@open-everywhere/core 0.1.0

package/dist/agent/access/connector-disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-disclosure.d.ts","sourceRoot":"","sources":["../../../agent/access/connector-disclosure.ts"],"names":[],"mappings":"AAaA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9G,OAAO,EAA4C,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGpH,yEAAyE;AACzE,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE;AACvB,kOAAkO;GAChO;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE;AAC1F,8FAA8F;GAC5F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE;AACjE;2FAC2F;GACzF;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;gFACgF;AAChF,MAAM,WAAW,wBAAwB;IACvC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,uGAAuG;IACvG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,iGAAiG;IACjG,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;+EAC2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;wGACoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;gGAC4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;CACpD;AAED,sIAAsI;AACtI,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,wBAAwB,GAAG,0BAA0B,CAcvG;AAID;yGACyG;AACzG,MAAM,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;AAInC,kGAAkG;AAClG,wBAAgB,iCAAiC,CAAC,EAAE,EAAE,yBAAyB,GAAG,IAAI,CAErF;AAED,gFAAgF;AAChF,wBAAgB,sCAAsC,IAAI,IAAI,CAE7D;AAOD,yLAAyL;AACzL,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAAC;IACpE,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,EAItF;CACF;AAyCD,+QAA+Q;AAC/Q,wBAAsB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAyGvG"}

package/dist/agent/access/connector-disclosure.js

@@ -0,0 +1,194 @@
+// LEG 1 refuses a connector read when the room's audience floor POSITIVELY resolves to guest; an unresolvable roster leaves it INERT. LEG 2, the opt-in requestor-entitlement pre-check, is connection-grain and fails closed.
+//
+// ⛔ WHAT LEG 1 ACTUALLY COVERS TODAY — READ THIS BEFORE CITING THE GATE AS A GUARANTEE (OPE-173). The classifier runs on every call, but it can only REFUSE where a registered member supplier positively resolves a roster whose `hasGuest` bit is set. Three independent narrowings gate that, and every one of them is narrower than "a guest is in the room":
+//
+// (n1) ONE SURFACE. Exactly one production member supplier exists in the tree — the Slack bundle's (channels/slack-events.ts registerSlackGovernanceMembers) — and it returns `undefined` for every non-`slack` channel key. Everywhere else resolveRoomRoster falls back to UNRESOLVED_ROSTER and leg 1 is STRUCTURALLY INERT: not "no guest was observed" but "the question is not askable". Discord, Teams, GitHub, Linear and Notion are all in that bucket.
+//
+// (n2) "GUEST" HERE MEANS "EXTERNALLY-SHARED CHANNEL", NOT "A GUEST IS STANDING IN THE ROOM". The Slack supplier sets `hasGuest` from the CHANNEL's externally-shared bits (is_ext_shared / is_org_shared / is_shared / is_pending_ext_shared, via channels/slack-identity.ts channelFactsFromInfo). It is not a per-member classification. A single-channel or multi-channel guest (is_ultra_restricted / is_restricted) sitting in an ordinary INTERNAL private channel sets none of those bits, so that room does NOT trip leg 1. Only a Slack Connect, shared or org-shared channel does.
+//
+// (n3) THE DM-ONLY WALL RUNS FIRST AND DEFAULTS ON. assertConnectorScope refuses every non-DM turn with `dm_only` BEFORE reaching this gate, unless the deployment sets connectors.dmOnly to false (connector-scope.ts connectorDmOnlyEnabled). So on the DEFAULT posture leg 1 only ever sees DM turns. The OPE-332 live probe (2026-08-09) verified ONE case and only one: an INTERNAL 1:1 `im` in our own workspace resolves with `hasGuest === false`, so leg 1 does not arm there. Still UNVERIFIED, and this file makes no claim about: a Slack Connect / cross-org `im`, and any `mpim`. An app without `im:read` gets `missing_scope` on conversations.info, an UNRESOLVED roster and leg 1 inert — a different reason for the same non-refusal, and the one a fresh install hits.
+//
+// NET: leg 1 refuses on an EXTERNALLY-SHARED SLACK CHANNEL in a deployment that has set connectors.dmOnly to false. That is a real case and a real refusal; it is not the general "a guest is in the room" guarantee. scripts/connector-disclosure-test.ts §5 PINS this scope, so it cannot widen or narrow without the claim being rewritten alongside it.
+import { appendAudit } from "../audit/audit.js";
+import { bindFrom, currentTurnAddressing, deploymentOrg } from "../identity/binding.js";
+import { resolvePartition } from "../memory/partition.js";
+import { getConfig } from "./config.js";
+import { requestorEntitlementChecksEnabled } from "../memory/domain.js";
+import { governanceAdminSet, resolveAudienceFloor } from "./audience-floor.js";
+import { PaneRedirectError } from "./pane-venue.js";
+/** Leg 1 runs first: a room that may not hear the connector at all is refused before anyone's personal entitlement is asked about. */
+export function classifyConnectorDisclosure(input) {
+    // LEG 1 — only an OBSERVED guest floors the room down (see the header's inert rule).
+    if (input.roster.resolved && input.floor === "guest") {
+        return { ok: false, reason: "audience-floor", floor: input.floor };
+    }
+    // LEG 2 — inert unless the org opted in AND this turn has a requestor to check.
+    if (!input.complianceMode || !input.directAddressed)
+        return { ok: true };
+    if (input.entitled === true)
+        return { ok: true };
+    if (input.entitled === false)
+        return { ok: false, reason: "requestor-unentitled" };
+    return {
+        ok: false,
+        reason: "entitlement-unavailable",
+        detail: input.entitlementDetail ?? "no entitlement signal available",
+    };
+}
+let probe = null;
+/** Register the deployment's entitlement probe (app boot; a later call REPLACES the previous). */
+export function registerConnectorEntitlementProbe(fn) {
+    probe = fn;
+}
+/** Test seam: drop the registered probe so one test can't inherit another's. */
+export function _resetConnectorEntitlementProbeForTest() {
+    probe = null;
+}
+/** The registered probe, or null when none is wired (⇒ compliance mode fails closed). */
+function connectorEntitlementProbe() {
+    return probe;
+}
+/** Thrown when compliance mode refuses a connector call. Distinct from PaneRedirectError because there is nowhere to redirect TO: the requestor is not entitled to the data anywhere. */
+export class ConnectorEntitlementError extends Error {
+    reason;
+    constructor(message, reason) {
+        super(message);
+        this.name = "ConnectorEntitlementError";
+        this.reason = reason;
+    }
+}
+function domainsOrNull() {
+    try {
+        return getConfig().loadDomains();
+    }
+    catch {
+        return null; // no config registered (a unit-test / boot-order path) ⇒ the gate is inert
+    }
+}
+/** TRUE for a DM and for an addressed mention (the oe_addressing stamp, written only for a direct-mention wake). An ambient or watch turn has neither, so leg 2 never runs there. */
+function isDirectAddressed(ctx, mode) {
+    if (mode === "dm")
+        return true;
+    const addressing = currentTurnAddressing(ctx);
+    return typeof addressing === "string" && addressing.length > 0;
+}
+/** A refusal uses connector.refused, the established refusal action, so it lands in the stream an operator already watches. The compliance ALLOW gets its own connector.entitlement_check action, so an allow never pollutes the refusal stream. */
+async function auditDisclosure(ctx, action, detail) {
+    let org = deploymentOrg();
+    let platform = "unknown";
+    let workspace = "unknown";
+    let surface;
+    let principalId;
+    try {
+        const p = resolvePartition(ctx);
+        org = p.org;
+        platform = p.platform;
+        workspace = p.workspace;
+        surface = p.surface;
+        principalId = bindFrom(ctx).principalId;
+    }
+    catch {
+        /* keep the "unknown" stamps — the row must still land */
+    }
+    await appendAudit({ org, platform, workspace, surface, principalId, action, detail });
+}
+/** Call this from a connection's getToken AFTER the grant gate and the DM wall; that composition is the full credential gate. Compliance mode off with no observed guest returns silently and writes NOTHING, which is byte-identical to the path before this gate existed. */
+export async function assertConnectorDisclosure(connection, ctx) {
+    const domains = domainsOrNull();
+    if (!domains)
+        return; // no config ⇒ inert
+    let mode;
+    let principalId;
+    try {
+        const b = bindFrom(ctx);
+        mode = b.mode;
+        principalId = b.principalId;
+    }
+    catch {
+        /* unresolved binding — leg 1 still evaluates on the roster; leg 2 fails closed below */
+    }
+    let channelKey;
+    try {
+        channelKey = resolvePartition(ctx).surfaceKey;
+    }
+    catch {
+        /* unresolvable surface — the floor is unobservable ⇒ leg 1 inert (the grant gate already ran) */
+    }
+    const resolution = channelKey
+        ? await resolveAudienceFloor(channelKey, governanceAdminSet(channelKey, domains))
+        : { floor: "guest", roster: { humanMemberIds: [], resolved: false, isPrivate: false, hasGuest: false } };
+    const complianceMode = requestorEntitlementChecksEnabled(domains);
+    const directAddressed = isDirectAddressed(ctx, mode);
+    // Only ASK the probe when its answer can matter — a probe call is a network read.
+    let entitled;
+    let entitlementDetail;
+    if (complianceMode && directAddressed) {
+        const fn = connectorEntitlementProbe();
+        if (!fn) {
+            entitlementDetail = "no entitlement probe is registered for this deployment";
+        }
+        else if (!principalId) {
+            entitlementDetail = "this turn has no verified requestor identity";
+        }
+        else {
+            try {
+                entitled = await fn({ connection, principalId, ctx });
+                if (entitled === undefined)
+                    entitlementDetail = "the system of record could not answer the entitlement question";
+            }
+            catch (err) {
+                entitlementDetail = `the entitlement probe failed: ${String(err).slice(0, 160)}`;
+            }
+        }
+    }
+    const verdict = classifyConnectorDisclosure({
+        floor: resolution.floor,
+        roster: resolution.roster,
+        complianceMode,
+        directAddressed,
+        entitled,
+        entitlementDetail,
+    });
+    if (verdict.ok) {
+        if (complianceMode && directAddressed) {
+            await auditDisclosure(ctx, "connector.entitlement_check", { connection, verdict: "allow", floor: resolution.floor });
+        }
+        return;
+    }
+    if (verdict.reason === "audience-floor") {
+        await auditDisclosure(ctx, "connector.refused", {
+            connection,
+            reason: "audience_floor",
+            floor: verdict.floor,
+            ...(channelKey ? { from: channelKey } : {}),
+        });
+        // The SAME redirect posture OPE-110 established for pane output (§5): never render in place,
+        // deliver to a venue whose audience is entitled, leave a pointer, stamp the redirect.
+        await auditDisclosure(ctx, "governance.redirected", {
+            kind: "connector.read",
+            connection,
+            to: "requester-dm",
+            ...(channelKey ? { from: channelKey } : {}),
+            floorBreach: "guest-present",
+        });
+        throw new PaneRedirectError(`connection "${connection}": this room's audience floor resolved to "guest" — it is externally shared, ` +
+            `or carries an observed guest/external member — so org-internal connector data ` +
+            `can't be disclosed here. Deliver the answer view-only in the requester's DM instead and reply here ` +
+            `only with a pointer ("I've sent it to you directly"). Do NOT render any of the substance in this ` +
+            `channel — partial disclosure is still disclosure.`, "requester-dm");
+    }
+    await auditDisclosure(ctx, "connector.refused", {
+        connection,
+        reason: verdict.reason === "requestor-unentitled" ? "requestor_unentitled" : "entitlement_unavailable",
+        ...(verdict.reason === "entitlement-unavailable" ? { detail: verdict.detail } : {}),
+    });
+    throw new ConnectorEntitlementError(verdict.reason === "requestor-unentitled"
+        ? `connection "${connection}": refused — this org runs requestor-entitlement compliance mode, and the ` +
+            `person who asked is not entitled to this resource in the system of record. This is a deployment ` +
+            `rule enforced at the credential layer, not a permission that can be requested in-chat.`
+        : `connection "${connection}": refused — this org runs requestor-entitlement compliance mode, but ` +
+            `${verdict.detail}. Compliance mode fails CLOSED: it never allows on an unverifiable entitlement. ` +
+            `An operator must register a connector entitlement probe (access/connector-disclosure.ts ` +
+            `registerConnectorEntitlementProbe) or turn requestorEntitlementChecks off on the org domain.`, verdict.reason);
+}
+//# sourceMappingURL=connector-disclosure.js.map

package/dist/agent/access/connector-disclosure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-disclosure.js","sourceRoot":"","sources":["../../../agent/access/connector-disclosure.ts"],"names":[],"mappings":"AAAA,+NAA+N;AAC/N,EAAE;AACF,kWAAkW;AAClW,EAAE;AACF,icAAic;AACjc,EAAE;AACF,8jBAA8jB;AAC9jB,EAAE;AACF,2vBAA2vB;AAC3vB,EAAE;AACF,4VAA4V;AAE5V,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iCAAiC,EAAe,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAuC,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmCpD,sIAAsI;AACtI,MAAM,UAAU,2BAA2B,CAAC,KAA+B;IACzE,qFAAqF;IACrF,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,gFAAgF;IAChF,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,iCAAiC;KACrE,CAAC;AACJ,CAAC;AAYD,IAAI,KAAK,GAAqC,IAAI,CAAC;AAEnD,kGAAkG;AAClG,MAAM,UAAU,iCAAiC,CAAC,EAA6B;IAC7E,KAAK,GAAG,EAAE,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sCAAsC;IACpD,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,SAAS,yBAAyB;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yLAAyL;AACzL,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,MAAM,CAAqD;IACpE,YAAY,OAAe,EAAE,MAA0D;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,2EAA2E;IAC1F,CAAC;AACH,CAAC;AAED,qLAAqL;AACrL,SAAS,iBAAiB,CAAC,GAAoB,EAAE,IAAwB;IACvE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,oPAAoP;AACpP,KAAK,UAAU,eAAe,CAC5B,GAAoB,EACpB,MAAqF,EACrF,MAAyC;IAEzC,IAAI,GAAG,GAAG,aAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,SAAS,CAAC;IACzB,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,IAAI,OAA2B,CAAC;IAChC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QACZ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QACtB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACxB,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACpB,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;IACD,MAAM,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,+QAA+Q;AAC/Q,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,GAAoB;IACtF,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,oBAAoB;IAE1C,IAAI,IAAwB,CAAC;IAC7B,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACd,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;IAED,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;IACnG,CAAC;IAED,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,MAAM,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC,CAAC,EAAE,KAAK,EAAE,OAAwB,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IAE5H,MAAM,cAAc,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAErD,kFAAkF;IAClF,IAAI,QAA6B,CAAC;IAClC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,yBAAyB,EAAE,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,GAAG,wDAAwD,CAAC;QAC/E,CAAC;aAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxB,iBAAiB,GAAG,8CAA8C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;gBACtD,IAAI,QAAQ,KAAK,SAAS;oBAAE,iBAAiB,GAAG,gEAAgE,CAAC;YACnH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iBAAiB,GAAG,iCAAiC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,2BAA2B,CAAC;QAC1C,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc;QACd,eAAe;QACf,QAAQ;QACR,iBAAiB;KAClB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,eAAe,CAAC,GAAG,EAAE,6BAA6B,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACxC,MAAM,eAAe,CAAC,GAAG,EAAE,mBAAmB,EAAE;YAC9C,UAAU;YACV,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,6FAA6F;QAC7F,sFAAsF;QACtF,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,IAAI,EAAE,gBAAgB;YACtB,UAAU;YACV,EAAE,EAAE,cAAc;YAClB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;QACH,MAAM,IAAI,iBAAiB,CACzB,eAAe,UAAU,+EAA+E;YACtG,gFAAgF;YAChF,qGAAqG;YACrG,mGAAmG;YACnG,mDAAmD,EACrD,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,CAAC,GAAG,EAAE,mBAAmB,EAAE;QAC9C,UAAU;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,yBAAyB;QACtG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;IACH,MAAM,IAAI,yBAAyB,CACjC,OAAO,CAAC,MAAM,KAAK,sBAAsB;QACvC,CAAC,CAAC,eAAe,UAAU,4EAA4E;YACnG,kGAAkG;YAClG,wFAAwF;QAC5F,CAAC,CAAC,eAAe,UAAU,wEAAwE;YAC/F,GAAG,OAAO,CAAC,MAAM,kFAAkF;YACnG,0FAA0F;YAC1F,8FAA8F,EACpG,OAAO,CAAC,MAAM,CACf,CAAC;AACJ,CAAC"}

package/dist/agent/access/connector-op-gating.d.ts

@@ -0,0 +1,32 @@
+import type { Bundle } from "./bundle.js";
+import { type ConnectorOpTier, type OpTierBasis } from "./consequence.js";
+/** The stricter of two tiers (the lattice JOIN). Total, commutative, and never returns a value
+ *  below either input — which is precisely the raise-only guarantee, stated as an operation. */
+export declare function joinConnectorOpTiers(a: ConnectorOpTier, b: ConnectorOpTier): ConnectorOpTier;
+/** The tier a config declaration RAISES a tool name to, or `undefined` when nothing names it. It never consults the base classifier, so a caller cannot mistake it for the answer. */
+export declare function declaredConnectorOpRaise(toolName: string, bundles?: readonly Bundle[]): ConnectorOpTier | undefined;
+/** Every rung of one op's tier decision, for the audit hook that must show its work. */
+export interface ConnectorOpTierParts {
+    /** The built-in verdict's tier — `classifyConnectorOpTier(toolName)`. */
+    readonly base: ConnectorOpTier;
+    /** WHY the built-in reached it. `unrecognised` is the abstention the arm may decide. */
+    readonly basis: OpTierBasis;
+    /** True when a deployment REPLACED the shipped default tiering function with its own. It is not "an arm ran": one always does, because the slot ships full. */
+    readonly armReplaced: boolean;
+    /** A consumer arm's in-vocabulary answer as the arm gave it, BEFORE the floor — which is what makes a mis-tiering arm visible in an audit row. Absent for every abstention, and absent whenever the deployment runs the shipped default. */
+    readonly arm?: ConnectorOpTier;
+    /** True when the arm's floored answer sits below the built-in. Measured BEFORE `declared`, so it is a fact about the ARM: a declared raise can put the op back at the built-in. */
+    readonly armLowered: boolean;
+    /** The tier `Bundle.connectorOps` raises to, when any bundle names the op. */
+    readonly declared?: ConnectorOpTier;
+    readonly tier: ConnectorOpTier;
+}
+/** Three rungs: the built-in verdict, the registered tiering function (raise freely, lower only to the floor), then `Bundle.connectorOps`, last and raise-only, so an arm cannot undercut an operator. The clamp is asymmetric and lives only here: a raise passes through as given. */
+export declare function connectorOpTierParts(toolName: string, bundles?: readonly Bundle[]): ConnectorOpTierParts;
+/** The tier every gate reads. With the shipped default it is a join and never below classifyConnectorOpTier; with a consumer arm it can be, down to the floor — but it answers `read` only where the built-in does. */
+export declare function effectiveConnectorOpTier(toolName: string, bundles?: readonly Bundle[]): ConnectorOpTier;
+/** `read` becomes `open`; `write` and `destructive` become `gate:member`. Never `gate:admin`: a config declaration deliberately cannot change which approver tier applies. */
+export declare function effectiveConnectorOpConsequence(toolName: string, bundles?: readonly Bundle[]): "open" | "gate:member";
+/** The same collapse over a tier the caller already holds, so the audit hook does not consult the arm twice for one row. An op is not consulted once overall: the approval policy and the unattended fence each consult it. */
+export declare function connectorOpConsequenceOfTier(tier: ConnectorOpTier): "open" | "gate:member";
+//# sourceMappingURL=connector-op-gating.d.ts.map

package/dist/agent/access/connector-op-gating.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-op-gating.d.ts","sourceRoot":"","sources":["../../../agent/access/connector-op-gating.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAqB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAKL,KAAK,eAAe,EAEpB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAU1B;gGACgG;AAChG,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,eAAe,CAE5F;AAkFD,sLAAsL;AACtL,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,GAAG,SAAS,CAiBnH;AA2CD,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,+JAA+J;IAC/J,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4OAA4O;IAC5O,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;IAC/B,mLAAmL;IACnL,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AAED,wRAAwR;AACxR,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,oBAAoB,CAsBxG;AAED,uNAAuN;AACvN,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAEvG;AAED,8KAA8K;AAC9K,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,aAAa,CAErH;AAED,+NAA+N;AAC/N,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,aAAa,CAE1F"}

package/dist/agent/access/connector-op-gating.js

@@ -0,0 +1,178 @@
+// The config-declared half of the connector-op consequence plane, and the seam's composition site. A `Bundle.connectorOps` declaration is RAISE-ONLY (the vocabulary cannot spell a lowering; the combination is a lattice join), an arm may lower only to `write`, and the join is deployment-wide rather than per-scope.
+import { classifyConnectorOpTierVerdict, connectorOpName, defaultConnectorOpTierArm, parseQualifiedToolName, } from "./consequence.js";
+import { getConfig } from "./config.js";
+/** Strictness order. The ONLY place the tiers are ranked; the join below is the only consumer. */
+const TIER_RANK = { read: 0, write: 1, destructive: 2 };
+/** The tier a `gated` / `destructive` list raises an op TO. Note both are ≥ `write`: neither
+ *  list — and there is no third list — can name the bottom of the lattice. */
+const LIST_TIER = { gated: "write", destructive: "destructive" };
+/** The stricter of two tiers (the lattice JOIN). Total, commutative, and never returns a value
+ *  below either input — which is precisely the raise-only guarantee, stated as an operation. */
+export function joinConnectorOpTiers(a, b) {
+    return TIER_RANK[a] >= TIER_RANK[b] ? a : b;
+}
+/** The lowest tier a consumer arm may ever produce: an arm may lower a verdict, never into `read`, the open tier that takes no card. Read only in connectorOpTierParts, so the floor lives in the seam. */
+const ARM_TIER_FLOOR = "write";
+/** Wildcard that matches every op of a connector. */
+const ALL_OPS = "*";
+/** Canonical form of a declared or observed op name: case-folded, `-`/`_` unified. Vendors and
+ *  operators disagree about the separator (`create_pages` vs `create-pages`) and that disagreement
+ *  must never be the reason a gate silently fails to apply. */
+function opKey(op) {
+    return op.trim().toLowerCase().replace(/-/gu, "_");
+}
+/** Both the bare op and the vendor-prefix-stripped op are accepted, because hosted MCP servers re-prefix their ops. Matching more spellings only ever makes a raise apply, which is the safe side. */
+function opKeysOf(toolName) {
+    const sep = toolName.indexOf("__");
+    const conn = sep > 0 ? toolName.slice(0, sep).toLowerCase() : "";
+    const op = opKey(connectorOpName(toolName));
+    const keys = new Set([op]);
+    if (conn !== "" && op.startsWith(`${opKey(conn)}_`))
+        keys.add(op.slice(opKey(conn).length + 1));
+    return [...keys];
+}
+/** The connector half of a qualified tool name, canonicalised; "" when the name carries none. */
+function connectorKeyOf(toolName) {
+    const sep = toolName.indexOf("__");
+    return sep > 0 ? opKey(toolName.slice(0, sep)) : "";
+}
+const EMPTY_INDEX = new Map();
+/** Memo keyed on the bundle ARRAY identity — `loadBundles()` normally returns a stable array, and
+ *  when it doesn't (a reload, a test) the cost is one rebuild over a handful of bundles. */
+const indexCache = new WeakMap();
+function buildIndex(bundles) {
+    const index = new Map();
+    for (const bundle of bundles) {
+        for (const entry of bundle.connectorOps ?? []) {
+            const connector = opKey(entry.connector);
+            if (connector === "")
+                continue; // assertBundlesValid already rejected this at config load
+            let ops = index.get(connector);
+            if (!ops) {
+                ops = new Map();
+                index.set(connector, ops);
+            }
+            for (const [list, tier] of Object.entries(LIST_TIER)) {
+                for (const raw of entry[list] ?? []) {
+                    const key = raw.trim() === ALL_OPS ? ALL_OPS : opKey(raw);
+                    if (key === "")
+                        continue;
+                    const prior = ops.get(key);
+                    ops.set(key, prior === undefined ? tier : joinConnectorOpTiers(prior, tier));
+                }
+            }
+        }
+    }
+    return index;
+}
+function indexFor(bundles) {
+    const cached = indexCache.get(bundles);
+    if (cached)
+        return cached;
+    const built = buildIndex(bundles);
+    indexCache.set(bundles, built);
+    return built;
+}
+/** The registered config's bundles, or `[]` when nothing is registered. An unreadable config declares no raises and cannot invent a lowering, because the caller joins whatever comes back onto the classifier's fail-closed baseline. */
+function configuredBundles() {
+    try {
+        return getConfig().loadBundles();
+    }
+    catch {
+        return [];
+    }
+}
+/** The tier a config declaration RAISES a tool name to, or `undefined` when nothing names it. It never consults the base classifier, so a caller cannot mistake it for the answer. */
+export function declaredConnectorOpRaise(toolName, bundles) {
+    const connector = connectorKeyOf(toolName);
+    if (connector === "")
+        return undefined;
+    let index;
+    try {
+        index = indexFor(bundles ?? configuredBundles());
+    }
+    catch {
+        index = EMPTY_INDEX; // a malformed declaration raises nothing; the baseline still stands
+    }
+    const ops = index.get(connector);
+    if (!ops)
+        return undefined;
+    let raised = ops.get(ALL_OPS);
+    for (const key of opKeysOf(toolName)) {
+        const declared = ops.get(key);
+        if (declared !== undefined)
+            raised = raised === undefined ? declared : joinConnectorOpTiers(raised, declared);
+    }
+    return raised;
+}
+/** The tiering function on the slot, never undefined: registerConfig fills it, and boot paths that skipped registerConfig fall back to the same default. The getConfig() throw is swallowed silently. */
+function registeredConnectorOpTierArm() {
+    try {
+        return getConfig().connectorOpTier ?? defaultConnectorOpTierArm;
+    }
+    catch {
+        return defaultConnectorOpTierArm;
+    }
+}
+/** Consult the registered function for one op; every failure is an ABSTENTION and the caller keeps the built-in verdict. A reserved `grant__…` name is never passed to an arm, and an unparseable name abstains. */
+function consultTieringFunction(toolName) {
+    const arm = registeredConnectorOpTierArm();
+    const replaced = arm !== defaultConnectorOpTierArm;
+    const parsed = parseQualifiedToolName(toolName);
+    if (parsed?.connection === undefined)
+        return { replaced };
+    let answer;
+    try {
+        answer = arm({ connection: parsed.connection, verb: parsed.verb, toolName });
+    }
+    catch (err) {
+        // Loud on purpose, once per call: a consistently broken arm is a deployment defect, not a
+        // condition to ride out quietly. The built-in verdict is already a correct, fail-closed answer.
+        console.warn(`[open-everywhere:access] connectorOpTier arm threw for ${toolName}; kept the built-in verdict: ${String(err)}`);
+        return { replaced };
+    }
+    if (answer === undefined)
+        return { replaced }; // a deliberate defer — not a defect, no note
+    // Out of vocabulary is an ABSTENTION: an arm is consumer JavaScript, so a typo'd tier must resolve to the built-in. `Object.hasOwn` and not `in`, so "toString" misses.
+    if (typeof answer !== "string" || !Object.hasOwn(TIER_RANK, answer)) {
+        console.warn(`[open-everywhere:access] connectorOpTier arm returned ${JSON.stringify(answer)} for ${toolName}, which is not a tier; kept the built-in verdict`);
+        return { replaced };
+    }
+    return { replaced, tier: answer };
+}
+/** Three rungs: the built-in verdict, the registered tiering function (raise freely, lower only to the floor), then `Bundle.connectorOps`, last and raise-only, so an arm cannot undercut an operator. The clamp is asymmetric and lives only here: a raise passes through as given. */
+export function connectorOpTierParts(toolName, bundles) {
+    const verdict = classifyConnectorOpTierVerdict(toolName);
+    const arm = consultTieringFunction(toolName);
+    // A raise (or an exact agreement) is the join. A lowering is the arm's answer lifted to the floor.
+    const afterArm = arm.tier === undefined
+        ? verdict.tier
+        : TIER_RANK[arm.tier] >= TIER_RANK[verdict.tier]
+            ? joinConnectorOpTiers(verdict.tier, arm.tier)
+            : joinConnectorOpTiers(arm.tier, ARM_TIER_FLOOR);
+    const armLowered = TIER_RANK[afterArm] < TIER_RANK[verdict.tier];
+    const declared = declaredConnectorOpRaise(toolName, bundles);
+    const tier = declared === undefined ? afterArm : joinConnectorOpTiers(afterArm, declared);
+    return {
+        base: verdict.tier,
+        basis: verdict.basis,
+        armReplaced: arm.replaced,
+        ...(arm.replaced && arm.tier !== undefined ? { arm: arm.tier } : {}),
+        armLowered,
+        ...(declared !== undefined ? { declared } : {}),
+        tier,
+    };
+}
+/** The tier every gate reads. With the shipped default it is a join and never below classifyConnectorOpTier; with a consumer arm it can be, down to the floor — but it answers `read` only where the built-in does. */
+export function effectiveConnectorOpTier(toolName, bundles) {
+    return connectorOpTierParts(toolName, bundles).tier;
+}
+/** `read` becomes `open`; `write` and `destructive` become `gate:member`. Never `gate:admin`: a config declaration deliberately cannot change which approver tier applies. */
+export function effectiveConnectorOpConsequence(toolName, bundles) {
+    return connectorOpConsequenceOfTier(effectiveConnectorOpTier(toolName, bundles));
+}
+/** The same collapse over a tier the caller already holds, so the audit hook does not consult the arm twice for one row. An op is not consulted once overall: the approval policy and the unattended fence each consult it. */
+export function connectorOpConsequenceOfTier(tier) {
+    return tier === "read" ? "open" : "gate:member";
+}
+//# sourceMappingURL=connector-op-gating.js.map

package/dist/agent/access/connector-op-gating.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-op-gating.js","sourceRoot":"","sources":["../../../agent/access/connector-op-gating.ts"],"names":[],"mappings":"AAAA,2TAA2T;AAG3T,OAAO,EACL,8BAA8B,EAC9B,eAAe,EACf,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,kGAAkG;AAClG,MAAM,SAAS,GAA8C,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAEnG;8EAC8E;AAC9E,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAqD,CAAC;AAEpH;gGACgG;AAChG,MAAM,UAAU,oBAAoB,CAAC,CAAkB,EAAE,CAAkB;IACzE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,2MAA2M;AAC3M,MAAM,cAAc,GAAoB,OAAO,CAAC;AAEhD,qDAAqD;AACrD,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;+DAE+D;AAC/D,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,sMAAsM;AACtM,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAMD,MAAM,WAAW,GAAgB,IAAI,GAAG,EAAE,CAAC;AAE3C;4FAC4F;AAC5F,MAAM,UAAU,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEtD,SAAS,UAAU,CAAC,OAA0B;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,EAAE;gBAAE,SAAS,CAAC,0DAA0D;YAC1F,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;gBAChB,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAoE,EAAE,CAAC;gBACxH,KAAK,MAAM,GAAG,IAAK,KAA2B,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC1D,IAAI,GAAG,KAAK,EAAE;wBAAE,SAAS;oBACzB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0OAA0O;AAC1O,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,sLAAsL;AACtL,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAA2B;IACpF,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,WAAW,CAAC,CAAC,oEAAoE;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,MAAM,GAAgC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yMAAyM;AACzM,SAAS,4BAA4B;IACnC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yBAAyB,CAAC;IACnC,CAAC;AACH,CAAC;AAQD,oNAAoN;AACpN,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,GAAG,GAAG,4BAA4B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,GAAG,KAAK,yBAAyB,CAAC;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0FAA0F;QAC1F,gGAAgG;QAChG,OAAO,CAAC,IAAI,CAAC,0DAA0D,QAAQ,gCAAgC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9H,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,6CAA6C;IAC5F,wKAAwK;IACxK,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CACV,yDAAyD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,QAAQ,kDAAkD,CAClJ,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAyB,EAAE,CAAC;AACvD,CAAC;AAmBD,wRAAwR;AACxR,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,OAA2B;IAChF,MAAM,OAAO,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC7C,mGAAmG;IACnG,MAAM,QAAQ,GACZ,GAAG,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1F,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,GAAG,CAAC,QAAQ;QACzB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,UAAU;QACV,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI;KACL,CAAC;AACJ,CAAC;AAED,uNAAuN;AACvN,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAA2B;IACpF,OAAO,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,8KAA8K;AAC9K,MAAM,UAAU,+BAA+B,CAAC,QAAgB,EAAE,OAA2B;IAC3F,OAAO,4BAA4B,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,+NAA+N;AAC/N,MAAM,UAAU,4BAA4B,CAAC,IAAqB;IAChE,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AAClD,CAAC"}

package/dist/agent/access/connector-scope.d.ts

@@ -0,0 +1,42 @@
+import type { SessionAuth } from "eve/context";
+import { type BindableContext } from "../identity/binding.js";
+export declare class ConnectorScopeError extends Error {
+}
+export declare function connectorDmOnlyEnabled(): boolean;
+interface ContextStore {
+    get(key: unknown): unknown;
+}
+interface EveInternals {
+    contextStorage: {
+        getStore(): ContextStore | undefined;
+    };
+    ChannelKey: unknown;
+}
+/** The eve package root, resolved through the one path eve's exports map allows ("./package.json") and never a hardcoded node_modules path, so it keeps working under any install layout. Exported so the internals test drives the real code path. */
+export declare function defaultEveRoot(): string;
+/** Import eve's two internal dist modules by absolute file URL, which bypasses eve's exports map — there is no public export for either. It takes an explicit root so a test can point it at a directory that lacks the files and exercise the "internals unavailable" path deterministically. */
+export declare function resolveEveInternalsFrom(root: string): Promise<EveInternals | null>;
+/** The boot probe's settled status: "pending" only between module load and the probe resolving, then permanently "available" or "unavailable" — the probe runs exactly once per process. */
+export type EveChannelReachStatus = "pending" | "available" | "unavailable";
+export declare function eveChannelReachStatus(): EveChannelReachStatus;
+/** Resolves once the boot probe has settled — a deterministic wait for tests instead of polling the status. */
+export declare function whenEveChannelReachSettled(): Promise<EveChannelReachStatus>;
+/** Catches a THROWING root resolver as well as the load failures: defaultEveRoot throws synchronously on a hosted build that inlines eve and ships no node_modules/eve. An uncaught throw here is a process-killing cold-start crash (it took prod down on 2026-07-25), so no probe failure mode may escape. */
+export declare function resolveEveInternalsSafe(rootFn: () => string): Promise<EveInternals | null>;
+/** Build the BindableContext the resolver and gate consume from the auth a connection's resolver ctx hands us directly. Returns null ONLY when the auth itself is absent — the sole fail-closed signal here — while a missing channel kind still produces a context, so the binding-bridge fallback can recover the real surface. */
+export declare function surfaceContextFromAuth(auth: SessionAuth): Promise<BindableContext | null>;
+/** Apply admin runtime overrides over the config-as-code grant set. NARROW-ONLY: a revoke removes a connector and a granted:true row is inert, so an override value can never open access, only close it; widening is exclusively a reviewed PR to bundles.ts. */
+export declare function applyConnectorOverrides(base: readonly string[], overrides: readonly {
+    connector: string;
+    granted: boolean;
+}[]): string[];
+/** The eve connection names granted to the surface behind auth, or null when the surface cannot be resolved — the caller MUST treat null as DENY. Pure read, safe from getToken: config-as-code grants are the base, and break-glass revoke overrides narrow them. */
+export declare function grantedConnectors(auth: SessionAuth): Promise<readonly string[] | null>;
+/** Apply the live connector_override overlay, narrow-only, scoped to the surface ctx resolves to. null means the override-STORE READ itself failed: fail closed, because a break-glass revoke lives only there and an unreadable store must never be read as "nothing was revoked". Exported so the egress compiler applies the same overlay to connection ids. */
+export declare function narrowByConnectorOverride(ctx: BindableContext, base: readonly string[]): Promise<readonly string[] | null>;
+/** The per-surface credential a connector grant bound to this connection, or null — on null the caller falls back to its own static secretRef. This is what lets one connector serve a different credential to each surface. */
+export declare function boundConnectorCredential(connection: string, auth: SessionAuth): Promise<import("./connector-credentials.js").ResolvedConnectorCredential | null>;
+/** Throws unless the surface behind auth is granted the connection and clears the context wall; a scoping denial is terminal and deliberately does NOT raise eve's re-consent flow, because re-consent cannot grant a scope. eve caches the resolved token per session, so a connector.use row is one credential-gate verdict per session, not one per op call — connector.op is the per-call record. */
+export declare function assertConnectorGranted(connectionName: string, auth: SessionAuth): Promise<void>;
+export {};
+//# sourceMappingURL=connector-scope.d.ts.map

package/dist/agent/access/connector-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-scope.d.ts","sourceRoot":"","sources":["../../../agent/access/connector-scope.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAcvF,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAGjD,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,UAAU,YAAY;IACpB,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5B;AACD,UAAU,YAAY;IACpB,cAAc,EAAE;QAAE,QAAQ,IAAI,YAAY,GAAG,SAAS,CAAA;KAAE,CAAC;IACzD,UAAU,EAAE,OAAO,CAAC;CACrB;AAMD,uPAAuP;AACvP,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED,kSAAkS;AAClS,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmBxF;AAID,4LAA4L;AAC5L,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAE5E,wBAAgB,qBAAqB,IAAI,qBAAqB,CAE7D;AAED,+GAA+G;AAC/G,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAGjF;AAED,gTAAgT;AAChT,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,MAAM,GACnB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAyCD,qUAAqU;AACrU,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAgB/F;AAED,kQAAkQ;AAClQ,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,GAC5D,MAAM,EAAE,CAMV;AAED,sQAAsQ;AACtQ,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC,CAI5F;AAED,mWAAmW;AACnW,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC,CAUnC;AAYD,gOAAgO;AAChO,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,OAAO,4BAA4B,EAAE,2BAA2B,GAAG,IAAI,CAAC,CAQlF;AA4BD,yYAAyY;AACzY,wBAAsB,sBAAsB,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6DrG"}