts

@@ -0,0 +1,47 @@
+import { PERSON_RESOURCE_TYPE } from "../channels/dm-audience.js";
+import { type BindableContext } from "../identity/binding.js";
+import type { Domain } from "../memory/domain.js";
+import type { ResourceCapability } from "./resource-capabilities.js";
+export { PERSON_RESOURCE_TYPE };
+/** One person this session may DM — the parsed form of a granted, in-domain address. */
+export interface ChatDmTarget {
+    readonly platform: string;
+    /** The recipient's bare platform member id — exactly what `deliverDirectMessage` takes. */
+    readonly principalId: string;
+    /** The address exactly as config wrote it — what the card renders and the audit row names. */
+    readonly address: string;
+}
+/** Thrown by {@link assertChatDmAllowed}. A distinct class so a call site can tell this refusal apart
+ *  from the transport failures it also has to report. */
+export declare class ChatDmGrantError extends Error {
+    readonly platform: string;
+    readonly principalId: string;
+    /** Which check refused: malformed (the model wrote nonsense, so no boundary was crossed), ungranted (no bundle names this person), cross-domain (the domain does not work on that surface), stopped (the RECIPIENT refused, and no operator remedy exists), unreadable (the stop could not be read). unreadable is never folded into stopped: reporting an outage as a person's decision states a fact about them that nobody established. */
+    readonly boundary: "malformed" | "ungranted" | "cross-domain" | "stopped" | "unreadable";
+    constructor(platform: string, principalId: string, 
+    /** Which check refused: malformed (the model wrote nonsense, so no boundary was crossed), ungranted (no bundle names this person), cross-domain (the domain does not work on that surface), stopped (the RECIPIENT refused, and no operator remedy exists), unreadable (the stop could not be read). unreadable is never folded into stopped: reporting an outage as a person's decision states a fact about them that nobody established. */
+    boundary: "malformed" | "ungranted" | "cross-domain" | "stopped" | "unreadable", message: string);
+}
+/** Reads the SAME roster every chat read is fenced against, so a gate and a fence cannot resolve the domain differently. The caller's own container is seeded into that roster, so a Slack session can DM a granted Slack person; what it cannot do is DM a person on a surface this domain never touches. */
+export declare function domainWorksOnPlatform(domainKey: string, platform: string, domains: readonly Domain[]): boolean;
+/** Pure: the caller injects the domain key, the grants and the domains, so the mount, the refusal copy and the test read ONE answer. The stop is deliberately not applied here — folding in a durable read would make the MOUNT depend on it, and the stop is instead read once at execute, closest to the send. */
+export declare function chatDmTargetsFrom(domainKey: string, granted: Readonly<Record<string, readonly ResourceCapability[]>>, domains: readonly Domain[]): readonly ChatDmTarget[];
+/** {@link chatDmTargetsFrom} bound to a live session. Both resolutions fail closed to nothing. */
+export declare function chatDmTargets(ctx: BindableContext, domains: readonly Domain[]): readonly ChatDmTarget[];
+/** ABSENCE OVER REFUSAL: a session with no grant must never see the verb, because a mounted-but-impossible tool produces a false capability claim in a reply. The domains thunk is lazy because a session.started resolver can run before the app config is registered, and any throw inside is a refusal. */
+export declare function chatDmMount(ctx: BindableContext, domains: () => readonly Domain[]): boolean;
+/** Returns the resolved target so the caller freezes exactly what the fence admitted, never a second parse of the model's string. The two refusals carry different messages because the remedies are different files: an ungranted person needs a bundle row, a cross-domain one needs the domain's own roster. */
+export declare function resolveChatDmTargetFrom(domainKey: string | undefined, granted: Readonly<Record<string, readonly ResourceCapability[]>>, domains: readonly Domain[], requested: string): ChatDmTarget;
+/** What {@link assertChatDmAllowed} admitted — the target plus the fact that decides whether this
+ *  delivery cards or flows. */
+export interface AdmittedChatDm {
+    readonly target: ChatDmTarget;
+    /** A proactive DM has ALREADY landed on this person under this grant, so this one flows. False on the first delivery, which is consequential and takes the approval card. */
+    readonly delivered: boolean;
+}
+/**
+ * Runs the pure grant and domain checks first, then the recipient's stop. The stop is checked LAST and always, which is what keeps it from leaking the existence of a grant: a caller with no grant is refused ungranted whether or not that person ever stopped anything.
+ * 🔴 THIS READ IS NOT THE CONTROL, AND MUST NEVER BE TREATED AS ONE (OPE-1855). It runs at the tool call, which on the carded arm is minutes or hours before the send; `deliverProactiveDm` reads the stop again at the send, on every plane, and THAT read is what a person's stop actually rests on. What this one buys is a refusal the seat can explain in the room, and the carded/flowing answer the caller needs before it proposes anything.
+ */
+export declare function assertChatDmAllowed(ctx: BindableContext, domains: readonly Domain[], requested: string): Promise<AdmittedChatDm>;
+//# sourceMappingURL=chat-dm-grant.d.ts.map

package/dist/agent/access/chat-dm-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-dm-grant.d.ts","sourceRoot":"","sources":["../../../agent/access/chat-dm-grant.ts"],"names":[],"mappings":"AAIA,OAAO,EAA0E,oBAAoB,EAAiC,MAAM,4BAA4B,CAAC;AACzK,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;yDACyD;AACzD,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,8aAA8a;IAC9a,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,YAAY;IAJ1F,YACW,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM;IAC5B,8aAA8a;IACra,QAAQ,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,YAAY,EACxF,OAAO,EAAE,MAAM,EAGhB;CACF;AAoBD,8SAA8S;AAC9S,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE9G;AAED,oTAAoT;AACpT,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAAC,EAChE,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,SAAS,YAAY,EAAE,CAkBzB;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,YAAY,EAAE,CAIvG;AAED,8SAA8S;AAC9S,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,SAAS,MAAM,EAAE,GAAG,OAAO,CAM3F;AAED,mTAAmT;AACnT,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAAC,EAChE,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,SAAS,EAAE,MAAM,GAChB,YAAY,CAqCd;AAMD;+BAC+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,6KAA6K;IAC7K,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAiCzB"}