@open-everywhere/core 0.1.0

package/dist/agent/access/subagent-taint.js

@@ -0,0 +1,175 @@
+// Durable taint markers for eve-native subagent children, in the task-result KV, written at TAINT-MARK time rather than at session end, because the parent resumes the moment the child finalises. The clean claim is put-if-absent and the tainted write an upsert, so the pair is order-independent; the session-keyed read fails OPEN and the call-keyed read fails CLOSED.
+import { getOperationalStore } from "../operational/provider.js";
+import { INGESTION_KINDS } from "./taint-tiers.js";
+/** Key prefix. Namespaced so a marker can never be mistaken for — or collide with — a real one-shot
+ *  task token (those are OE-minted `t/…`-derived nonces; this prefix is not a legal token shape). */
+const MARKER_PREFIX = "oe-subagent-taint:";
+/** How long a marker outlives its child — six hours, so markers cannot accumulate. The bound is the CHILD's lifetime, not the parent's turn: a background settlement reads it on a later turn. */
+const SUBAGENT_TAINT_TTL_MS = 6 * 60 * 60 * 1000;
+/** Keyed by the child's CONTINUATION TOKEN, not its session id: the session id appears on no event the parent's hooks receive, while eve mints the token as `subagent:<parentSessionId>:<callId>`, which both ends derive. */
+export function subagentTaintKey(childToken) {
+    return `${MARKER_PREFIX}${childToken}`;
+}
+/** Record that the child holding `childToken` ingested untrusted content. Idempotent, and never throws. */
+export async function markSubagentTainted(org, childToken) {
+    try {
+        if (childToken.length === 0)
+            return;
+        await getOperationalStore().putTaskResult(org, subagentTaintKey(childToken), JSON.stringify({ tainted: true }), new Date().toISOString(), SUBAGENT_TAINT_TTL_MS);
+    }
+    catch {
+        /* recording is best-effort; the child's own gates are unaffected */
+    }
+}
+/** Did this child taint itself? FALSE for an absent, expired or unreadable marker — the fail-open direction, where the belt degrades and the primary approval control does not. */
+export async function subagentWasTainted(org, childToken) {
+    try {
+        if (childToken.length === 0)
+            return false;
+        const raw = await getOperationalStore().getTaskResult(org, subagentTaintKey(childToken));
+        if (raw === null)
+            return false;
+        const parsed = JSON.parse(raw);
+        return parsed?.tainted === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Key prefix for the OPE-437 call-keyed marker — namespaced separately from {@link MARKER_PREFIX} so
+ *  the two rows for one delegation (one per session id, one per call) can never collide. */
+const CALL_MARKER_PREFIX = "oe-subagent-taint-by-call:";
+/** Keyed by the PARENT's own session id and the callId, never the child's: the parent is the only reader and always holds both, with no dependency on an eve event. */
+export function subagentCallTaintKey(parentSessionId, callId) {
+    return `${CALL_MARKER_PREFIX}${parentSessionId}:${callId}`;
+}
+/** Claim one delegation call as KNOWN-CLEAN, from the child at `turn.started`. PUT-IF-ABSENT, never an upsert: it must not overwrite a `true` the tainted write stored, and the two can be in flight on one tick. */
+export async function claimSubagentCallClean(org, parentSessionId, callId) {
+    try {
+        if (parentSessionId.length === 0 || callId.length === 0)
+            return;
+        await getOperationalStore().putTaskResultIfAbsent(org, subagentCallTaintKey(parentSessionId, callId), JSON.stringify({ tainted: false }), new Date().toISOString(), SUBAGENT_TAINT_TTL_MS);
+    }
+    catch {
+        /* recording is best-effort; see this file's OPE-437 note for the caller's fail-closed posture */
+    }
+}
+/** Record one delegation call as TAINTED — an unconditional upsert, so it wins over the eager clean claim whichever lands first. The repeats carry different payloads on ONE key, so every caller must issue them on hooks/spawn-taint.ts's single queue. */
+export async function markSubagentCallTainted(org, parentSessionId, callId, kinds = []) {
+    try {
+        if (parentSessionId.length === 0 || callId.length === 0)
+            return;
+        await getOperationalStore().putTaskResult(org, subagentCallTaintKey(parentSessionId, callId), JSON.stringify(kinds.length === 0 ? { tainted: true } : { tainted: true, kinds: [...kinds] }), new Date().toISOString(), SUBAGENT_TAINT_TTL_MS);
+    }
+    catch {
+        /* recording is best-effort; see this file's OPE-437 note for the caller's fail-closed posture */
+    }
+}
+// The task-call map: a settlement names the child by `taskId` while the taint marker is keyed by `callId`, so these rows remember the join. It maps taskId to childToken because a continuation mints a new taskId on the same child, and the agent-keyed row pins the FIRST dispatch's token.
+/** Key prefix for the per-continuation task row. Namespaced separately from every marker prefix in
+ *  this file so the rows for one delegation can never be mistaken for each other. */
+const TASK_CALL_PREFIX = "oe-task-call:";
+/** Key prefix for the per-child row pinning the life-stable child token against eve's persistent `agentId`. Written put-if-absent, so the first dispatch's token wins and a continuation reads it back. */
+const TASK_AGENT_PREFIX = "oe-task-agent:";
+/** The store key for one task's row. `taskId` alone is enough: eve derives it from
+ *  `sha256(parentSessionId, parentTurnId, callId)`, so it is unique within the org. */
+export function taskCallKey(taskId) {
+    return `${TASK_CALL_PREFIX}${taskId}`;
+}
+/** The store key for one persistent child's row, scoped by the PARENT's own session id — the parent
+ *  is the only writer and the only reader, exactly as {@link subagentCallTaintKey}. */
+export function taskAgentKey(parentSessionId, agentId) {
+    return `${TASK_AGENT_PREFIX}${parentSessionId}:${agentId}`;
+}
+function parseTaskCallLink(raw) {
+    if (raw === null)
+        return undefined;
+    const parsed = JSON.parse(raw);
+    const callId = parsed?.callId;
+    const childToken = parsed?.childToken;
+    const agentId = parsed?.agentId;
+    const tool = parsed?.tool;
+    if (typeof callId !== "string" || callId.length === 0)
+        return undefined;
+    if (typeof childToken !== "string" || childToken.length === 0)
+        return undefined;
+    // Additive and OPTIONAL, so a row written by an earlier deployment still parses; the two required fields are unchanged.
+    return {
+        callId,
+        childToken,
+        ...(typeof agentId === "string" && agentId.length > 0 ? { agentId } : {}),
+        ...(typeof tool === "string" && tool.length > 0 ? { tool } : {}),
+    };
+}
+/** Record the join for one background-task dispatch. Upsert, and never throws. */
+export async function rememberTaskCall(org, taskId, link) {
+    try {
+        if (taskId.length === 0 || link.callId.length === 0 || link.childToken.length === 0)
+            return;
+        await getOperationalStore().putTaskResult(org, taskCallKey(taskId), JSON.stringify(link), new Date().toISOString(), SUBAGENT_TAINT_TTL_MS);
+    }
+    catch {
+        /* best-effort; a lost row means the settlement read fails CLOSED, which is the safe direction */
+    }
+}
+/** Read the join for one task. `undefined` is the FAIL-CLOSED signal: the caller asks only after a terminal task view proved a child ran, so a missing row can only mean the record was lost. */
+export async function taskCallLink(org, taskId) {
+    try {
+        if (taskId.length === 0)
+            return undefined;
+        return parseTaskCallLink(await getOperationalStore().getTaskResult(org, taskCallKey(taskId)));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Pin the life-stable child token for one persistent `agentId`, on its FIRST dispatch. PUT-IF-ABSENT: a continuation's `callId` is a wrong value for this row, because the child never re-mints its token. */
+export async function rememberTaskAgent(org, parentSessionId, agentId, link) {
+    try {
+        if (parentSessionId.length === 0 || agentId.length === 0 || link.childToken.length === 0)
+            return;
+        await getOperationalStore().putTaskResultIfAbsent(org, taskAgentKey(parentSessionId, agentId), JSON.stringify(link), new Date().toISOString(), SUBAGENT_TAINT_TTL_MS);
+    }
+    catch {
+        /* best-effort; a lost row degrades a continuation to the fail-closed read, never to fail-open */
+    }
+}
+/** Read the pinned first-dispatch join for one persistent `agentId`, or `undefined`. */
+export async function taskAgentLink(org, parentSessionId, agentId) {
+    try {
+        if (parentSessionId.length === 0 || agentId.length === 0)
+            return undefined;
+        return parseTaskCallLink(await getOperationalStore().getTaskResult(org, taskAgentKey(parentSessionId, agentId)));
+    }
+    catch {
+        return undefined;
+    }
+}
+// The forward direction — was the dispatching parent turn tainted — does NOT travel through this store: a read in the child's turn preamble re-runs on redelivery and loses eve's divergence-detector timing bet. It rides the child's opening auth.
+/** The parent-side read. `undefined` means the record was LOST, never "nothing happened": the caller asks only after eve confirmed a child produced a result for this call. */
+export async function subagentCallTaintStatus(org, parentSessionId, callId) {
+    return (await subagentCallTaintRecord(org, parentSessionId, callId))?.tainted;
+}
+/** The parent-side read, whole; same `undefined` contract as the status read. Kinds are ADMITTED on read against INGESTION_KINDS, so an unknown name written by an earlier deployment is dropped rather than carried. */
+export async function subagentCallTaintRecord(org, parentSessionId, callId) {
+    try {
+        if (parentSessionId.length === 0 || callId.length === 0)
+            return undefined;
+        const raw = await getOperationalStore().getTaskResult(org, subagentCallTaintKey(parentSessionId, callId));
+        if (raw === null)
+            return undefined;
+        const parsed = JSON.parse(raw);
+        const tainted = parsed?.tainted;
+        if (typeof tainted !== "boolean")
+            return undefined;
+        const rawKinds = parsed?.kinds;
+        const kinds = Array.isArray(rawKinds)
+            ? rawKinds.filter((k) => typeof k === "string" && INGESTION_KINDS.includes(k))
+            : [];
+        return { tainted, kinds };
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=subagent-taint.js.map

package/dist/agent/access/subagent-taint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-taint.js","sourceRoot":"","sources":["../../../agent/access/subagent-taint.ts"],"names":[],"mappings":"AAAA,+WAA+W;AAE/W,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAsB,MAAM,kBAAkB,CAAC;AAEvE;qGACqG;AACrG,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,kMAAkM;AAClM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,8NAA8N;AAC9N,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,GAAG,aAAa,GAAG,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,UAAkB;IACvE,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,mBAAmB,EAAE,CAAC,aAAa,CACvC,GAAG,EACH,gBAAgB,CAAC,UAAU,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EACjC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,mLAAmL;AACnL,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,UAAkB;IACtE,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAQ,MAAuC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;4FAC4F;AAC5F,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,uKAAuK;AACvK,MAAM,UAAU,oBAAoB,CAAC,eAAuB,EAAE,MAAc;IAC1E,OAAO,GAAG,kBAAkB,GAAG,eAAe,IAAI,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,qNAAqN;AACrN,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAW,EAAE,eAAuB,EAAE,MAAc;IAC/F,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChE,MAAM,mBAAmB,EAAE,CAAC,qBAAqB,CAC/C,GAAG,EACH,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,EAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAClC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;IACnG,CAAC;AACH,CAAC;AAED,6PAA6P;AAC7P,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,eAAuB,EACvB,MAAc,EACd,KAAK,GAAsB,EAAE;IAE7B,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChE,MAAM,mBAAmB,EAAE,CAAC,aAAa,CACvC,GAAG,EACH,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,EAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,EAC7F,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;IACnG,CAAC;AACH,CAAC;AAED,+RAA+R;AAE/R;qFACqF;AACrF,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEzC,2MAA2M;AAC3M,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAK3C;uFACuF;AACvF,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,GAAG,gBAAgB,GAAG,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;uFACuF;AACvF,MAAM,UAAU,YAAY,CAAC,eAAuB,EAAE,OAAe;IACnE,OAAO,GAAG,iBAAiB,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyF,CAAC;IACvH,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,wHAAwH;IACxH,OAAO;QACL,MAAM;QACN,UAAU;QACV,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAc,EAAE,IAAkB;IACpF,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC5F,MAAM,mBAAmB,EAAE,CAAC,aAAa,CACvC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,EACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EACpB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;IACnG,CAAC;AACH,CAAC;AAED,iMAAiM;AACjM,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,MAAc;IAC5D,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,iBAAiB,CAAC,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+MAA+M;AAC/M,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,eAAuB,EAAE,OAAe,EAAE,IAAkB;IAC/G,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjG,MAAM,mBAAmB,EAAE,CAAC,qBAAqB,CAC/C,GAAG,EACH,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EACpB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;IACnG,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,eAAuB,EAAE,OAAe;IACvF,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3E,OAAO,iBAAiB,CAAC,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qPAAqP;AAErP,+KAA+K;AAC/K,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,eAAuB,EACvB,MAAc;IAEd,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;AAChF,CAAC;AAQD,yNAAyN;AACzN,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,eAAuB,EACvB,MAAc;IAEd,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1G,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,OAAO,GAAI,MAAuC,EAAE,OAAO,CAAC;QAClE,IAAI,OAAO,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACnD,MAAM,QAAQ,GAAI,MAAqC,EAAE,KAAK,CAAC;QAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACnC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/agent/access/surface-work-grant.d.ts

@@ -0,0 +1,20 @@
+import { type BindableContext } from "../identity/binding.js";
+import { type Domain } from "../memory/domain.js";
+/** The work role for a CHAT surface, or undefined when the platform's work half is not the conversation. `github` answers undefined by design: its grant is the bundle's `repos:` list, which domainHoldsSurfaceWorkGrant reads instead. */
+export declare function surfaceWorkRole(platform: string): string | undefined;
+export declare const SURFACE_WORK_ROLES: Readonly<Record<string, string>>;
+/** NO FALLBACK: a domain that declares nothing holds nothing, and a surface with no row answers false. GitHub is the one arm that reads the resolved REPO grant rather than the domain, and a caller with none in hand passes none, which answers false. */
+export declare function domainHoldsSurfaceWorkGrant(domain: Domain | undefined, platform: string, repos?: readonly string[]): boolean;
+/** Every platform in the window's SOURCES whose work grant the caller's domain holds. Sources and grant are ANDed, not ORed: a chat-surface work read is container-fenced, so a grant on a platform this window never receives wakes from names no readable container. */
+export declare function surfaceWorkReadPlatforms(ctx: BindableContext, domains: readonly Domain[]): readonly string[];
+/** The MOUNT predicate: absence over refusal, because an ungranted domain must never see a verb it cannot use. The domain list is a THUNK so a mount resolver can run before the app config is registered, and any throw inside is a refusal. */
+export declare function surfaceWorkReadMount(ctx: BindableContext, domains: () => readonly Domain[]): boolean;
+/** Thrown by {@link assertSurfaceWorkGrant}. A distinct class so a call site can audit this refusal
+ *  apart from the topology and origin-fence refusals it also catches. */
+export declare class SurfaceWorkGrantError extends Error {
+    readonly platform: string;
+    constructor(platform: string, message: string);
+}
+/** The PER-TURN half of the gate. The mount asks "any source granted", so on a multi-source window a turn arriving on the UNGRANTED surface must still be refused here. */
+export declare function assertSurfaceWorkGrant(ctx: BindableContext, domains: readonly Domain[], platform: string): void;
+//# sourceMappingURL=surface-work-grant.d.ts.map

package/dist/agent/access/surface-work-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-work-grant.d.ts","sourceRoot":"","sources":["../../../agent/access/surface-work-grant.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAA2B,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3E,4OAA4O;AAC5O,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE/D,CAAC;AAEF,4PAA4P;AAC5P,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,SAAS,MAAM,EAAO,GAC5B,OAAO,CAKT;AAoBD,0QAA0Q;AAC1Q,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAW5G;AAED,iPAAiP;AACjP,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,SAAS,MAAM,EAAE,GAAG,OAAO,CAMpG;AAED;yEACyE;AACzE,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAArC,YAAqB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAErD;CACF;AAED,2KAA2K;AAC3K,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAW/G"}

package/dist/agent/access/surface-work-grant.js

@@ -0,0 +1,84 @@
+// A domain's `Domain.credentials` work-role declaration IS the chat-surface work grant; GitHub is the exception, because its grant is the access bundle's `repos:` list and it holds no `WORK_ROLES` row. The enforcement that is real here is the MOUNT plus the read adapter's per-surface domain allowlist — the work role usually names the same vendor secret the chat route uses.
+import { containerWorkRoleFor, hasWorkGrant, hasGithubWorkGrant, GITHUB_CONNECTOR, WORK_ROLES } from "./work-grant.js";
+import { resolveAccessFor } from "./request.js";
+import { resolveWindowSources } from "../identity/binding.js";
+import { resolveDomainForChannel } from "../memory/domain.js";
+import { resolvePartition } from "../memory/partition.js";
+/** The work role for a CHAT surface, or undefined when the platform's work half is not the conversation. `github` answers undefined by design: its grant is the bundle's `repos:` list, which domainHoldsSurfaceWorkGrant reads instead. */
+export function surfaceWorkRole(platform) {
+    return containerWorkRoleFor(platform);
+}
+export const SURFACE_WORK_ROLES = Object.freeze(Object.fromEntries(WORK_ROLES.filter((w) => w.kind === "container").map((w) => [w.connector, w.role])));
+/** NO FALLBACK: a domain that declares nothing holds nothing, and a surface with no row answers false. GitHub is the one arm that reads the resolved REPO grant rather than the domain, and a caller with none in hand passes none, which answers false. */
+export function domainHoldsSurfaceWorkGrant(domain, platform, repos = []) {
+    if (platform === GITHUB_CONNECTOR)
+        return hasGithubWorkGrant(repos);
+    const role = surfaceWorkRole(platform);
+    if (!role)
+        return false;
+    return hasWorkGrant(domain, platform, role);
+}
+/** Resolves the caller's own domain the same way work-destinations.ts does, so a gate and a fence can never disagree. FAIL CLOSED, SILENTLY: an identity-less ctx answers no domain. */
+function callerDomain(ctx, domains) {
+    try {
+        return resolveDomainForChannel(resolvePartition(ctx).surfaceKey, domains).domain;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** This session's resolved REPO grant, read for the calling scope. FAIL CLOSED TO NONE: an unreadable config means the work read does not mount — the opposite posture from `githubWorkMount`, which guards addressable tools whose own execute fence refuses an ungranted repo. */
+function callerRepos(ctx) {
+    try {
+        return resolveAccessFor(ctx).repos;
+    }
+    catch {
+        return [];
+    }
+}
+/** Every platform in the window's SOURCES whose work grant the caller's domain holds. Sources and grant are ANDed, not ORed: a chat-surface work read is container-fenced, so a grant on a platform this window never receives wakes from names no readable container. */
+export function surfaceWorkReadPlatforms(ctx, domains) {
+    const domain = callerDomain(ctx, domains);
+    let sources;
+    try {
+        sources = resolveWindowSources(ctx, domains);
+    }
+    catch {
+        return [];
+    }
+    // An unresolved domain is deliberately NOT an early return: every credential-declared surface already answers false, and GitHub reads the repo grant, so returning early would refuse a session that genuinely holds the grant.
+    const repos = callerRepos(ctx);
+    return sources.filter((platform) => domainHoldsSurfaceWorkGrant(domain, platform, repos));
+}
+/** The MOUNT predicate: absence over refusal, because an ungranted domain must never see a verb it cannot use. The domain list is a THUNK so a mount resolver can run before the app config is registered, and any throw inside is a refusal. */
+export function surfaceWorkReadMount(ctx, domains) {
+    try {
+        return surfaceWorkReadPlatforms(ctx, domains()).length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Thrown by {@link assertSurfaceWorkGrant}. A distinct class so a call site can audit this refusal
+ *  apart from the topology and origin-fence refusals it also catches. */
+export class SurfaceWorkGrantError extends Error {
+    platform;
+    constructor(platform, message) {
+        super(message);
+        this.platform = platform;
+    }
+}
+/** The PER-TURN half of the gate. The mount asks "any source granted", so on a multi-source window a turn arriving on the UNGRANTED surface must still be refused here. */
+export function assertSurfaceWorkGrant(ctx, domains, platform) {
+    if (domainHoldsSurfaceWorkGrant(callerDomain(ctx, domains), platform, callerRepos(ctx)))
+        return;
+    // The REMEDY differs because the DECLARATION differs: a chat surface's grant is a
+    // `Domain.credentials` role, GitHub's is the access bundle's `repos:` list. Naming the wrong one
+    // sends an operator to edit a file that decides nothing.
+    const remedy = platform === GITHUB_CONNECTOR
+        ? "grant this scope at least one repo in its access bundle's `repos:` to read github on the work plane."
+        : `declare the ${platform} work role ("${surfaceWorkRole(platform) ?? "<none>"}") in its ` +
+            `\`credentials\` to read ${platform} on the work plane.`;
+    throw new SurfaceWorkGrantError(platform, `work read: this domain holds no ${platform} work grant — ${remedy}`);
+}
+//# sourceMappingURL=surface-work-grant.js.map

package/dist/agent/access/surface-work-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-work-grant.js","sourceRoot":"","sources":["../../../agent/access/surface-work-grant.ts"],"names":[],"mappings":"AAAA,wXAAwX;AAExX,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAwB,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAe,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,4OAA4O;AAC5O,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAqC,MAAM,CAAC,MAAM,CAC/E,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACvG,CAAC;AAEF,4PAA4P;AAC5P,MAAM,UAAU,2BAA2B,CACzC,MAA0B,EAC1B,QAAgB,EAChB,KAAK,GAAsB,EAAE;IAE7B,IAAI,QAAQ,KAAK,gBAAgB;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,wLAAwL;AACxL,SAAS,YAAY,CAAC,GAAoB,EAAE,OAA0B;IACpE,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oRAAoR;AACpR,SAAS,WAAW,CAAC,GAAoB;IACvC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0QAA0Q;AAC1Q,MAAM,UAAU,wBAAwB,CAAC,GAAoB,EAAE,OAA0B;IACvF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,gOAAgO;IAChO,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,2BAA2B,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,iPAAiP;AACjP,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,OAAgC;IACzF,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACzB,QAAQ;IAA7B,YAAqB,QAAgB,EAAE,OAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;wBADI,QAAQ;IAE7B,CAAC;CACF;AAED,2KAA2K;AAC3K,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,OAA0B,EAAE,QAAgB;IACvG,IAAI,2BAA2B,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO;IAChG,kFAAkF;IAClF,iGAAiG;IACjG,yDAAyD;IACzD,MAAM,MAAM,GACV,QAAQ,KAAK,gBAAgB;QAC3B,CAAC,CAAC,sGAAsG;QACxG,CAAC,CAAC,eAAe,QAAQ,gBAAgB,eAAe,CAAC,QAAQ,CAAC,IAAI,QAAQ,YAAY;YACxF,2BAA2B,QAAQ,qBAAqB,CAAC;IAC/D,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,mCAAmC,QAAQ,iBAAiB,MAAM,EAAE,CAAC,CAAC;AAClH,CAAC"}

package/dist/agent/access/taint-enforcement.d.ts

@@ -0,0 +1,46 @@
+import { type IngestionSource, type IngestionVerdict } from "./taint-tiers.js";
+import { type TaintTierMode as SettingsTaintTierMode, type TaintMode } from "../settings/settings.js";
+/** Whether the table DECIDES (enforced) or merely observes (dryrun). The vocabulary is declared once, in the settings schema. */
+export type TaintTierMode = SettingsTaintTierMode;
+export type { TaintMode };
+/** Does this deployment run the tainted-turn model? `on` is the shipped default (OPE-399). */
+export declare function taintMode(): TaintMode;
+/** Per call, never cached: getSettings resolves fresh, so a test can flip it mid-process without a module reload. There is no env path to this answer. */
+export declare function taintEnabled(): boolean;
+/** Per call, never cached — a module-load constant would need a rebuild to revert, which is the opposite of a kill switch. `enforce`, `enforced` and unset mean enforced; EVERYTHING else, typos included, means dryrun, which restores the over-tainting behaviour so a misspelling can only ever fail toward more marking. */
+export declare function taintTierMode(): TaintTierMode;
+/** One divergence, as the sink receives it. Names and verdicts ONLY — never ingested content, the
+ *  same hard rule every audit detail in this repo carries. */
+export interface TaintVerdictRow {
+    /** `over-taint` (the site's own call taints, the table says trusted) / `under-taint` (the reverse)
+     *  / `assumed` (the two agree, but only via the fail-closed default). */
+    readonly divergence: "over-taint" | "under-taint" | "assumed";
+    readonly kind: IngestionSource["kind"];
+    /** A taint-clean label the site supplied — a tool or connector NAME, never content. */
+    readonly label?: string;
+    /** Which world wrote this row. `enforced` ⇒ the table decided (subject to `applied`); `dryrun` ⇒
+     *  the kill switch is set and the site's own call decided, exactly as before OPE-324. */
+    readonly mode: TaintTierMode;
+    /** Did the table's verdict decide the live taint here? True only for an ENFORCED site that would otherwise have tainted, so an over-taint row with applied true says the mark was not set. It is false for every under-taint row, every dryrun row, and every render-time declarer. */
+    readonly applied: boolean;
+    /** What the SITE's own pre-flip call does, read as an EFFECT rather than as a call. At a render-time site the two come apart: the render runs where the taint half no-ops, so what decides the reader's turn is whether a seeded auth attribute rides the delivery. */
+    readonly taintsToday: boolean;
+    /** What the TABLE says. Under `mode: enforced` with `applied: true`, this IS the live decision. */
+    readonly tableTier: IngestionVerdict["tier"];
+    /** True when the table reached that tier via the fail-closed default, not via real metadata. */
+    readonly assumed: boolean;
+    readonly reason: string;
+}
+type Sink = (row: TaintVerdictRow) => void;
+/** Install the sink that persists a divergence. Called once at module load by hooks/spawn-taint.ts —
+ *  see this file's header for why it is injected rather than imported. Idempotent by overwrite. */
+export declare function registerTaintVerdictSink(fn: Sink | null): void;
+/** Test seam: the currently installed sink, so a test can save/restore it without guessing. */
+export declare function currentTaintVerdictSink(): Sink | null;
+/** Drops the dedupe memo at the turn boundary, keyed on the eve turn id so a re-entered turn keeps its memo. It differs from the taint signal's reset in one arm: an UNREADABLE turn id CLEARS here, because the unsafe failure of an observer is silence while the unsafe failure of the signal is a lost mark. It is a LOG boundary only and must never reach decideIngestion's answer. */
+export declare function beginTaintVerdictTurn(turnId: string | undefined): void;
+/** `siteWouldTaint` is the CEILING, not decoration: enforced answers it AND the table's untrusted verdict, dryrun answers it alone, so this never mints a mark the site did not already have. It NEVER throws and its failure answer is siteWouldTaint, and an undeclared site keeps its own call verbatim and writes no row. */
+export declare function decideIngestion(src: IngestionSource | undefined, siteWouldTaint: boolean): boolean;
+/** Records what the table said for a site that decides its own taint anyway — the render-time declarers and the fence-only GitHub seams. Rows from here always carry applied false, and it never throws and never changes behaviour. */
+export declare function noteIngestionVerdict(src: IngestionSource | undefined, taintsToday: boolean): void;
+//# sourceMappingURL=taint-enforcement.d.ts.map

package/dist/agent/access/taint-enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-enforcement.d.ts","sourceRoot":"","sources":["../../../agent/access/taint-enforcement.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAe,KAAK,aAAa,IAAI,qBAAqB,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEnH,iIAAiI;AACjI,MAAM,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAElD,YAAY,EAAE,SAAS,EAAE,CAAC;AAI1B,8FAA8F;AAC9F,wBAAgB,SAAS,IAAI,SAAS,CAErC;AAED,0JAA0J;AAC1J,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED,gUAAgU;AAChU,wBAAgB,aAAa,IAAI,aAAa,CAE7C;AAED;8DAC8D;AAC9D,MAAM,WAAW,eAAe;IAC9B;6EACyE;IACzE,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;6FACyF;IACzF,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uRAAuR;IACvR,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uQAAuQ;IACvQ,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,mGAAmG;IACnG,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC7C,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,KAAK,IAAI,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,IAAI,CAAC;AAI3C;mGACmG;AACnG,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAE9D;AAED,+FAA+F;AAC/F,wBAAgB,uBAAuB,IAAI,IAAI,GAAG,IAAI,CAErD;AAwBD,6XAA6X;AAC7X,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAUtE;AAkBD,iUAAiU;AACjU,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,SAAS,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAmBlG;AAED,wOAAwO;AACxO,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,IAAI,CAQjG"}

package/dist/agent/access/taint-enforcement.js

@@ -0,0 +1,141 @@
+// The reviewed source-tier table DECIDES whether an ingestion marks the turn, and enforcement is RELAXATION-ONLY by ruling: a site that does not taint today never starts, so decideIngestion(src, false) is false for every kind, forever. The kill switch taint.tierMode restores each site's own pre-flip call, and every unrecognised value falls to dryrun because that is the over-tainting direction.
+import { defineState } from "eve/context";
+import { classifyIngestion } from "./taint-tiers.js";
+import { getSettings } from "../settings/settings.js";
+// taint.mode and taint.tierMode are different questions: tierMode asks HOW a mark is decided and both its values still mark, while mode asks whether the tainted-turn model runs at all. Turning it off costs the gate sinks their ask-floor, the provenance disclosure, the durable memory mark and the delegation withdrawal, but it does NOT touch the fence, whose envelope and defang ride every ingested body in both modes.
+/** Does this deployment run the tainted-turn model? `on` is the shipped default (OPE-399). */
+export function taintMode() {
+    return getSettings().taint.mode;
+}
+/** Per call, never cached: getSettings resolves fresh, so a test can flip it mid-process without a module reload. There is no env path to this answer. */
+export function taintEnabled() {
+    return taintMode() !== "off";
+}
+/** Per call, never cached — a module-load constant would need a rebuild to revert, which is the opposite of a kill switch. `enforce`, `enforced` and unset mean enforced; EVERYTHING else, typos included, means dryrun, which restores the over-tainting behaviour so a misspelling can only ever fail toward more marking. */
+export function taintTierMode() {
+    return getSettings().taint.tierMode;
+}
+let sink = null;
+/** Install the sink that persists a divergence. Called once at module load by hooks/spawn-taint.ts —
+ *  see this file's header for why it is injected rather than imported. Idempotent by overwrite. */
+export function registerTaintVerdictSink(fn) {
+    sink = fn;
+}
+/** Test seam: the currently installed sink, so a test can save/restore it without guessing. */
+export function currentTaintVerdictSink() {
+    return sink;
+}
+const seen = defineState("open-everywhere.taint-dryrun-seen", () => ({ keys: [] }));
+/** Read defensively: the slot key is unchanged from when it held a bare string array, so a session resumed across either deploy hands one back. A legacy list is honoured as the CURRENT turn's keys, so the next provable boundary clears it. */
+function readSeen(v) {
+    if (Array.isArray(v))
+        return { keys: v.filter((k) => typeof k === "string") };
+    if (typeof v === "object" && v !== null && "keys" in v) {
+        const s = v;
+        return {
+            turn: typeof s.turn === "string" ? s.turn : undefined,
+            keys: Array.isArray(s.keys) ? s.keys.filter((k) => typeof k === "string") : [],
+        };
+    }
+    return { keys: [] };
+}
+/** Drops the dedupe memo at the turn boundary, keyed on the eve turn id so a re-entered turn keeps its memo. It differs from the taint signal's reset in one arm: an UNREADABLE turn id CLEARS here, because the unsafe failure of an observer is silence while the unsafe failure of the signal is a lost mark. It is a LOG boundary only and must never reach decideIngestion's answer. */
+export function beginTaintVerdictTurn(turnId) {
+    try {
+        seen.update((cur) => {
+            const state = readSeen(cur);
+            if (turnId !== undefined && state.turn === turnId)
+                return state; // same turn re-entered ⇒ keep the memo
+            return { ...(turnId !== undefined ? { turn: turnId } : {}), keys: [] };
+        });
+    }
+    catch {
+        /* no session context here — nothing to reset, and never a reason to disturb the turn */
+    }
+}
+/** Has this turn already reported this (kind, divergence)? Fail-soft: no context ⇒ never deduped. */
+function firstThisTurn(key) {
+    try {
+        let fresh = false;
+        seen.update((cur) => {
+            const state = readSeen(cur);
+            if (state.keys.includes(key))
+                return state;
+            fresh = true;
+            return { ...state, keys: [...state.keys, key] };
+        });
+        return fresh;
+    }
+    catch {
+        return true;
+    }
+}
+/** `siteWouldTaint` is the CEILING, not decoration: enforced answers it AND the table's untrusted verdict, dryrun answers it alone, so this never mints a mark the site did not already have. It NEVER throws and its failure answer is siteWouldTaint, and an undeclared site keeps its own call verbatim and writes no row. */
+export function decideIngestion(src, siteWouldTaint) {
+    // The master switch runs BEFORE the undeclared-site arm, and the order is the point: an undeclared site is the one that taints unconditionally, so checking later would leave every ungoverned site still marking on a taint-off deployment. No row is written either, because a divergence log about a dead control would misread as an armed one.
+    if (!taintEnabled())
+        return false;
+    if (src === undefined)
+        return siteWouldTaint;
+    try {
+        const mode = taintTierMode();
+        const verdict = classifyIngestion(src);
+        const wouldTaint = verdict.tier === "untrusted";
+        // The table governs only where the site had a mark to give up. `applied` is the honest record of
+        // that, and it is what a reader of the log uses to tell "we relaxed this" from "we noticed this".
+        const applied = mode === "enforced" && siteWouldTaint;
+        const decision = applied ? wouldTaint : siteWouldTaint;
+        // The row is written LAST and behind noteRow's own catch, so an exploding sink cannot reach `decision`. With the sink call inside this try, a throwing log fell through to the fallback and silently resurrected a mark the table had dropped.
+        noteRow(src, verdict, { mode, applied, siteWouldTaint });
+        return decision;
+    }
+    catch {
+        /* the table must never disturb the read it governs — fall back to the site's own call */
+        return siteWouldTaint;
+    }
+}
+/** Records what the table said for a site that decides its own taint anyway — the render-time declarers and the fence-only GitHub seams. Rows from here always carry applied false, and it never throws and never changes behaviour. */
+export function noteIngestionVerdict(src, taintsToday) {
+    if (!taintEnabled())
+        return; // OPE-399 — no live model, nothing to observe against
+    if (src === undefined)
+        return;
+    try {
+        noteRow(src, classifyIngestion(src), { mode: taintTierMode(), applied: false, siteWouldTaint: taintsToday });
+    }
+    catch {
+        /* an observer must never disturb the read it is observing */
+    }
+}
+/** Silent when site and table agree on REAL metadata, so the log stays short enough to read. TOTALLY SWALLOWING: everything from the dedupe read to the sink call runs inside this catch, so no failure of the log can propagate into decideIngestion's answer. */
+function noteRow(src, verdict, ctx) {
+    try {
+        const wouldTaint = verdict.tier === "untrusted";
+        const divergence = ctx.siteWouldTaint && !wouldTaint
+            ? "over-taint"
+            : !ctx.siteWouldTaint && wouldTaint
+                ? "under-taint"
+                : verdict.assumed
+                    ? "assumed"
+                    : null;
+        if (divergence === null)
+            return; // site and table agree on real metadata — the boring case
+        if (!firstThisTurn(`${src.kind}:${divergence}`))
+            return;
+        sink?.({
+            divergence,
+            kind: src.kind,
+            ...(src.label !== undefined ? { label: src.label } : {}),
+            mode: ctx.mode,
+            applied: ctx.applied,
+            taintsToday: ctx.siteWouldTaint,
+            tableTier: verdict.tier,
+            assumed: verdict.assumed,
+            reason: verdict.reason,
+        });
+    }
+    catch {
+        /* the log must never disturb the read it observes, nor the verdict that governs it */
+    }
+}
+//# sourceMappingURL=taint-enforcement.js.map

package/dist/agent/access/taint-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-enforcement.js","sourceRoot":"","sources":["../../../agent/access/taint-enforcement.ts"],"names":[],"mappings":"AAAA,6YAA6Y;AAE7Y,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAA+C,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,WAAW,EAA+D,MAAM,yBAAyB,CAAC;AAOnH,maAAma;AAEna,8FAA8F;AAC9F,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,0JAA0J;AAC1J,MAAM,UAAU,YAAY;IAC1B,OAAO,SAAS,EAAE,KAAK,KAAK,CAAC;AAC/B,CAAC;AAED,gUAAgU;AAChU,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;AACtC,CAAC;AA2BD,IAAI,IAAI,GAAgB,IAAI,CAAC;AAE7B;mGACmG;AACnG,MAAM,UAAU,wBAAwB,CAAC,EAAe;IACtD,IAAI,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,IAAI,GAAG,WAAW,CAAc,mCAAmC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEjG,kPAAkP;AAClP,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;IAC3F,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAK,CAA6B,EAAE,CAAC;QACpF,MAAM,CAAC,GAAG,CAAuC,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACrD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC5F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,6XAA6X;AAC7X,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;YACxG,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iUAAiU;AACjU,MAAM,UAAU,eAAe,CAAC,GAAgC,EAAE,cAAuB;IACvF,oVAAoV;IACpV,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC;QAChD,iGAAiG;QACjG,kGAAkG;QAClG,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,IAAI,cAAc,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;QACvD,+OAA+O;QAC/O,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;QACzF,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAED,wOAAwO;AACxO,MAAM,UAAU,oBAAoB,CAAC,GAAgC,EAAE,WAAoB;IACzF,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,CAAC,sDAAsD;IACnF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/G,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED,mQAAmQ;AACnQ,SAAS,OAAO,CACd,GAAoB,EACpB,OAAyB,EACzB,GAAuE;IAEvE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC;QAChD,MAAM,UAAU,GACd,GAAG,CAAC,cAAc,IAAI,CAAC,UAAU;YAC/B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU;gBACjC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,OAAO,CAAC,OAAO;oBACf,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,IAAI,CAAC;QACf,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,CAAC,0DAA0D;QAC3F,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAAE,OAAO;QACxD,IAAI,EAAE,CAAC;YACL,UAAU;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,cAAc;YAC/B,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;IACxF,CAAC;AACH,CAAC"}

package/dist/agent/access/taint-signal.d.ts

@@ -0,0 +1,100 @@
+import type { IngestionKind } from "./taint-tiers.js";
+import type { WakeTrust } from "../channels/wake-envelope.js";
+import { type AuthorTrustQuery } from "../identity/author-trust.js";
+/** Clears the signal at a turn boundary, called exactly once and first from the turn.started hook. An undefined turn id is not an error: the boundary cannot be proven, so the slot keeps what it had. */
+export declare function beginTaintTurn(turnId: string | undefined): void;
+/** Marks that this turn ingested untrusted content, optionally naming the class of source, which is disclosure material and decides nothing. Called on every wrap, because wrapping stops structural breakout and not semantic injection, and it takes no turn id: it writes into whatever turn the boundary last established. */
+export declare function markUntrustedIngestedThisTurn(kind?: IngestionKind): void;
+type TaintFlipObserver = () => void;
+/**
+ * Observe the moment THIS turn's taint bit goes false → true. Registered once at module load by
+ * hooks/spawn-taint.ts. Observers are side-effect-only and must never throw to the ingestion path —
+ * {@link notifyTaintFlipped} swallows anything they raise, because a failure to record a taint fact
+ * may not be allowed to fail the read that produced it (the approval-card control is primary).
+ */
+export declare function registerTaintFlipObserver(observer: TaintFlipObserver): void;
+type TaintKindObserver = () => void;
+/**
+ * Observe the moment THIS turn's kind list GROWS — including the first kind of the turn, which also
+ * fires the flip seam. Registered once at module load by hooks/spawn-taint.ts. Same swallowing
+ * contract as {@link registerTaintFlipObserver}, and the same reason for it.
+ */
+export declare function registerTaintKindObserver(observer: TaintKindObserver): void;
+/** Did this turn ingest untrusted external content? The bit is marking, not gating: it changes a verdict only at the gate-tier sinks, where it floors the decision to ask. Fail-soft, so no session context reads false. */
+export declare function untrustedIngestedThisTurn(): boolean;
+/** Would a mark here actually land? The render-time ingestion sites call this instead of hardcoding false, so a render path that ever ran in-turn shows up as an over-taint row rather than a premise nobody re-checks. It reads the slot and never creates state. */
+export declare function taintMarkLands(): boolean;
+/**
+ * WHICH classes of source this turn ingested, for disclosure (OPE-307). Ordered first-seen,
+ * deduped, and DELIBERATELY ALLOWED TO BE EMPTY on a tainted turn — the auth-attribute seeds mark
+ * without a kind, so an empty list means "no breakdown", never "clean". Always read alongside
+ * {@link untrustedIngestedThisTurn}, never instead of it. Fail-soft: no session context → empty.
+ */
+export declare function taintKindsThisTurn(): readonly string[];
+/** Auth attribute marking a TRIGGERED FIRE whose opening prompt carries untrusted external content.
+ *  Host-set at dispatch, model-unforgeable (see channels/unified-window.ts §AUTH-ATTRIBUTE
+ *  PROVENANCE), and consumed by hooks/spawn-taint.ts at `turn.started`. */
+export declare const OE_TAINTED_FIRE_ATTR = "oe_tainted_fire";
+/** Positive-only: an untainted fire gets an empty bag, so nothing has to reason about a false string. The tainted flag is the caller's own judgement, and a config webhook always renders its raw body wrapped while an event fire is tainted unless the delivery was redacted. */
+export declare function taintedFireAttrs(tainted: boolean): Record<string, string>;
+/** Auth attribute marking a chat wake whose ingested content includes a message written by an author
+ *  the surface's identity gate could not vouch as a member. Host-set at the wake dispatch,
+ *  model-unforgeable (see channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE), and consumed by
+ *  hooks/spawn-taint.ts at `turn.started`. */
+export declare const OE_CHAT_NONMEMBER_ATTR = "oe_chat_nonmember";
+/**
+ * The attribute fragment a chat wake spreads into the woken session's auth bag. POSITIVE-ONLY, for
+ * the same reason as {@link taintedFireAttrs}: a member-only wake gets `{}`, so its bag is
+ * byte-identical to before this existed and nothing has to reason about a `"false"` string.
+ *
+ * `nonMember` is the JOIN the dispatching surface computes — see {@link nonMemberChatTrust}.
+ */
+export declare function nonMemberChatAttrs(nonMember: boolean): Record<string, string>;
+/** One ingested message, as the join reads it: the resolved per-message tier, plus the surface's
+ *  POSITIVE refutation of its author. See {@link nonMemberChatTrust} for why both are needed. */
+export interface IngestedChatMessage {
+    readonly trust?: WakeTrust;
+    /**
+     * The surface POSITIVELY refuted this author's membership — `users.info` said guest/stranger,
+     * `member.pending` said screening-incomplete, Entra said `userType: "guest"`. `false` and absent
+     * both mean "not refuted", which includes "the probe could not answer": absence of evidence is
+     * never evidence, and this leg fails OPEN.
+     */
+    readonly refuted?: boolean;
+    /** The author-trust register's answer for this message's author, which is the OPERATOR's refutation where refuted is the SURFACE's. Absent, or present on an unarmed tenant, contributes nothing: silence is never a declaration, and both directions fail open. */
+    readonly authorTrust?: AuthorTrustQuery;
+    /**
+     * THIS MESSAGE'S AUTHOR WAS NEVER GRADED (OPE-1747) — set only where that is a POSITIVE fact about the message, not a missing probe: today, a persisted session-tail row written before the row shape carried `refuted` at all (channels/session-tail.ts).
+     * 🔴 IT IS THE WITHHOLD GRAIN'S INPUT ALONE, AND THE TAINT JOIN NEVER READS IT. {@link nonMemberChatTrust} fails OPEN by design — "absence of evidence is never evidence" — so an ungraded row must not mark a turn, or every old row would start marking. `withholdsBody` (access/external-policy.ts) is the opposite question, asked by a deployment that DECLARED non-member bytes must not reach the model, and there UNKNOWN is the fail-closed answer: it withholds. Keeping the two answers on one field is what lets the shipped `taint` grain stay byte-identical while the `withhold` grain fails closed.
+     */
+    readonly ungraded?: boolean;
+}
+/** Marks only on a positive refutation, never on bare unauth, which is a three-way disjunction that once made every human-authored turn on an undeclared guild mark. The two sources of refutation are the surface's verdict and the operator's register, and a relay machine author is deliberately excluded. */
+export declare function nonMemberChatTrust(m: IngestedChatMessage): boolean;
+/** The operator's declaration for the room a chat wake fires on, and the keys it is read at. */
+export interface ChatWakeRoom {
+    /**
+     * The DOMAIN-grain surface key of the room (`platform/tenant/surface`) — the container an operator
+     * actually declares, which is the channel rather than a thread inside it. Absent ⇒ the room leg
+     * cannot resolve and contributes nothing (fail-open, like every other carriage leg here).
+     */
+    readonly surfaceKey?: string;
+    /** The GROUP-rung key when the platform has one (Teams' `teams/<tenant>/team:<id>`). */
+    readonly groupKey?: string;
+    /**
+     * This wake is a DM or group DM. DMs are OUT of scope for the `public` tier: on a DM the trust
+     * plane asks about the PARTNER, not about the room, so a room declaration means something else
+     * there. A DM contributes NO room leg and is judged by its author leg alone.
+     */
+    readonly dm?: boolean;
+}
+/** A room declared public marks, a room declared internal does not, and an undeclared room follows the taint.undeclaredSurface setting, shipped clean. Undeclared is never read as public: silence means the operator has not declared, not that the room is open to the world. */
+export declare function chatRoomMarks(room: ChatWakeRoom): boolean;
+/** The join over one wake: the room leg, then the author leg over every ingested message. The two are additive and neither subsumes the other, because the room gates audience and the register gates authority, and an entry the surface could not grade contributes nothing. */
+export declare function chatWakeIngestsNonMember(ingested: readonly IngestedChatMessage[], room: ChatWakeRoom): boolean;
+/** Stamps the carriage onto the delivery auth when either leg says yes, returning the input auth by reference when neither does. The room argument is required rather than optional, because a call site that silently lost the room leg would lose the entire trust statement on Discord and Notion. */
+export declare function stampNonMemberChatAuth<A extends {
+    attributes?: Record<string, unknown>;
+}>(auth: A, ingested: readonly IngestedChatMessage[], room: ChatWakeRoom): A;
+export {};
+//# sourceMappingURL=taint-signal.d.ts.map

package/dist/agent/access/taint-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-signal.d.ts","sourceRoot":"","sources":["../../../agent/access/taint-signal.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAS9D,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAiC7F,0MAA0M;AAC1M,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAW/D;AAED,kUAAkU;AAClU,wBAAgB,6BAA6B,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,IAAI,CA8BxE;AAID,KAAK,iBAAiB,GAAG,MAAM,IAAI,CAAC;AAIpC;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAE3E;AAcD,KAAK,iBAAiB,GAAG,MAAM,IAAI,CAAC;AAIpC;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAE3E;AAYD,4NAA4N;AAC5N,wBAAgB,yBAAyB,IAAI,OAAO,CAOnD;AAED,sQAAsQ;AACtQ,wBAAgB,cAAc,IAAI,OAAO,CAOxC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,MAAM,EAAE,CAOtD;AAID;;2EAE2E;AAC3E,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD,mRAAmR;AACnR,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE;AAID;;;8CAG8C;AAC9C,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7E;AAED;iGACiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,oQAAoQ;IACpQ,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAOD,kTAAkT;AAClT,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,mBAAmB,GAAG,OAAO,CASlE;AAED,gGAAgG;AAChG,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,mRAAmR;AACnR,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAYzD;AAED,kRAAkR;AAClR,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAE9G;AAED,ySAAyS;AACzS,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACvF,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,SAAS,mBAAmB,EAAE,EACxC,IAAI,EAAE,YAAY,GACjB,CAAC,CAGH"}