@open-everywhere/core 0.1.0

package/dist/agent/access/credential-grant.d.ts

@@ -0,0 +1,94 @@
+import { type GrantCopyAudience, type GrantDuplicateFacts } from "./credential-grant-copy.js";
+import { type CredentialGrantAskRow, type CredentialGrantMode, type CredentialGrantRow, type GrantJsonObject } from "../operational/credential-grant-rows.js";
+/** The minimum shape this module reads off a domain, so a caller can pass a bare bag in a test. The grant declaration is its own field rather than a credential override, because the MEMBER plane reads that field too. */
+export interface GrantBoundDomain {
+    readonly name?: string;
+    /** The connectors whose personal credentials this domain's rooms may raise grant asks for; each must appear in CREDENTIAL_GRANT_ROLES. Absent or empty admits NO grant, and there is no org-wide fallback. */
+    readonly credentialGrants?: readonly string[];
+}
+/** One provider's GRANT role — the (connector, personal credential id) pair a declaration names. */
+export interface CredentialGrantRole {
+    readonly connector: string;
+    readonly role: string;
+}
+/** The (connector, personal credential) pairs this tree admits grants for — the only place core enumerates vendors here. Naming one grants nothing (the domain must declare it too) and a connector missing from it admits no grant at all. */
+export declare const CREDENTIAL_GRANT_ROLES: readonly CredentialGrantRole[];
+/** Is this a connector the tree admits grants for? Read at DISPATCH as well as at mint, because a grant row outlives the list: removing a connector leaves every row already minted for it. */
+export declare function isCredentialGrantConnector(connector: string): boolean;
+export declare function credentialGrantConnectors(): readonly string[];
+/** An OR across the domains a surface resolves into, matching `memberPlaneGrants`. `false` is a refusal, never an org default, and BOTH halves must say yes: a domain naming a connector with no grant role declares nothing spendable. */
+export declare function domainsAdmitCredentialGrant(domains: readonly (GrantBoundDomain | undefined)[], connector: string): boolean;
+/** Shape problems in one domain's `credentialGrants`, as operator-facing lines. An unadmitted connector is refused at BOOT rather than ignored at runtime, because silence there reads as "grants are off for a reason". */
+export declare function credentialGrantDeclarationProblems(domain: GrantBoundDomain): readonly string[];
+/** Why a grant could not be minted. Every arm is a refusal the requester's turn reports out loud. */
+export type GrantMintRefusal = "no_domain_grant" | "unverified_requester" | "illegal_owner_handle" | "unresolvable_owner" | "owner_unresolved" | "grant_already_live" | "ask_already_pending" | "write_verb_out_of_slice" | "illegal_tool_name" | "illegal_connector_id";
+export interface GrantBorrowMintInput {
+    /** The vendor MCP tool, in the vendor's exact bytes. It decides the tier and, slugified, the verb segment of the mounted name; the bytes are never re-derived from the name. */
+    readonly mcpTool: string;
+    /** The granted target's human label, slugified into the tail of the mounted name. MODEL-AUTHORED but bounded: the slugifier admits only `[a-z0-9_]`, the composer truncates, and the owner reads the composed name; an unslugifiable label falls back to the tool slug. */
+    readonly targetLabel: string;
+    /** The ask row's own id, and the source of the collision suffix. Passed in because this function is pure, and because the row the caller writes must carry the same id the name was spelled from. */
+    readonly rowId: string;
+    /** The mounted names already claimed in this chat, LIVE OR DEAD — the mount projects existence, so a dead row still holds its name. `[]` is the honest answer for the first grant in a chat, and the only way to say it. */
+    readonly takenToolNames: readonly string[];
+}
+export interface GrantMintInput {
+    readonly domainGrantsConnector: boolean;
+    /** Exactly one verified human this turn, or undefined. */
+    readonly requesterPrincipalId: string | undefined;
+    readonly ownerPrincipalId: string;
+    /** The owner's display handle, slugified into the mounted name's owner segment. */
+    readonly ownerHandle: string;
+    readonly connector: string;
+    /** What this ask would borrow, and it is REQUIRED: a grant lends one vendor MCP tool. One object, so `takenToolNames` cannot be forgotten — "nothing is claimed" is spelled `[]`. */
+    readonly borrow: GrantBorrowMintInput;
+    /** A live grant already held for the same key — the at-most-one rule. The key is the CALLER's to read: (owner, connector, mcpTool, frozen-args digest, scope), so the same tool frozen to two resources is two grants. */
+    readonly liveGrant: CredentialGrantRow | undefined;
+    /** A pending, unexpired ask already held for the same tuple — the anti-nag control. A second ask while one is pending answers "already asked" and sends nothing, because an owner who is paged turns the feature off. */
+    readonly liveAsk: CredentialGrantAskRow | undefined;
+}
+export type GrantMintVerdict = {
+    readonly ok: true;
+    readonly ownerSlug: string;
+    readonly tier: "read" | "write" | "destructive";
+    readonly toolName: string;
+} | {
+    readonly ok: false;
+    readonly reason: GrantMintRefusal;
+};
+/** May this grant be minted, and under what name? PURE, so the whole decision table is testable without a store; the at-most-one rule is what keeps the mounted name unique inside one chat. */
+export declare function credentialGrantMintVerdict(input: GrantMintInput): GrantMintVerdict;
+/** What the duplicate refusal knows about the grant that already exists — all optional, because a caller that read none must still get an id-free sentence. `audience` is decided from the principal keys by the caller. */
+export interface GrantDuplicateContext extends Omit<GrantDuplicateFacts, "connector"> {
+    readonly audience: GrantCopyAudience;
+}
+/** The refusal copy the requester's turn reports. Each line names the boundary, never a bare "no". */
+export declare function grantMintRefusalMessage(connector: string, reason: GrantMintRefusal, duplicate?: GrantDuplicateContext): string;
+/** The ceiling on a standing grant. Standing means standing FOR A NAMED SCOPE: a grant with no ceiling is ambient use wearing a grant's clothes. */
+export declare const GRANT_STANDING_MAX_MS: number;
+/** When a grant of `mode` minted at `nowMs` expires. `requestedMs` only narrows a standing grant. */
+export declare function credentialGrantExpiry(mode: CredentialGrantMode, nowMs: number, requestedMs?: number): string;
+/** A pending ask's own TTL — minutes-to-hours, and deliberately NOT the grant's. */
+export declare const GRANT_ASK_TTL_MS: number;
+/**
+ * The grant row an approved ask mints. Pure: the caller writes it and owns the ids and the clock.
+ *
+ * 🔴 `undefined` MEANS THE MODE MAY NOT BE MINTED AGAINST THIS ASK, AND IT BINDS NOTHING (OPE-2160).
+ * The one case today is a `standing` mode on an ask that carries no domain key: the row would bind to
+ * the asking session and still stamp a 30-day expiry, which is the promise the mechanism cannot keep.
+ * The refusal lives here rather than in the caller because this function is the only thing that
+ * composes the row — a caller that forgot the rule would write the forbidden row, and now it cannot
+ * spell one. `access/credential-grant-flow.ts` refuses the click before the approve CAS, so a row this
+ * function refuses is a case the card never offered.
+ */
+export declare function credentialGrantFromAsk(ask: CredentialGrantAskRow, fields: {
+    readonly grantId: string;
+    readonly ownerSlug: string;
+    readonly tier: "read" | "write" | "destructive";
+    readonly mode: CredentialGrantMode;
+    readonly nowIso: string;
+    readonly expiresAt: string;
+    /** The vendor tool's schema with each frozen argument pinned in place, read from the LIVE connection at approve time. A grant that carries none mounts nothing. */
+    readonly inputSchema?: GrantJsonObject;
+}): CredentialGrantRow | undefined;
+//# sourceMappingURL=credential-grant.d.ts.map

package/dist/agent/access/credential-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-grant.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmD,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE/I,OAAO,EAML,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,yCAAyC,CAAC;AAGjD,4NAA4N;AAC5N,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8MAA8M;IAC9M,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+OAA+O;AAC/O,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAEhE,CAAC;AAEF,+LAA+L;AAC/L,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAED,2OAA2O;AAC3O,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,gBAAgB,GAAG,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAG1H;AAED,4NAA4N;AAC5N,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,MAAM,EAAE,CAyB9F;AAED,qGAAqG;AACrG,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,sBAAsB,GACtB,sBAAsB,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,qBAAqB,GACrB,yBAAyB,GACzB,mBAAmB,GACnB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACnC,gLAAgL;IAChL,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2QAA2Q;IAC3Q,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qMAAqM;IACrM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4NAA4N;IAC5N,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qLAAqL;IACrL,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,0NAA0N;IAC1N,QAAQ,CAAC,SAAS,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACnD,yNAAyN;IACzN,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC7H;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9D,gMAAgM;AAChM,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,cAAc,GAAG,gBAAgB,CAiBlF;AAiCD,4NAA4N;AAC5N,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC;IACnF,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,qBAAqB,GAAG,MAAM,CA+B9H;AAMD,oJAAoJ;AACpJ,eAAO,MAAM,qBAAqB,QAA2B,CAAC;AAE9D,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAI5G;AAED,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE;IACN,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mKAAmK;IACnK,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;CACxC,GACA,kBAAkB,GAAG,SAAS,CA8BhC"}

package/dist/agent/access/credential-grant.js

@@ -0,0 +1,198 @@
+// The credential-grant plane: one person's credential serving one CHAT, for one vendor tool with the owner's frozen arguments, until a stated time. The schema and mount are a routing and honesty control and never narrow the credential, which is why v1 mounts granted tools on conversational seats only.
+import { classifyConnectorOpTier } from "./consequence.js";
+import { connectorDisplayName, grantDuplicateRefusalText } from "./credential-grant-copy.js";
+import { grantScopeKeyForMode } from "./credential-grant-scope.js";
+import { grantOwnerSlug, grantTargetSlug, grantToolSlug, isGrantNameSegment, nextGrantBorrowToolName, } from "../operational/credential-grant-rows.js";
+import { isQualifiedPrincipalKey } from "../identity/principal-key.js";
+/** The (connector, personal credential) pairs this tree admits grants for — the only place core enumerates vendors here. Naming one grants nothing (the domain must declare it too) and a connector missing from it admits no grant at all. */
+export const CREDENTIAL_GRANT_ROLES = [
+    { connector: "notion", role: "user-oauth" },
+];
+/** Is this a connector the tree admits grants for? Read at DISPATCH as well as at mint, because a grant row outlives the list: removing a connector leaves every row already minted for it. */
+export function isCredentialGrantConnector(connector) {
+    return CREDENTIAL_GRANT_ROLES.some((r) => r.connector === connector);
+}
+export function credentialGrantConnectors() {
+    return [...new Set(CREDENTIAL_GRANT_ROLES.map((r) => r.connector))].sort();
+}
+/** An OR across the domains a surface resolves into, matching `memberPlaneGrants`. `false` is a refusal, never an org default, and BOTH halves must say yes: a domain naming a connector with no grant role declares nothing spendable. */
+export function domainsAdmitCredentialGrant(domains, connector) {
+    if (!isCredentialGrantConnector(connector))
+        return false;
+    return domains.some((domain) => (domain?.credentialGrants ?? []).includes(connector));
+}
+/** Shape problems in one domain's `credentialGrants`, as operator-facing lines. An unadmitted connector is refused at BOOT rather than ignored at runtime, because silence there reads as "grants are off for a reason". */
+export function credentialGrantDeclarationProblems(domain) {
+    const declared = domain.credentialGrants;
+    if (declared === undefined)
+        return [];
+    const name = domain.name ?? "(unnamed)";
+    const bad = [];
+    if (!Array.isArray(declared))
+        return [`  "${name}" \`credentialGrants\` must be a list of connector ids`];
+    const seen = new Set();
+    const admitted = credentialGrantConnectors();
+    for (const connector of declared) {
+        if (typeof connector !== "string" || connector.trim().length === 0) {
+            bad.push(`  "${name}" \`credentialGrants\` holds an entry that is not a non-empty connector id`);
+            continue;
+        }
+        if (seen.has(connector))
+            bad.push(`  "${name}" \`credentialGrants\` names "${connector}" more than once`);
+        seen.add(connector);
+        if (!admitted.includes(connector)) {
+            bad.push(`  "${name}" \`credentialGrants\` names "${connector}", which this tree admits no credential-grant role for — ` +
+                `add the (connector, personal credential) pair to CREDENTIAL_GRANT_ROLES ` +
+                `(packages/core/agent/access/credential-grant.ts) in the same diff, or delete the entry ` +
+                `(admitted today: ${admitted.length > 0 ? admitted.join(", ") : "none"})`);
+        }
+    }
+    return bad;
+}
+/** May this grant be minted, and under what name? PURE, so the whole decision table is testable without a store; the at-most-one rule is what keeps the mounted name unique inside one chat. */
+export function credentialGrantMintVerdict(input) {
+    if (!input.domainGrantsConnector)
+        return { ok: false, reason: "no_domain_grant" };
+    // A coalesced turn keeps only the last delivery's auth, so an ask with no single verified requester has nobody to record as having spent the owner's credential.
+    if (input.requesterPrincipalId === undefined)
+        return { ok: false, reason: "unverified_requester" };
+    // The owner's key is checked at MINT, not at spend: a malformed key names nobody, so the grant would mount and every call would then refuse. The broker keeps its own backstop arm.
+    if (!isQualifiedPrincipalKey(input.ownerPrincipalId))
+        return { ok: false, reason: "unresolvable_owner" };
+    const shape = borrowShape(input.connector, input.borrow);
+    if (!shape.ok)
+        return shape;
+    const ownerSlug = grantOwnerSlug(input.ownerHandle);
+    if (ownerSlug === undefined)
+        return { ok: false, reason: "illegal_owner_handle" };
+    if (input.liveGrant !== undefined)
+        return { ok: false, reason: "grant_already_live" };
+    // Checked LAST, deliberately: every refusal above is a permanent property of the ask, and the requester should hear it even while an earlier ask is still pending.
+    if (input.liveAsk !== undefined)
+        return { ok: false, reason: "ask_already_pending" };
+    const toolName = shape.name(ownerSlug);
+    // A name past GRANT_TOOL_NAME_MAX refuses here rather than mounting a tool a model provider would reject: this function is pure and callers read it as total, so a composer failure must arrive as a refusal.
+    if (toolName === undefined)
+        return { ok: false, reason: "illegal_tool_name" };
+    return { ok: true, ownerSlug, tier: shape.tier, toolName };
+}
+/** The tier is the one the owner's own DM would get: classifyConnectorOpTier is handed `<connector>__<mcpTool>`, so a borrowed op classifies byte-identically. It reads the VENDOR's bytes, never the slug. */
+function borrowShape(connector, borrow) {
+    // A connector id that cannot be a name segment is a DEPLOYMENT fault, not a bad ask, so it refuses under its own name. Folding it into `illegal_tool_name` would send the requester into a retry loop.
+    if (!isGrantNameSegment(connector))
+        return { ok: false, reason: "illegal_connector_id" };
+    const toolSlug = grantToolSlug(borrow.mcpTool);
+    if (toolSlug === undefined)
+        return { ok: false, reason: "illegal_tool_name" };
+    const tier = classifyConnectorOpTier(`${connector}__${borrow.mcpTool}`);
+    // Only a `read` tier mints today: a write borrow records the owner's name at the vendor on an act the requester drove, and it lands in its own slice — refused by name here rather than shipping untested.
+    if (tier !== "read")
+        return { ok: false, reason: "write_verb_out_of_slice" };
+    // An unslugifiable target label is NOT a refusal: the name falls back to the tool slug, which is still legal and still unique once the collision suffix is applied.
+    const targetSlug = grantTargetSlug(borrow.targetLabel);
+    return {
+        name: (ownerSlug) => tryCompose(() => nextGrantBorrowToolName(ownerSlug, connector, toolSlug, targetSlug, borrow.rowId, borrow.takenToolNames)),
+        ok: true,
+        tier,
+    };
+}
+/** Run a name composer, turning its throw into `undefined` so a pure verdict stays a verdict. */
+function tryCompose(compose) {
+    try {
+        return compose();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The refusal copy the requester's turn reports. Each line names the boundary, never a bare "no". */
+export function grantMintRefusalMessage(connector, reason, duplicate) {
+    switch (reason) {
+        case "no_domain_grant":
+            return `This room's domain does not admit credential grants for ${connectorDisplayName(connector)}. An operator declares the grant role on the domain before anyone can ask.`;
+        case "unverified_requester":
+            return "This turn names no single verified requester, so there is nobody to record as having asked. Ask again in a turn that carries one verified author.";
+        case "illegal_owner_handle":
+            return "That owner's handle carries no characters a tool name can hold, so the grant could not be named. Link the account to a readable handle first.";
+        case "unresolvable_owner":
+            return "That owner is not named in a form this deployment can resolve a credential for, so nothing could ever be spent under the grant. Ask again naming the owner by their linked account.";
+        case "owner_unresolved":
+            return "That owner id is not a user id on this conversation's platform, so it names nobody here. Name the owner as they appear in this room, or give their full principal key.";
+        case "grant_already_live":
+            // One composer for both audiences; `duplicate` carries the facts that make the sentence specific. A caller that read none still gets a sentence with no id in it, which this arm must never lose.
+            return grantDuplicateRefusalText(duplicate?.audience ?? "seat", {
+                connector,
+                conversationLabel: duplicate?.conversationLabel,
+                expiresAt: duplicate?.expiresAt,
+                mcpTool: duplicate?.mcpTool,
+                nowMs: duplicate?.nowMs ?? 0,
+                ownerLabel: duplicate?.ownerLabel,
+            });
+        case "ask_already_pending":
+            return "You already asked that person for this, and they have not answered yet. Do not ask again — they were sent one card, and a second ask would page them again for the same decision. Say in the room that the ask is still with them, and carry on with something else.";
+        case "write_verb_out_of_slice":
+            return "That call mutates. Credential grants admit read operations today; a write grant records the owner's name at the vendor on the requester's act, and it needs its own slice.";
+        case "illegal_tool_name":
+            return `That tool name carries no characters a mounted tool name can hold, so the grant could not be named. Name the ${connectorDisplayName(connector)} tool exactly as the connection publishes it.`;
+        case "illegal_connector_id":
+            return `This deployment spells the ${connectorDisplayName(connector)} connector id in a form a mounted tool name cannot hold, so no grant for it can be named. Nothing about the ask was wrong — an operator fixes this, not a retry.`;
+    }
+}
+/** A once-mode grant's TTL. Short: the grant is meant to be spent in the turn that asked for it. */
+const GRANT_ONCE_TTL_MS = 60 * 60 * 1000;
+/** A session-mode grant's TTL. It is scoped to the chat anyway, so the clock is only a backstop. */
+const GRANT_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+/** The ceiling on a standing grant. Standing means standing FOR A NAMED SCOPE: a grant with no ceiling is ambient use wearing a grant's clothes. */
+export const GRANT_STANDING_MAX_MS = 30 * 24 * 60 * 60 * 1000;
+/** When a grant of `mode` minted at `nowMs` expires. `requestedMs` only narrows a standing grant. */
+export function credentialGrantExpiry(mode, nowMs, requestedMs) {
+    const ceiling = mode === "once" ? GRANT_ONCE_TTL_MS : mode === "session" ? GRANT_SESSION_TTL_MS : GRANT_STANDING_MAX_MS;
+    const span = mode === "standing" && typeof requestedMs === "number" && requestedMs > 0 ? Math.min(requestedMs, ceiling) : ceiling;
+    return new Date(nowMs + span).toISOString();
+}
+/** A pending ask's own TTL — minutes-to-hours, and deliberately NOT the grant's. */
+export const GRANT_ASK_TTL_MS = 30 * 60 * 1000;
+/**
+ * The grant row an approved ask mints. Pure: the caller writes it and owns the ids and the clock.
+ *
+ * 🔴 `undefined` MEANS THE MODE MAY NOT BE MINTED AGAINST THIS ASK, AND IT BINDS NOTHING (OPE-2160).
+ * The one case today is a `standing` mode on an ask that carries no domain key: the row would bind to
+ * the asking session and still stamp a 30-day expiry, which is the promise the mechanism cannot keep.
+ * The refusal lives here rather than in the caller because this function is the only thing that
+ * composes the row — a caller that forgot the rule would write the forbidden row, and now it cannot
+ * spell one. `access/credential-grant-flow.ts` refuses the click before the approve CAS, so a row this
+ * function refuses is a case the card never offered.
+ */
+export function credentialGrantFromAsk(ask, fields) {
+    // 🔴 DECIDED FROM THE MODE THE OWNER TAPPED (OPE-1950), never from the requested one: a standing
+    // grant binds to the room's domain-shaped seat key when the ask recorded one, and every other
+    // mode keeps the asking session. The ask carries both keys precisely so this line can choose.
+    // 🔴 AND A `standing` MODE WITH NO KEY REFUSES RATHER THAN FALLING BACK (OPE-2160) — see this
+    // function's own note, and `grantScopeKeyForMode`.
+    const scopeKey = grantScopeKeyForMode(fields.mode, ask.scopeKey, ask.domainScopeKey);
+    if (scopeKey === undefined)
+        return undefined;
+    return {
+        id: fields.grantId,
+        askId: ask.id,
+        requesterPrincipalId: ask.requesterPrincipalId,
+        ownerPrincipalId: ask.ownerPrincipalId,
+        ownerSlug: fields.ownerSlug,
+        connector: ask.connector,
+        verb: ask.verb,
+        resource: ask.resource,
+        // The borrow columns are copied from the ask, never recomputed: the owner answered a card rendered from that row, so re-deriving any of them could mint a grant they never read.
+        ...(ask.mcpTool === undefined ? {} : { mcpTool: ask.mcpTool }),
+        ...(ask.frozenArgs === undefined ? {} : { frozenArgs: ask.frozenArgs }),
+        ...(ask.toolName === undefined ? {} : { toolName: ask.toolName }),
+        ...(fields.inputSchema === undefined ? {} : { inputSchema: fields.inputSchema }),
+        scopeKey,
+        mode: fields.mode,
+        tier: fields.tier,
+        status: "active",
+        purpose: ask.purpose,
+        createdAt: fields.nowIso,
+        expiresAt: fields.expiresAt,
+    };
+}
+//# sourceMappingURL=credential-grant.js.map

package/dist/agent/access/credential-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-grant.js","sourceRoot":"","sources":["../../../agent/access/credential-grant.ts"],"names":[],"mappings":"AAAA,+SAA+S;AAE/S,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAoD,MAAM,4BAA4B,CAAC;AAC/I,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GAKxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAevE,+OAA+O;AAC/O,MAAM,CAAC,MAAM,sBAAsB,GAAmC;IACpE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;CAC5C,CAAC;AAEF,+LAA+L;AAC/L,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,2OAA2O;AAC3O,MAAM,UAAU,2BAA2B,CAAC,OAAkD,EAAE,SAAiB;IAC/G,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4NAA4N;AAC5N,MAAM,UAAU,kCAAkC,CAAC,MAAwB;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,MAAM,IAAI,wDAAwD,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,4EAA4E,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,iCAAiC,SAAS,kBAAkB,CAAC,CAAC;QAC1G,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CACN,MAAM,IAAI,iCAAiC,SAAS,2DAA2D;gBAC7G,0EAA0E;gBAC1E,yFAAyF;gBACzF,oBAAoB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA8CD,gMAAgM;AAChM,MAAM,UAAU,0BAA0B,CAAC,KAAqB;IAC9D,IAAI,CAAC,KAAK,CAAC,qBAAqB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClF,iKAAiK;IACjK,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACnG,oLAAoL;IACpL,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACzG,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAClF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACtF,mKAAmK;IACnK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,8MAA8M;IAC9M,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAMD,+MAA+M;AAC/M,SAAS,WAAW,CAAC,SAAiB,EAAE,MAA4B;IAClE,uMAAuM;IACvM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACzF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,2MAA2M;IAC3M,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC7E,oKAAoK;IACpK,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO;QACL,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/I,EAAE,EAAE,IAAI;QACR,IAAI;KACL,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,UAAU,CAAC,OAAiC;IACnD,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,sGAAsG;AACtG,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,MAAwB,EAAE,SAAiC;IACpH,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,iBAAiB;YACpB,OAAO,2DAA2D,oBAAoB,CAAC,SAAS,CAAC,4EAA4E,CAAC;QAChL,KAAK,sBAAsB;YACzB,OAAO,mJAAmJ,CAAC;QAC7J,KAAK,sBAAsB;YACzB,OAAO,+IAA+I,CAAC;QACzJ,KAAK,oBAAoB;YACvB,OAAO,qLAAqL,CAAC;QAC/L,KAAK,kBAAkB;YACrB,OAAO,wKAAwK,CAAC;QAClL,KAAK,oBAAoB;YACvB,kMAAkM;YAClM,OAAO,yBAAyB,CAAC,SAAS,EAAE,QAAQ,IAAI,MAAM,EAAE;gBAC9D,SAAS;gBACT,iBAAiB,EAAE,SAAS,EAAE,iBAAiB;gBAC/C,SAAS,EAAE,SAAS,EAAE,SAAS;gBAC/B,OAAO,EAAE,SAAS,EAAE,OAAO;gBAC3B,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;gBAC5B,UAAU,EAAE,SAAS,EAAE,UAAU;aAClC,CAAC,CAAC;QACL,KAAK,qBAAqB;YACxB,OAAO,sQAAsQ,CAAC;QAChR,KAAK,yBAAyB;YAC5B,OAAO,4KAA4K,CAAC;QACtL,KAAK,mBAAmB;YACtB,OAAO,gHAAgH,oBAAoB,CAAC,SAAS,CAAC,+CAA+C,CAAC;QACxM,KAAK,sBAAsB;YACzB,OAAO,8BAA8B,oBAAoB,CAAC,SAAS,CAAC,kKAAkK,CAAC;IAC3O,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,oGAAoG;AACpG,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,oJAAoJ;AACpJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9D,qGAAqG;AACrG,MAAM,UAAU,qBAAqB,CAAC,IAAyB,EAAE,KAAa,EAAE,WAAoB;IAClG,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACxH,MAAM,IAAI,GAAG,IAAI,KAAK,UAAU,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClI,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAA0B,EAC1B,MASC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,mDAAmD;IACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO;QAClB,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,iLAAiL;QACjL,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,QAAQ;QACR,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/agent/access/credentials.d.ts

@@ -0,0 +1,41 @@
+import type { Connection, CredentialAuthorizationDetail } from "./bundle.js";
+export declare class CredentialError extends Error {
+}
+/** The audit action every unresolvable credential writes. One name, shared by the db broker's own refusals and the two broker-level ones here; db-broker.ts re-exports it. */
+export declare const CREDENTIAL_UNRESOLVED = "credential.unresolved";
+/** Why a credential did not resolve, as our own classification and never an error message. `no-stored-row` and `reserved-namespace` are the db broker's; `broker-unstamped` and `broker-not-registered` are this module's. */
+export type UnresolvedReason = "no-stored-row" | "reserved-namespace" | "broker-unstamped" | "broker-not-registered";
+/**
+ * The `broker` an unstamped credential is recorded under. There is no broker name to report, and a
+ * blank would read as one — the parentheses make it un-confusable with a registry name (`env`, `db`).
+ */
+export declare const UNSTAMPED_BROKER = "(unstamped)";
+/** A resolved secret plus its lifetime. `expiresAtMs` is absent when the secret has no stated deadline, which is the honest answer for a stored value, and present only when a broker MINTS one; absent means never re-minted. */
+export interface BrokeredSecret {
+    readonly value: string;
+    /** Epoch milliseconds at which the issuer says this value stops working. Absent ⇒ no stated
+     *  deadline (a stored secret; rotate by hand). NEVER a guess — omit it rather than invent one. */
+    readonly expiresAtMs?: number;
+}
+export interface CredentialBroker {
+    /** `authorizationDetails` is the optional down-scoping passthrough handed to every broker; one with no scoping mechanism ignores it. Omitted or undefined must produce the broker's ordinary unscoped grant, unchanged. */
+    getSecret(ref: string, authorizationDetails?: readonly CredentialAuthorizationDetail[]): Promise<string>;
+    /** Implement this only if the broker MINTS short-lived credentials and therefore knows a deadline; leave it out and the seam reports no stated expiry, which is the truth for a stored value. When implemented it is the one resolution path, so the two methods must not disagree about the value. */
+    getSecretWithLifetime?(ref: string, authorizationDetails?: readonly CredentialAuthorizationDetail[]): Promise<BrokeredSecret>;
+}
+/** The built-in env broker: an ordinary registered adapter that ships in core because reading `process.env` needs no SDK, which makes it the zero-wiring floor. */
+export declare const envBroker: CredentialBroker;
+export declare const ENV_BROKER = "env";
+/** Register a credential broker by name; idempotent overwrite. A vendor adapter registers the same way at startup. */
+export declare function registerBroker(name: string, broker: CredentialBroker): void;
+export declare function resetBrokers(): void;
+/** The names of every registered broker. The connector-offer resolver reads it to decide whether an api-key may be pasted in chat: the offer exists iff a host-write-capable broker is registered, independent of any one credential's stamp. */
+export declare function registeredBrokerNames(): readonly string[];
+/** Resolve a broker by its explicit home-broker name. The name is required and there is no default: an unregistered name throws rather than falling back, because a coincidental value from the wrong broker is worse than a clear error. */
+export declare function brokerFor(name: string): CredentialBroker;
+/** Resolve a secret by ref through its credential's explicit home broker. An undefined broker fails closed rather than guessing one, and every per-credential resolution routes through here. */
+export declare function getSecretVia(broker: string | undefined, ref: string, authorizationDetails?: readonly CredentialAuthorizationDetail[]): Promise<string>;
+/** The single resolution path, returning the secret's lifetime; `getSecretVia` is its value-only view. A broker with no `getSecretWithLifetime` resolves through `getSecret` and reports no stated expiry, and both broker-level refusals write their own best-effort audit row without changing the verdict. */
+export declare function getSecretWithLifetimeVia(broker: string | undefined, ref: string, authorizationDetails?: readonly CredentialAuthorizationDetail[]): Promise<BrokeredSecret>;
+export declare function resolveHeaders(conn: Connection): Promise<Record<string, string>>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/agent/access/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../agent/access/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,6BAA6B,EAAgC,MAAM,aAAa,CAAC;AAI3G,qBAAa,eAAgB,SAAQ,KAAK;CAAG;AAE7C,8KAA8K;AAC9K,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,8NAA8N;AAC9N,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,uBAAuB,CAAC;AAErH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAa9C,kOAAkO;AAClO,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;sGACkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,2NAA2N;IAC3N,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,SAAS,6BAA6B,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,uSAAuS;IACvS,qBAAqB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,SAAS,6BAA6B,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/H;AAED,mKAAmK;AACnK,eAAO,MAAM,SAAS,EAAE,gBAMvB,CAAC;AAEF,eAAO,MAAM,UAAU,QAAQ,CAAC;AAKhC,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAE3E;AAID,wBAAgB,YAAY,IAAI,IAAI,CAGnC;AAED,iPAAiP;AACjP,wBAAgB,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAEzD;AAED,6OAA6O;AAC7O,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAUxD;AAED,iMAAiM;AACjM,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,MAAM,EACX,oBAAoB,CAAC,EAAE,SAAS,6BAA6B,EAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,iTAAiT;AACjT,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,MAAM,EACX,oBAAoB,CAAC,EAAE,SAAS,6BAA6B,EAAE,GAC9D,OAAO,CAAC,cAAc,CAAC,CAgBzB;AAoCD,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEtF"}

package/dist/agent/access/credentials.js

@@ -0,0 +1,112 @@
+// Static credential handlers for the EGRESS plane: each type stamps a header from a secret resolved host-side, which never enters the sandbox. Every credential names its ONE home broker; resolution fails closed when that broker is not registered and never substitutes another.
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/binding.js";
+export class CredentialError extends Error {
+}
+/** The audit action every unresolvable credential writes. One name, shared by the db broker's own refusals and the two broker-level ones here; db-broker.ts re-exports it. */
+export const CREDENTIAL_UNRESOLVED = "credential.unresolved";
+/**
+ * The `broker` an unstamped credential is recorded under. There is no broker name to report, and a
+ * blank would read as one — the parentheses make it un-confusable with a registry name (`env`, `db`).
+ */
+export const UNSTAMPED_BROKER = "(unstamped)";
+/** Record one unresolvable credential at the broker seam. The detail carries POINTERS ONLY, the broker, the ref and a fixed reason, never a value, length, prefix, hash or caught error text. Best-effort and silent on failure. */
+async function auditUnresolved(broker, ref, reason) {
+    await appendAudit({
+        org: deploymentOrg(),
+        platform: "credential",
+        workspace: broker,
+        action: CREDENTIAL_UNRESOLVED,
+        detail: { broker, ref, reason },
+    }).catch(() => undefined);
+}
+/** The built-in env broker: an ordinary registered adapter that ships in core because reading `process.env` needs no SDK, which makes it the zero-wiring floor. */
+export const envBroker = {
+    async getSecret(ref) {
+        const v = process.env[ref];
+        if (!v)
+            throw new CredentialError(`secret not found for ref "${ref}" (set env ${ref})`);
+        return v;
+    },
+};
+export const ENV_BROKER = "env";
+// `Object.create(null)` is load-bearing. As a plain object this registry inherited Object.prototype, so a credential stamped `broker: "constructor"` read back a function: the registry answered "registered", no refusal row was written, and the failure arrived as a TypeError every consumer re-throws.
+const BROKERS = Object.create(null);
+/** Register a credential broker by name; idempotent overwrite. A vendor adapter registers the same way at startup. */
+export function registerBroker(name, broker) {
+    BROKERS[name] = broker;
+}
+registerBroker(ENV_BROKER, envBroker);
+export function resetBrokers() {
+    for (const k of Object.keys(BROKERS))
+        delete BROKERS[k];
+    registerBroker(ENV_BROKER, envBroker);
+}
+/** The names of every registered broker. The connector-offer resolver reads it to decide whether an api-key may be pasted in chat: the offer exists iff a host-write-capable broker is registered, independent of any one credential's stamp. */
+export function registeredBrokerNames() {
+    return Object.keys(BROKERS);
+}
+/** Resolve a broker by its explicit home-broker name. The name is required and there is no default: an unregistered name throws rather than falling back, because a coincidental value from the wrong broker is worse than a clear error. */
+export function brokerFor(name) {
+    const broker = BROKERS[name];
+    if (!broker) {
+        throw new CredentialError(`credential home broker "${name}" is not registered — register it at startup ` +
+            `(see @open-everywhere/adapters) or correct the credential's \`broker\` field. ` +
+            `Refusing to fall back to another broker (fail closed).`);
+    }
+    return broker;
+}
+/** Resolve a secret by ref through its credential's explicit home broker. An undefined broker fails closed rather than guessing one, and every per-credential resolution routes through here. */
+export async function getSecretVia(broker, ref, authorizationDetails) {
+    return (await getSecretWithLifetimeVia(broker, ref, authorizationDetails)).value;
+}
+/** The single resolution path, returning the secret's lifetime; `getSecretVia` is its value-only view. A broker with no `getSecretWithLifetime` resolves through `getSecret` and reports no stated expiry, and both broker-level refusals write their own best-effort audit row without changing the verdict. */
+export async function getSecretWithLifetimeVia(broker, ref, authorizationDetails) {
+    // `async` so an undefined/unregistered `broker` (the throws below are SYNCHRONOUS) surfaces as a
+    // REJECTED promise, not a synchronous throw — one consistent failure mode for every caller (await).
+    if (broker === undefined) {
+        await auditUnresolved(UNSTAMPED_BROKER, ref, "broker-unstamped");
+        throw new CredentialError(`no credential broker for ref "${ref}" — every credential must name its home broker ` +
+            `(\`broker: "env" | "db" | ...\`); there is no selected default. Stamp the credential's broker.`);
+    }
+    // The registry read is repeated rather than wrapped: `brokerFor` stays the ONE place that owns the
+    // not-registered refusal text, and it is synchronous, so it cannot await the row itself.
+    if (BROKERS[broker] === undefined)
+        await auditUnresolved(broker, ref, "broker-not-registered");
+    const resolved = brokerFor(broker);
+    if (resolved.getSecretWithLifetime)
+        return resolved.getSecretWithLifetime(ref, authorizationDetails);
+    return { value: await resolved.getSecret(ref, authorizationDetails) };
+}
+/** Resolve secret-valued custom headers (name + optional prefix + secret) through the connection's
+ *  home `broker`. Custom headers ride the same connection as its primary credential, so they
+ *  resolve through the SAME broker — never split across brokers. An undefined `broker` fails closed
+ *  like every other resolution: there is no selected default to fall back to. */
+async function resolveCustomHeaders(headers, broker) {
+    const out = {};
+    for (const h of headers ?? [])
+        out[h.name] = `${h.prefix ?? ""}${await getSecretVia(broker, h.secretRef)}`;
+    return out;
+}
+const HANDLERS = {
+    bearer: async (conn) => ({
+        authorization: `Bearer ${await getSecretVia(conn.broker, conn.secretRef, conn.authorizationDetails)}`,
+        ...(await resolveCustomHeaders(conn.customHeaders, conn.broker)),
+    }),
+    basic: async (conn) => {
+        // secret is expected pre-encoded "user:pass" (base64 done here).
+        const b64 = Buffer.from(await getSecretVia(conn.broker, conn.secretRef, conn.authorizationDetails), "utf-8").toString("base64");
+        return { authorization: `Basic ${b64}`, ...(await resolveCustomHeaders(conn.customHeaders, conn.broker)) };
+    },
+    // GitHub App: a stored installation token behaves as a bearer for the API.
+    // (Minting installation tokens from app id + private key is an OAuth-ish exchange and
+    // belongs to the connector plane; the static path covers a pre-provisioned token.)
+    "github-app": async (conn) => ({
+        authorization: `Bearer ${await getSecretVia(conn.broker, conn.secretRef, conn.authorizationDetails)}`,
+        ...(await resolveCustomHeaders(conn.customHeaders, conn.broker)),
+    }),
+};
+export async function resolveHeaders(conn) {
+    return HANDLERS[conn.credentialType](conn);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/agent/access/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../agent/access/credentials.ts"],"names":[],"mappings":"AAAA,qRAAqR;AAGrR,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAE7C,8KAA8K;AAC9K,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAK7D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,oOAAoO;AACpO,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,GAAW,EAAE,MAAwB;IAClF,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,aAAa,EAAE;QACpB,QAAQ,EAAE,YAAY;QACtB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;KAChC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAiBD,mKAAmK;AACnK,MAAM,CAAC,MAAM,SAAS,GAAqB;IACzC,KAAK,CAAC,SAAS,CAAC,GAAG;QACjB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,GAAG,cAAc,GAAG,GAAG,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAEhC,4SAA4S;AAC5S,MAAM,OAAO,GAAqC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAqC,CAAC;AAE1G,sHAAsH;AACtH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAwB;IACnE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;AACzB,CAAC;AAED,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAEtC,MAAM,UAAU,YAAY;IAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,iPAAiP;AACjP,MAAM,UAAU,qBAAqB;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,6OAA6O;AAC7O,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CACvB,2BAA2B,IAAI,+CAA+C;YAC5E,gFAAgF;YAChF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iMAAiM;AACjM,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,GAAW,EACX,oBAA+D;IAE/D,OAAO,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;AACnF,CAAC;AAED,iTAAiT;AACjT,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA0B,EAC1B,GAAW,EACX,oBAA+D;IAE/D,iGAAiG;IACjG,oGAAoG;IACpG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,eAAe,CAAC,gBAAgB,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACjE,MAAM,IAAI,eAAe,CACvB,iCAAiC,GAAG,iDAAiD;YACnF,gGAAgG,CACnG,CAAC;IACJ,CAAC;IACD,mGAAmG;IACnG,yFAAyF;IACzF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,qBAAqB;QAAE,OAAO,QAAQ,CAAC,qBAAqB,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrG,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;iFAGiF;AACjF,KAAK,UAAU,oBAAoB,CACjC,OAA4C,EAC5C,MAAe;IAEf,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3G,OAAO,GAAG,CAAC;AACb,CAAC;AAID,MAAM,QAAQ,GAAoC;IAChD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,aAAa,EAAE,UAAU,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE;QACrG,GAAG,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;KACjE,CAAC;IACF,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,iEAAiE;QACjE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChI,OAAO,EAAE,aAAa,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7G,CAAC;IACD,2EAA2E;IAC3E,sFAAsF;IACtF,mFAAmF;IACnF,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7B,aAAa,EAAE,UAAU,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE;QACrG,GAAG,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;KACjE,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAgB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC"}

package/dist/agent/access/dated-read.d.ts

@@ -0,0 +1,3 @@
+/** How old `itemAt` was WHEN THE READ RAN, in words. `undefined` when either timestamp is missing or unparseable, or when `itemAt` is stamped after `readAt` (clock skew) — it never guesses. */
+export declare function ageAtRead(itemAt: string | undefined, readAt: string | undefined): string | undefined;
+//# sourceMappingURL=dated-read.d.ts.map

package/dist/agent/access/dated-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dated-read.d.ts","sourceRoot":"","sources":["../../../agent/access/dated-read.ts"],"names":[],"mappings":"AAEA,iMAAiM;AACjM,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAcpG"}

package/dist/agent/access/dated-read.js

@@ -0,0 +1,24 @@
+// One shape for any read that returns a live field beside a history list: stamp when the read ran and age each historical item against it. Measured 2026-08-22 (soak run 3): with both values carrying absolute ISO timestamps the model relayed a 27-minute-old comment as the present, so the CONTRAST is the discriminator, not the timestamp.
+/** How old `itemAt` was WHEN THE READ RAN, in words. `undefined` when either timestamp is missing or unparseable, or when `itemAt` is stamped after `readAt` (clock skew) — it never guesses. */
+export function ageAtRead(itemAt, readAt) {
+    if (!itemAt || !readAt)
+        return undefined;
+    const then = Date.parse(itemAt);
+    const now = Date.parse(readAt);
+    if (!Number.isFinite(then) || !Number.isFinite(now))
+        return undefined;
+    const ms = now - then;
+    if (ms < 0)
+        return undefined;
+    const minutes = Math.floor(ms / 60_000);
+    if (minutes < 1)
+        return "less than a minute";
+    if (minutes < 60)
+        return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24)
+        return `${hours} hour${hours === 1 ? "" : "s"}`;
+    const days = Math.floor(hours / 24);
+    return `${days} day${days === 1 ? "" : "s"}`;
+}
+//# sourceMappingURL=dated-read.js.map

package/dist/agent/access/dated-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dated-read.js","sourceRoot":"","sources":["../../../agent/access/dated-read.ts"],"names":[],"mappings":"AAAA,kVAAkV;AAElV,iMAAiM;AACjM,MAAM,UAAU,SAAS,CAAC,MAA0B,EAAE,MAA0B;IAC9E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC7C,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,GAAG,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/C,CAAC"}

package/dist/agent/access/delegation-flag.d.ts

@@ -0,0 +1,5 @@
+/** True (the DEFAULT since OPE-370) iff this deployment delegates at all. Disarmed ⇒ no seat holds
+ *  eve's built-in `agent`, `spawn_thread_session` never mounts, and the wide-hands kit is
+ *  `["task","native"]`. */
+export declare function oneshotAgentEnabled(): boolean;
+//# sourceMappingURL=delegation-flag.d.ts.map

package/dist/agent/access/delegation-flag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-flag.d.ts","sourceRoot":"","sources":["../../../agent/access/delegation-flag.ts"],"names":[],"mappings":"AAMA;;2BAE2B;AAC3B,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}

package/dist/agent/access/delegation-flag.js

@@ -0,0 +1,10 @@
+// This deployment's single delegation gate, armed by DEFAULT since OPE-370; it gates the native seat verdict, `spawn_thread_session`, the wide-hands kit and the routine fire window. Every consumer must read it LIVE at the point of use — a module-level `const` captures the schema's shipped default and never moves, because ESM evaluates imports before `registerSettings` runs.
+// There is no env override for this flag: a deployment expresses less delegation as a reviewed diff in its own `agent/settings.ts`. `getSettings()` resolves fresh per call, so a DEPLOY that disarms delegation reaches already-standing seats without waiting for them to rotate.
+import { getSettings } from "../settings/settings.js";
+/** True (the DEFAULT since OPE-370) iff this deployment delegates at all. Disarmed ⇒ no seat holds
+ *  eve's built-in `agent`, `spawn_thread_session` never mounts, and the wide-hands kit is
+ *  `["task","native"]`. */
+export function oneshotAgentEnabled() {
+    return getSettings().delegation.oneshotAgent;
+}
+//# sourceMappingURL=delegation-flag.js.map

package/dist/agent/access/delegation-flag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-flag.js","sourceRoot":"","sources":["../../../agent/access/delegation-flag.ts"],"names":[],"mappings":"AAAA,yXAAyX;AAEzX,oRAAoR;AAEpR,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;2BAE2B;AAC3B,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;AAC/C,CAAC"}

package/dist/agent/access/delegation-mount.d.ts

@@ -0,0 +1,6 @@
+import { type BindableContext } from "../identity/binding.js";
+/** The caller's own bare window token: `ctx.channel.continuationToken` (strip eve's `unified:` prefix), falling back to the per-delivery host-stamped `oe_window_token` attribute. The fallback is load-bearing — on a RESUMED standing window seat the continuationToken can be absent at tool-execute time (live-found 2026-07-16) — and `undefined` means neither channel parsed. */
+export declare function resolveOwnWindowToken(ctx: BindableContext): string | undefined;
+/** Can a delegation verb WORK from this seat? The one answer, consulted by the mount predicate AND the prompt render, so a seat is never offered a verb whose wall it cannot pass. Fail-OPEN on an unreadable identity. */
+export declare function canDelegateFromSeat(ctx: BindableContext): boolean;
+//# sourceMappingURL=delegation-mount.d.ts.map

package/dist/agent/access/delegation-mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-mount.d.ts","sourceRoot":"","sources":["../../../agent/access/delegation-mount.ts"],"names":[],"mappings":"AAEA,OAAO,EAA8C,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG1G,wXAAwX;AACxX,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAQ9E;AAED,2NAA2N;AAC3N,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAUjE"}

package/dist/agent/access/delegation-mount.js

@@ -0,0 +1,30 @@
+// Can a delegation verb work from this seat — is there a window token to mint a worker into? FAIL-OPEN: the answer is `false` only when a token is PRESENT and positively not a window token, because a genuine window seat's token can be absent at `session.started`, and the delegation seat verdict stays the enforcing wall. Callers asking "is this a DM?" read `bindFrom(ctx).mode`, never this predicate.
+import { currentWindowToken, isSubagentChildContext } from "../identity/binding.js";
+import { parseWindowToken } from "../channels/window-key.js";
+/** The caller's own bare window token: `ctx.channel.continuationToken` (strip eve's `unified:` prefix), falling back to the per-delivery host-stamped `oe_window_token` attribute. The fallback is load-bearing — on a RESUMED standing window seat the continuationToken can be absent at tool-execute time (live-found 2026-07-16) — and `undefined` means neither channel parsed. */
+export function resolveOwnWindowToken(ctx) {
+    const raw = ctx.channel?.continuationToken;
+    if (typeof raw === "string" && raw.length > 0) {
+        const stripped = raw.startsWith("unified:") ? raw.slice("unified:".length) : raw;
+        if (parseWindowToken(stripped))
+            return stripped;
+    }
+    const stamped = currentWindowToken(ctx);
+    return stamped && parseWindowToken(stamped) ? stamped : undefined;
+}
+/** Can a delegation verb WORK from this seat? The one answer, consulted by the mount predicate AND the prompt render, so a seat is never offered a verb whose wall it cannot pass. Fail-OPEN on an unreadable identity. */
+export function canDelegateFromSeat(ctx) {
+    try {
+        // A subagent child is a LEAF, and only this arm says so. Measured 2026-08-11: a native child's `resolveOwnWindowToken` returns the PARENT's window token verbatim, so without this the child would mint a worker whose completion wakes a conversation that never asked. The fail direction here is deliberately the opposite of the rest of the file — this signal is positive proof, not a degradation, and a positive proof may refuse.
+        if (isSubagentChildContext(ctx))
+            return false;
+        if (resolveOwnWindowToken(ctx))
+            return true;
+        const raw = ctx.channel?.continuationToken;
+        return typeof raw !== "string" || raw.length === 0; // no readable identity at all ⇒ mount (the execute guard protects)
+    }
+    catch {
+        return true; // a throwing identity read is the §S3 degradation, not a "not a window seat" signal
+    }
+}
+//# sourceMappingURL=delegation-mount.js.map

package/dist/agent/access/delegation-mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-mount.js","sourceRoot":"","sources":["../../../agent/access/delegation-mount.ts"],"names":[],"mappings":"AAAA,kZAAkZ;AAElZ,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAwB,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,wXAAwX;AACxX,MAAM,UAAU,qBAAqB,CAAC,GAAoB;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,IAAI,gBAAgB,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IAClD,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,2NAA2N;AAC3N,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,IAAI,CAAC;QACH,2aAA2a;QAC3a,IAAI,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,qBAAqB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC;QAC3C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,mEAAmE;IACzH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,oFAAoF;IACnG,CAAC;AACH,CAAC"}