@open-everywhere/core 0.1.0

package/dist/agent/access/credential-grant-ask.d.ts

@@ -0,0 +1,22 @@
+import { type GrantDuplicateContext, type GrantMintRefusal } from "./credential-grant.js";
+export interface ResolvedGrantOwner {
+    readonly principalId: string;
+    readonly platform: string;
+    readonly nativeId: string;
+    /** The display handle the mounted name's owner segment is slugified from. */
+    readonly handle: string;
+    /** The owner's display name, present ONLY when the identity plane resolved one. Unlike `handle` it never falls back to the native id, because copy may never print an id. */
+    readonly displayName?: string;
+}
+/** The id a bare-id refusal names, and the platform it was read on. */
+export interface UnresolvedGrantOwner {
+    readonly named: string;
+    readonly platform: string;
+}
+/** Resolve the model's `owner` string, or a refusal sentence. `surfacePlatform` and `surfaceWorkspace` are the REQUESTER's own partition, the namespace a bare id is read in; they never reinterpret a full principal key. */
+export declare function resolveGrantOwner(raw: string, surfacePlatform: string, surfaceWorkspace: string): Promise<ResolvedGrantOwner | {
+    readonly refusal: string;
+}>;
+/** The sentence the ask path reports when nothing was sent. The duplicate arm deliberately carries NO `Refused:` prefix; the machine signal for every arm alike is the tool's own `asked: false` field, never this prose. */
+export declare function credentialGrantRefusalNote(connector: string, reason: GrantMintRefusal | "owner_unreachable", duplicate?: GrantDuplicateContext, unresolvedOwner?: UnresolvedGrantOwner): string;
+//# sourceMappingURL=credential-grant-ask.d.ts.map

package/dist/agent/access/credential-grant-ask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-ask.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-grant-ask.ts"],"names":[],"mappings":"AAIA,OAAO,EAA2B,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGnH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6KAA6K;IAC7K,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAiBD,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,8NAA8N;AAC9N,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC5D;AAED,6NAA6N;AAC7N,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,GAAG,mBAAmB,EAC9C,SAAS,CAAC,EAAE,qBAAqB,EACjC,eAAe,CAAC,EAAE,oBAAoB,GACrC,MAAM,CA0BR"}

package/dist/agent/access/credential-grant-ask.js

@@ -0,0 +1,82 @@
+// Resolves the model's `owner` string to a principal key through identity/principal-key.ts's composer and nothing else — a divergent spelling would key the grant to a vault row nothing reads. A bare member id resolves against the REQUESTER's own surface only: no directory lookup and no fuzzy display-name match, and naming somebody elsewhere needs their full principal key.
+import { accountProfileFor, composedAccountName } from "../identity/account-display-name.js";
+import { isQualifiedPrincipalKey, parsePrincipalKey, tryPrincipalKey } from "../identity/principal-key.js";
+import { grantMintRefusalMessage } from "./credential-grant.js";
+import { GRANT_ID_LEAK_PATTERNS } from "./credential-grant-copy.js";
+/** Strip a surface's mention rendering off an id. Slack renders `<@U123>`, Discord `<@123>`; both are
+ *  what a person literally types, so the model relays them verbatim and a parse that refused them
+ *  would refuse the most natural input there is. */
+function bareId(raw) {
+    const trimmed = raw.trim();
+    const m = /^<@!?([^>|]+)(?:\|[^>]*)?>$/u.exec(trimmed);
+    return m ? m[1].trim() : trimmed;
+}
+/** The shape a BARE member id must have on each platform that defines one. A platform absent here takes any bare id, as before. */
+const BARE_ID_SHAPES = {
+    discord: { noun: "Discord user id", re: /^\d{17,20}$/u },
+    slack: { noun: "Slack member id", re: /^[UW][A-Z0-9]{8,}$/u },
+};
+/** Resolve the model's `owner` string, or a refusal sentence. `surfacePlatform` and `surfaceWorkspace` are the REQUESTER's own partition, the namespace a bare id is read in; they never reinterpret a full principal key. */
+export async function resolveGrantOwner(raw, surfacePlatform, surfaceWorkspace) {
+    const named = bareId(raw);
+    if (named.length === 0)
+        return { refusal: "Refused: no owner was named. Name the person whose credential you are asking for." };
+    // 🔴 A BARE ID MUST FIT THE ROOM'S PLATFORM (OPE-2063). A unified seat holds backscroll from every
+    // surface, so a Slack member id can arrive in a Discord room. Composed here, it would key an ask to
+    // a person who does not exist, miss every live grant, and fail at the DM send.
+    const shape = named.includes("/") ? undefined : BARE_ID_SHAPES[surfacePlatform];
+    if (shape !== undefined && !shape.re.test(named)) {
+        return { refusal: credentialGrantRefusalNote("", "owner_unresolved", undefined, { named, platform: surfacePlatform }) };
+    }
+    // A string carrying a `/` is read as a principal key and ONLY as one. A bare id never contains one
+    // (the composer refuses a tenant with a slash for the same reason), so the two forms cannot collide.
+    const asKey = named.includes("/")
+        ? isQualifiedPrincipalKey(named)
+            ? named
+            : undefined
+        : tryPrincipalKey(surfacePlatform, surfaceWorkspace, named);
+    if (asKey === undefined) {
+        return {
+            refusal: `Refused: "${named}" does not name a person this deployment can resolve. ` +
+                "Give either their full principal key (for example `slack/T0AB1CD2E/U123ABC`) or, for somebody on this same surface, their bare member id.",
+        };
+    }
+    const parsed = parsePrincipalKey(asKey);
+    if (parsed === undefined) {
+        return { refusal: `Refused: "${named}" is not a well-formed principal key, so nothing could ever be spent under it.` };
+    }
+    const profile = await accountProfileFor(parsed.platform, parsed.id, parsed.tenant).catch(() => undefined);
+    // The handle falls back to the NATIVE ID rather than to an invented name. `grantOwnerSlug` refuses a
+    // segment that carries no legal characters, so a deployment with no display-name arm still mounts a
+    // readable-enough `grant__u123abc__read_page` instead of nothing.
+    const displayName = composedAccountName(profile);
+    const handle = displayName ?? parsed.id;
+    return { handle, nativeId: parsed.id, platform: parsed.platform, principalId: asKey, ...(displayName === undefined ? {} : { displayName }) };
+}
+/** The sentence the ask path reports when nothing was sent. The duplicate arm deliberately carries NO `Refused:` prefix; the machine signal for every arm alike is the tool's own `asked: false` field, never this prose. */
+export function credentialGrantRefusalNote(connector, reason, duplicate, unresolvedOwner) {
+    if (reason === "owner_unresolved" && unresolvedOwner !== undefined) {
+        const noun = BARE_ID_SHAPES[unresolvedOwner.platform]?.noun ?? `${unresolvedOwner.platform} user id`;
+        // The id is echoed only when it carries no leak shape, so a refusal never prints a snowflake.
+        // The echo is model-authored, so it is flattened and capped.
+        const flat = unresolvedOwner.named.replace(/[\r\n"]+/gu, " ").trim().slice(0, 64);
+        const shown = GRANT_ID_LEAK_PATTERNS.some(({ re }) => re.test(flat)) ? "That owner id" : `"${flat}"`;
+        return `Refused: ${shown} is not a ${noun}; name the owner as they appear in this room, or give their full principal key.`;
+    }
+    if (reason === "owner_unreachable") {
+        // 🔴 ONE SENTENCE FOR EVERY REASON THE DM DID NOT GO OUT, AND THE OWNER'S STOP IS DELIBERATELY
+        // NOT NAMED (OPE-1855). Four things reach this arm: no DM arm on the owner's platform, a failed
+        // send, the owner's own stop, and a stop this deployment could not read. The requester is a
+        // THIRD PARTY — they asked to borrow somebody else's credential — and "that person has told the
+        // agent to stop messaging them" is a fact about the OWNER that the owner shared with the agent
+        // in their own DM, not with the room. Naming it here would make the requester's ask a way to
+        // probe a boundary the owner drew privately. The sentence below is true of all four, the
+        // `dm.refused` and `grant.refused` audit rows carry which one it was for an operator, and the
+        // requester is never left in silence. The copy test pins this shape.
+        return ("Refused: this deployment cannot send that person a direct message, so the card would never be seen. " +
+            "An ask nobody can read is worse than no ask — say so in the room rather than trying again.");
+    }
+    const message = grantMintRefusalMessage(connector, reason, duplicate);
+    return reason === "grant_already_live" ? message : `Refused: ${message}`;
+}
+//# sourceMappingURL=credential-grant-ask.js.map

package/dist/agent/access/credential-grant-ask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-ask.js","sourceRoot":"","sources":["../../../agent/access/credential-grant-ask.ts"],"names":[],"mappings":"AAAA,uXAAuX;AAEvX,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAqD,MAAM,uBAAuB,CAAC;AACnH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAYpE;;oDAEoD;AACpD,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACpC,CAAC;AAED,mIAAmI;AACnI,MAAM,cAAc,GAA6E;IAC/F,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,cAAc,EAAE;IACxD,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,qBAAqB,EAAE;CAC9D,CAAC;AAQF,8NAA8N;AAC9N,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,eAAuB,EACvB,gBAAwB;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,mFAAmF,EAAE,CAAC;IAEhI,mGAAmG;IACnG,oGAAoG;IACpG,+EAA+E;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC;IAED,mGAAmG;IACnG,qGAAqG;IACrG,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC/B,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,eAAe,CAAC,eAAe,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EACL,aAAa,KAAK,wDAAwD;gBAC1E,2IAA2I;SAC9I,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,aAAa,KAAK,gFAAgF,EAAE,CAAC;IACzH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1G,qGAAqG;IACrG,oGAAoG;IACpG,kEAAkE;IAClE,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC/I,CAAC;AAED,6NAA6N;AAC7N,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,MAA8C,EAC9C,SAAiC,EACjC,eAAsC;IAEtC,IAAI,MAAM,KAAK,kBAAkB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,GAAG,eAAe,CAAC,QAAQ,UAAU,CAAC;QACrG,8FAA8F;QAC9F,6DAA6D;QAC7D,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;QACrG,OAAO,YAAY,KAAK,aAAa,IAAI,iFAAiF,CAAC;IAC7H,CAAC;IACD,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACnC,+FAA+F;QAC/F,gGAAgG;QAChG,4FAA4F;QAC5F,gGAAgG;QAChG,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,8FAA8F;QAC9F,qEAAqE;QACrE,OAAO,CACL,sGAAsG;YACtG,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC;AAC3E,CAAC"}

package/dist/agent/access/credential-grant-broker.d.ts

@@ -0,0 +1,85 @@
+import { type CredentialGrantRefusal, type CredentialGrantRow } from "../operational/credential-grant-rows.js";
+import { type GrantAuditStamps } from "./credential-grant-flow.js";
+import { GrantBorrowTransportAlreadyRegisteredError, grantBorrowTransport, registerGrantBorrowTransport } from "./grant-borrow-transport-registry.internal.js";
+import { GrantRoomNoticeAlreadyRegisteredError, registerGrantRoomNotice } from "./grant-room-notice-registry.internal.js";
+import { type GrantOwnerSubject } from "./credential-grant-owner.js";
+import { type HaltScope } from "./halt.js";
+/** One borrowed vendor MCP tool call. The model's input stays unmerged here: the transport merges the grant's frozen arguments over it, so the frozen half wins beside the fence that enforces the pin. */
+export interface GrantBorrowCall {
+    /** The vendor tool, in the vendor's exact bytes — `grant.mcpTool`, never the mounted name. */
+    readonly mcpTool: string;
+    /** What the MODEL supplied this call. Untrusted; every frozen key is overwritten downstream. */
+    readonly input: Readonly<Record<string, unknown>>;
+}
+/** A transport must not re-decide the boundary: every state, scope and requester check has run and the once-mode burn is spent before it is called. Only a GrantUndispatchedError asks for that burn back, and a transport must never reason about whether it is given. */
+export type GrantBorrowTransport = (call: GrantBorrowCall, grant: CredentialGrantRow, owner: GrantOwnerSubject) => Promise<unknown>;
+/** The registry lives off the published export map, and it refuses a second registration for one connector: the first transport stays in force and the second call throws. */
+export { GrantBorrowTransportAlreadyRegisteredError, grantBorrowTransport, registerGrantBorrowTransport };
+/** The port that puts the host-authored acting-as-owner line in the conversation, not only in the model's result. */
+export type GrantRoomNotice = (line: string, grant: CredentialGrantRow) => Promise<GrantRoomNoticeOutcome>;
+export type GrantRoomNoticeOutcome = {
+    readonly posted: true;
+} | {
+    readonly posted: false;
+    readonly reason: GrantRoomSilence;
+};
+/** Why the room did not see the line: the call ran outside the mount's room-context wrap, the surface takes no mid-turn post, or the post was attempted and threw. */
+export type GrantRoomSilence = "no_room_context" | "no_post_arm" | "post_failed";
+/** The two silences the port produces rather than an arm: nothing is registered on the port, or the registered arm threw instead of reporting. */
+export type GrantRoomSilenceAtPort = "port_unarmed" | "arm_threw";
+/** The registry lives off the published export map, and the port refuses a second registration: core's shipped arm stays in force and the second call throws. */
+export { GrantRoomNoticeAlreadyRegisteredError, registerGrantRoomNotice };
+export declare const GRANT_REFUND_CAP_PER_TURN = 3;
+/** Everything the broker needs about the calling turn, resolved by the mount before it calls in. */
+export interface GrantCallContext extends GrantAuditStamps {
+    /** The CHAT this call is happening in — this eve session's own id. A `once` or `session` grant must
+     *  be bound to exactly this, or the call refuses. */
+    readonly scopeKey: string;
+    /**
+     * THE ROOM'S DOMAIN-SHAPED SEAT KEY (OPE-1950) — the second key a `standing` grant may be bound to,
+     * which is what lets one survive the rotation that retires {@link scopeKey}. Absent in a room whose
+     * domain does not window, and absent from every caller that resolves no room, which leaves the
+     * backstop on the exact-session rule alone.
+     *
+     * 🔴 IT WIDENS ONE MODE. `grantScopeAdmits` gates the domain arm on `mode === "standing"`, so a
+     * once- or session-mode row is unreachable through this key however it was spelled.
+     */
+    readonly domainScopeKey?: string;
+    /**
+     * The single verified human this turn, AS A PRINCIPAL KEY (OPE-1090) — the same grammar
+     * `grant.ownerPrincipalId` carries, so the `grant.used` row names both principals joinably in
+     * one row (design §8.1). The mount composes it through `identity/principal-key.ts`'s own
+     * composer; `undefined` when no single human is verified this turn.
+     */
+    readonly requesterPrincipalId: string | undefined;
+    /**
+     * The eve TURN this call runs in — `identity/binding.ts currentTurnId`, which the mount already
+     * reads for the requester verdict. It keys the per-turn refund cap and nothing else.
+     *
+     * `undefined` is not an error and never widens the cap: a claim with no turn id never rolls the
+     * row's count, so the allowance becomes per row for the row's whole life instead of per turn. The
+     * store statement owns that rule — see `OperationalStore.claimCredentialGrantRefund`.
+     */
+    readonly turnId?: string;
+    readonly nowMs: number;
+}
+/** The halt address comes from the audit stamps' room, never from ctx.scopeKey: that key is an eve session id, and reading it as an address silently dropped the domain, surface and workspace halt axes. */
+export declare function grantCallHaltScope(ctx: GrantCallContext): HaltScope;
+/** True when the mount could not read the room, so the derived address is a placeholder. Such a call asks the unaddressed halt question instead, because a halt must have no gap an unreadable room opens. */
+export declare function grantCallRoomUnresolved(ctx: GrantCallContext): boolean;
+export declare const HALT_UNRESOLVED_ROOM_NOTE = "This deployment could not resolve which conversation this call is running in, so the halt was applied to be safe: a halt anywhere in this organisation stops a call whose room cannot be read.";
+/** What the model gets back. Both shapes carry the boundary in words. */
+export type GrantCallResult = {
+    readonly ok: true;
+    readonly disclosure: string;
+    readonly result: unknown;
+} | {
+    readonly ok: false;
+    readonly refused: CredentialGrantRefusal;
+    readonly message: string;
+};
+/** The order is load-bearing: read the row fresh, refuse an unattended wake, then state, scope and requester, then resolve the transport and the owner, then burn before the vendor call and audit before it. Only a GrantUndispatchedError refunds the burn, capped per grant row per turn. */
+export declare function runGrantedCall(grantId: string, input: Readonly<Record<string, unknown>>, ctx: GrantCallContext): Promise<GrantCallResult>;
+/** A coarse, non-reversible description of one borrowed call. Keys, never values: the digest shows that two calls had the same shape and cannot be used to reconstruct one. */
+export declare function borrowScopeDigest(directUrl: string, mcpTool: string, input: Readonly<Record<string, unknown>>, frozenArgs: Readonly<Record<string, unknown>>): string;
+//# sourceMappingURL=credential-grant-broker.d.ts.map

package/dist/agent/access/credential-grant-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-broker.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-grant-broker.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAIjD,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EACL,0CAA0C,EAC1C,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,qCAAqC,EAErC,uBAAuB,EACxB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGxF,OAAO,EAAqD,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAG9F,2MAA2M;AAC3M,MAAM,WAAW,eAAe;IAC9B,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,2QAA2Q;AAC3Q,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpI,8KAA8K;AAC9K,OAAO,EAAE,0CAA0C,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,CAAC;AAE1G,qHAAqH;AACrH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE3G,MAAM,MAAM,sBAAsB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE/H,sKAAsK;AACtK,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,aAAa,GAAG,aAAa,CAAC;AAEjF,kJAAkJ;AAClJ,MAAM,MAAM,sBAAsB,GAAG,cAAc,GAAG,WAAW,CAAC;AAElE,iKAAiK;AACjK,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;AAK1E,eAAO,MAAM,yBAAyB,IAAsB,CAAC;AAE7D,oGAAoG;AACpG,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD;yDACqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,6MAA6M;AAC7M,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAUnE;AAMD,8MAA8M;AAC9M,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAQtE;AAED,eAAO,MAAM,yBAAyB,mMAC4J,CAAC;AAEnM,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F,gSAAgS;AAChS,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+J/I;AA8CD,+KAA+K;AAC/K,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACxC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC5C,MAAM,CAWR"}

package/dist/agent/access/credential-grant-broker.js

@@ -0,0 +1,252 @@
+// The execute of every per-grant mounted tool. A granted tool mounts on the grant row's existence and refuses on its state, so a revoked grant's tool stays mounted and refuses, and mode, expiry and state are re-read on every call.
+import { credentialGrantDisclosureLine, credentialGrantRefusalMessage, credentialGrantStateRefusal, grantAuditResource, GrantUndispatchedError, quotedPurpose, } from "../operational/credential-grant-rows.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { connectorTransportSpec } from "../connections/connector-transport.js";
+import { isCredentialGrantConnector } from "./credential-grant.js";
+import { auditGrant } from "./credential-grant-flow.js";
+import { GrantBorrowTransportAlreadyRegisteredError, grantBorrowTransport, registerGrantBorrowTransport, } from "./grant-borrow-transport-registry.internal.js";
+import { GrantRoomNoticeAlreadyRegisteredError, grantRoomNotice, registerGrantRoomNotice, } from "./grant-room-notice-registry.internal.js";
+import { grantOwnerSubject } from "./credential-grant-owner.js";
+import { grantScopeAdmits } from "./credential-grant-scope.js";
+import { currentJobWakePosture } from "./job-session-state.js";
+import { haltScopeFor, resolveHalt, resolveHaltUnaddressed } from "./halt.js";
+import { surfaceKeyOf, tenantKeyOf } from "./resolver.js";
+/** The registry lives off the published export map, and it refuses a second registration for one connector: the first transport stays in force and the second call throws. */
+export { GrantBorrowTransportAlreadyRegisteredError, grantBorrowTransport, registerGrantBorrowTransport };
+/** The registry lives off the published export map, and the port refuses a second registration: core's shipped arm stays in force and the second call throws. */
+export { GrantRoomNoticeAlreadyRegisteredError, registerGrantRoomNotice };
+// Three refunds per grant row per turn, so a once-mode row can be spent four times in one turn and then stays spent. The count lives on the row beside the burn it bounds, and a call with no readable turn id never rolls it.
+const REFUND_CAP_PER_TURN = 3;
+export const GRANT_REFUND_CAP_PER_TURN = REFUND_CAP_PER_TURN;
+/** The halt address comes from the audit stamps' room, never from ctx.scopeKey: that key is an eve session id, and reading it as an address silently dropped the domain, surface and workspace halt axes. */
+export function grantCallHaltScope(ctx) {
+    const roomKey = ctx.surface === undefined || ctx.surface === ""
+        ? tenantKeyOf({ platform: ctx.platform, workspace: ctx.workspace })
+        : surfaceKeyOf({ platform: ctx.platform, workspace: ctx.workspace, channel: ctx.surface });
+    return haltScopeFor({
+        org: ctx.org,
+        scopeKey: roomKey,
+        ...(ctx.requesterPrincipalId !== undefined ? { principalKey: ctx.requesterPrincipalId } : {}),
+    });
+}
+/** The placeholder the mount writes into every partition field when `resolvePartition` throws
+ *  (tools/grant_tools.ts). It is a literal there, so it is a literal here — matched, never guessed. */
+const UNRESOLVED_PARTITION = "unknown";
+/** True when the mount could not read the room, so the derived address is a placeholder. Such a call asks the unaddressed halt question instead, because a halt must have no gap an unreadable room opens. */
+export function grantCallRoomUnresolved(ctx) {
+    return (ctx.org === UNRESOLVED_PARTITION ||
+        ctx.platform === UNRESOLVED_PARTITION ||
+        ctx.workspace === UNRESOLVED_PARTITION ||
+        ctx.surface === undefined ||
+        ctx.surface === "");
+}
+export const HALT_UNRESOLVED_ROOM_NOTE = "This deployment could not resolve which conversation this call is running in, so the halt was applied to be safe: a halt anywhere in this organisation stops a call whose room cannot be read.";
+/** The order is load-bearing: read the row fresh, refuse an unattended wake, then state, scope and requester, then resolve the transport and the owner, then burn before the vendor call and audit before it. Only a GrantUndispatchedError refunds the burn, capped per grant row per turn. */
+export async function runGrantedCall(grantId, input, ctx) {
+    const store = getOperationalStore();
+    const nowIso = new Date(ctx.nowMs).toISOString();
+    const grant = await store.getCredentialGrant(ctx.org, grantId);
+    if (grant === null) {
+        // Rows are never deleted, so a vanished row is treated as revoked rather than given a permissive branch. The placeholder shape only has to be honest.
+        const shape = { connector: "", mcpTool: undefined, ownerSlug: "the owner", resource: "", verb: "that tool" };
+        await auditGrant(ctx, "grant.refused", ctx.requesterPrincipalId, { gate: "revoked", grantId });
+        return { message: credentialGrantRefusalMessage(shape, "revoked"), ok: false, refused: "revoked" };
+    }
+    /** `note` appends one host-authored clause to the shared copy — for a refusal whose REASON needs a
+     *  word about how it was decided, never for a caller's free text. */
+    const refuse = async (reason, note) => {
+        await auditGrant(ctx, "grant.refused", ctx.requesterPrincipalId, {
+            gate: reason,
+            grantId: grant.id,
+            owner: grant.ownerPrincipalId,
+            verb: grant.verb,
+        });
+        const message = credentialGrantRefusalMessage(grant, reason);
+        return { message: note === undefined ? message : `${message} ${note}`, ok: false, refused: reason };
+    };
+    // The grant plane's own execute backstop for an unattended wake; the primary control is the tool's absence at the model-call seam. It runs first because nobody-in-the-room is prior to the row's state, and the posture read fails soft.
+    if (currentJobWakePosture() === "restricted")
+        return refuse("unattended_wake");
+    // The break-glass halt sits after the room question and before every question about the row: a halt is not a property of the grant, so the refusal must not read as an expiry. It fails closed on a room it cannot read.
+    const roomUnresolved = grantCallRoomUnresolved(ctx);
+    const haltState = roomUnresolved ? await resolveHaltUnaddressed(ctx.org) : await resolveHalt(grantCallHaltScope(ctx));
+    if (haltState.halted) {
+        return refuse("halted", roomUnresolved ? HALT_UNRESOLVED_ROOM_NOTE : undefined);
+    }
+    const stateRefusal = credentialGrantStateRefusal(grant, nowIso);
+    if (stateRefusal !== undefined)
+        return refuse(stateRefusal);
+    // L0 as an EXECUTE BACKSTOP, not only as a mount rule. The resolver already mounts a grant's tool
+    // only where its scope admits it, but a replayed turn rebuilds the tool from persisted metadata, so
+    // the check has to hold at the call too.
+    // 🔴 THIS IS THE BACKSTOP'S OWN COPY OF THE RULE, NOT THE ONLY ONE. The mount and the own-account
+    // gate read `credential-grant-reach.ts` `credentialGrantsInReach`, whose half lives in SQL — see
+    // `grantScopeAdmits`'s own docblock for what differs and why. A change to what a seat may reach
+    // moves both.
+    if (!grantScopeAdmits(grant, ctx.scopeKey, ctx.domainScopeKey))
+        return refuse("out_of_scope");
+    if (ctx.requesterPrincipalId === undefined)
+        return refuse("unverified_requester");
+    // A row that names no vendor tool is not a legal grant row. Only a row an older build persisted can reach here, and it refuses by name before the burn.
+    const mcpTool = grant.mcpTool;
+    if (mcpTool === undefined)
+        return refuse("no_lent_tool");
+    // A grant row outlives the reviewed connector list that admitted it, so the list is re-read at dispatch. It runs before the transport lookup and the burn, so the refusal resolves, dials and spends nothing.
+    if (!isCredentialGrantConnector(grant.connector))
+        return refuse("connector_delisted");
+    const path = resolveBorrowPath(grant, mcpTool);
+    if (path === undefined)
+        return refuse("no_transport");
+    // WHOSE ROW THIS CALL WILL SPEND, resolved BEFORE the burn for the same reason the transport is:
+    // a once-mode grant must not be spent by a call this deployment could never have sent. It is a
+    // REFUSAL and never a fallback — see credential-grant-owner.ts for why there is no weaker subject
+    // to try.
+    const owner = await grantOwnerSubject(ctx.org, grant.connector, grant.ownerPrincipalId);
+    if (owner === undefined)
+        return refuse("owner_unresolvable");
+    // THE BURN, and the stamp that lets it be undone. `burnedAt` is non-undefined exactly when THIS
+    // call won the CAS on a once-mode row, and it is what `refundCredentialGrant` is keyed on — see
+    // step 7 below and the store's own contract.
+    let burnedAt;
+    if (grant.mode === "once") {
+        const burned = await store.burnCredentialGrant(ctx.org, grant.id, nowIso);
+        if (burned === null)
+            return refuse("burned");
+        burnedAt = nowIso;
+    }
+    // AFTER THE BURN, deliberately: the audit digest describes a call this deployment has already
+    // committed to making.
+    const send = path.prepare(input);
+    const disclosure = credentialGrantDisclosureLine(grant, ctx.nowMs);
+    // ONE ROW, BOTH PRINCIPALS. The requester drove the act and the owner's credential paid for it,
+    // and that pair is the property this whole plane buys — so it is a single row rather than a join
+    // across two. IDS AND NAMES ONLY: the composed request is recorded as a coarse digest, never as
+    // the vendor request, and the output is never recorded at all.
+    await auditGrant(ctx, "grant.used", ctx.requesterPrincipalId, {
+        connector: grant.connector,
+        grantId: grant.id,
+        mode: grant.mode,
+        owner: grant.ownerPrincipalId,
+        purpose: quotedPurpose(grant.purpose),
+        requester: ctx.requesterPrincipalId,
+        // 🔴 NAMES, NEVER THE FROZEN VALUES. A borrow's `resource` column is a display label composed
+        // from the frozen ARGUMENTS, which are model-authored; the audit contract on this plane is ids
+        // and names only. See `grantAuditResource`.
+        resource: grantAuditResource(grant),
+        scopeDigest: send.scopeDigest,
+        // OPE-1950: TWO SCOPES, AND THEY ARE DIFFERENT QUESTIONS. `scopeKey` is what the GRANT is bound
+        // to — identical on every call of one row, and for a standing grant it is the room's domain key
+        // rather than a session id that no longer exists. `callerScopeKey` is the SESSION that made THIS
+        // call. Before the widening the two were always equal, so one field answered both; a standing
+        // grant is now spent by many sessions over 30 days, and an operator tracing a misuse needs the
+        // one that moves.
+        scopeKey: grant.scopeKey,
+        callerScopeKey: ctx.scopeKey,
+        tier: grant.tier,
+        verb: grant.verb,
+    });
+    // Only a GrantUndispatchedError refunds the burn; every other throw keeps it, because none can tell a delivered call from a lost one. A refund restores the owner's approval, not the vendor session, and the throw still reaches the model.
+    let result;
+    try {
+        result = await send.run(owner);
+    }
+    catch (err) {
+        if (burnedAt !== undefined && err instanceof GrantUndispatchedError) {
+            // The claim runs before the refund, so a capped attempt writes no refund at all, and the claim is never revisited afterwards. A claim that throws refunds nothing and still writes its closing audit row: the row stays spent.
+            let claimed = false;
+            let unclaimable = false;
+            try {
+                claimed = await store.claimCredentialGrantRefund(ctx.org, grant.id, ctx.turnId, REFUND_CAP_PER_TURN);
+            }
+            catch (claimErr) {
+                unclaimable = true;
+                console.log(`[open-everywhere:grant] grant ${grant.id}: the undispatched-call refund could not be CLAIMED, so the approval stays spent: ${String(claimErr)}`);
+            }
+            try {
+                const refunded = claimed ? await store.refundCredentialGrant(ctx.org, grant.id, burnedAt) : false;
+                // The closing row for a call that never went out; refunded false means the owner revoked while it was in flight. Three gate names, because they are three different jobs for a reader: undispatched, refund_capped (the allowance is spent) and refund_unclaimed (the store could not count).
+                await auditGrant(ctx, "grant.refused", ctx.requesterPrincipalId, {
+                    connector: grant.connector,
+                    gate: claimed ? "undispatched" : unclaimable ? "refund_unclaimed" : "refund_capped",
+                    grantId: grant.id,
+                    mode: grant.mode,
+                    owner: grant.ownerPrincipalId,
+                    refunded,
+                    requester: ctx.requesterPrincipalId,
+                    resource: grantAuditResource(grant),
+                    verb: grant.verb,
+                });
+            }
+            catch (refundErr) {
+                // The grant stays burned, which is the fail-closed direction, and the original refusal is
+                // what reaches the model. Logged rather than swallowed silently: an operator needs to know
+                // an owner's one-shot approval was spent on a call that never ran. Which half failed is
+                // named, because the two are different events — a refund that could not be written, and a
+                // turn that ran out of refunds and then could not write its own closing row. A claim that
+                // could not be counted logs above and still reaches this write.
+                console.log(`[open-everywhere:grant] grant ${grant.id}: the undispatched-call ${claimed ? "refund" : "refund cap row"} could not be written: ${String(refundErr)}`);
+            }
+        }
+        throw err;
+    }
+    // The vendor call has already run, so a disclosure that never reached the room is audited rather than refused. Every silence gets a row, and the disclosure still reaches the model in the result.
+    const notice = grantRoomNotice();
+    if (notice === undefined) {
+        await auditUndisclosedCall(ctx, grant, "port_unarmed");
+    }
+    else {
+        try {
+            const outcome = await notice(disclosure, grant);
+            if (!outcome.posted)
+                await auditUndisclosedCall(ctx, grant, outcome.reason);
+        }
+        catch (noticeErr) {
+            await auditUndisclosedCall(ctx, grant, "arm_threw", noticeErr);
+        }
+    }
+    return { disclosure, ok: true, result };
+}
+/** One granted call whose acting-as-owner line did not reach the room, the counterpart of grant.used. Ids, names and an Error name only, never the disclosure line, and a lost row never fails the call. */
+async function auditUndisclosedCall(stamps, grant, gate, err) {
+    await auditGrant(stamps, "grant.undisclosed", grant.ownerPrincipalId, {
+        connector: grant.connector,
+        gate,
+        grantId: grant.id,
+        mode: grant.mode,
+        owner: grant.ownerPrincipalId,
+        requester: grant.requesterPrincipalId,
+        resource: grantAuditResource(grant),
+        verb: grant.verb,
+        ...(err === undefined ? {} : { error: err instanceof Error ? err.name : "unknown" }),
+    });
+}
+/** The row names the tool and freezes the arguments, so nothing is composed here. A missing connection spec or a missing borrow transport both mean this deployment cannot send, and the grant stays valid. */
+function resolveBorrowPath(grant, mcpTool) {
+    const spec = connectorTransportSpec(grant.connector);
+    if (spec === undefined)
+        return undefined;
+    const transport = grantBorrowTransport(grant.connector);
+    if (transport === undefined)
+        return undefined;
+    return {
+        prepare: (input) => ({
+            run: async (owner) => await transport({ input, mcpTool }, grant, owner),
+            scopeDigest: borrowScopeDigest(spec.directUrl, mcpTool, input, grant.frozenArgs ?? {}),
+        }),
+    };
+}
+/** A coarse, non-reversible description of one borrowed call. Keys, never values: the digest shows that two calls had the same shape and cannot be used to reconstruct one. */
+export function borrowScopeDigest(directUrl, mcpTool, input, frozenArgs) {
+    let host = "unparseable";
+    try {
+        host = new URL(directUrl).host;
+    }
+    catch {
+        /* keep "unparseable" — a connection with a bad URL is still worth an honest row */
+    }
+    const keys = [...new Set([...Object.keys(input), ...Object.keys(frozenArgs)])].sort().join(",");
+    // The vendor tool name is MODEL-AUTHORED at ask time, so it rides the same quoted-data discipline
+    // a model-authored purpose does before it lands in an audit row.
+    return `mcp ${host} tools/call ${quotedPurpose(mcpTool)} keys:${keys}`;
+}
+//# sourceMappingURL=credential-grant-broker.js.map

package/dist/agent/access/credential-grant-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-broker.js","sourceRoot":"","sources":["../../../agent/access/credential-grant-broker.ts"],"names":[],"mappings":"AAAA,uOAAuO;AAEvO,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,GAGd,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAyB,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EACL,0CAA0C,EAC1C,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,qCAAqC,EACrC,eAAe,EACf,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAA0B,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,sBAAsB,EAAkB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAa1D,8KAA8K;AAC9K,OAAO,EAAE,0CAA0C,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,CAAC;AAa1G,iKAAiK;AACjK,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;AAE1E,+NAA+N;AAC/N,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAoC7D,6MAA6M;AAC7M,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,MAAM,OAAO,GACX,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE;QAC7C,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,OAAO,YAAY,CAAC;QAClB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,GAAG,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC;AAED;uGACuG;AACvG,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAEvC,8MAA8M;AAC9M,MAAM,UAAU,uBAAuB,CAAC,GAAqB;IAC3D,OAAO,CACL,GAAG,CAAC,GAAG,KAAK,oBAAoB;QAChC,GAAG,CAAC,QAAQ,KAAK,oBAAoB;QACrC,GAAG,CAAC,SAAS,KAAK,oBAAoB;QACtC,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,GAAG,CAAC,OAAO,KAAK,EAAE,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GACpC,gMAAgM,CAAC;AAOnM,gSAAgS;AAChS,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAwC,EAAE,GAAqB;IACnH,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,sJAAsJ;QACtJ,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC7G,MAAM,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/F,OAAO,EAAE,OAAO,EAAE,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrG,CAAC;IACD;yEACqE;IACrE,MAAM,MAAM,GAAG,KAAK,EAAE,MAA8B,EAAE,IAAa,EAA4B,EAAE;QAC/F,MAAM,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,oBAAoB,EAAE;YAC/D,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,KAAK,EAAE,KAAK,CAAC,gBAAgB;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACtG,CAAC,CAAC;IAEF,0OAA0O;IAC1O,IAAI,qBAAqB,EAAE,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE/E,yNAAyN;IACzN,MAAM,cAAc,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IACtH,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,YAAY,GAAG,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,kGAAkG;IAClG,oGAAoG;IACpG,yCAAyC;IACzC,kGAAkG;IAClG,iGAAiG;IACjG,gGAAgG;IAChG,cAAc;IACd,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAElF,wJAAwJ;IACxJ,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAEzD,8MAA8M;IAC9M,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEtF,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAEtD,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,UAAU;IACV,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE7D,gGAAgG;IAChG,gGAAgG;IAChG,6CAA6C;IAC7C,IAAI,QAA4B,CAAC;IACjC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAED,8FAA8F;IAC9F,uBAAuB;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,6BAA6B,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACnE,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,+DAA+D;IAC/D,MAAM,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE;QAC5D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,gBAAgB;QAC7B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,oBAAoB;QACnC,8FAA8F;QAC9F,+FAA+F;QAC/F,4CAA4C;QAC5C,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gGAAgG;QAChG,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,+FAA+F;QAC/F,kBAAkB;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,GAAG,CAAC,QAAQ;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;IACH,6OAA6O;IAC7O,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YACpE,+NAA+N;YAC/N,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,CAAC,EAAE,qFAAqF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAChK,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClG,8RAA8R;gBAC9R,MAAM,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,oBAAoB,EAAE;oBAC/D,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe;oBACnF,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,gBAAgB;oBAC7B,QAAQ;oBACR,SAAS,EAAE,GAAG,CAAC,oBAAoB;oBACnC,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC;oBACnC,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,0FAA0F;gBAC1F,2FAA2F;gBAC3F,wFAAwF;gBACxF,0FAA0F;gBAC1F,0FAA0F;gBAC1F,gEAAgE;gBAChE,OAAO,CAAC,GAAG,CACT,iCAAiC,KAAK,CAAC,EAAE,2BAA2B,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,CAAC,SAAS,CAAC,EAAE,CACvJ,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,mMAAmM;IACnM,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,4MAA4M;AAC5M,KAAK,UAAU,oBAAoB,CACjC,MAAwB,EACxB,KAAyB,EACzB,IAA+C,EAC/C,GAAa;IAEb,MAAM,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,EAAE;QACpE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,gBAAgB;QAC7B,SAAS,EAAE,KAAK,CAAC,oBAAoB;QACrC,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAYD,+MAA+M;AAC/M,SAAS,iBAAiB,CAAC,KAAyB,EAAE,OAAe;IACnE,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnB,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;YACvE,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;SACvF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+KAA+K;AAC/K,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,OAAe,EACf,KAAwC,EACxC,UAA6C;IAE7C,IAAI,IAAI,GAAG,aAAa,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,kGAAkG;IAClG,iEAAiE;IACjE,OAAO,OAAO,IAAI,eAAe,aAAa,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;AACzE,CAAC"}

package/dist/agent/access/credential-grant-card.d.ts

@@ -0,0 +1,98 @@
+import { type DirectMessageAction } from "../channels/post-arms.js";
+import { type DmDeliveryWhere } from "../channels/dm-audience.js";
+import { type GrantScopeReach } from "./credential-grant-key-shape.js";
+import { type CredentialGrantAskRow, type CredentialGrantMode, type CredentialGrantRow, type GrantJsonObject } from "../operational/credential-grant-rows.js";
+/** How many times one "once" grant can be attempted in a turn: one burn plus the broker's cap of three refunds, because the burn happens before the vendor call and a call the host can prove never left is refunded. The value is duplicated rather than imported to avoid an import cycle, and a test pins the two equal. */
+export declare const GRANT_ONCE_MAX_ATTEMPTS_PER_TURN = 4;
+/** One reader-facing word per mode, spent by every surface that names a mode, so a person who taps one word never reads another and cannot tell whether they got what they tapped. These are READER words only: the wire values stay once/session/standing in the column, the action id and the audit row. */
+export declare const GRANT_MODE_WORDS: Readonly<Record<CredentialGrantMode, string>>;
+/** True when mode admits more than thanMode — one call, then one conversation, then a span of days. An approval may legitimately be wider than the ask because the owner chooses breadth, and the room notice uses this to say so rather than let a room read the ask's breadth as the grant's. */
+export declare function grantModeIsBroader(mode: CredentialGrantMode, thanMode: CredentialGrantMode): boolean;
+/** The prefix every grant-card button id carries. A surface's interaction router classifies "ours" on exactly this string, so it must not collide with the approval, credential-intake, connector-card or identity-consent prefixes, or with eve's own. */
+export declare const OE_GRANT_ACTION_PREFIX = "oe_grant:";
+/** What a tap MEANS. A closed set: the id is PARSED, never interpreted. */
+export type GrantCardAnswer = CredentialGrantMode | "decline";
+/** The action id grammar oe_grant:<answer>:<askId>. The mode rides the id because the owner's answer must be a click on host-rendered copy, and the click route reads nothing else off the payload but the CLICKER. An ask id is not a bearer token: holding one lets you name an ask, not answer one, because every click whose verified clicker is not the ask's owner is refused. */
+export declare function grantCardActionId(askId: string, answer: GrantCardAnswer): string;
+/** Parse one grant-card button id, or undefined when it is not ours or not well-formed. The answer is peeled off the FRONT because an ask id is our own store key and could contain a colon, so a grammar that split from the end would mis-read one. */
+export declare function parseGrantCardActionId(raw: string | undefined): {
+    readonly askId: string;
+    readonly answer: GrantCardAnswer;
+} | undefined;
+/** One mode spelled the way a sentence takes it: the single-sourced word plus the preposition that word needs, so a card that reads a decision back cannot drift from the button that made it. */
+export declare function grantModePhrase(mode: CredentialGrantMode): string;
+/**
+ * WHICH STANDING ARM THIS ASK OFFERS, or `undefined` when it offers none (OPE-2160).
+ *
+ * 🔴 A 30-DAY BUTTON IS A 30-DAY PROMISE, SO IT IS RENDERED ONLY WHERE THE MECHANISM CAN KEEP ONE.
+ * A standing grant binds to the ask's own `domainScopeKey`, and an ask that carries none has nothing
+ * conversation-stable to bind to. Before this, such a tap bound the row to the ASKING SESSION and
+ * still stamped a 30-day expiry: the owner read "30 days" and the row became unreachable at the next
+ * seat rotation — 7 days, a 12-hour quiet gap, a turn or token backstop, or any deploy that changes
+ * the eve build. Nobody was told, and the audit trail showed a live grant nobody could spend for
+ * another 29 days. `grantScopeKeyForMode` refuses the same case at the mint, so the button and the
+ * row agree.
+ *
+ * ONE READER, THREE USES — the buttons, the card body's bullet and the line that reads the ASK's own
+ * mode back must never disagree about what is on offer. It answers the REACH rather than a boolean so
+ * the bullet's own arms stay exhaustive over what is left.
+ */
+export declare function grantCardStandingReach(ask: Pick<CredentialGrantAskRow, "domainScopeKey">): Exclude<GrantScopeReach, "session"> | undefined;
+export declare function grantCardActions(ask: CredentialGrantAskRow): readonly DirectMessageAction[];
+/** Present only when a DELEGATED WORKER raised the ask. It is deliberately not on the row: it changes the card's copy and nothing else, so the owner's decision, the anti-nag key and the audit join are unchanged. seatLabel is the deployment's own configured agent name, resolved by the caller and never model input. */
+export interface GrantAskWorkerOrigin {
+    readonly seatLabel: string;
+}
+/** The card text, HOST-AUTHORED throughout except the quoted purpose. A caller that resolved no display name passes an empty string and never a principal key; an absent conversation label makes the card say "that conversation" and never an id. A worker-raised card names the AGENT the owner knows, then states the worker context beneath it. */
+export declare function grantCardText(ask: CredentialGrantAskRow, requesterLabel: string, workerOrigin?: GrantAskWorkerOrigin, conversationLabel?: string): string;
+/** What was borrowed, in one clause: the reviewed action phrase plus the requester's own target label, rendered as quoted data. Shared with the room's resolution notice rather than inlined twice, so the owner's card and the room's answer name one borrow and not two. */
+export declare function grantBorrowPhrase(row: {
+    readonly connector: string;
+    readonly mcpTool?: string;
+    readonly resource: string;
+    readonly frozenArgs?: GrantJsonObject;
+}): string;
+/** The lapsed card speaks to what a tap would DO — nothing, because the approve CAS carries an unexpired conjunct — and says nothing about whether the buttons are still rendered, which is a property of today's two arms rather than of the seam. requesterNotified is a parameter rather than an assumption, because the lapse notice genuinely may not go out. */
+export declare function expiredGrantCardText(ask: CredentialGrantAskRow, requesterNotified: boolean): string;
+/** The card an owner is left with when the approve-time catalogue read refused the ask: they pressed a button and nothing happened, and silence there reads as a broken button. It names no vendor error text, because what the connection published is data from outside and a card is host-authored copy. */
+export declare function refusedGrantCardText(ask: CredentialGrantAskRow, gate: GrantApproveGate): string;
+/** Why an approve-time catalogue read refused an ask. A closed set: each arm is a boundary the card,
+ *  the requester's notice and the audit row all name with the same word. */
+export type GrantApproveGate = "tool_absent" | "frozen_args_unknown";
+/** The card an owner is left with after they approved — it replaces the open question with what was answered, so four live-looking buttons no longer sit under a closed request. mode is the mode the owner actually TAPPED, which may be broader than what was asked. */
+export declare function approvedGrantCardText(ask: CredentialGrantAskRow, grant: Pick<CredentialGrantRow, "mode" | "expiresAt">, nowMs: number): string;
+/** The card an owner is left with after they declined. It names no reason: a person's reason for refusing their own credential is theirs. */
+export declare function declinedGrantCardText(ask: CredentialGrantAskRow): string;
+/** The ask stays PENDING and nothing is spent — connecting is a step, not a refusal, so the copy sends the owner back to the card. The URL is CAPABILITY-BEARING, since whoever opens it binds that account: it goes to the owner's own DM, and it is never logged, never audited and never posted into the requesting room. */
+export declare function grantConsentPromptText(ask: CredentialGrantAskRow, url: string): string;
+/** Why a grant DM did not go out. `owner_stopped_dms` and `owner_dm_unreadable` are the recipient's own plane (OPE-1855): the first is their decision, the second is a store that did not answer, and the two are never folded together — reporting an outage as a person's decision states a fact about them that nobody established. */
+export type GrantCardRefusal = "no_dm_arm" | "send_failed" | "owner_stopped_dms" | "owner_dm_unreadable";
+export type GrantCardDelivery = {
+    readonly delivered: true;
+    readonly surfaceId: string;
+    readonly messageId: string;
+} | {
+    readonly delivered: false;
+    readonly reason: GrantCardRefusal;
+};
+/** The person address the OWNER's stop is keyed on — `set_dm_delivery` writes this exact spelling from the owner's own DM, so the ask row's platform and native id must compose it the same way or a stop would key on a string no grant can name. */
+export declare function grantOwnerDmAddress(ask: Pick<CredentialGrantAskRow, "ownerPlatform" | "ownerNativeId">): string;
+/**
+ * Deliver one ask's card to its owner. An unreachable owner is an HONEST REFUSAL, never a queued ask: a platform with no DM arm cannot cold-address a person, so the caller must tell the requester so rather than write a pending row nobody will ever see.
+ * 🔴 IT TAKES THE PROACTIVE-DM ROAD (OPE-1855), so the owner's own stop refuses it, the message carries the stop line, and one audit row names the plane. This plane used to address the post arm directly, which is how a person who had told the agent to stop still received this card.
+ */
+export declare function deliverGrantCard(ask: CredentialGrantAskRow, where: DmDeliveryWhere, requesterLabel: string, workerOrigin?: GrantAskWorkerOrigin, conversationLabel?: string): Promise<GrantCardDelivery>;
+/** Rewrite one lapsed ask's card to say expired. TRUE when it landed; FALSE means the card was not rewritten and is never an error — the CAS has already closed the ask, and the rewrite is cosmetic. */
+export declare function expireGrantCard(ask: CredentialGrantAskRow, requesterNotified: boolean): Promise<boolean>;
+/** Rewrite one ask's card to say the approve-time catalogue read refused it. TRUE when it landed; FALSE is never an error — see rewriteGrantCard. */
+export declare function refuseGrantCard(ask: CredentialGrantAskRow, gate: GrantApproveGate): Promise<boolean>;
+/** Rewrite one ask's card to say the OWNER approved it. TRUE when it landed; FALSE is never an error — see rewriteGrantCard. */
+export declare function approveGrantCard(ask: CredentialGrantAskRow, grant: Pick<CredentialGrantRow, "mode" | "expiresAt">, nowMs: number): Promise<boolean>;
+/** Rewrite one ask's card to say the OWNER declined it. TRUE when it landed; FALSE is never an error — see rewriteGrantCard. */
+export declare function declineGrantCard(ask: CredentialGrantAskRow): Promise<boolean>;
+/**
+ * DM the owner the link that connects their own account, with no buttons. FALSE means this deployment cannot cold-address the owner on their platform — no DM arm, their own stop, an unreadable stop, or a failed send — which the caller reports rather than leaving them staring at a card that will not move.
+ * 🔴 IT TAKES THE ROAD for the same reason the card does (OPE-1855): it is a DM this agent starts, so the owner's stop answers it. 🔴 THE URL IS CAPABILITY-BEARING and must never reach an audit row — the road writes ids only, never the text, which is what keeps that true.
+ */
+export declare function deliverGrantConsentPrompt(ask: CredentialGrantAskRow, where: DmDeliveryWhere, url: string): Promise<boolean>;
+//# sourceMappingURL=credential-grant-card.d.ts.map

package/dist/agent/access/credential-grant-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant-card.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-grant-card.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,yCAAyC,CAAC;AAOjD,+TAA+T;AAC/T,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD,8SAA8S;AAC9S,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAI1E,CAAC;AAIF,mSAAmS;AACnS,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAEpG;AAED,2PAA2P;AAC3P,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,SAAS,CAAC;AAE9D,wXAAwX;AACxX,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAEhF;AAED,yPAAyP;AACzP,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG,SAAS,CAUxI;AAED,kMAAkM;AAClM,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAEjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,SAAS,CAG1I;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG,SAAS,mBAAmB,EAAE,CAS3F;AAED,8TAA8T;AAC9T,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wVAAwV;AACxV,wBAAgB,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAqEzJ;AAQD,8QAA8Q;AAC9Q,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACvC,GAAG,MAAM,CAIT;AAkID,sWAAsW;AACtW,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,GAAG,MAAM,CAWnG;AAED,+SAA+S;AAC/S,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAe/F;AAED;4EAC4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,qBAAqB,CAAC;AAErE,0QAA0Q;AAC1Q,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAU9I;AAED,6IAA6I;AAC7I,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,qBAAqB,GAAG,MAAM,CAQxE;AAED,gUAAgU;AAChU,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAWtF;AAED,0UAA0U;AAC1U,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,aAAa,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;AAEzG,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAErE,sPAAsP;AACtP,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,EAAE,eAAe,GAAG,eAAe,CAAC,GAAG,MAAM,CAE/G;AAcD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,eAAe,EACtB,cAAc,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,oBAAoB,EACnC,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,iBAAiB,CAAC,CA8B5B;AAED,yMAAyM;AACzM,wBAAsB,eAAe,CAAC,GAAG,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAE9G;AAED,qJAAqJ;AACrJ,wBAAsB,eAAe,CAAC,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAE1G;AAED,gIAAgI;AAChI,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzJ;AAED,gIAAgI;AAChI,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAQD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBjI"}