@open-everywhere/core 0.1.0

package/dist/agent/access/connector-scope.js

@@ -0,0 +1,258 @@
+// The connector HARD gate. eve has no public per-surface connection filter, so assertConnectorGranted rebuilds the BindableContext the resolver expects and refuses a surface that is not granted a connection. It fails CLOSED on the one signal that means "we do not know who is calling" — no auth identity at all — and deliberately does NOT fail closed on an unresolved channel kind, because the binding-bridge fallback is the only recovery on a hosted build.
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { bindFrom, deploymentOrg } from "../identity/binding.js";
+import { resolveAccessForWithGroups } from "./group-request.js";
+import { assertConnectorDisclosure } from "./connector-disclosure.js";
+import { resolvePartition } from "../memory/partition.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { appendAudit } from "../audit/audit.js";
+import { haltAuditDetail, haltRefusalMessage, haltScopeForCtx, resolveHalt } from "./halt.js";
+import { getSettings } from "../settings/settings.js";
+// The per-op consequence gate's arming flag. A LEAF read (connector-flags.ts imports only the
+// settings schema), so this is not a cycle back through connections/connector-auth.ts — that file
+// imports THIS one, never the reverse.
+import { connectorOpTieringEnabled } from "../connections/connector-flags.js";
+import { delegatedBindingAdopted } from "../identity/delegated-binding.js";
+export class ConnectorScopeError extends Error {
+}
+// The credential wall is two-tier: a personal (principal-scoped) grant resolves only from a positively-resolved DM, and a domain container-ladder grant reaches channel and worker contexts ONLY while connectors.opTiering is armed, because that flag is what keeps its writes behind an approval. connectors.dmOnly defaults ON and is the wall itself — taking it down to widen reach is strictly wider and gives up the personal tier for nothing, and it now costs a reviewed diff rather than an env override.
+export function connectorDmOnlyEnabled() {
+    return getSettings().connectors.dmOnly;
+}
+// The two eve-internal dist paths the channel-kind reach touches, named here so an eve bump is a one-line diff. The contract test pins the same two files by its own literal strings, deliberately not sharing this constant, so a move fails both the prod reach and its test.
+const EVE_INTERNAL_CONTAINER_REL = "dist/src/context/container.js";
+const EVE_INTERNAL_RUNTIME_KEYS_REL = "dist/src/runtime/sessions/runtime-context-keys.js";
+/** The eve package root, resolved through the one path eve's exports map allows ("./package.json") and never a hardcoded node_modules path, so it keeps working under any install layout. Exported so the internals test drives the real code path. */
+export function defaultEveRoot() {
+    const req = createRequire(import.meta.url);
+    return dirname(req.resolve("eve/package.json"));
+}
+/** Import eve's two internal dist modules by absolute file URL, which bypasses eve's exports map — there is no public export for either. It takes an explicit root so a test can point it at a directory that lacks the files and exercise the "internals unavailable" path deterministically. */
+export async function resolveEveInternalsFrom(root) {
+    try {
+        const abs = (rel) => pathToFileURL(join(root, rel)).href;
+        const [container, runtimeKeys] = await Promise.all([
+            // hosted-inline-exempt: best-effort reach into eve's installed internals by absolute path;
+            // absence is an expected, handled state (falls back to inert channel-kind resolution).
+            import(abs(EVE_INTERNAL_CONTAINER_REL)),
+            // hosted-inline-exempt: same best-effort reach as the line above.
+            import(abs(EVE_INTERNAL_RUNTIME_KEYS_REL)),
+        ]);
+        if (!container?.contextStorage || !runtimeKeys?.ChannelKey) {
+            internalsLoadError = "internal modules loaded but expected exports are missing";
+            return null;
+        }
+        return { contextStorage: container.contextStorage, ChannelKey: runtimeKeys.ChannelKey };
+    }
+    catch (err) {
+        internalsLoadError = String(err);
+        return null;
+    }
+}
+let internalsLoadError;
+let bootStatus = "pending";
+export function eveChannelReachStatus() {
+    return bootStatus;
+}
+/** Resolves once the boot probe has settled — a deterministic wait for tests instead of polling the status. */
+export async function whenEveChannelReachSettled() {
+    await internalsPromise;
+    return bootStatus;
+}
+/** Catches a THROWING root resolver as well as the load failures: defaultEveRoot throws synchronously on a hosted build that inlines eve and ships no node_modules/eve. An uncaught throw here is a process-killing cold-start crash (it took prod down on 2026-07-25), so no probe failure mode may escape. */
+export async function resolveEveInternalsSafe(rootFn) {
+    let root;
+    try {
+        root = rootFn();
+    }
+    catch (err) {
+        internalsLoadError = String(err);
+        return null;
+    }
+    return resolveEveInternalsFrom(root);
+}
+// Feature-detect the reach ONCE at module load, well before any real connector call, and log one line per process — never per call. A lazy first-call probe let an eve-bump breakage sit silent until a connector first fired in prod.
+let internalsPromise = resolveEveInternalsSafe(defaultEveRoot);
+internalsPromise = internalsPromise.then((eve) => {
+    bootStatus = eve ? "available" : "unavailable";
+    console.warn(`[open-everywhere:connector-scope:boot] channel-kind ALS reach: ${bootStatus}` +
+        (eve
+            ? ""
+            : ` — permanently falling back to inert channel-kind resolution for this process ` +
+                `(${internalsLoadError ?? "unknown reason"}). This does NOT open the connector gate: ` +
+                `assertConnectorGranted still fails closed on a missing auth identity; only the ` +
+                `best-effort surface.channel.kind hint is unavailable (expected on some hosted builds — ` +
+                `see this file's header).`));
+    return eve;
+});
+// Diagnostics, logged once per distinct reason per instance.
+const loggedReasons = new Set();
+function logOnce(reason) {
+    if (!loggedReasons.has(reason)) {
+        loggedReasons.add(reason);
+        console.warn(`[open-everywhere:surface-context] ${reason}`);
+    }
+}
+/** Best-effort read of the caller's channel kind off eve's internal ALS. It returns undefined — never a deny signal — when the internals cannot be loaded or no ALS store is in scope, both expected on a hosted build. */
+async function readChannelKind() {
+    const eve = await internalsPromise;
+    if (!eve)
+        return undefined; // boot log already recorded the reason; no per-call spam
+    const store = eve.contextStorage.getStore();
+    if (!store) {
+        logOnce("channel kind unresolvable: no ALS store — outside an eve session scope (expected on a hosted build)");
+        return undefined;
+    }
+    const channel = store.get(eve.ChannelKey);
+    return channel?.kind;
+}
+/** Build the BindableContext the resolver and gate consume from the auth a connection's resolver ctx hands us directly. Returns null ONLY when the auth itself is absent — the sole fail-closed signal here — while a missing channel kind still produces a context, so the binding-bridge fallback can recover the real surface. */
+export async function surfaceContextFromAuth(auth) {
+    const current = auth.current ?? null;
+    const initiator = auth.initiator ?? current;
+    if (current === null && initiator === null) {
+        logOnce("resolver ctx carried no auth identity (current/initiator both null) — fail closed");
+        return null;
+    }
+    // A delayed child may carry a later sibling's raw auth. Mark the reconstructed context as a
+    // child whenever the validated dispatch authority slot is present, so bindFrom consumes that
+    // one snapshot instead of rebuilding authority from the mutable launch bag.
+    const kind = delegatedBindingAdopted() ? "subagent" : await readChannelKind();
+    return {
+        session: { auth: { current, initiator } },
+        channel: { kind },
+    };
+}
+/** Apply admin runtime overrides over the config-as-code grant set. NARROW-ONLY: a revoke removes a connector and a granted:true row is inert, so an override value can never open access, only close it; widening is exclusively a reviewed PR to bundles.ts. */
+export function applyConnectorOverrides(base, overrides) {
+    const set = new Set(base);
+    for (const o of overrides) {
+        if (!o.granted)
+            set.delete(o.connector); // revoke narrows; a `true` override is inert (can't widen)
+    }
+    return [...set].sort();
+}
+/** The eve connection names granted to the surface behind auth, or null when the surface cannot be resolved — the caller MUST treat null as DENY. Pure read, safe from getToken: config-as-code grants are the base, and break-glass revoke overrides narrow them. */
+export async function grantedConnectors(auth) {
+    const ctx = await surfaceContextFromAuth(auth);
+    if (!ctx)
+        return null;
+    return grantedForCtx(ctx);
+}
+/** Apply the live connector_override overlay, narrow-only, scoped to the surface ctx resolves to. null means the override-STORE READ itself failed: fail closed, because a break-glass revoke lives only there and an unreadable store must never be read as "nothing was revoked". Exported so the egress compiler applies the same overlay to connection ids. */
+export async function narrowByConnectorOverride(ctx, base) {
+    try {
+        const p = resolvePartition(ctx);
+        const overrides = await getOperationalStore().connectorOverrides(p.org, p.surfaceKey);
+        return overrides.length ? applyConnectorOverrides(base, overrides) : base;
+    }
+    catch (err) {
+        // An override-store failure must fail CLOSED: a break-glass revoke lives only in the override store, so falling back to the config base would re-grant a revoked connector a live token. A transient tool error is the safe cost.
+        console.warn(`[open-everywhere:connector-scope] override lookup failed; refusing (fail closed): ${String(err)}`);
+        return null;
+    }
+}
+async function grantedForCtx(ctx) {
+    try {
+        // The awaitable resolve fills a DM caller's confirmed link-set membership, so a group member and a linkSet principal binding both grant their connectors here. CONFIRMED-only and fail-closed on the store read: an outage degrades to the config-direct grant and never widens.
+        const base = (await resolveAccessForWithGroups(ctx)).connectors;
+        return await narrowByConnectorOverride(ctx, base);
+    }
+    catch {
+        return null; // resolver/identity failure → fail closed
+    }
+}
+/** The per-surface credential a connector grant bound to this connection, or null — on null the caller falls back to its own static secretRef. This is what lets one connector serve a different credential to each surface. */
+export async function boundConnectorCredential(connection, auth) {
+    const ctx = await surfaceContextFromAuth(auth);
+    if (!ctx)
+        return null;
+    try {
+        return (await resolveAccessForWithGroups(ctx)).connectorCredentials[connection] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+// Audit one credential-gate verdict with IDS ONLY — connection name, verdict specifics, who and where — never token material and never op arguments. Best-effort: when the surface itself is unresolvable the row still lands stamped "unknown".
+async function auditConnectorGate(ctx, action, detail) {
+    let org = deploymentOrg();
+    let platform = "unknown";
+    let workspace = "unknown";
+    let surface;
+    let principalId;
+    if (ctx) {
+        try {
+            const p = resolvePartition(ctx);
+            org = p.org;
+            platform = p.platform;
+            workspace = p.workspace;
+            surface = p.surface;
+            principalId = bindFrom(ctx).principalId;
+        }
+        catch {
+            // keep the "unknown" stamps — the row must still land
+        }
+    }
+    await appendAudit({ org, platform, workspace, surface, principalId, action, detail });
+}
+/** Throws unless the surface behind auth is granted the connection and clears the context wall; a scoping denial is terminal and deliberately does NOT raise eve's re-consent flow, because re-consent cannot grant a scope. eve caches the resolved token per session, so a connector.use row is one credential-gate verdict per session, not one per op call — connector.op is the per-call record. */
+export async function assertConnectorGranted(connectionName, auth) {
+    const ctx = await surfaceContextFromAuth(auth);
+    // The break-glass halt is checked FIRST, because a halt is not about this connection and its refusal must not read as "that connector is not granted". No connector op routes through the approver chain, so this wall is the only place a halt can reach one; fail-CLOSED, exactly as the override store is one branch down.
+    const haltState = ctx ? await resolveHalt(haltScopeForCtx(ctx)) : await resolveHalt({ org: deploymentOrg() });
+    if (haltState.halted) {
+        await auditConnectorGate(ctx, "connector.refused", { connection: connectionName, reason: "halted", ...haltAuditDetail(haltState) });
+        throw new ConnectorScopeError(haltRefusalMessage(haltState, `connection "${connectionName}"`));
+    }
+    const granted = ctx ? await grantedForCtx(ctx) : null;
+    if (granted === null) {
+        await auditConnectorGate(ctx, "connector.refused", { connection: connectionName, reason: "unresolved_surface" });
+        throw new ConnectorScopeError(`connection "${connectionName}": refusing — could not resolve the calling surface ` +
+            `(no auth identity on the resolver ctx). Fail closed.`);
+    }
+    if (!granted.includes(connectionName)) {
+        await auditConnectorGate(ctx, "connector.refused", { connection: connectionName, reason: "ungranted" });
+        throw new ConnectorScopeError(`connection "${connectionName}" is not granted to this surface. ` +
+            `Grant it with \`connectors: [{ name: "${connectionName}", credential: "<id>", contentOrigin: "internal" | "external" }]\` ` +
+            `on a bundle bound to this scope — the credential ids come from that connector's catalogue in ` +
+            `agent/access/connector-credentials.ts (see agent/access/bundles.ts).`);
+    }
+    // The T4 context wall: a positively-resolved DM mode or nothing. bindFrom's fallback
+    // for an unresolvable context is "channel", so an unconfirmed surface is refused by
+    // construction; a bindFrom failure is refused explicitly (fail closed, never open).
+    let mode;
+    try {
+        mode = bindFrom(ctx).mode;
+    }
+    catch {
+        mode = undefined;
+    }
+    // A non-DM context reaches a connector only when per-op consequence tiering is armed, because the carve-out's whole promise is "reads open, writes tiered". With tiering off the connection falls back to the blanket once() policy, which would let a channel-context WRITE through on a read's approval.
+    const workSurfaceTierArmed = connectorOpTieringEnabled();
+    if (connectorDmOnlyEnabled() && mode !== "dm" && !workSurfaceTierArmed) {
+        await auditConnectorGate(ctx, "connector.refused", {
+            connection: connectionName,
+            reason: "dm_only",
+            mode: mode ?? "unresolved",
+        });
+        throw new ConnectorScopeError(`connection "${connectionName}": refused — host-side connector operations are DM-only ` +
+            `(this surface resolved mode "${mode ?? "unresolved"}", not a DM) unless this deployment arms ` +
+            `per-op consequence tiering (\`connectors: { opTiering: true }\` in agent/settings.ts), which ` +
+            `is what keeps a domain work-surface grant's WRITES behind an approval. This is a deployment ` +
+            `rule enforced at the credential layer, not a permission that can be requested in-chat.`);
+    }
+    // The disclosure half runs LAST, so the cheaper grant and DM checks refuse first, and it is inert on the default posture. ⛔ SCOPE (OPE-173): its audience-floor leg is narrower than it reads — read connector-disclosure.ts's header narrowings n1-n3 before citing it. Only the Slack bundle registers a member supplier, its `hasGuest` bit is the CHANNEL's externally-shared flag rather than a per-member guest classification, and the DM-only wall above defaults ON, so leg 1 only ever refuses on an externally-shared Slack channel in a deployment that has set connectors.dmOnly to false.
+    await assertConnectorDisclosure(connectionName, ctx);
+    await auditConnectorGate(ctx, "connector.use", {
+        connection: connectionName,
+        ...(mode !== undefined ? { mode } : {}),
+        // WHICH TIER ADMITTED THIS CALL — the one observable that tells a personal DM connector apart
+        // from a domain work-surface grant in the audit log. `work-surface` appears only where the
+        // carve-out above did the admitting: a non-DM context with the wall still up.
+        ...(connectorDmOnlyEnabled() && mode !== "dm" ? { grant: "work-surface" } : {}),
+    });
+}
+//# sourceMappingURL=connector-scope.js.map

package/dist/agent/access/connector-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-scope.js","sourceRoot":"","sources":["../../../agent/access/connector-scope.ts"],"names":[],"mappings":"AAAA,0cAA0c;AAE1c,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,8FAA8F;AAC9F,kGAAkG;AAClG,uCAAuC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,sfAAsf;AACtf,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;AACzC,CAAC;AAUD,gRAAgR;AAChR,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AACnE,MAAM,6BAA6B,GAAG,mDAAmD,CAAC;AAE1F,uPAAuP;AACvP,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,kSAAkS;AAClS,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,2FAA2F;YAC3F,uFAAuF;YACvF,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YACvC,kEAAkE;YAClE,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,cAAc,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;YAC3D,kBAAkB,GAAG,0DAA0D,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,IAAI,kBAAsC,CAAC;AAI3C,IAAI,UAAU,GAA0B,SAAS,CAAC;AAClD,MAAM,UAAU,qBAAqB;IACnC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,gBAAgB,CAAC;IACvB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gTAAgT;AAChT,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAoB;IAEpB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,uOAAuO;AACvO,IAAI,gBAAgB,GAAiC,uBAAuB,CAAC,cAAc,CAAC,CAAC;AAC7F,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;IAC/C,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/C,OAAO,CAAC,IAAI,CACV,kEAAkE,UAAU,EAAE;QAC5E,CAAC,GAAG;YACF,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,gFAAgF;gBAChF,IAAI,kBAAkB,IAAI,gBAAgB,4CAA4C;gBACtF,iFAAiF;gBACjF,yFAAyF;gBACzF,0BAA0B,CAAC,CAClC,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AACxC,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,2NAA2N;AAC3N,KAAK,UAAU,eAAe;IAC5B,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC,CAAC,yDAAyD;IACrF,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,qGAAqG,CAAC,CAAC;QAC/G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAkC,CAAC;IAC3E,OAAO,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC;AAED,qUAAqU;AACrU,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAiB;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,CAAC,mFAAmF,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4FAA4F;IAC5F,6FAA6F;IAC7F,4EAA4E;IAC5E,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC;IAE9E,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAsB,EAAE;QAC7D,OAAO,EAAE,EAAE,IAAI,EAAE;KACC,CAAC;AACvB,CAAC;AAED,kQAAkQ;AAClQ,MAAM,UAAU,uBAAuB,CACrC,IAAuB,EACvB,SAA6D;IAE7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2DAA2D;IACtG,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,sQAAsQ;AACtQ,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAiB;IACvD,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,mWAAmW;AACnW,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAoB,EACpB,IAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACtF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kOAAkO;QAClO,OAAO,CAAC,IAAI,CAAC,qFAAqF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC/C,IAAI,CAAC;QACH,iRAAiR;QACjR,MAAM,IAAI,GAAG,CAAC,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QAChE,OAAO,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,0CAA0C;IACzD,CAAC;AACH,CAAC;AAED,gOAAgO;AAChO,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAkB,EAClB,IAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iPAAiP;AACjP,KAAK,UAAU,kBAAkB,CAC/B,GAA2B,EAC3B,MAA6C,EAC7C,MAAyC;IAEzC,IAAI,GAAG,GAAG,aAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,SAAS,CAAC;IACzB,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,IAAI,OAA2B,CAAC;IAChC,IAAI,WAA+B,CAAC;IACpC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAChC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;YACZ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACtB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YACpB,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IACD,MAAM,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,yYAAyY;AACzY,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,cAAsB,EAAE,IAAiB;IACpF,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/C,8TAA8T;IAC9T,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9G,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpI,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,eAAe,cAAc,GAAG,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjH,MAAM,IAAI,mBAAmB,CAC3B,eAAe,cAAc,sDAAsD;YACjF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,MAAM,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,mBAAmB,CAC3B,eAAe,cAAc,oCAAoC;YAC/D,yCAAyC,cAAc,qEAAqE;YAC5H,+FAA+F;YAC/F,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,qFAAqF;IACrF,oFAAoF;IACpF,oFAAoF;IACpF,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,GAAsB,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,2SAA2S;IAC3S,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,IAAI,sBAAsB,EAAE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACvE,MAAM,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE;YACjD,UAAU,EAAE,cAAc;YAC1B,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,IAAI,IAAI,YAAY;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,mBAAmB,CAC3B,eAAe,cAAc,0DAA0D;YACrF,gCAAgC,IAAI,IAAI,YAAY,2CAA2C;YAC/F,+FAA+F;YAC/F,8FAA8F;YAC9F,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,wkBAAwkB;IACxkB,MAAM,yBAAyB,CAAC,cAAc,EAAE,GAAsB,CAAC,CAAC;IAExE,MAAM,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE;QAC7C,UAAU,EAAE,cAAc;QAC1B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,8FAA8F;QAC9F,2FAA2F;QAC3F,8EAA8E;QAC9E,GAAG,CAAC,sBAAsB,EAAE,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/access/consequence.d.ts

@@ -0,0 +1,205 @@
+/** The three consequence tiers (design §3 grain 1). `open` is still audited. */
+export type ConsequenceTier = "open" | "gate:member" | "gate:admin";
+export declare const CONNECTOR_READ_VERBS: readonly string[];
+/** The op suffix of a qualified connector tool name (`notion__create_page` → `create_page`),
+ *  or the whole name when it carries no `__` separator. The DECLARATION key of an op — what a
+ *  bundle's `connectorOps` list and the audit row name it by. NOT the tier input: a tier reads
+ *  the VERB segment only, through {@link parseQualifiedToolName}. */
+export declare function connectorOpName(toolName: string): string;
+/** True iff `toolName` is a qualified connector-op name (`<connection>__<op>`; no framework or authored OE tool uses `__`). A RESERVED namespace answers true too, deliberately: every consumer then routes the name through the fail-closed verb classifier instead of a static-table lookup it can never satisfy. */
+export declare function isConnectorOpTool(toolName: string): boolean;
+/**
+ * Does `toolName` sit in a RESERVED namespace, whatever its arity and whatever its other segments say?
+ * 🔴 Deliberately WIDER than `isGrantToolName`, which asks only whether a mint path could have MINTED the name — a restriction must not depend on the mint path being the only writer of names into an assembled toolset. The match is STRUCTURAL, on the first `__`-delimited SEGMENT and never a prefix: `grants__x__read` stays an ordinary connector op.
+ */
+export declare function isReservedNamespaceTool(toolName: string): boolean;
+export interface QualifiedToolName {
+    /** The reserved namespace (`grant`), or undefined for a connector op. */
+    readonly namespace?: string;
+    /** The owner segment of a reserved name. Never feeds a tier. */
+    readonly owner?: string;
+    /** The connection segment of a connector op: EVERY segment before the verb, joined, so a
+     *  plugin connection slug that itself contains `__` stays whole. */
+    readonly connection?: string;
+    /** The trailing segment — the operation verb, and the only tier input. */
+    readonly verb: string;
+}
+/** Parse `toolName` into its structural parts, or undefined when it carries no `__` or its shape is not one this file recognises. An unparseable QUALIFIED name yields no verb tokens, so {@link classifyConnectorOpTier} defaults it to `destructive` — fail-closed, never read. */
+export declare function parseQualifiedToolName(toolName: string): QualifiedToolName | undefined;
+/** The tier of one connector op by its verb: a leading known READ verb is `open`, everything else — writes AND unrecognised verbs — is `gate:member`. Never `gate:admin`: a connector op is org-data movement, not an org config or spend mutation. */
+export declare function classifyConnectorOp(toolName: string): "open" | "gate:member";
+/** The three-tier connector-op class (OPE-11). `read` ⟺ classifyConnectorOp `open`; `write`
+ *  and `destructive` both ⟺ `gate:member` (both are gated — the split is about the session grant). */
+export type ConnectorOpTier = "read" | "write" | "destructive";
+/** Irreversible-mutation verbs (rubric axis 2). Kept TIGHT — a reversible change is a write. A
+ *  REVIEWED heuristic over vendor op names; the fail-closed default is destructive (see the note above). */
+export declare const CONNECTOR_DESTRUCTIVE_VERBS: readonly string[];
+/** Recognised NON-destructive mutation verbs → tier `write` (session-skippable). Generous by
+ *  design (aggressive heuristic vocab): a common write should be session-skippable, while an
+ *  UNRECOGNISED verb fails closed to `destructive` (per-call). */
+export declare const CONNECTOR_WRITE_VERBS: readonly string[];
+/**
+ * WHY the classifier reached its tier, as PASS 1 over the VERB SEGMENT saw it. `destructive-verb` means that segment named a KNOWN irreversible verb; `unrecognised` means it named nothing this file knows — the fail-closed default. A caller must not read the second as "this is a delete".
+ * 🔴 The basis NEVER reads the connection path, and the head segment can RAISE it but never lower it — so a basis is not a function of the KEPT tokens alone.
+ */
+export type OpTierBasis = "destructive-verb" | "write-verb" | "read-verb" | "unrecognised";
+/** The tier of one connector op, plus {@link OpTierBasis} — the reason the verb segment gave. */
+export interface ConnectorOpTierVerdict {
+    readonly tier: ConnectorOpTier;
+    readonly basis: OpTierBasis;
+}
+/**
+ * The three-tier class of one op, by the HIGHEST tier of any recognised verb token in the VERB SEGMENT; no recognised token at all → `destructive` (fail-closed, per-call, never session-skippable). The cost is over-gating rare noun collisions, which is friction in the safe direction.
+ * 🔴 SEGMENT ASYMMETRY: only the verb segment's KEPT tokens may LOWER the tier — the connection path and the tokens the vendor-prefix strip removed are RAISE-ONLY. The one downward move is a reserved name's OWNER segment, made inert in both directions on purpose. The BASIS is a report, not a gate.
+ */
+export declare function classifyConnectorOpTierVerdict(toolName: string): ConnectorOpTierVerdict;
+/** {@link classifyConnectorOpTierVerdict}'s `tier`, which is where the whole classification lives — read that function for the rule. A caller that needs to know WHY takes the verdict instead. */
+export declare function classifyConnectorOpTier(toolName: string): ConnectorOpTier;
+export interface ConnectorOpTierQuestion {
+    readonly connection: string;
+    readonly verb: string;
+    readonly toolName: string;
+}
+/** A TIERING FUNCTION — the type `AppConfig.connectorOpTier` holds, answering how consequential one op is or returning undefined to abstain. The slot holds ONE: a deployment REPLACES the shipped default rather than adding to it, and the seam's `write` floor clamps every lowering whichever function produced it. */
+export type ConnectorOpTierArm = (op: ConnectorOpTierQuestion) => ConnectorOpTier | undefined;
+/**
+ * THE DEFAULT TIERING FUNCTION, and the value `registerConfig` puts on `AppConfig.connectorOpTier` when a deployment supplies none — {@link classifyConnectorOpTier} wearing the seam's signature. A REGISTERED DEFAULT, not a fallback behind an empty slot, so "what tiers my connector ops?" always has one answer with one type.
+ * IT NEVER ABSTAINS: `classifyConnectorOpTier` is total, so this returns a tier for every op. The `undefined` half of the type exists for a consumer function that wants to defer.
+ */
+export declare const defaultConnectorOpTierArm: ConnectorOpTierArm;
+/**
+ * The REST METHOD MAP, assigned at op-DEFINITION time rather than by a runtime classifier: GET/HEAD/OPTIONS → read, POST/PUT/PATCH → write, DELETE → destructive.
+ * An unrecognised method fails CLOSED to `destructive`. No host-side REST connection exists in-tree today, so this is the def-time primitive the first REST/OpenAPI connector registry will consume.
+ */
+export declare function restMethodTier(method: string): ConnectorOpTier;
+/**
+ * HOW a tool's declared tier is enforced, cross-checked against the tool's SOURCE and the live ActionKind registry: "none" (the source must contain NO gating construct), "action-kind" (frozen args, and the kind's ApproverPolicy must match the tier), "admin-roles" (an inline standing check), "eve-hitl" (an eve-native session-scoped confirm that cannot DENY — legal only on tier `open`), "delegated-roles" (the real admin check lives in a named module).
+ * 🔴 "delegated-roles" exists because the per-file source scan cannot see a gate one import away, which let a tool be gated without the registry saying so AND let an under-gated tool point at a helper that had stopped gating. Declaring it makes deleting the gate at either end a red rather than a silence.
+ */
+export type GatingMechanism = {
+    readonly kind: "none";
+} | {
+    readonly kind: "action-kind";
+    readonly action: string;
+} | {
+    readonly kind: "admin-roles";
+} | {
+    readonly kind: "eve-hitl";
+} | {
+    readonly kind: "delegated-roles";
+    /** The function the TOOL calls, which must appear in the tool's own source. */
+    readonly helper: string;
+    /** Repo-root-relative path of the module that must contain the admin-standing check. */
+    readonly module: string;
+};
+export interface ConsequenceEntry {
+    readonly tier: ConsequenceTier;
+    readonly via: GatingMechanism;
+    /** WHY this tier — the rubric axis (or why none applies). Reviewed prose, not runtime data. */
+    readonly reason: string;
+    /**
+     * `true` softens this row's per-verb default from `ask` to `defer`: with the judge armed, a request that would have landed on that ask goes to the judge, whose own defer, error or timeout falls back to the very card this row produced before the flip.
+     * With the judge NOT armed a defer row resolves EXACTLY as `ask`, so config carrying flips is safe on an unarmed deploy. Rows move here on MEASURED shadow-log agreement, and each flipped row's comment must cite its evidence. Ignored on `open` rows.
+     */
+    readonly judgeDefer?: true;
+    /**
+     * THE PER-SINK TAINT TOLERANCE. "gate" floors a tainted turn at a human decision (`allow → ask`): no lowering — a custom approver, a config allow, the judge, a bypassed domain — may take it below that, and an UNATTENDED tainted run then denies. "disclose" changes NO verdict at all: the card carries a disclosure line and the audit row carries `tainted` plus the kind list.
+     * REQUIRED on every gated row, fail-closed: an undeclared gated sink is treated "gate" at runtime AND fails the lint. WHICH rows carry "gate" is DERIVED, not typed — every row whose `postTurnSurface` arms or disarms must declare it.
+     */
+    readonly taint?: "gate" | "disclose";
+    /**
+     * THE VECTOR-1 PREDICATE: does this tool arm, alter or remove surface that EXECUTES or INSTRUCTS after the turn ends? Declared per row rather than enumerated, because a hand-kept list of dangerous things rots FAIL-OPEN — {@link checkPostTurnSurface} reads the tree's durable write sites and fails the build on a tool that reaches one while declaring nothing.
+     * "arms" and "disarms" both require `taint: "gate"`; "templated" is post-turn execution whose instruction text is CODE-templated, so the model authors none of it; "none" reaches a write primitive but arms nothing. The implication runs ONE WAY only — a row may declare `gate` without this column.
+     */
+    readonly postTurnSurface?: PostTurnSurface;
+}
+/** The vector-1 predicate's four answers — see {@link ConsequenceEntry.postTurnSurface}. */
+export type PostTurnSurface = "arms" | "disarms" | "templated" | "none";
+/** The two values that FLOOR a tainted turn at a human decision (see
+ *  {@link ConsequenceEntry.postTurnSurface}). The ONE read both the lint and `taintToleranceOf`
+ *  key on, so the build check and the runtime arrow can never disagree about which is which. */
+export declare function postTurnSurfaceFloors(surface: PostTurnSurface | undefined): boolean;
+/**
+ * THE NAME OF THE LIFT VERB — ONE spelling, because two planes must agree on it or a control silently reopens. `resume` is the name both `mode:HALT` and `mode:DANGEROUSLY_BYPASS` EXEMPT in access/approver-chain.ts, and this table's key IS the registered tool name.
+ * As bare literals those exemptions would survive a rename: the halt would deny its own lift, the bypass would auto-approve the renamed verb, and every test spelling the same dead name would stay green.
+ */
+export declare const RESUME_TOOL = "resume";
+/** The table. Keys are tool file slugs (packages/core/agent/tools/<name>.ts, plus the app-mounted adapter tools — scripts/consequence-lint.ts holds the enumeration). */
+export declare const TOOL_CONSEQUENCE: Readonly<Record<string, ConsequenceEntry>>;
+/** Is `tool`'s per-verb default flipped `ask → defer`? The ONE read the approver chain keys its judge consult on. CONNECTOR OPS RETURN FALSE deliberately: no connector op class has shadow evidence behind a flip, and when one earns it the class policy lands here. */
+export declare function judgeDeferredTool(tool: string): boolean;
+/** One non-tool ActionKind's pinned tier. Same shape as {@link ConsequenceEntry} minus `via`: the
+ *  mechanism is not in question (it is the ActionKind plane, by construction) — only the bar is. */
+export interface ActionKindEntry {
+    readonly tier: Exclude<ConsequenceTier, "open">;
+    readonly reason: string;
+}
+/** ActionKinds registered by something other than a tool's propose call. TOTAL, fail-closed: a new
+ *  kind that no tool names and that is absent here fails CI rather than shipping unpinned. */
+export declare const NON_TOOL_ACTION_KINDS: Readonly<Record<string, ActionKindEntry>>;
+/** Verify the ActionKind plane is TOTAL and consistent: every registered kind is either NAMED by a TOOL_CONSEQUENCE action-kind row or pinned in {@link NON_TOOL_ACTION_KINDS}, and every pinned tier must match the kind's live ApproverPolicy. Pure — the caller enumerates the kinds and supplies the policy lookup. */
+export declare function checkActionKindRegistry(registeredKinds: readonly string[], policyOf: (action: string) => "admin" | "member" | undefined, toolRegistry?: Readonly<Record<string, ConsequenceEntry>>, nonToolRegistry?: Readonly<Record<string, ActionKindEntry>>): string[];
+/** One `registerActionKind(...)` statement found in a source, resolved to the kind it registers. */
+export interface ActionKindRegistration {
+    readonly file: string;
+    /** 1-based, of the registration statement. */
+    readonly line: number;
+    readonly ident: string;
+    /** The `kind:` literal from the registered declaration, or undefined when the identifier could not
+     *  be resolved in this file. Reported rather than dropped — dropping is the failure being checked
+     *  for, so the scan must never answer "nothing to see here" by losing a site it half-parsed. */
+    readonly kind?: string;
+}
+/** Find every `registerActionKind(...)` statement in one source and resolve each to the `kind:` literal of the declaration it names. Line-based, like every other check here; an identifier it cannot resolve is REPORTED by {@link checkActionKindCoverage} rather than skipped. */
+export declare function findActionKindRegistrations(file: string, source: string): ActionKindRegistration[];
+/** Check that every ActionKind registered ANYWHERE IN THE TREE is present in the enumeration the caller checked — that the totality above is total over the plane, not merely over this process's import graph. Pure: the caller supplies both the on-disk registrations and the live kinds. */
+export declare function checkActionKindCoverage(registrations: readonly ActionKindRegistration[], registeredKinds: readonly string[]): string[];
+/** Non-tool files that legitimately contain a line matching the `approval:` scan, and why. */
+export declare const NON_TOOL_APPROVAL_SITES: Readonly<Record<string, string>>;
+export interface ApprovalSite {
+    readonly file: string;
+    /** 1-based. */
+    readonly line: number;
+}
+/** Find every eve-native `approval:` line in one source, using the SAME predicate checkConsequenceRegistry applies to tool files, so the tool arm and this scan can never disagree about what one looks like. `approval: never()` is not one. */
+export declare function findEveApprovalSites(file: string, source: string): ApprovalSite[];
+/** Check the non-tool `approval:` surface is TOTAL in BOTH directions: an unlisted site is an unreviewed approval mechanism, and a stale entry is a reason nobody will ever read again that still reads as coverage. */
+export declare function checkApprovalSites(sites: readonly ApprovalSite[], registry?: Readonly<Record<string, string>>): string[];
+/**
+ * The durable writes that land POST-TURN instruction or execution surface, named as bare call identifiers — a member call like `store.addRoutine(` is the operational driver's own plumbing and is deliberately not matched.
+ * ADDING ONE IS THE RIGHT MOVE when a new store verb persists something a later run reads as instruction or executes. Removing one is almost never right: the value is that the set is broader than the tools anyone remembers.
+ */
+export declare const POST_TURN_WRITE_PRIMITIVES: readonly string[];
+export interface PostTurnWriteSite {
+    readonly file: string;
+    readonly line: number;
+    readonly primitive: string;
+}
+/**
+ * Locate every durable post-turn write in one file. Line-based, like every other check here.
+ * TWO EXCLUSIONS, both to keep the sites CALLS rather than definitions: a member expression is dropped by the lookbehind, and the line DECLARING the primitive is dropped outright. Neither can hide a caller, because a caller imports the free function.
+ */
+export declare function findPostTurnWriteSites(file: string, source: string): PostTurnWriteSite[];
+/**
+ * Check the vector-1 plane is TOTAL and consistent. Four rules, each closing a direction the others leave open: (1) REACH ⇒ DECLARATION — a tool reaching a durable post-turn write must declare `postTurnSurface`; (2) arms/disarms ⇒ `taint: "gate"`; (3) EVERY SITE IS ATTRIBUTED, to a tool, a registered kind or a pinned non-tool file; (4) NO STALE CLAIMS, in either plane.
+ * Pure — the caller supplies the tool sources, the tree's write sites and the ActionKind registrations.
+ */
+export declare function checkPostTurnSurface(tools: readonly ToolSource[], treeWriteSites: readonly PostTurnWriteSite[], registrations: readonly ActionKindRegistration[], registry?: Readonly<Record<string, ConsequenceEntry>>, nonToolWriters?: Readonly<Record<string, string>>): string[];
+/** One tool's identity + source, as enumerated by the caller (file slug + file text). */
+export interface ToolSource {
+    readonly name: string;
+    readonly source: string;
+}
+/**
+ * Verify the registry is TOTAL over the RUNTIME tool surface — the OE-authored tools, each source-scanned so its declared mechanism matches its code, plus the eve framework tools mounted at runtime. Fail-closed: any mounted tool missing from the registry is a hard problem.
+ * A framework tool OE does not author has no source to scan and no ActionKind of its own, so it is REQUIRED to be open/none; gating one means shipping an agent/tools/<name>.ts override, which moves it onto the scanned path.
+ */
+export declare function checkConsequenceRegistry(tools: readonly ToolSource[], frameworkToolNames: readonly string[], policyOf: (action: string) => "admin" | "member" | undefined, registry?: Readonly<Record<string, ConsequenceEntry>>, 
+/** Declared-subagent directory names (OPE-45) — `agent/subagents/<dir>/`, which eve lowers into a
+ *  model-visible tool under the BARE dir name. Same fail-closed treatment as a framework tool: no
+ *  source to scan, no ActionKind of its own ⇒ must be open/none. Defaulted so existing callers and
+ *  crafted-surface unit tests are unaffected. */
+subagentNames?: readonly string[], 
+/** Sources of every module a `delegated-roles` row names, read off disk by the caller (the registry itself says which are needed). FAIL-CLOSED: a declared module absent from this map is a problem, never an assumed pass — "we could not read the gate" and "there is no gate" must not produce the same green. */
+moduleSources?: ReadonlyMap<string, string>): string[];
+//# sourceMappingURL=consequence.d.ts.map

package/dist/agent/access/consequence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consequence.d.ts","sourceRoot":"","sources":["../../../agent/access/consequence.ts"],"names":[],"mappings":"AAIA,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAIpE,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAGjD,CAAC;AAEF;;;qEAGqE;AACrE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,uTAAuT;AACvT,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAQD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;wEACoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qRAAqR;AACrR,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAUtF;AAED,uPAAuP;AACvP,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,CAE5E;AAKD;sGACsG;AACtG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAE/D;4GAC4G;AAC5G,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAA+E,CAAC;AAEzI;;kEAEkE;AAClE,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAwCF;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,CAAC;AAU3F,iGAAiG;AACjG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAkCvF;AAED,mMAAmM;AACnM,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAEzE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,2TAA2T;AAC3T,MAAM,MAAM,kBAAkB,GAAG,CAAC,EAAE,EAAE,uBAAuB,KAAK,eAAe,GAAG,SAAS,CAAC;AAE9F;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,kBAAiE,CAAC;AAE1G;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAe9D;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;CAC5C;AAKD,4FAA4F;AAC5F,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAExE;;gGAEgG;AAChG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAEnF;AAoBD;;;GAGG;AACH,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,yKAAyK;AACzK,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAsSvE,CAAC;AAEF,0QAA0Q;AAC1Q,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvD;AAKD;oGACoG;AACpG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;8FAC8F;AAC9F,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAW3E,CAAC;AAEF,2TAA2T;AAC3T,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,QAAQ,GAAG,SAAS,EAC5D,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAoB,EAC3E,eAAe,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAyB,GACjF,MAAM,EAAE,CAwCV;AAKD,oGAAoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;oGAEgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD,qRAAqR;AACrR,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAoClG;AAED,gSAAgS;AAChS,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,sBAAsB,EAAE,EAChD,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,EAAE,CAwBV;AAKD,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpE,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iPAAiP;AACjP,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CAMjF;AAED,wNAAwN;AACxN,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA2B,GACnE,MAAM,EAAE,CAkBV;AAKD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EASvD,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAkBD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CASxF;AAQD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,cAAc,EAAE,SAAS,iBAAiB,EAAE,EAC5C,aAAa,EAAE,SAAS,sBAAsB,EAAE,EAChD,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAoB,EACvE,cAAc,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA8B,GAC5E,MAAM,EAAE,CAwGV;AAED,yFAAyF;AACzF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AASD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,QAAQ,GAAG,SAAS,EAC5D,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAoB;AACvE;;;iDAGiD;AACjD,aAAa,GAAE,SAAS,MAAM,EAAO;AACrC,qTAAqT;AACrT,aAAa,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GACrD,MAAM,EAAE,CA0KV"}