@open-everywhere/core 0.1.0

package/dist/agent/approvals/card-venue.d.ts

@@ -0,0 +1,55 @@
+import { type Domain } from "../memory/domain.js";
+import { type Partition } from "../memory/partition.js";
+import type { SurfaceBinding } from "../identity/binding.js";
+import { type PriorRejection } from "./flow.js";
+import { type CardDisclosureDeps } from "./card-disclosure.js";
+/** A resolved place to post an approval card. */
+export interface ApprovalVenue {
+    /** The platform whose CardPoster renders + posts it (drives approvalPostDeps). */
+    readonly platform: string;
+    /** The channel id the card is posted into (PendingActionRow.channelId). */
+    readonly channelId: string;
+    /** Fully-qualified `platform/workspace/surface` of that channel — the pending's `postedTo`. */
+    readonly surfaceKey: string;
+    /** Is this the room the request came from? False ⇒ the caller MUST say where the card went. */
+    readonly sameRoom: boolean;
+}
+/** Why no venue could be resolved — carried so the refusal can name the config to change. */
+export interface ApprovalVenueRefusal {
+    readonly reason: "no-domain" | "no-card-channel"
+    /** The domain has card-capable channels and every one of them positively floors to `guest`. Only {@link checkApprovalVenue} can produce it, because the pure walk cannot see a floor. */
+     | "no-internal-card-channel";
+    readonly domain?: string;
+}
+export type ApprovalVenueResult = {
+    readonly venue: ApprovalVenue;
+} | {
+    readonly refusal: ApprovalVenueRefusal;
+};
+/** Resolve the venue, PURE: this room if it can host a card, else the first card-capable channel of its explicit domain in declaration order, else a refusal naming what to add. FLOOR-BLIND, so {@link checkApprovalVenue} is the production entry; a channel in no explicit domain gets no venue. */
+export declare function approvalVenueFor(binding: SurfaceBinding, partition: Partition, 
+/** LAZY on purpose: the overwhelmingly common path (a Slack or Discord room hosting its own card)
+ *  returns before this is called, so `create_routine` on a card-capable surface reads no config at
+ *  all and stays exactly as cheap — and as test-constructible — as it was before OPE-148. */
+loadDomains: () => readonly Domain[]): ApprovalVenueResult;
+/** The floor-aware venue: a REDIRECT candidate whose audience floor positively resolves to `guest` is skipped and the walk continues. The own room is deliberately not floor-checked, because redirecting out of it would launder external provenance into an internal approval room, and this never replaces the propose-time gate. */
+export declare function checkApprovalVenue(binding: SurfaceBinding, partition: Partition, loadDomains: () => readonly Domain[], deps?: CardDisclosureDeps): Promise<ApprovalVenueResult>;
+/** The refusal a caller shows a human — it names the exact config change, never just the blockage. `action` is the verb in the reader's own terms, and it defaults to create_routine's original wording. */
+export declare function describeVenueRefusal(refusal: ApprovalVenueRefusal, platform: string, action?: string): string;
+/** `card posted` — or `card posted in <venue>` when it landed somewhere else. */
+export declare function cardPostedPrefix(venue: ApprovalVenue): string;
+/** The trailing instruction a REDIRECTED card owes the model, or "" when the card is in this room. It addresses the MODEL because the tool result is the only channel through which "your confirmation is in another room" reaches a human here. */
+export declare function describeVenueRedirect(venue: ApprovalVenue, whatNext: string): string;
+/** The fixed sentence every card-path result carries (OPE-2071). The decision wake goes to the OWNING conversation session, never to the proposing call, so a proposer that waits for an answer, or calls again to get one, waits for nothing. */
+export declare const PROPOSER_DECISION_NOTE: string;
+/** The line a result carries when a person rejected the same proposal inside the approval TTL. It informs and never blocks: a second human ask must still get its card. */
+export declare function describePriorRejection(prior: PriorRejection): string;
+/** The proposer's tail for a POSTED card: the fixed decision note, then the prior-reject line when there is one. {@link cardPostedTail} adds the venue redirect; a tool with no venue calls this directly. */
+export declare function proposerTail(posted: {
+    readonly priorRejection?: PriorRejection;
+}): string;
+/** THE ONE TAIL of every card-path tool result: the venue redirect (empty in the same room), then {@link proposerTail}. `posted` is required, so a tool cannot build a card-path result without the decision note. */
+export declare function cardPostedTail(venue: ApprovalVenue, whatNext: string, posted: {
+    readonly priorRejection?: PriorRejection;
+}): string;
+//# sourceMappingURL=card-venue.d.ts.map

package/dist/agent/approvals/card-venue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-venue.d.ts","sourceRoot":"","sources":["../../../agent/approvals/card-venue.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkC,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EACX,WAAW,GACX,iBAAiB;IACnB,yLAAyL;OACvL,0BAA0B,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,mBAAmB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjH,uSAAuS;AACvS,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,SAAS;AACpB;;6FAE6F;AAC7F,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,GACnC,mBAAmB,CAOrB;AA8BD,wUAAwU;AACxU,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAY9B;AAED,4MAA4M;AAC5M,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAgB,GAAG,MAAM,CAkBpH;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAE7D;AAED,oPAAoP;AACpP,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,kPAAkP;AAClP,eAAO,MAAM,sBAAsB,QAE4G,CAAC;AAEhJ,2KAA2K;AAC3K,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAKpE;AAED,8MAA8M;AAC9M,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;CAAE,GAAG,MAAM,CAEzF;AAED,sNAAsN;AACtN,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;CAAE,GAAG,MAAM,CAEnI"}

package/dist/agent/approvals/card-venue.js

@@ -0,0 +1,106 @@
+// Where an approval card goes when the asking room cannot host one: a card-capable room in the SAME domain, never outside it, with every input host-derived. Redirecting AWAY from a guest-floored room that CAN host a card is not licensed here — that stays a refusal.
+import { domainForChannel, domainRoster } from "../memory/domain.js";
+import { domainKeyOf } from "../memory/partition.js";
+import { postedToSurfaceKey } from "./flow.js";
+import { checkCardDisclosure } from "./card-disclosure.js";
+import { hasApprovalCardPath } from "../tools/set_spend_limit.js";
+/** Resolve the venue, PURE: this room if it can host a card, else the first card-capable channel of its explicit domain in declaration order, else a refusal naming what to add. FLOOR-BLIND, so {@link checkApprovalVenue} is the production entry; a channel in no explicit domain gets no venue. */
+export function approvalVenueFor(binding, partition, 
+/** LAZY on purpose: the overwhelmingly common path (a Slack or Discord room hosting its own card)
+ *  returns before this is called, so `create_routine` on a card-capable surface reads no config at
+ *  all and stays exactly as cheap — and as test-constructible — as it was before OPE-148. */
+loadDomains) {
+    const own = ownRoomVenue(binding);
+    if (own)
+        return { venue: own };
+    const candidates = inDomainVenues(partition, loadDomains);
+    if ("refusal" in candidates)
+        return candidates;
+    const first = candidates.venues[0];
+    return first ? { venue: first } : { refusal: { reason: "no-card-channel", domain: candidates.domain } };
+}
+/** Step 1 of the order above, extracted so the pure walk and {@link checkApprovalVenue} cannot
+ *  disagree about what "this room can host its own card" means. */
+function ownRoomVenue(binding) {
+    const ownChannelId = typeof binding.target?.["channelId"] === "string" ? binding.target["channelId"] : undefined;
+    if (!hasApprovalCardPath(binding.platform) || !ownChannelId)
+        return undefined;
+    return { platform: binding.platform, channelId: ownChannelId, surfaceKey: postedToSurfaceKey(binding, ownChannelId), sameRoom: true };
+}
+/** Step 2: EVERY card-capable channel in this room's explicit domain, in declaration order. It enumerates rather than short-circuiting because the operator's first-listed channel can itself be externally shared, and a redirect that stops there just moves the leak. */
+function inDomainVenues(partition, loadDomains) {
+    const domain = domainForChannel(domainKeyOf(partition), loadDomains());
+    if (!domain)
+        return { refusal: { reason: "no-domain" } };
+    const venues = [];
+    for (const ch of domainRoster(domain)) {
+        const segs = ch.split("/");
+        // A card-capable surfaceKey's THIRD segment is literally the channel id, which is the only reason a configured key can become a poster target with no binding. That holds for exactly the platforms `hasApprovalCardPath` admits, so the check stays inside the loop.
+        if (segs.length !== 3)
+            continue;
+        const platform = segs[0];
+        const channelId = segs[2];
+        if (channelId.length === 0 || !hasApprovalCardPath(platform))
+            continue;
+        venues.push({ platform, channelId, surfaceKey: ch, sameRoom: false });
+    }
+    return { venues, domain: domain.name };
+}
+/** The floor-aware venue: a REDIRECT candidate whose audience floor positively resolves to `guest` is skipped and the walk continues. The own room is deliberately not floor-checked, because redirecting out of it would launder external provenance into an internal approval room, and this never replaces the propose-time gate. */
+export async function checkApprovalVenue(binding, partition, loadDomains, deps = {}) {
+    const own = ownRoomVenue(binding);
+    if (own)
+        return { venue: own };
+    const candidates = inDomainVenues(partition, loadDomains);
+    if ("refusal" in candidates)
+        return candidates;
+    for (const venue of candidates.venues) {
+        if ((await checkCardDisclosure(venue.surfaceKey, deps)).ok)
+            return { venue };
+    }
+    // Which refusal depends on whether there was anything to reject: an empty candidate list means the domain has no card path at all, and a wholly-rejected one means every card path it has is shared outside the org.
+    return {
+        refusal: { reason: candidates.venues.length === 0 ? "no-card-channel" : "no-internal-card-channel", domain: candidates.domain },
+    };
+}
+/** The refusal a caller shows a human — it names the exact config change, never just the blockage. `action` is the verb in the reader's own terms, and it defaults to create_routine's original wording. */
+export function describeVenueRefusal(refusal, platform, action = "set that up") {
+    if (refusal.reason === "no-domain") {
+        return (`I can't ${action} from here: "${platform}" has no approval-card path, and this channel isn't in an explicit domain, so there's nowhere in-domain to put the card a human has to click. ` +
+            `Add this channel to a domain (agent/memory/config/domains/<name>.ts) that also contains a Slack or Discord channel, or ask me in one of those channels.`);
+    }
+    if (refusal.reason === "no-internal-card-channel") {
+        // Deliberately does NOT say "ask somewhere that isn't shared": the reader is not standing in the offending room, and the shared room was chosen by domain config on their behalf. It names no channel id either — the domain is the smallest handle that unblocks them.
+        return (`I can't ${action} from here: "${platform}" has no approval-card path, so the card has to go to a Slack or Discord channel in domain "${refusal.domain}" — and every one of those is shared outside your org (or has an observed guest), so an approval card there would spell out exactly what would execute to people outside it. ` +
+            `Add an internal Slack or Discord channel to "${refusal.domain}".reach (agent/memory/config/domains/<name>.ts), or stop sharing the one that's there, and I'll use it.`);
+    }
+    return (`I can't ${action} from here: "${platform}" has no approval-card path, and domain "${refusal.domain}" has no Slack or Discord channel to put the card in. ` +
+        `Add one to "${refusal.domain}".reach (agent/memory/config/domains/<name>.ts), or ask me from a Slack or Discord channel.`);
+}
+/** `card posted` — or `card posted in <venue>` when it landed somewhere else. */
+export function cardPostedPrefix(venue) {
+    return venue.sameRoom ? "card posted" : `card posted in ${venue.surfaceKey}`;
+}
+/** The trailing instruction a REDIRECTED card owes the model, or "" when the card is in this room. It addresses the MODEL because the tool result is the only channel through which "your confirmation is in another room" reaches a human here. */
+export function describeVenueRedirect(venue, whatNext) {
+    if (venue.sameRoom)
+        return "";
+    return ` This surface can't host an approval card, so it went to the card-capable channel in this domain — tell the user where it is, by name, and that someone there has to ${whatNext}.`;
+}
+/** The fixed sentence every card-path result carries (OPE-2071). The decision wake goes to the OWNING conversation session, never to the proposing call, so a proposer that waits for an answer, or calls again to get one, waits for nothing. */
+export const PROPOSER_DECISION_NOTE = " The card is with the approvers. Their decision goes to the owning conversation session, not to this call. " +
+    "Do not call again for the same change: a repeat while the card is undecided returns this same pending id. Report the pending id and finish.";
+/** The line a result carries when a person rejected the same proposal inside the approval TTL. It informs and never blocks: a second human ask must still get its card. */
+export function describePriorRejection(prior) {
+    return (` The same proposal was REJECTED by ${prior.decidedBy} at ${prior.decidedAt}. This card stands only if a person asked again. ` +
+        `If you are retrying on your own, stop and report the rejection.`);
+}
+/** The proposer's tail for a POSTED card: the fixed decision note, then the prior-reject line when there is one. {@link cardPostedTail} adds the venue redirect; a tool with no venue calls this directly. */
+export function proposerTail(posted) {
+    return PROPOSER_DECISION_NOTE + (posted.priorRejection !== undefined ? describePriorRejection(posted.priorRejection) : "");
+}
+/** THE ONE TAIL of every card-path tool result: the venue redirect (empty in the same room), then {@link proposerTail}. `posted` is required, so a tool cannot build a card-path result without the decision note. */
+export function cardPostedTail(venue, whatNext, posted) {
+    return describeVenueRedirect(venue, whatNext) + proposerTail(posted);
+}
+//# sourceMappingURL=card-venue.js.map

package/dist/agent/approvals/card-venue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-venue.js","sourceRoot":"","sources":["../../../agent/approvals/card-venue.ts"],"names":[],"mappings":"AAAA,0QAA0Q;AAE1Q,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAA2B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AA0BlE,uSAAuS;AACvS,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,SAAoB;AACpB;;6FAE6F;AAC7F,WAAoC;IAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,SAAS,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1G,CAAC;AAED;mEACmE;AACnE,SAAS,YAAY,CAAC,OAAuB;IAC3C,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7H,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxI,CAAC;AAED,4QAA4Q;AAC5Q,SAAS,cAAc,CACrB,SAAoB,EACpB,WAAoC;IAEpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;IACzD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,sQAAsQ;QACtQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wUAAwU;AACxU,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,SAAoB,EACpB,WAAoC,EACpC,IAAI,GAAuB,EAAE;IAE7B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,SAAS,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IACD,qNAAqN;IACrN,OAAO;QACL,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,0BAA0B,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;KAChI,CAAC;AACJ,CAAC;AAED,4MAA4M;AAC5M,MAAM,UAAU,oBAAoB,CAAC,OAA6B,EAAE,QAAgB,EAAE,MAAM,GAAG,aAAa;IAC1G,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CACL,WAAW,MAAM,gBAAgB,QAAQ,gJAAgJ;YACzL,yJAAyJ,CAC1J,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAClD,wQAAwQ;QACxQ,OAAO,CACL,WAAW,MAAM,gBAAgB,QAAQ,+FAA+F,OAAO,CAAC,MAAM,+KAA+K;YACrU,gDAAgD,OAAO,CAAC,MAAM,yGAAyG,CACxK,CAAC;IACJ,CAAC;IACD,OAAO,CACL,WAAW,MAAM,gBAAgB,QAAQ,4CAA4C,OAAO,CAAC,MAAM,wDAAwD;QAC3J,eAAe,OAAO,CAAC,MAAM,6FAA6F,CAC3H,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,KAAoB;IACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,UAAU,EAAE,CAAC;AAC/E,CAAC;AAED,oPAAoP;AACpP,MAAM,UAAU,qBAAqB,CAAC,KAAoB,EAAE,QAAgB;IAC1E,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,wKAAwK,QAAQ,GAAG,CAAC;AAC7L,CAAC;AAED,kPAAkP;AAClP,MAAM,CAAC,MAAM,sBAAsB,GACjC,6GAA6G;IAC7G,6IAA6I,CAAC;AAEhJ,2KAA2K;AAC3K,MAAM,UAAU,sBAAsB,CAAC,KAAqB;IAC1D,OAAO,CACL,sCAAsC,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,SAAS,mDAAmD;QAC9H,iEAAiE,CAClE,CAAC;AACJ,CAAC;AAED,8MAA8M;AAC9M,MAAM,UAAU,YAAY,CAAC,MAAoD;IAC/E,OAAO,sBAAsB,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED,sNAAsN;AACtN,MAAM,UAAU,cAAc,CAAC,KAAoB,EAAE,QAAgB,EAAE,MAAoD;IACzH,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC"}

package/dist/agent/approvals/card.d.ts

@@ -0,0 +1,23 @@
+import type { PendingActionRow } from "./types.js";
+export interface SlackBlock {
+    readonly type: string;
+    readonly [key: string]: unknown;
+}
+/** A rendered card: the `blocks` payload plus Slack's required plain-text `text` fallback
+ *  (used for notifications/accessibility when a client can't render blocks). */
+export interface RenderedCard {
+    readonly blocks: readonly SlackBlock[];
+    readonly text: string;
+}
+/** `value` on every button is the org, because the click handler needs the org BEFORE it can look up the row and Slack's block_actions payload has nowhere else to carry it; the id rides in the action_id. */
+export declare function pendingCardBlocks(row: PendingActionRow, summaryLines: readonly string[]): RenderedCard;
+/** The notice for an act the armed judge lifted, which posts no card — its single button writes the `approval.judge.contradicted` row a reviewer reads. NOT an approval card: no Approve, no Reject, no expiry line, because the act is already done and this is a review surface. */
+export declare function judgeLiftNoticeBlocks(row: PendingActionRow, summaryLines: readonly string[], outcomeLine: string): RenderedCard;
+/**
+ * The judge-lift notice for a room that cannot carry a BUTTON — every surface whose bundle registers no notice poster and that is not Slack (Teams, GitHub, Linear, Notion today).
+ * 🔴 IT IS THE SAME NOTICE, NOT A LESSER ONE. The act already ran and nobody was asked, so the trace is the whole point; only the affordance differs. Where the tap is missing the instruction is spelled out instead, and it names ONLY routes that exist — `row.id` is the id a reviewer finds the act by in the audit trail, and the operator disarm is the one verb that stops the judge lifting the next act. It must never promise a tap, a reply keyword or a command this deployment does not route: a member told to press something that is not there is exactly the silence this render replaces.
+ */
+export declare function judgeLiftNoticeText(row: PendingActionRow, summaryLines: readonly string[], outcomeLine: string): string;
+/** The card once a decision has landed: the same summary, with the actions block replaced by one context line. It decides nothing — it renders whatever the caller already CAS-decided. */
+export declare function decidedCardBlocks(row: PendingActionRow, summaryLines: readonly string[], outcomeLine: string): RenderedCard;
+//# sourceMappingURL=card.d.ts.map

package/dist/agent/approvals/card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../../../agent/approvals/card.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAMnD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;gFACgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAcD,+MAA+M;AAC/M,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAmCtG;AAED,sRAAsR;AACtR,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAqB/H;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAOvH;AAED,2LAA2L;AAC3L,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAY3H"}

package/dist/agent/approvals/card.js

@@ -0,0 +1,99 @@
+// Pure Block Kit renderers — no I/O, nothing async — because the security property is that the card is a CODE-RENDERED view of the FROZEN args, never model text. `SlackBlock` is a deliberately loose structural type; Block Kit has no first-party types in this repo.
+import { grantButtonLabel, sessionGrantKind } from "./session-grant.js";
+// Duplicated from flow.ts's `OE_APPROVAL_PREFIX` rather than imported, to keep this file a leaf; approvals-test.ts pins that the two stay in sync.
+const APPROVAL_PREFIX = "oe_approval:";
+function headerBlock(kind) {
+    return { type: "header", text: { type: "plain_text", text: `Approval requested: ${kind}`, emoji: true } };
+}
+function summarySection(summaryLines) {
+    return { type: "section", text: { type: "mrkdwn", text: summaryLines.join("\n") } };
+}
+function contextBlock(text) {
+    return { type: "context", elements: [{ type: "mrkdwn", text }] };
+}
+/** `value` on every button is the org, because the click handler needs the org BEFORE it can look up the row and Slack's block_actions payload has nowhere else to carry it; the id rides in the action_id. */
+export function pendingCardBlocks(row, summaryLines) {
+    const requestedContext = `Requested by <@${row.requestedBy}> · expires ${row.expiresAt}`;
+    const elements = [
+        {
+            type: "button",
+            style: "primary",
+            text: { type: "plain_text", text: "Approve", emoji: true },
+            action_id: `${APPROVAL_PREFIX}approve:${row.id}`,
+            value: row.org,
+        },
+    ];
+    // sessionGrantKind() is the ONE predicate for the middle button, and it grants for `pr.open` alone — every other kind stays two-button per call. Old cards carry no third button, and the click grammar still parses them.
+    if (sessionGrantKind(row) !== null) {
+        elements.push({
+            type: "button",
+            // Only the LABEL differs on a routine fire's card: a permission minted there is keyed on the routine and outlives every session, so a "for session" label would make the card lie about what the click does.
+            text: { type: "plain_text", text: grantButtonLabel(row), emoji: true },
+            action_id: `${APPROVAL_PREFIX}approve_session:${row.id}`,
+            value: row.org,
+        });
+    }
+    elements.push({
+        type: "button",
+        style: "danger",
+        text: { type: "plain_text", text: "Reject", emoji: true },
+        action_id: `${APPROVAL_PREFIX}reject:${row.id}`,
+        value: row.org,
+    });
+    const blocks = [
+        headerBlock(row.kind),
+        summarySection(summaryLines),
+        contextBlock(requestedContext),
+        { type: "actions", block_id: `oe_approval_actions:${row.id}`, elements },
+    ];
+    return { blocks, text: `Approval requested: ${row.kind}\n${summaryLines.join(" · ")}\n${requestedContext}` };
+}
+/** The notice for an act the armed judge lifted, which posts no card — its single button writes the `approval.judge.contradicted` row a reviewer reads. NOT an approval card: no Approve, no Reject, no expiry line, because the act is already done and this is a review surface. */
+export function judgeLiftNoticeBlocks(row, summaryLines, outcomeLine) {
+    const context = `⚡ Auto-approved by the approval judge — no card was posted and this has already run · ${outcomeLine}`;
+    const blocks = [
+        { type: "header", text: { type: "plain_text", text: `Ran without asking: ${row.kind}`, emoji: true } },
+        summarySection(summaryLines),
+        contextBlock(context),
+        {
+            type: "actions",
+            block_id: `oe_approval_actions:${row.id}`,
+            elements: [
+                {
+                    type: "button",
+                    style: "danger",
+                    text: { type: "plain_text", text: "This should not have run", emoji: true },
+                    action_id: `${APPROVAL_PREFIX}contradict:${row.id}`,
+                    value: row.org,
+                },
+            ],
+        },
+    ];
+    return { blocks, text: `Ran without asking: ${row.kind}\n${summaryLines.join(" · ")}\n${context}` };
+}
+/**
+ * The judge-lift notice for a room that cannot carry a BUTTON — every surface whose bundle registers no notice poster and that is not Slack (Teams, GitHub, Linear, Notion today).
+ * 🔴 IT IS THE SAME NOTICE, NOT A LESSER ONE. The act already ran and nobody was asked, so the trace is the whole point; only the affordance differs. Where the tap is missing the instruction is spelled out instead, and it names ONLY routes that exist — `row.id` is the id a reviewer finds the act by in the audit trail, and the operator disarm is the one verb that stops the judge lifting the next act. It must never promise a tap, a reply keyword or a command this deployment does not route: a member told to press something that is not there is exactly the silence this render replaces.
+ */
+export function judgeLiftNoticeText(row, summaryLines, outcomeLine) {
+    return [
+        `Ran without asking: ${row.kind}`,
+        ...summaryLines,
+        `⚡ Auto-approved by the approval judge — no card was posted and this has already run · ${outcomeLine}`,
+        `This surface cannot carry the "This should not have run" button, so there is nothing to tap here. If it should not have run, say so in this conversation and quote action ${row.id} — that is the id the act is recorded under in the audit trail. An operator stops the judge lifting further acts from the control plane.`,
+    ].join("\n");
+}
+/** The card once a decision has landed: the same summary, with the actions block replaced by one context line. It decides nothing — it renders whatever the caller already CAS-decided. */
+export function decidedCardBlocks(row, summaryLines, outcomeLine) {
+    const decidedContext = row.status === "approved"
+        ? `✅ Approved by <@${row.decidedBy}> · ${outcomeLine}`
+        : row.status === "rejected"
+            ? // A kind whose DECLINE is itself durable returns a line saying what the decline recorded
+                // (approvals/types.ts ActionKind.declined). Every other kind's reject passes the literal
+                // "rejected" and renders byte-for-byte what it always did.
+                `❌ Rejected by <@${row.decidedBy}>${outcomeLine === "rejected" ? "" : ` · ${outcomeLine}`}`
+            : "⏰ Expired";
+    const blocks = [headerBlock(row.kind), summarySection(summaryLines), contextBlock(decidedContext)];
+    return { blocks, text: `Approval requested: ${row.kind}\n${summaryLines.join(" · ")}\n${decidedContext}` };
+}
+//# sourceMappingURL=card.js.map

package/dist/agent/approvals/card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../../../agent/approvals/card.ts"],"names":[],"mappings":"AAAA,yQAAyQ;AAGzQ,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAExE,mJAAmJ;AACnJ,MAAM,eAAe,GAAG,cAAc,CAAC;AAcvC,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;AAC5G,CAAC;AAED,SAAS,cAAc,CAAC,YAA+B;IACrD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,+MAA+M;AAC/M,MAAM,UAAU,iBAAiB,CAAC,GAAqB,EAAE,YAA+B;IACtF,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,CAAC,WAAW,eAAe,GAAG,CAAC,SAAS,EAAE,CAAC;IACzF,MAAM,QAAQ,GAAiB;QAC7B;YACE,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;YAC1D,SAAS,EAAE,GAAG,eAAe,WAAW,GAAG,CAAC,EAAE,EAAE;YAChD,KAAK,EAAE,GAAG,CAAC,GAAG;SACf;KACF,CAAC;IACF,2NAA2N;IAC3N,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,6MAA6M;YAC7M,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;YACtE,SAAS,EAAE,GAAG,eAAe,mBAAmB,GAAG,CAAC,EAAE,EAAE;YACxD,KAAK,EAAE,GAAG,CAAC,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;QACzD,SAAS,EAAE,GAAG,eAAe,UAAU,GAAG,CAAC,EAAE,EAAE;QAC/C,KAAK,EAAE,GAAG,CAAC,GAAG;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAiB;QAC3B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QACrB,cAAc,CAAC,YAAY,CAAC;QAC5B,YAAY,CAAC,gBAAgB,CAAC;QAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,uBAAuB,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;KACzE,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,gBAAgB,EAAE,EAAE,CAAC;AAC/G,CAAC;AAED,sRAAsR;AACtR,MAAM,UAAU,qBAAqB,CAAC,GAAqB,EAAE,YAA+B,EAAE,WAAmB;IAC/G,MAAM,OAAO,GAAG,yFAAyF,WAAW,EAAE,CAAC;IACvH,MAAM,MAAM,GAAiB;QAC3B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtG,cAAc,CAAC,YAAY,CAAC;QAC5B,YAAY,CAAC,OAAO,CAAC;QACrB;YACE,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,uBAAuB,GAAG,CAAC,EAAE,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,QAAQ;oBACf,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,IAAI,EAAE;oBAC3E,SAAS,EAAE,GAAG,eAAe,cAAc,GAAG,CAAC,EAAE,EAAE;oBACnD,KAAK,EAAE,GAAG,CAAC,GAAG;iBACf;aACF;SACF;KACF,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,EAAE,CAAC;AACtG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAqB,EAAE,YAA+B,EAAE,WAAmB;IAC7G,OAAO;QACL,uBAAuB,GAAG,CAAC,IAAI,EAAE;QACjC,GAAG,YAAY;QACf,yFAAyF,WAAW,EAAE;QACtG,6KAA6K,GAAG,CAAC,EAAE,0IAA0I;KAC9T,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,2LAA2L;AAC3L,MAAM,UAAU,iBAAiB,CAAC,GAAqB,EAAE,YAA+B,EAAE,WAAmB;IAC3G,MAAM,cAAc,GAClB,GAAG,CAAC,MAAM,KAAK,UAAU;QACvB,CAAC,CAAC,mBAAmB,GAAG,CAAC,SAAS,OAAO,WAAW,EAAE;QACtD,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU;YACzB,CAAC,CAAC,yFAAyF;gBACzF,yFAAyF;gBACzF,2DAA2D;gBAC3D,mBAAmB,GAAG,CAAC,SAAS,IAAI,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,EAAE;YAC7F,CAAC,CAAC,WAAW,CAAC;IACpB,MAAM,MAAM,GAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;IACjH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,EAAE,CAAC;AAC7G,CAAC"}

package/dist/agent/approvals/chat-dm.d.ts

@@ -0,0 +1,19 @@
+export interface ChatDmArgs {
+    readonly org: string;
+    readonly scopeKey: string;
+    /** The RECIPIENT's platform — chooses the transport at decide time. */
+    readonly platform: string;
+    /** The recipient's bare platform member id — what `deliverDirectMessage` takes. */
+    readonly principalId: string;
+    /** The ARN-like address the grant named — the audit row's "which config line allowed this". */
+    readonly grant: string;
+    /** The model's message. Rendered in FULL on the card, because the card is the injection gate. */
+    readonly text: string;
+    /** The HOST-authored attribution + stop line, frozen at propose time. Rendered on the card too, so
+     *  the approver sees exactly what the recipient will see — including how they can stop it. */
+    readonly footer: string;
+    readonly requestedBy: string;
+    /** Proposing turn ingested untrusted content — reviewer-scrutiny flag, never auto-reject. */
+    readonly tainted?: boolean;
+}
+//# sourceMappingURL=chat-dm.d.ts.map

package/dist/agent/approvals/chat-dm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-dm.d.ts","sourceRoot":"","sources":["../../../agent/approvals/chat-dm.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;kGAC8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B"}

package/dist/agent/approvals/chat-dm.js

@@ -0,0 +1,41 @@
+// This kind is reached ONCE PER PERSON, not once per message: the card gates the FIRST proactive DM to somebody and every later one flows, so never describe tier P2 as carded without saying "the first one". After that first message the model's bytes reach a person with no reviewer between. Everything the delivery needs is FROZEN at propose, because there is no ctx at decide time, and the kind is not session-grantable.
+import { deliverProactiveDm } from "../channels/dm-audience.js";
+import { registerActionKind, whereFromScope } from "./actions.js";
+/** The card body. The recipient AND the full text AND the footer, because the card is the injection
+ *  gate and because an approver must be able to check the stop line is really there. */
+function summarizeDm(args) {
+    const lines = [
+        `Start a direct message with ${args.platform} person ${args.principalId} (granted by ${args.grant})`,
+        args.text,
+        `They will also see: ${args.footer.trim()}`,
+        "Approving this also lets later messages to this person go without a card. They can stop it from their own DM at any time.",
+    ];
+    if (args.tainted)
+        lines.push("⚠ proposed in a turn that read external content — review before approving");
+    return lines;
+}
+const chatDm = {
+    kind: "chat.dm",
+    policy: "member",
+    summarize: summarizeDm,
+    async execute(args, decidedBy) {
+        // ONE delivery path, shared with the flowing arm; `first: true` is the only thing this arm says differently. It THROWS when the send did not land — Slack refuses without `im:write`, Discord when the recipient shares no server or has DMs off — because a silent failure would be the fabrication class this tier exists to avoid.
+        // 🔴 IT ALSO THROWS WHEN THE RECIPIENT STOPPED, and the read happens INSIDE the road rather than here (OPE-1855). The propose-time fence ran minutes or hours ago; a person who asks the agent to stop while their card sits open must not then receive the message the card was about.
+        await deliverProactiveDm({
+            where: whereFromScope(args.org, args.scopeKey),
+            plane: "chat.dm",
+            platform: args.platform,
+            recipientId: args.principalId,
+            address: args.grant,
+            text: args.text,
+            footer: args.footer,
+            requestedBy: args.requestedBy,
+            attributedTo: decidedBy,
+            first: true,
+            ...(args.tainted === undefined ? {} : { tainted: args.tainted }),
+        });
+        return `sent a direct message to ${args.platform} person ${args.principalId}`;
+    },
+};
+registerActionKind(chatDm);
+//# sourceMappingURL=chat-dm.js.map

package/dist/agent/approvals/chat-dm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-dm.js","sourceRoot":"","sources":["../../../agent/approvals/chat-dm.ts"],"names":[],"mappings":"AAAA,saAAsa;AAEta,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsBlE;wFACwF;AACxF,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,KAAK,GAAG;QACZ,+BAA+B,IAAI,CAAC,QAAQ,WAAW,IAAI,CAAC,WAAW,gBAAgB,IAAI,CAAC,KAAK,GAAG;QACpG,IAAI,CAAC,IAAI;QACT,uBAAuB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;QAC3C,2HAA2H;KAC5H,CAAC;IACF,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC1G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,MAAM,GAA2B;IACrC,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,sUAAsU;QACtU,wRAAwR;QACxR,MAAM,kBAAkB,CAAC;YACvB,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC9C,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,OAAO,4BAA4B,IAAI,CAAC,QAAQ,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;IAChF,CAAC;CACF,CAAC;AAEF,kBAAkB,CAAC,MAAM,CAAC,CAAC"}

package/dist/agent/approvals/chat-post.d.ts

@@ -0,0 +1,15 @@
+export interface ChatPostArgs {
+    readonly org: string;
+    readonly scopeKey: string;
+    /** The DESTINATION's platform — chooses the transport at decide time. */
+    readonly platform: string;
+    /** The destination container's own id on that platform (a Slack channel id). */
+    readonly container: string;
+    /** The ARN-like address the grant named — the audit row's "which config line allowed this". */
+    readonly grant: string;
+    readonly text: string;
+    readonly requestedBy: string;
+    /** Proposing turn ingested untrusted content — reviewer-scrutiny flag, never auto-reject. */
+    readonly tainted?: boolean;
+}
+//# sourceMappingURL=chat-post.d.ts.map

package/dist/agent/approvals/chat-post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-post.d.ts","sourceRoot":"","sources":["../../../agent/approvals/chat-post.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B"}

package/dist/agent/approvals/chat-post.js

@@ -0,0 +1,43 @@
+// The gated `post_message` kind: the propose tool fences the destination and freezes everything, because there is no ctx at decide time and a row may be decided hours later. The card renders the FULL body, because the card is the injection gate. The audit row names the GRANT that allowed the post, not merely the destination, and the kind is not session-grantable.
+import { postSurfaceTextStrict } from "../channels/surface-message-ops.js";
+import { appendAudit } from "../audit/audit.js";
+import { registerActionKind, whereFromScope } from "./actions.js";
+/** The card body. The destination AND the full text, because the card is the injection gate. */
+function summarizePost(args) {
+    const lines = [`Post a message into ${args.platform} container ${args.container} (granted by ${args.grant})`, args.text];
+    if (args.tainted)
+        lines.push("⚠ proposed in a turn that read external content — review before approving");
+    return lines;
+}
+const chatPost = {
+    kind: "chat.post",
+    policy: "member",
+    summarize: summarizePost,
+    async execute(args, decidedBy) {
+        // `postSurfaceText` never throws and answers `undefined` on failure, but here the post IS the work, so the strict form is used: it throws the TRANSPORT'S OWN reason, which is what the human deciding this row needs, and every arm of it is token-free by construction.
+        let messageId;
+        try {
+            messageId = await postSurfaceTextStrict(args.platform, { channelId: args.container, text: args.text });
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new Error(`chat.post: the ${args.platform} post into "${args.container}" did not land — ${reason}`);
+        }
+        await appendAudit({
+            ...whereFromScope(args.org, args.scopeKey),
+            principalId: decidedBy,
+            action: "chat.post",
+            detail: {
+                platform: args.platform,
+                container: args.container,
+                grant: args.grant,
+                messageId,
+                requestedBy: args.requestedBy,
+                tainted: Boolean(args.tainted),
+            },
+        });
+        return `posted into ${args.platform} container ${args.container}`;
+    },
+};
+registerActionKind(chatPost);
+//# sourceMappingURL=chat-post.js.map

package/dist/agent/approvals/chat-post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-post.js","sourceRoot":"","sources":["../../../agent/approvals/chat-post.ts"],"names":[],"mappings":"AAAA,8WAA8W;AAE9W,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAkBlE,gGAAgG;AAChG,SAAS,aAAa,CAAC,IAAkB;IACvC,MAAM,KAAK,GAAG,CAAC,uBAAuB,IAAI,CAAC,QAAQ,cAAc,IAAI,CAAC,SAAS,gBAAgB,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzH,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC1G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAA6B;IACzC,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,0QAA0Q;QAC1Q,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,QAAQ,eAAe,IAAI,CAAC,SAAS,oBAAoB,MAAM,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,WAAW,CAAC;YAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC1C,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC/B;SACF,CAAC,CAAC;QACH,OAAO,eAAe,IAAI,CAAC,QAAQ,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;IACpE,CAAC;CACF,CAAC;AAEF,kBAAkB,CAAC,QAAQ,CAAC,CAAC"}

package/dist/agent/approvals/clicker-floor.d.ts

@@ -0,0 +1,48 @@
+import { resolveAudienceFloor, type AudienceFloor, type RoomRoster } from "../access/audience-floor.js";
+import type { PendingActionRow } from "./types.js";
+/** Why a click was refused before the policy branch ever ran. */
+export type ClickerFloorRefusal = 
+/** The room's audience floor POSITIVELY resolved to `guest` — today, an externally-shared Slack
+ *  channel. Leg A. */
+"audience-floor"
+/** A beneficiary kind (the click MINTS a live secret and destroys the one in use; the reveal goes
+ *  to the asker) in a room whose membership the platform could not attest. Leg B. */
+ | "unattested-room"
+/** The click did not come from the room the card was posted into. Leg C (hardening). */
+ | "foreign-room"
+/** Leg D: the platform could NOT CONFIRM the clicker as a member of the workspace — Slack's `slackAuthorIsMember` verdict, inverted. It covers a Connect stranger, a deleted account and a home workspace that is neither the event's own nor declared internal, but not a bot account on its own. */
+ | "guest-clicker";
+export type ClickerFloorVerdict = {
+    readonly ok: true;
+    readonly floor: AudienceFloor;
+} | {
+    readonly ok: false;
+    readonly reason: ClickerFloorRefusal;
+    readonly floor: AudienceFloor;
+};
+export interface ClickerFloorInput {
+    /** The room's floor, from the ONE primitive (access/audience-floor.ts). */
+    readonly floor: AudienceFloor;
+    /** The live roster the floor came from — read for its `resolved` bit (the inert rule above). */
+    readonly roster: RoomRoster;
+    /** Does approving this kind hand the CLICKER what it creates? ({@link ActionKind.beneficiaryClicker}) */
+    readonly beneficiaryClicker: boolean;
+}
+/** The pure decision for legs A and B. An observed guest is named first; a roster that did not RESOLVE allows on leg A even when its floor defaults to `guest`, which is the anti-outage pin. */
+export declare function classifyClickerFloor(input: ClickerFloorInput): ClickerFloorVerdict;
+/** Injectable edges — the live default is the shared, memoized audience-floor seam. */
+export interface ClickerFloorDeps {
+    readonly floor?: typeof resolveAudienceFloor;
+}
+/** Resolve one click's verdict for legs A and B. `surfaceKey` is the room the CLICK happened in, taken from the click rather than the frozen row; a throw FAILS OPEN, because a disclosure-shaped layer must never turn a platform blip into an undecidable card. */
+export declare function checkClickerFloor(surfaceKey: string, opts: {
+    readonly beneficiaryClicker: boolean;
+    /** Leg D (OPE-589). A POSITIVE per-clicker guest verdict from the surface, or `undefined` when
+     *  the surface cannot give one. `undefined` is ALWAYS inert — never a refusal. */
+    readonly clickerIsGuest?: boolean;
+}, deps?: ClickerFloorDeps): Promise<ClickerFloorVerdict>;
+/** Leg C: did this click come from the room the card was posted into? Pure, and it compares the CHANNEL segment only — a venue-routed card's workspace segment is whatever the operator typed — and it is INERT rather than refusing when there is no channel segment to compare. */
+export declare function clickRoomMatches(row: PendingActionRow, clickSurfaceKey: string): boolean;
+/** The one human-readable refusal a clicker sees, kept in ONE place so the Slack thread note and the Discord ephemeral cannot drift. Every arm says the same three things: nothing was applied, the request is still pending, and the move that unblocks it. */
+export declare function clickerFloorRefusalNotice(reason: ClickerFloorRefusal): string;
+//# sourceMappingURL=clicker-floor.d.ts.map

package/dist/agent/approvals/clicker-floor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clicker-floor.d.ts","sourceRoot":"","sources":["../../../agent/approvals/clicker-floor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACxG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,iEAAiE;AACjE,MAAM,MAAM,mBAAmB;AAC7B;sBACsB;AACpB,gBAAgB;AAClB;qFACqF;GACnF,iBAAiB;AACnB,wFAAwF;GACtF,cAAc;AAChB,sSAAsS;GACpS,eAAe,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,yGAAyG;IACzG,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED,iMAAiM;AACjM,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,CAQlF;AAKD,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,oBAAoB,CAAC;CAC9C;AAED,qQAAqQ;AACrQ,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;sFACkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC,EACD,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CAU9B;AAED,qRAAqR;AACrR,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAMxF;AAED,gQAAgQ;AAChQ,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAuB7E"}

package/dist/agent/approvals/clicker-floor.js

@@ -0,0 +1,58 @@
+// A member-tier card is SELF-APPROVABLE: nothing compares the clicker to the requester, by decision (Tommy, 2026-07-27) — the card guards the model's proposal, not the member. Transport authenticity stays the ONLY thing a click itself verifies — a Slack HMAC over the raw body, a verified Discord interaction, authenticated control-plane MCP — so the legs below are the only thing that says anything about WHOSE hand pressed the button. The control-plane click path supplies no click context, so none of these legs run for it.
+import { resolveAudienceFloor } from "../access/audience-floor.js";
+/** The pure decision for legs A and B. An observed guest is named first; a roster that did not RESOLVE allows on leg A even when its floor defaults to `guest`, which is the anti-outage pin. */
+export function classifyClickerFloor(input) {
+    if (input.roster.resolved && input.floor === "guest") {
+        return { ok: false, reason: "audience-floor", floor: input.floor };
+    }
+    if (input.beneficiaryClicker && !input.roster.resolved) {
+        return { ok: false, reason: "unattested-room", floor: input.floor };
+    }
+    return { ok: true, floor: input.floor };
+}
+/** The admin set this leg judges against is EMPTY on purpose: `computeAudienceFloor` decides `guest` before it consults an admin set, so passing one would imply a dependency this leg does not have. */
+const NO_ADMINS = new Set();
+/** Resolve one click's verdict for legs A and B. `surfaceKey` is the room the CLICK happened in, taken from the click rather than the frozen row; a throw FAILS OPEN, because a disclosure-shaped layer must never turn a platform blip into an undecidable card. */
+export async function checkClickerFloor(surfaceKey, opts, deps = {}) {
+    // Leg D runs FIRST and never touches the room roster: a positively-observed guest is a claim about the person, decided before any question about the room, so a room-floor blip cannot mask it.
+    if (opts.clickerIsGuest === true)
+        return { ok: false, reason: "guest-clicker", floor: "guest" };
+    try {
+        const resolution = await (deps.floor ?? resolveAudienceFloor)(surfaceKey, NO_ADMINS);
+        return classifyClickerFloor({ ...resolution, beneficiaryClicker: opts.beneficiaryClicker });
+    }
+    catch (err) {
+        console.log(`[open-everywhere:approvals] audience floor unresolvable for ${surfaceKey} (${String(err)}) — clicker floor inert`);
+        return { ok: true, floor: "guest" };
+    }
+}
+/** Leg C: did this click come from the room the card was posted into? Pure, and it compares the CHANNEL segment only — a venue-routed card's workspace segment is whatever the operator typed — and it is INERT rather than refusing when there is no channel segment to compare. */
+export function clickRoomMatches(row, clickSurfaceKey) {
+    const segs = clickSurfaceKey.split("/");
+    if (segs.length !== 3)
+        return true; // no channel segment to compare — inert, never a refusal
+    const channelId = segs[2];
+    if (channelId.length === 0)
+        return true;
+    return channelId === row.channelId;
+}
+/** The one human-readable refusal a clicker sees, kept in ONE place so the Slack thread note and the Discord ephemeral cannot drift. Every arm says the same three things: nothing was applied, the request is still pending, and the move that unblocks it. */
+export function clickerFloorRefusalNotice(reason) {
+    switch (reason) {
+        case "audience-floor":
+            return ("I didn't apply that: this channel's audience floor resolved to \"guest\" — it's externally shared, " +
+                "or carries an observed guest/external member — so a decision made here can't stand in for one made " +
+                "inside the org. The request is still pending; decide it from an internal channel and it will apply.");
+        case "unattested-room":
+            return ("I didn't apply that: approving it would hand YOU a live signing secret, and I couldn't verify who " +
+                "is in this channel (the membership list didn't resolve). The request is still pending; decide it " +
+                "from a channel whose membership I can read and it will apply.");
+        case "foreign-room":
+            return "I didn't apply that: this click didn't come from the channel the card was posted in. The request is still pending.";
+        case "guest-clicker":
+            return ("I didn't apply that: you could not be confirmed as a member of this workspace, so this decision " +
+                "can't be made on the org's behalf. The request is still pending; a confirmed member of the org " +
+                "can decide it and it will apply.");
+    }
+}
+//# sourceMappingURL=clicker-floor.js.map

package/dist/agent/approvals/clicker-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clicker-floor.js","sourceRoot":"","sources":["../../../agent/approvals/clicker-floor.ts"],"names":[],"mappings":"AAAA,+gBAA+gB;AAE/gB,OAAO,EAAE,oBAAoB,EAAuC,MAAM,6BAA6B,CAAC;AA6BxG,iMAAiM;AACjM,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,yMAAyM;AACzM,MAAM,SAAS,GAAwB,IAAI,GAAG,EAAU,CAAC;AAOzD,qQAAqQ;AACrQ,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,IAKC,EACD,IAAI,GAAqB,EAAE;IAE3B,gMAAgM;IAChM,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACrF,OAAO,oBAAoB,CAAC,EAAE,GAAG,UAAU,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,+DAA+D,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAChI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,qRAAqR;AACrR,MAAM,UAAU,gBAAgB,CAAC,GAAqB,EAAE,eAAuB;IAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yDAAyD;IAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;IACpC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC;AACrC,CAAC;AAED,gQAAgQ;AAChQ,MAAM,UAAU,yBAAyB,CAAC,MAA2B;IACnE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB;YACnB,OAAO,CACL,qGAAqG;gBACrG,qGAAqG;gBACrG,qGAAqG,CACtG,CAAC;QACJ,KAAK,iBAAiB;YACpB,OAAO,CACL,oGAAoG;gBACpG,mGAAmG;gBACnG,+DAA+D,CAChE,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,oHAAoH,CAAC;QAC9H,KAAK,eAAe;YAClB,OAAO,CACL,kGAAkG;gBAClG,iGAAiG;gBACjG,kCAAkC,CACnC,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/agent/approvals/decision-authority.internal.d.ts

@@ -0,0 +1,19 @@
+import { type RequesterVerdict } from "../access/requester-identity.js";
+import { type UnifiedWakeOrigin } from "../channels/unified-window.js";
+import { type BindableContext, type SurfaceBinding } from "../identity/binding.js";
+export interface ApprovalDecisionAuthority {
+    readonly binding: SurfaceBinding;
+    readonly origin: UnifiedWakeOrigin;
+    readonly surfaceKey: string;
+    readonly requester: RequesterVerdict;
+    readonly nonMemberWake: boolean;
+}
+/** Resolve one proposal turn's exact durable wake authority. Non-window callers have no decision
+ * wake to restore; a window caller whose row cannot prove its binding fails closed. */
+export declare function captureApprovalDecisionAuthority(ctx: BindableContext): Promise<ApprovalDecisionAuthority | undefined>;
+/** Persist beside the pending action through its whole click lifetime. */
+export declare function rememberApprovalDecisionAuthority(org: string, id: string, expiresAt: string, authority: ApprovalDecisionAuthority): Promise<void>;
+/** Read the proposal-frozen authority. Malformed/missing legacy rows fail soft to no session wake;
+ * the decision notice beside their card remains the human-facing source of truth. */
+export declare function readApprovalDecisionAuthority(org: string, id: string): Promise<ApprovalDecisionAuthority | undefined>;
+//# sourceMappingURL=decision-authority.internal.d.ts.map