@open-everywhere/core 0.1.0

package/dist/agent/approvals/decision-authority.internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-authority.internal.d.ts","sourceRoot":"","sources":["../../../agent/approvals/decision-authority.internal.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAoG,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAOrL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAMD;uFACuF;AACvF,wBAAsB,gCAAgC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CA4C3H;AAYD,0EAA0E;AAC1E,wBAAsB,iCAAiC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvJ;AAED;qFACqF;AACrF,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAW3H"}

package/dist/agent/approvals/decision-authority.internal.js

@@ -0,0 +1,107 @@
+// Durable authority for the internal wake emitted after an approval decision. The click actor
+// decides the card; they do not become the requester or the proposing seat. Freeze those facts from
+// the original host-validated wake while the proposal turn still has them.
+import { addressedWakeThisTurn, exactDispatchWakeThisTurn } from "../access/dispatch-origin-signal.js";
+import { isRequesterVerdict } from "../access/requester-identity.js";
+import { isUnifiedWakeOrigin, resolveUnifiedWakeAuthority, wakeBindingMatchesOrigin, wakeBindingMatchesSurfaceKey, } from "../channels/unified-window.js";
+import { resolveDelegatedTaskAuthority } from "../channels/task-wake.js";
+import { currentTurnId, currentWindowToken, deploymentOrg, isSubagentChildContext, isUnifiedWindowContext } from "../identity/binding.js";
+import { isFrozenSurfaceBinding } from "../identity/frozen-surface-binding.internal.js";
+import { getOperationalStore } from "../operational/provider.js";
+const KEY_PREFIX = "approval-decision-authority:";
+const RETENTION_AFTER_EXPIRY_MS = 24 * 60 * 60 * 1_000;
+function key(id) {
+    return `${KEY_PREFIX}${id}`;
+}
+/** Resolve one proposal turn's exact durable wake authority. Non-window callers have no decision
+ * wake to restore; a window caller whose row cannot prove its binding fails closed. */
+export async function captureApprovalDecisionAuthority(ctx) {
+    // A native worker inherits the parent's window token but its brief intentionally carries no
+    // delivered <wake>. Parent session + call id are the host-owned linkage: resolve their durable
+    // dispatch pointer back to the one atomic wake row. Never pair the child's current auth with it.
+    if (isSubagentChildContext(ctx)) {
+        const child = await resolveDelegatedTaskAuthority(ctx);
+        if (child === undefined) {
+            // A native/non-window delegation intentionally stores only a binding snapshot. It has no
+            // unified conversational seat to resume, so approval remains card-only as before. A child
+            // carrying a window token, however, must resolve that exact wake-backed pointer or refuse.
+            if (currentWindowToken(ctx) === undefined)
+                return undefined;
+            throw new Error("approval decision authority: the delegated child has no exact wake-backed dispatch authority");
+        }
+        return {
+            binding: child.binding,
+            origin: child.origin,
+            surfaceKey: child.surfaceKey,
+            requester: child.requester,
+            nonMemberWake: child.nonMemberWake,
+        };
+    }
+    // A tool-execute context carries no channel object. The host-stamped window token is its exact
+    // equivalent signal; accepting only `ctx.channel.kind` here would silently skip every real model
+    // proposal while making hook-shaped tests pass.
+    if (!isUnifiedWindowContext(ctx) && currentWindowToken(ctx) === undefined)
+        return undefined;
+    const turnId = currentTurnId(ctx);
+    const wakeId = addressedWakeThisTurn(turnId) ?? exactDispatchWakeThisTurn(turnId);
+    if (wakeId === undefined)
+        throw new Error("approval decision authority: the proposing window turn has no exact delivered or addressed wake");
+    const store = getOperationalStore();
+    const authority = await resolveUnifiedWakeAuthority(store, deploymentOrg(), wakeId);
+    if (authority === undefined) {
+        throw new Error("approval decision authority: the proposing wake has no complete frozen binding");
+    }
+    const { binding, origin, surfaceKey, requester, nonMemberWake } = authority;
+    if (!wakeBindingMatchesSurfaceKey(binding, surfaceKey) || !wakeBindingMatchesOrigin(binding, origin)) {
+        throw new Error("approval decision authority: the proposing wake binding does not match its durable origin");
+    }
+    return {
+        binding,
+        origin,
+        surfaceKey,
+        requester,
+        nonMemberWake,
+    };
+}
+function isAuthority(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const row = value;
+    if (!Object.keys(row).every((k) => ["binding", "origin", "surfaceKey", "requester", "nonMemberWake"].includes(k)))
+        return false;
+    if (!isFrozenSurfaceBinding(row.binding) || !isUnifiedWakeOrigin(row.origin) || !isRequesterVerdict(row.requester))
+        return false;
+    if (typeof row.surfaceKey !== "string" || row.surfaceKey.length === 0 || typeof row.nonMemberWake !== "boolean")
+        return false;
+    const binding = row.binding;
+    return wakeBindingMatchesSurfaceKey(binding, row.surfaceKey) && wakeBindingMatchesOrigin(binding, row.origin);
+}
+/** Persist beside the pending action through its whole click lifetime. */
+export async function rememberApprovalDecisionAuthority(org, id, expiresAt, authority) {
+    if (authority.binding.org !== org)
+        throw new Error("approval decision authority: proposal org does not match the frozen binding");
+    const expiryMs = Date.parse(expiresAt);
+    if (!Number.isFinite(expiryMs))
+        throw new Error("approval decision authority: pending expiry is invalid");
+    const ttlMs = Math.max(1, expiryMs - Date.now() + RETENTION_AFTER_EXPIRY_MS);
+    await getOperationalStore().putTaskResult(org, key(id), JSON.stringify(authority), new Date().toISOString(), ttlMs);
+}
+/** Read the proposal-frozen authority. Malformed/missing legacy rows fail soft to no session wake;
+ * the decision notice beside their card remains the human-facing source of truth. */
+export async function readApprovalDecisionAuthority(org, id) {
+    try {
+        const raw = await getOperationalStore().getTaskResult(org, key(id));
+        if (raw === null)
+            return undefined;
+        const parsed = JSON.parse(raw);
+        if (!isAuthority(parsed))
+            return undefined;
+        if (parsed.binding.org !== org)
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=decision-authority.internal.js.map

package/dist/agent/approvals/decision-authority.internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-authority.internal.js","sourceRoot":"","sources":["../../../agent/approvals/decision-authority.internal.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,oGAAoG;AACpG,2EAA2E;AAE3E,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAyB,MAAM,iCAAiC,CAAC;AAC5F,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,wBAAwB,EACxB,4BAA4B,GAE7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,sBAAsB,EAAE,sBAAsB,EAA6C,MAAM,wBAAwB,CAAC;AACrL,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAUvD,SAAS,GAAG,CAAC,EAAU;IACrB,OAAO,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED;uFACuF;AACvF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,GAAoB;IACzE,4FAA4F;IAC5F,+FAA+F;IAC/F,iGAAiG;IACjG,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;IACJ,CAAC;IACD,+FAA+F;IAC/F,iGAAiG;IACjG,gDAAgD;IAChD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5F,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;IACpF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;IAC5E,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO;QACL,OAAO;QACP,MAAM;QACN,UAAU;QACV,SAAS;QACT,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChI,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACjI,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9H,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,OAAO,4BAA4B,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAChH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,GAAW,EAAE,EAAU,EAAE,SAAiB,EAAE,SAAoC;IACtI,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAClI,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,CAAC,CAAC;IAC7E,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;AACtH,CAAC;AAED;qFACqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,GAAW,EAAE,EAAU;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/agent/approvals/decision-wake.d.ts

@@ -0,0 +1,28 @@
+import { type NormalizedWake } from "../channels/normalized-wake.js";
+import type { UnifiedWakeOrigin } from "../channels/unified-window.js";
+export type ApprovalOutcome = "approved" | "rejected" | "expired";
+export interface ApprovalDecisionWakeInput {
+    /** The proposing session's reply target (surface + conversation ids) — the anchor thread the card
+     *  lived in, so a warranted `reply` lands exactly where the human-facing notice already is. */
+    readonly origin: UnifiedWakeOrigin;
+    /** Host-minted wake id (the caller mints it and renders it into the envelope). */
+    readonly wakeId: string;
+    /** The pending's own summary line (kindDef.summarize(frozen args)[0]) — WHAT was decided. */
+    readonly summaryLine: string;
+    readonly outcome: ApprovalOutcome;
+    /** The admin who decided — absent for a system expiry. */
+    readonly clickerId?: string;
+    readonly pendingId: string;
+    /** Present only for an APPROVED outcome: `line` is the verbatim string kindDef.execute returned, or its failure message, and `ran` says which. It is HOST text, never model text, and rides the trusted `<system-note>` exactly like `summaryLine`. */
+    readonly execution?: {
+        readonly ran: "ok" | "failed";
+        readonly line: string;
+    };
+}
+/** The decision-notice body, pure and asserted verbatim in the test: it states the outcome, says the humans were ALREADY told, and steers the default to silence. The summary line is the pending's own OE-rendered summary, never model text. */
+export declare function approvalDecisionBody(input: ApprovalDecisionWakeInput): string;
+/** Build the decision NormalizedWake (pure). `wakeId` is host-minted by the caller (the receive hook
+ *  registers it → origin before the send, so a `reply` naming it resolves the anchor thread). */
+export declare function buildApprovalDecisionWake(input: ApprovalDecisionWakeInput): NormalizedWake;
+export declare function renderApprovalDecisionMessage(input: ApprovalDecisionWakeInput, nowIso: string): string;
+//# sourceMappingURL=decision-wake.d.ts.map

package/dist/agent/approvals/decision-wake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-wake.d.ts","sourceRoot":"","sources":["../../../agent/approvals/decision-wake.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,yBAAyB;IACxC;mGAC+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uPAAuP;IACvP,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/E;AAqED,kPAAkP;AAClP,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,MAAM,CAW7E;AAED;iGACiG;AACjG,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,yBAAyB,GAAG,cAAc,CAU1F;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtG"}

package/dist/agent/approvals/decision-wake.js

@@ -0,0 +1,84 @@
+// The pure builder for the wake that tells a WINDOW session its pending approval was decided; a session woken in a different thread never sees the in-thread notice. Addressing is "channel-watch" (ambient, silence-biased) because the humans were already told, and reason is "dispatch".
+// 🔴 THE NOTICE IS OE'S OWN INSTRUCTION, SO IT IS A STRUCTURAL `<system-note>` (a `notice` trigger + `systemNote`), NEVER A MESSAGE. As a `trust="relay"` message it rendered inside an `untrusted_external_data source="slack-message"` fence, and a model that obeys the fence read the silence instruction as an injection (OPE-2065).
+import { renderWake } from "../channels/normalized-wake.js";
+/** The COSMETIC container id for the wake's locus line — reply targeting is by wake-id/map, never
+ *  this, so a best-effort primary id per origin is enough. */
+function originContainerId(origin) {
+    switch (origin.platform) {
+        case "slack":
+            return origin.channelId;
+        case "github":
+            return `${origin.owner}/${origin.repo}`;
+        case "linear":
+            return origin.issueId;
+        case "notion":
+            return origin.discussionId;
+        case "discord":
+            return origin.channelId;
+        case "teams":
+            return origin.conversationId;
+    }
+}
+function outcomeClause(outcome, clickerId) {
+    const by = clickerId ? ` by <@${clickerId}>` : "";
+    switch (outcome) {
+        case "approved":
+            return `has been APPROVED${by} and applied`;
+        case "rejected":
+            return `was REJECTED${by} and NOT applied`;
+        case "expired":
+            return `EXPIRED without a decision and was NOT applied`;
+    }
+}
+/** The sentence every closing carries (OPE-2071). A worker never receives the decision — it goes to this owning session — so a worker still running toward the act learns nothing unless this session cancels it. */
+const CANCEL_WORKER_SENTENCE = `If a worker of yours is still running toward this act, cancel it (\`task_cancel\`) — the decision is final for that proposal.`;
+/** The closing instruction for a REJECTED or EXPIRED outcome — nothing ran, so nothing is owed. */
+const REJECTED_CLOSING = `If someone still genuinely wants this change, treat a fresh request as a NEW proposal (a new card) — do not point anyone at the old, dead card, and do not re-propose unprompted. ` +
+    CANCEL_WORKER_SENTENCE;
+/** The approval plane RAN the act, not the proposing seat, so this closing states what already ran and a re-issue is plainly redundant. A FAILED execution says so instead, so the seat may attempt it again, and the no-fact arm claims nothing about what ran. */
+function approvedClosing(execution) {
+    const continuation = `If you told the room you would do more BEYOND that act once it was approved, continue that work ` +
+        `now — the approval unblocks it, it does not end your turn.`;
+    if (execution?.ran === "ok") {
+        return (`THE APPROVED ACT HAS ALREADY RUN. The approval performed it — you did not, and a delegated ` +
+            `worker of yours does not need to. It reports: "${execution.line}". Do NOT do it again and do ` +
+            `NOT delegate it again: a second run repeats the same effect on whoever it reached. ` +
+            `${continuation} That does not re-open the act above. Otherwise, nothing more is needed unless ` +
+            `someone asks a follow-up. ${CANCEL_WORKER_SENTENCE}`);
+    }
+    if (execution?.ran === "failed") {
+        return (`THE APPROVED ACT RAN AND FAILED, so nothing was applied. It reports: "${execution.line}". You ` +
+            `may attempt it again, or tell the room it failed. ${continuation} ${CANCEL_WORKER_SENTENCE}`);
+    }
+    return (`If you told the room you would do more once this was approved, continue that work now — the ` +
+        `approval unblocks it, it does not end your turn. Otherwise, nothing more is needed unless ` +
+        `someone asks a follow-up. ${CANCEL_WORKER_SENTENCE}`);
+}
+/** The decision-notice body, pure and asserted verbatim in the test: it states the outcome, says the humans were ALREADY told, and steers the default to silence. The summary line is the pending's own OE-rendered summary, never model text. */
+export function approvalDecisionBody(input) {
+    const closed = input.outcome === "approved" ? approvedClosing(input.execution) : REJECTED_CLOSING;
+    return (`A pending approval you were waiting on (id ${input.pendingId}) has been decided. The request ` +
+        `"${input.summaryLine}" ${outcomeClause(input.outcome, input.clickerId)}.\n\n` +
+        `The people in that thread have ALREADY been notified — a decision notice was posted there — so you do ` +
+        `NOT need to announce this. Just update your understanding: this pending is now CLOSED, and you must ` +
+        `never describe it as "still awaiting approval" or "already posted, just needs an admin to approve". ` +
+        `${closed}\n\n` +
+        `Staying silent is the right, common outcome here: if nothing genuinely needs saying, call \`no_reply\`.`);
+}
+/** Build the decision NormalizedWake (pure). `wakeId` is host-minted by the caller (the receive hook
+ *  registers it → origin before the send, so a `reply` naming it resolves the anchor thread). */
+export function buildApprovalDecisionWake(input) {
+    return {
+        platform: input.origin.platform,
+        reason: "dispatch",
+        addressing: "channel-watch",
+        wakeId: input.wakeId,
+        locus: { channel: { id: originContainerId(input.origin) } },
+        trigger: { kind: "notice" },
+        systemNote: approvalDecisionBody(input),
+    };
+}
+export function renderApprovalDecisionMessage(input, nowIso) {
+    return renderWake(buildApprovalDecisionWake(input), () => nowIso).message;
+}
+//# sourceMappingURL=decision-wake.js.map

package/dist/agent/approvals/decision-wake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-wake.js","sourceRoot":"","sources":["../../../agent/approvals/decision-wake.ts"],"names":[],"mappings":"AAAA,6RAA6R;AAC7R,0UAA0U;AAE1U,OAAO,EAAE,UAAU,EAAuB,MAAM,gCAAgC,CAAC;AAqBjF;8DAC8D;AAC9D,SAAS,iBAAiB,CAAC,MAAyB;IAClD,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,cAAc,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB,EAAE,SAAkB;IACjE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,OAAO,oBAAoB,EAAE,cAAc,CAAC;QAC9C,KAAK,UAAU;YACb,OAAO,eAAe,EAAE,kBAAkB,CAAC;QAC7C,KAAK,SAAS;YACZ,OAAO,gDAAgD,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,qNAAqN;AACrN,MAAM,sBAAsB,GAC1B,+HAA+H,CAAC;AAElI,mGAAmG;AACnG,MAAM,gBAAgB,GACpB,oLAAoL;IACpL,sBAAsB,CAAC;AAEzB,oQAAoQ;AACpQ,SAAS,eAAe,CAAC,SAAoE;IAC3F,MAAM,YAAY,GAChB,kGAAkG;QAClG,4DAA4D,CAAC;IAC/D,IAAI,SAAS,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,CACL,6FAA6F;YAC7F,kDAAkD,SAAS,CAAC,IAAI,+BAA+B;YAC/F,qFAAqF;YACrF,GAAG,YAAY,iFAAiF;YAChG,6BAA6B,sBAAsB,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CACL,yEAAyE,SAAS,CAAC,IAAI,SAAS;YAChG,qDAAqD,YAAY,IAAI,sBAAsB,EAAE,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,CACL,8FAA8F;QAC9F,4FAA4F;QAC5F,6BAA6B,sBAAsB,EAAE,CACtD,CAAC;AACJ,CAAC;AAED,kPAAkP;AAClP,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAClG,OAAO,CACL,8CAA8C,KAAK,CAAC,SAAS,kCAAkC;QAC/F,IAAI,KAAK,CAAC,WAAW,KAAK,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;QAC9E,wGAAwG;QACxG,sGAAsG;QACtG,sGAAsG;QACtG,GAAG,MAAM,MAAM;QACf,yGAAyG,CAC1G,CAAC;AACJ,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,yBAAyB,CAAC,KAAgC;IACxE,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAC/B,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE;QAC3D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAgC,EAAE,MAAc;IAC5F,OAAO,UAAU,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;AAC5E,CAAC"}

package/dist/agent/approvals/domain-exposure.d.ts

@@ -0,0 +1,27 @@
+/** What a widening would ADD, in the two shapes a card needs: the words a person reads, and the reach tags to test the domain's other rooms against. */
+export interface WideningSubject {
+    /** The addition, as a person reads it — "the payments connector", "api.example.com". */
+    readonly label: string;
+    /** The reach items this addition grants, tagged as {@link reachTagsOf} tags a container's. Hosts must arrive NORMALISED; empty means nothing this read can compare, and the uniqueness sentence is then omitted rather than guessed. */
+    readonly reachTags: readonly string[];
+    /** Sources whose OWN audience Open Everywhere cannot read — named for a person ("Notion"). */
+    readonly opaqueSources: readonly string[];
+}
+export interface DomainExposureInput {
+    readonly org: string;
+    /** The memory domain the requesting room sits in, or null when it sits in none. */
+    readonly domain: string | null;
+    readonly subject: WideningSubject;
+    /** Whether the widening lands on a ROOM; default true. A grant to a DM or a person-group is already named in full by the request tool's own universe note, so a non-room grant gets only the not-enumerable statement. */
+    readonly landsOnARoom?: boolean;
+    /** Injectable seam — the live default is {@link accessView}. */
+    readonly reachOf?: (surfaceKey: string) => Promise<readonly string[]>;
+}
+/** A host pattern, as the access resolver compares them: trim and lower-case. Exported so a caller tags hosts the one way — an unnormalised tag matches nothing, which renders as "no room can reach this" and would be a fabricated widening claim. */
+export declare function normalizeHost(host: string): string;
+/** "a", "a and b", "a, b and c" — the one list joiner, so every sentence here reads the same.
+ *  Exported so a caller composing a {@link WideningSubject} label joins the same way. */
+export declare function joinWords(words: readonly string[]): string;
+/** The exposure lines for a widening card. It never throws and never returns an empty array — a failure renders the "could not compute" line. */
+export declare function domainExposureLines(input: DomainExposureInput): Promise<readonly string[]>;
+//# sourceMappingURL=domain-exposure.d.ts.map

package/dist/agent/approvals/domain-exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-exposure.d.ts","sourceRoot":"","sources":["../../../agent/approvals/domain-exposure.ts"],"names":[],"mappings":"AAQA,wJAAwJ;AACxJ,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wOAAwO;IACxO,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,8FAA8F;IAC9F,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,0NAA0N;IAC1N,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACvE;AAED,wPAAwP;AACxP,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;yFACyF;AACzF,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAK1D;AA6DD,iJAAiJ;AACjJ,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA8EhG"}

package/dist/agent/approvals/domain-exposure.js

@@ -0,0 +1,145 @@
+// The exposure delta a widening card renders, from what this deployment can PROVE: how far the domain reaches, whether its rooms share one memory (`Domain.memory`, never the window gate), and whether the addition is already reachable. It never states a person count, never throws, and never blocks the card.
+import { surfaceDisplayName } from "../instructions/seat-prompt.js";
+import { accessView } from "../control/views.js";
+import { getConfig } from "../access/config.js";
+import { displayTitle } from "../identity/display-title.js";
+import { domainContainers, domainRoster } from "../memory/domain.js";
+/** A host pattern, as the access resolver compares them: trim and lower-case. Exported so a caller tags hosts the one way — an unnormalised tag matches nothing, which renders as "no room can reach this" and would be a fabricated widening claim. */
+export function normalizeHost(host) {
+    return host.trim().toLowerCase();
+}
+/** "a", "a and b", "a, b and c" — the one list joiner, so every sentence here reads the same.
+ *  Exported so a caller composing a {@link WideningSubject} label joins the same way. */
+export function joinWords(words) {
+    const kept = words.filter((w) => w.trim().length > 0);
+    if (kept.length === 0)
+        return "";
+    if (kept.length === 1)
+        return kept[0];
+    return `${kept.slice(0, -1).join(", ")} and ${kept[kept.length - 1]}`;
+}
+/** "Slack", "Slack and Microsoft Teams" — never a bare list of platform keys. Applied to PLATFORMS
+ *  only: the surface namer title-cases an unlisted key, which would mangle a hostname. */
+function surfaceSentence(platforms) {
+    return joinWords(platforms.map((p) => surfaceDisplayName(p)));
+}
+/** "1 room" / "4 rooms" — the count is the domain's declared roster length, never an estimate. */
+function roomCount(n) {
+    return n === 1 ? "1 room" : `${n} rooms`;
+}
+/** Everything one container can reach, in the audit's tag vocabulary. */
+async function reachTagsOf(surfaceKey) {
+    const parts = surfaceKey.split("/");
+    const a = await accessView({ platform: parts[0] ?? "", workspace: parts[1] ?? "", channel: parts.slice(2).join("/"), mode: "channel" });
+    return [
+        ...a.reachableHosts.map((h) => `host:${normalizeHost(h.host)}`),
+        ...a.connectors.map((c) => `connector:${c}`),
+        ...a.repos.map((r) => `repo:${r}`),
+        ...a.skills.map((s) => `skill:${s}`),
+        ...a.subagents.map((s) => `subagent:${s}`),
+    ];
+}
+function domainLabel(d, name) {
+    return displayTitle(d) ?? name;
+}
+/** The rooms this domain ENUMERATES — fully-qualified keys only, never a claim pattern. A domain can own a room without listing it, so counting the enumerable half there would print "lists 0 rooms" and declare a domain-wide widening, which is false in the reassuring direction. */
+function enumerableRooms(d) {
+    return domainRoster(d);
+}
+/** What this domain admits by a RULE rather than by a list, in plain words, or `undefined` when it claims nothing. Whenever a container entry exists the enumerable count is only a FLOOR, and this card may not err in the reassuring direction; the entries are raw addresses, so the card names their shape and never the entry. */
+function claimSentence(d) {
+    const entries = domainContainers(d).filter((c) => c.trim().length > 0);
+    if (entries.length === 0)
+        return undefined;
+    const grains = new Set(entries.map((e) => {
+        const where = surfaceDisplayName(e.split("/")[0] ?? "");
+        // 🔴 THE GRAIN NEVER SAYS "RULE". Both callers append "by a rule", so a grain that also said
+        // it rendered "every room matching a rule on GitHub by a rule". "Pattern" names the entry's
+        // shape; "rule" stays the one word for the mechanism.
+        const scope = e.split("/").length <= 2 ? "every room in a whole workspace" : "every room matching a pattern";
+        return where ? `${scope} on ${where}` : scope;
+    }));
+    return joinWords([...grains].sort());
+}
+/** The sentence naming what Open Everywhere cannot see. Always rendered: the gap is the finding. */
+function opaqueSentence(sources) {
+    const named = sources.filter((s) => s.trim().length > 0);
+    if (named.length === 0) {
+        return "Open Everywhere cannot list who else can read the source itself. Check that where the source lives.";
+    }
+    return `Open Everywhere cannot list who else can read ${joinWords(named)}. Check that there before you send.`;
+}
+/** The exposure lines for a widening card. It never throws and never returns an empty array — a failure renders the "could not compute" line. */
+export async function domainExposureLines(input) {
+    const opaque = opaqueSentence(input.subject.opaqueSources);
+    if (input.landsOnARoom === false)
+        return [opaque];
+    if (!input.domain) {
+        // No domain means no shared roster and no other rooms — the grant reaches the asking room and
+        // stops there. That is a complete answer, not a failure, so it says so plainly.
+        return ["This room is in no memory domain, so this reaches this room and no other.", opaque];
+    }
+    let domain;
+    let rooms;
+    try {
+        domain = getConfig()
+            .loadDomains()
+            .find((d) => d.name === input.domain);
+        if (!domain)
+            throw new Error("domain not loaded");
+        rooms = enumerableRooms(domain);
+    }
+    catch {
+        return [`Open Everywhere could not read the rooms of the "${input.domain}" domain, so it cannot show what this would expose.`, opaque];
+    }
+    const label = domainLabel(domain, input.domain);
+    const lines = [];
+    // SHARED MEMORY — the fact that makes one room's reach everybody's. Declared, not inferred, and
+    // true whether or not the rooms can be listed.
+    const sharesMemory = domain.memory !== undefined;
+    const claims = claimSentence(domain);
+    if (rooms.length === 0) {
+        lines.push(claims
+            ? `The "${label}" domain lists no rooms — it admits ${claims} by a rule — so Open Everywhere cannot show how far this reaches inside it.`
+            : `The "${label}" domain does not list its rooms, so Open Everywhere cannot show how far this reaches inside it.`);
+        if (sharesMemory)
+            lines.push("Every room it admits shares one memory, so what the agent reads through this can come back in any of them.");
+        lines.push(opaque);
+        return lines;
+    }
+    const platforms = [...new Set(rooms.map((r) => r.split("/")[0] ?? ""))].sort();
+    const where = surfaceSentence(platforms);
+    lines.push(`This lands in the "${label}" domain, which lists ${roomCount(rooms.length)}${where ? ` on ${where}` : ""}.`);
+    if (claims)
+        lines.push(`It also admits ${claims} by a rule, and Open Everywhere cannot name those rooms — so the count above is a floor.`);
+    if (sharesMemory) {
+        lines.push("Those rooms share one memory, so what the agent reads through this can come back in any of them.");
+    }
+    // Uniquely widens: a reach tag no room in the domain holds means this grant widens the domain itself, not just this room. A resolve that will not answer withholds the sentence rather than asserting the zero case.
+    if (input.subject.reachTags.length > 0) {
+        const wanted = new Set(input.subject.reachTags);
+        let holders = 0;
+        try {
+            const reach = input.reachOf ?? reachTagsOf;
+            for (const room of rooms) {
+                const held = await reach(room);
+                if (held.some((t) => wanted.has(t)))
+                    holders++;
+            }
+            // The check only ever sees the rooms the domain LISTS. With no claim that IS the whole domain; with a claim it is a sample, so the sentence withholds the widening verdict rather than earning it from a partial set.
+            lines.push(holders === 0
+                ? claims
+                    ? `No room this domain LISTS can reach ${input.subject.label} today. The rooms its rule admits were not checked.`
+                    : `No room in this domain can reach ${input.subject.label} today, so this widens the domain itself.`
+                : claims
+                    ? `${holders} of the rooms it lists can already reach ${input.subject.label}.`
+                    : `${roomCount(holders)} in this domain can already reach ${input.subject.label}.`);
+        }
+        catch {
+            lines.push(`Open Everywhere could not check which rooms already reach ${input.subject.label}.`);
+        }
+    }
+    lines.push(opaque);
+    return lines;
+}
+//# sourceMappingURL=domain-exposure.js.map

package/dist/agent/approvals/domain-exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-exposure.js","sourceRoot":"","sources":["../../../agent/approvals/domain-exposure.ts"],"names":[],"mappings":"AAAA,oTAAoT;AAEpT,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAuBlF,wPAAwP;AACxP,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;yFACyF;AACzF,MAAM,UAAU,SAAS,CAAC,KAAwB;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;0FAC0F;AAC1F,SAAS,eAAe,CAAC,SAA4B;IACnD,OAAO,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,kGAAkG;AAClG,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,WAAW,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACxI,OAAO;QACL,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAqB,EAAE,IAAY;IACtD,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,yRAAyR;AACzR,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,uUAAuU;AACvU,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,6FAA6F;QAC7F,4FAA4F;QAC5F,sDAAsD;QACtD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC7G,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAChD,CAAC,CAAC,CACH,CAAC;IACF,OAAO,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,OAA0B;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,qGAAqG,CAAC;IAC/G,CAAC;IACD,OAAO,iDAAiD,SAAS,CAAC,KAAK,CAAC,qCAAqC,CAAC;AAChH,CAAC;AAED,iJAAiJ;AACjJ,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3D,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,8FAA8F;QAC9F,gFAAgF;QAChF,OAAO,CAAC,2EAA2E,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,EAAE;aACjB,WAAW,EAAE;aACb,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,oDAAoD,KAAK,CAAC,MAAM,qDAAqD,EAAE,MAAM,CAAC,CAAC;IACzI,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,gGAAgG;IAChG,+CAA+C;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;IAEjD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,MAAM;YACJ,CAAC,CAAC,QAAQ,KAAK,uCAAuC,MAAM,6EAA6E;YACzI,CAAC,CAAC,QAAQ,KAAK,kGAAkG,CACpH,CAAC;QACF,IAAI,YAAY;YAAE,KAAK,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC3I,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,sBAAsB,KAAK,yBAAyB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzH,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,0FAA0F,CAAC,CAAC;IAE3I,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;IACjH,CAAC;IAED,qNAAqN;IACrN,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,IAAI,WAAW,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,EAAE,CAAC;YACjD,CAAC;YACD,sNAAsN;YACtN,KAAK,CAAC,IAAI,CACR,OAAO,KAAK,CAAC;gBACX,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,uCAAuC,KAAK,CAAC,OAAO,CAAC,KAAK,qDAAqD;oBACjH,CAAC,CAAC,oCAAoC,KAAK,CAAC,OAAO,CAAC,KAAK,2CAA2C;gBACtG,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,GAAG,OAAO,4CAA4C,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG;oBAC9E,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,qCAAqC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,CACvF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,6DAA6D,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/agent/approvals/eve-response-policy.d.ts

@@ -0,0 +1,22 @@
+import type { ApprovalResponseDecision, ApprovalResponsePolicy } from "eve/tools/approval";
+/** eve's `SessionAuthContext`, narrowed to the fields this comparison reads. Declared locally
+ *  because eve does not export the channel type from a public entry point; the four fields are
+ *  eve's own candidate-identity tuple (harness/approval-delivery-coordinator.js
+ *  `approvalCandidateIdPrefix`), so this narrowing cannot drift from the thing it mirrors. */
+export interface ResponderIdentity {
+    readonly authenticator: string;
+    readonly issuer?: string;
+    readonly principalId: string;
+    readonly principalType: string;
+}
+/** The refusal a rejected responder's candidate carries. eve surfaces it on the
+ *  `approval.candidate` event (`outcome: "rejected"`, `reason`). Says the same three things every
+ *  OE refusal says: nothing was applied, the request is STILL PENDING, and who can unblock it. */
+export declare const FOREIGN_RESPONDER_REASON = "Only the person who asked for this can approve it. Nothing was applied and the request is still pending.";
+/** Do these two identities name the SAME principal? All four fields must agree, with a missing `issuer` compared as the empty string on both sides, exactly as eve's own candidate-id derivation does. Pure and total: no throw, no I/O. */
+export declare function sameResponder(a: ResponderIdentity | null | undefined, b: ResponderIdentity | null | undefined): boolean;
+/** Decide one responder against one session initiator. No initiator allows — a routine fire or send()-created wake has nobody to bind the click to, and rejecting would park the request forever. The same principal allows; anyone else is rejected, which leaves the request PENDING. */
+export declare function decideResponder(responder: ResponderIdentity | null | undefined, initiator: ResponderIdentity | null | undefined): ApprovalResponseDecision;
+/** The response policy OE authors on its eve-native approval sites, binding the Approve click to the session initiator. Authoring it is also the SWITCH that routes the request onto eve's candidate path — a call site that forgets it silently keeps the pre-adoption "any authenticated clicker may approve" behaviour. */
+export declare function initiatorBoundResponsePolicy<TInput = Record<string, unknown>>(): ApprovalResponsePolicy<TInput>;
+//# sourceMappingURL=eve-response-policy.d.ts.map

package/dist/agent/approvals/eve-response-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-response-policy.d.ts","sourceRoot":"","sources":["../../../agent/approvals/eve-response-policy.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE3F;;;8FAG8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;kGAEkG;AAClG,eAAO,MAAM,wBAAwB,6GACuE,CAAC;AAE7G,4OAA4O;AAC5O,wBAAgB,aAAa,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAQvH;AAED,2RAA2R;AAC3R,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC/C,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC9C,wBAAwB,CAI1B;AAED,8TAA8T;AAC9T,wBAAgB,4BAA4B,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAE/G"}

package/dist/agent/approvals/eve-response-policy.js

@@ -0,0 +1,27 @@
+// This policy can refuse a RESPONDER, never deny a request — eve's `rejected` keeps the shared request pending — and eve runs it on the APPROVE leg only, so any authenticated clicker can still CANCEL any eve-native confirmation. That is denial of service rather than escalation, which is why an eve-native confirmation stays legal only at consequence tier "open". Keep it PURE and SYNCHRONOUS: eve wraps it in a hardcoded 10 second timeout and a timeout fails the candidate, so no database, platform API or config read may go here.
+/** The refusal a rejected responder's candidate carries. eve surfaces it on the
+ *  `approval.candidate` event (`outcome: "rejected"`, `reason`). Says the same three things every
+ *  OE refusal says: nothing was applied, the request is STILL PENDING, and who can unblock it. */
+export const FOREIGN_RESPONDER_REASON = "Only the person who asked for this can approve it. Nothing was applied and the request is still pending.";
+/** Do these two identities name the SAME principal? All four fields must agree, with a missing `issuer` compared as the empty string on both sides, exactly as eve's own candidate-id derivation does. Pure and total: no throw, no I/O. */
+export function sameResponder(a, b) {
+    if (a === null || a === undefined || b === null || b === undefined)
+        return false;
+    return (a.authenticator === b.authenticator &&
+        (a.issuer ?? "") === (b.issuer ?? "") &&
+        a.principalType === b.principalType &&
+        a.principalId === b.principalId);
+}
+/** Decide one responder against one session initiator. No initiator allows — a routine fire or send()-created wake has nobody to bind the click to, and rejecting would park the request forever. The same principal allows; anyone else is rejected, which leaves the request PENDING. */
+export function decideResponder(responder, initiator) {
+    if (initiator === null || initiator === undefined)
+        return { status: "allowed" };
+    if (sameResponder(responder, initiator))
+        return { status: "allowed" };
+    return { reason: FOREIGN_RESPONDER_REASON, status: "rejected" };
+}
+/** The response policy OE authors on its eve-native approval sites, binding the Approve click to the session initiator. Authoring it is also the SWITCH that routes the request onto eve's candidate path — a call site that forgets it silently keeps the pre-adoption "any authenticated clicker may approve" behaviour. */
+export function initiatorBoundResponsePolicy() {
+    return (ctx) => decideResponder(ctx.responder, ctx.session.initiator);
+}
+//# sourceMappingURL=eve-response-policy.js.map

package/dist/agent/approvals/eve-response-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-response-policy.js","sourceRoot":"","sources":["../../../agent/approvals/eve-response-policy.ts"],"names":[],"mappings":"AAAA,ohBAAohB;AAiBphB;;kGAEkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GACnC,0GAA0G,CAAC;AAE7G,4OAA4O;AAC5O,MAAM,UAAU,aAAa,CAAC,CAAuC,EAAE,CAAuC;IAC5G,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACjF,OAAO,CACL,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QACnC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QACnC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAChC,CAAC;AACJ,CAAC;AAED,2RAA2R;AAC3R,MAAM,UAAU,eAAe,CAC7B,SAA+C,EAC/C,SAA+C;IAE/C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChF,IAAI,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAClE,CAAC;AAED,8TAA8T;AAC9T,MAAM,UAAU,4BAA4B;IAC1C,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,SAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,SAAqC,CAAC,CAAC;AACzH,CAAC"}