@open-everywhere/core 0.1.0

package/dist/agent/connections/notion.js

@@ -0,0 +1,35 @@
+// An eve *connection* — the host-side connector plane. The token is attached host-side and the call never
+// enters the sandbox, so the egress firewall does not gate it. The connection's runtime name is this slug.
+import { defineMcpClientConnection } from "eve/connections";
+import { connectorApprovalPolicy } from "./connector-auth.js";
+import { selectConnectorTransport } from "./connector-transport.js";
+// ⚠ LIVE (2026-07-21): hosted mcp.notion.com accepts tokens from its OWN MCP-OAuth flow only — it 401s
+// integration secrets and public OAuth tokens alike. Only the own-rolled oe-oauth flow arms this — the user
+// subject in a DM (`user-oauth`), and since OPE-1914 the app subject for the org credential (`workspace-oauth`).
+const NOTION_MCP_URL = "https://mcp.notion.com/mcp";
+// Transport selection runs ONCE at module load; the settings it depends on are read PER CALL, because this
+// module is scan-mounted and can evaluate before `registerSettings()`. Recording the SPEC here is deliberate.
+const transport = selectConnectorTransport({
+    connector: "notion",
+    provider: "notion",
+    directUrl: NOTION_MCP_URL,
+    fallbackSecretRef: "NOTION_API_KEY",
+    fallbackBroker: "env",
+});
+export default defineMcpClientConnection({
+    url: transport.url,
+    description: "Notion workspace (MCP): search and read pages/databases, AND — when the connected " +
+        "integration has edit access — create/update pages and append blocks. This is the team's " +
+        "read/WRITE knowledge base: answer questions grounded in it, and record durable notes back " +
+        "into the page/database a channel points you at. Append under the right heading; don't " +
+        "rewrite whole pages. Notion's API owns the block model, so there's no markdown round-trip.",
+    // The provider-routed builder: the per-surface HARD GATE runs first, then it resolves WHICH credential this
+    // surface is bound to, so ten domains can use ten keys. The per-user arm changes the SUBJECT, never the gate.
+    auth: transport.auth,
+    // Defence in depth over the hard gates. Armed, it gates per op — reads never prompt, a write prompts once
+    // per session; off, it keeps eve's blanket `once()`.
+    approval: connectorApprovalPolicy(),
+});
+// The bound credential's `type` selects the OAuth path, and core carries no OAuth-vendor SDK import.
+// ENFORCEMENT: eve has no per-surface connection filter — `assertConnectorGranted` in getToken is the gate.
+//# sourceMappingURL=notion.js.map

package/dist/agent/connections/notion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion.js","sourceRoot":"","sources":["../../../agent/connections/notion.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,2GAA2G;AAE3G,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,uGAAuG;AACvG,4GAA4G;AAC5G,iHAAiH;AACjH,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAEpD,2GAA2G;AAC3G,8GAA8G;AAC9G,MAAM,SAAS,GAAG,wBAAwB,CAAC;IACzC,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,cAAc;IACzB,iBAAiB,EAAE,gBAAgB;IACnC,cAAc,EAAE,KAAK;CACtB,CAAC,CAAC;AAEH,eAAe,yBAAyB,CAAC;IACvC,GAAG,EAAE,SAAS,CAAC,GAAG;IAClB,WAAW,EACT,oFAAoF;QACpF,0FAA0F;QAC1F,4FAA4F;QAC5F,wFAAwF;QACxF,4FAA4F;IAE9F,4GAA4G;IAC5G,8GAA8G;IAC9G,IAAI,EAAE,SAAS,CAAC,IAAI;IAEpB,0GAA0G;IAC1G,qDAAqD;IACrD,QAAQ,EAAE,uBAAuB,EAAE;CACpC,CAAC,CAAC;AAEH,qGAAqG;AACrG,4GAA4G"}

package/dist/agent/connections/oe-oauth-callback.d.ts

@@ -0,0 +1,61 @@
+import { resumeAfterConsent } from "./consent-resume.js";
+import type { ConsentCarriage } from "./user-auth-flow.js";
+import { appendAudit } from "../audit/audit.js";
+/** The mounted route path — GET ?state=<opaque>&code=<code> (or &error=…). */
+export declare const OE_OAUTH_CALLBACK_PATH = "/oauth/v1/callback";
+/** The verbatim `state` (opaque single-use id the adapter minted at startAuthorization) + provider
+ *  `code`. Never carries a secret. */
+export interface OeOauthCallbackArgs {
+    readonly state: string;
+    readonly code: string;
+}
+/** The completer's outcome — `ok` gates success vs failure rendering; `connectionName` + `detail`
+ *  are shown to the human. NEVER carries a secret (no token transits the callback page). */
+export interface OeOauthCallbackResult {
+    readonly ok: boolean;
+    readonly connectionName?: string;
+    readonly detail?: string;
+    /**
+     * WHICH vault subject the completed consent bound — `app` is the deployment-wide org row every granting
+     * domain spends, `user` is one person's row. Only the TYPE is audited, never the id (see
+     * {@link auditCredentialBound}), and it is never rendered (OPE-1937).
+     */
+    readonly subject?: {
+        readonly type: "app";
+    } | {
+        readonly type: "user";
+        readonly id: string;
+    };
+    /**
+     * Did the bind REPLACE an existing row for that subject? `storeToken` is last-write-wins, so a second
+     * admin's consent silently swaps the credential; this is the flag that puts the swap in the ledger.
+     */
+    readonly rebound?: boolean;
+    /**
+     * The consent carriage the pending row was minted with, handed straight back by the adapter. Present only
+     * when the authorization started from a detour that had a conversation to return to.
+     */
+    readonly consent?: ConsentCarriage;
+}
+/** The injected exchange step (the adapter's code→token + vault store). */
+export type OeOauthCallbackCompleter = (args: OeOauthCallbackArgs) => Promise<OeOauthCallbackResult>;
+/** Called at boot by the adapter's registerOeOauth, only when the OE_OAUTH master flag is armed. */
+export declare function registerOeOauthCallbackCompleter(fn: OeOauthCallbackCompleter): void;
+/** Test seam / rollback: forget the registered completer (the fail-closed 404 path). */
+export declare function resetOeOauthCallbackCompleter(): void;
+/** The registered completer, or null when the own-rolled OAuth adapter is not armed. */
+export declare function resolveOeOauthCallbackCompleter(): OeOauthCallbackCompleter | null;
+/**
+ * Handles the callback: 404 not armed, 400 declined or missing param, 502 exchange rejected, 200 authorized.
+ * It only ever returns an inline page, so a crafted query cannot bounce the browser — never an open redirect.
+ */
+export declare function handleOeOauthCallback(req: Request, complete: OeOauthCallbackCompleter | null, deps?: OeOauthCallbackDeps): Promise<Response>;
+/** The injected resume seam (OPE-1619). Absent ⇒ the live consent-resume plane. */
+export interface OeOauthCallbackDeps {
+    readonly resume?: typeof resumeAfterConsent;
+    /** The audit sink (OPE-1937). Absent ⇒ the live ledger. */
+    readonly audit?: typeof appendAudit;
+    /** The deployment's org for the audited row. Absent ⇒ the live deployment identity. */
+    readonly org?: () => string;
+}
+//# sourceMappingURL=oe-oauth-callback.d.ts.map

package/dist/agent/connections/oe-oauth-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oe-oauth-callback.d.ts","sourceRoot":"","sources":["../../../agent/connections/oe-oauth-callback.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyB,kBAAkB,EAA6B,MAAM,qBAAqB,CAAC;AAC3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;sCACsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;4FAC4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7F;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,MAAM,wBAAwB,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAIrG,oGAAoG;AACpG,wBAAgB,gCAAgC,CAAC,EAAE,EAAE,wBAAwB,GAAG,IAAI,CAEnF;AAED,wFAAwF;AACxF,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED,wFAAwF;AACxF,wBAAgB,+BAA+B,IAAI,wBAAwB,GAAG,IAAI,CAEjF;AAeD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,wBAAwB,GAAG,IAAI,EACzC,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CA0CnB;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC5C,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,WAAW,CAAC;IACpC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B"}

package/dist/agent/connections/oe-oauth-callback.js

@@ -0,0 +1,142 @@
+// Port half of the eve-mounted `GET /oauth/v1/callback`: the adapter's completer runs the code→token
+// exchange. No completer ⇒ 404, so the route is inert until the adapter arms. `state` is opaque, never logged.
+// A successful completion leaves a `connector.credential_bound` audit row (OPE-1937) — see
+// `auditCredentialBound` for what it carries and why it names no principal at all.
+import { asConsentResumeRecord, resumeAfterConsent } from "./consent-resume.js";
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/binding.js";
+/** The mounted route path — GET ?state=<opaque>&code=<code> (or &error=…). */
+export const OE_OAUTH_CALLBACK_PATH = "/oauth/v1/callback";
+let registered;
+/** Called at boot by the adapter's registerOeOauth, only when the OE_OAUTH master flag is armed. */
+export function registerOeOauthCallbackCompleter(fn) {
+    registered = fn;
+}
+/** Test seam / rollback: forget the registered completer (the fail-closed 404 path). */
+export function resetOeOauthCallbackCompleter() {
+    registered = undefined;
+}
+/** The registered completer, or null when the own-rolled OAuth adapter is not armed. */
+export function resolveOeOauthCallbackCompleter() {
+    return registered ?? null;
+}
+function esc(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function page(status, title, body) {
+    const html = `<!doctype html><html lang="en"><head><meta charset="utf-8">` +
+        `<meta name="viewport" content="width=device-width,initial-scale=1">` +
+        `<title>${esc(title)}</title></head><body style="font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem">` +
+        `<h1 style="font-size:1.25rem">${esc(title)}</h1><p>${body}</p></body></html>`;
+    return new Response(html, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+}
+/**
+ * Handles the callback: 404 not armed, 400 declined or missing param, 502 exchange rejected, 200 authorized.
+ * It only ever returns an inline page, so a crafted query cannot bounce the browser — never an open redirect.
+ */
+export async function handleOeOauthCallback(req, complete, deps = {}) {
+    // Fail closed: no completer ⇒ the own-rolled OAuth layer is not armed ⇒ the route does not exist.
+    if (!complete)
+        return new Response("not found", { status: 404 });
+    const url = new URL(req.url);
+    const q = (name) => {
+        const v = (url.searchParams.get(name) ?? "").trim();
+        return v.length > 0 ? v : undefined;
+    };
+    const state = q("state");
+    const code = q("code");
+    const error = q("error");
+    if (error) {
+        const desc = q("error_description");
+        return page(400, "Authorization was not granted", `The provider returned <code>${esc(error)}</code>${desc ? `: ${esc(desc)}` : ""}. You can close this tab and try again.`);
+    }
+    if (!state)
+        return page(400, "Missing authorization state", "This link is missing its <code>state</code> parameter and cannot be completed.");
+    if (!code)
+        return page(400, "Missing authorization code", "This link is missing its <code>code</code> parameter and cannot be completed.");
+    let result;
+    try {
+        result = await complete({ state, code });
+    }
+    catch (err) {
+        return page(502, "Could not complete the connection", `The authorization exchange failed: ${esc(err instanceof Error ? err.message : String(err))}.`);
+    }
+    if (!result.ok) {
+        return page(502, "Could not complete the connection", `The authorization exchange was rejected${result.detail ? `: ${esc(result.detail)}` : ""}.`);
+    }
+    await auditCredentialBound(result, deps);
+    const resumed = await runConsentResume(result, deps);
+    return page(200, "Connection authorized", `The connection${result.connectionName ? ` <strong>${esc(result.connectionName)}</strong>` : ""} is now authorized. ` +
+        `${resumeClause(resumed)} You can close this tab.`);
+}
+/**
+ * Record the bind (OPE-1937). A consent completion is where a credential STARTS EXISTING — and, because
+ * `storeToken` is last-write-wins, where one may silently REPLACE another. Before this row the only trace
+ * was `connector.oauth_url_issued` from the click, which says a URL was issued and nothing about what the
+ * URL went on to bind.
+ *
+ * 🔴 WHAT THE ROW CARRIES, AND WHAT IT CANNOT. The connector, the subject type and the rebind flag. NEVER
+ * token material — no token transits this route at all.
+ * 🔴 AND IT NAMES NO PRINCIPAL, ON EITHER SUBJECT TYPE. On an APP subject the route genuinely has none:
+ * the callback authenticates nobody, so whoever opens the URL binds the row, and naming the clicker would
+ * be a guess. On a USER subject the only id in reach is the VAULT SUBJECT — `p:<org>/<platform>/<tenant>/
+ * <id>` (identity/oauth-vault-share.ts), or an `ls:` link-set id that names no person at all. The ledger's
+ * `principal_id` holds the BARE vendor id with the platform in its own column, so writing a vault subject
+ * there would bucket the row away from every other row that person produced. Who ASKED is already on the
+ * record: the click writes `connector.oauth_url_issued` naming the clicker. Naming who COMPLETED would
+ * take the subject decomposed against this row's platform/workspace columns, which this change does not do.
+ * Best-effort, like every audit write: the page still renders if it fails.
+ */
+async function auditCredentialBound(result, deps) {
+    const subject = result.subject;
+    if (!subject)
+        return; // a completer that reports no subject has nothing to declare — never a guessed row
+    try {
+        await (deps.audit ?? appendAudit)({
+            org: (deps.org ?? deploymentOrg)(),
+            platform: "oauth",
+            workspace: "callback",
+            action: "connector.credential_bound",
+            detail: {
+                connector: result.connectionName ?? "unknown",
+                subject: subject.type,
+                rebound: result.rebound === true,
+            },
+        });
+    }
+    catch {
+        /* the ledger write is best-effort — the human's page must render whatever the store does */
+    }
+}
+/**
+ * Resume the request this consent interrupted, if there was one. NEVER throws: the page must render whatever
+ * happens, so a resume failure is a page that says less, not a 502.
+ */
+async function runConsentResume(result, deps) {
+    const record = asConsentResumeRecord(result.consent);
+    if (!record)
+        return undefined;
+    try {
+        return await (deps.resume ?? resumeAfterConsent)(record);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * What the landing page says about the conversation the person came FROM. It states only what actually
+ * happened — the page is the one place a person can check whether their request survived.
+ */
+function resumeClause(outcome) {
+    if (!outcome)
+        return "";
+    if (!outcome.delivered)
+        return "Go back to your conversation and ask again — I could not reach it from here.";
+    switch (outcome.verdict) {
+        case "offer":
+            return "I've said so in your conversation — tell me there to carry on with the request you paused.";
+        case "expired":
+            return "The request you paused is too old to pick up on its own; ask me again in your conversation.";
+    }
+}
+//# sourceMappingURL=oe-oauth-callback.js.map

package/dist/agent/connections/oe-oauth-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oe-oauth-callback.js","sourceRoot":"","sources":["../../../agent/connections/oe-oauth-callback.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,+GAA+G;AAC/G,2FAA2F;AAC3F,mFAAmF;AAEnF,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAA6B,MAAM,qBAAqB,CAAC;AAE3G,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAoC3D,IAAI,UAAgD,CAAC;AAErD,oGAAoG;AACpG,MAAM,UAAU,gCAAgC,CAAC,EAA4B;IAC3E,UAAU,GAAG,EAAE,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,6BAA6B;IAC3C,UAAU,GAAG,SAAS,CAAC;AACzB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,+BAA+B;IAC7C,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY;IACvD,MAAM,IAAI,GACR,6DAA6D;QAC7D,qEAAqE;QACrE,UAAU,GAAG,CAAC,KAAK,CAAC,kHAAkH;QACtI,iCAAiC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAAC;IACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAY,EACZ,QAAyC,EACzC,IAAI,GAAwB,EAAE;IAE9B,kGAAkG;IAClG,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,IAAY,EAAsB,EAAE;QAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAEzB,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACpC,OAAO,IAAI,CACT,GAAG,EACH,+BAA+B,EAC/B,+BAA+B,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,yCAAyC,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,6BAA6B,EAAE,gFAAgF,CAAC,CAAC;IAC9I,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,4BAA4B,EAAE,+EAA+E,CAAC,CAAC;IAE3I,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,EAAE,mCAAmC,EAAE,sCAAsC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACxJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,GAAG,EAAE,mCAAmC,EAAE,0CAA0C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrJ,CAAC;IACD,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,IAAI,CACT,GAAG,EACH,uBAAuB,EACvB,iBAAiB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,sBAAsB;QACnH,GAAG,YAAY,CAAC,OAAO,CAAC,0BAA0B,CACrD,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,oBAAoB,CAAC,MAA6B,EAAE,IAAyB;IAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,mFAAmF;IACzG,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;YAChC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,EAAE;YAClC,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE,4BAA4B;YACpC,MAAM,EAAE;gBACN,SAAS,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;gBAC7C,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;IAC9F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA6B,EAC7B,IAAyB;IAEzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAyC;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,8EAA8E,CAAC;IAC9G,QAAQ,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,4FAA4F,CAAC;QACtG,KAAK,SAAS;YACZ,OAAO,6FAA6F,CAAC;IACzG,CAAC;AACH,CAAC"}

package/dist/agent/connections/own-account-ask.d.ts

@@ -0,0 +1,120 @@
+import type { CredentialGrantFamily } from "../access/connector-credentials.js";
+/** One vendor, as the grammar recognises it: the connector id plus the words a person writes for it. */
+export interface OwnAccountVendor {
+    /** The connector id the rest of the access plane uses, e.g. `notion`. */
+    readonly connector: string;
+    /** Lower-case words a person writes for this vendor. The connector id itself need not be repeated. */
+    readonly aliases?: readonly string[];
+}
+/**
+ * A recognised ask. 🔴 It carries NO member words: the audit record is append-only with no delete path, so a
+ * quoted sentence would sit outside the erasure path forever. It records THAT an ask was recognised.
+ */
+export interface OwnAccountAsk {
+    readonly connector: string;
+    /**
+     * The same sentence also named the TEAM's account, so which identity the member meant cannot be
+     * read off it. Refused rather than resolved — see {@link decideActingIdentity}.
+     */
+    readonly ambiguous: boolean;
+}
+/**
+ * Which vendor the requester asked to act AS THEMSELVES for. 🔴 `messages` must be ONE person's own words:
+ * handing it tool output or an envelope would let somebody else's text ask for this requester's credential.
+ */
+export declare function namedOwnAccountVendor(messages: readonly string[], vendors: readonly OwnAccountVendor[]): OwnAccountAsk | undefined;
+/** Why the acting identity came out the way it did — the `why` half of the audit row, and a closed
+ *  set so a reader can count rows by reason rather than by parsing a sentence. */
+export type ActingIdentityReason = 
+/** No requester sentence named an account. The ordinary path, and unchanged behaviour. */
+"no-own-account-ask"
+/** The requester named their own account and this chat holds a live personal grant for the vendor. */
+ | "own-account-ask-grant-held"
+/** The requester named their own account and no personal grant exists. REFUSED. */
+ | "own-account-ask-no-grant"
+/** One sentence named their own account AND the team's. REFUSED, with a question back. */
+ | "own-account-ask-ambiguous";
+/**
+ * The gate's answer. 🔴 `identity` is absent exactly when `refusal` is present: `requiredIdentity` is what
+ * the REQUEST needs, `identity` is what the caller may run under. A caller keys on `refusal` first.
+ */
+export interface ActingIdentityVerdict {
+    /** What the request requires. Always present, and what the audit row reports. */
+    readonly requiredIdentity: CredentialGrantFamily;
+    /** What the caller may run under. Present iff `refusal` is absent. */
+    readonly identity?: CredentialGrantFamily;
+    readonly reason: ActingIdentityReason;
+    /** The sentence to give the model, present iff the call is refused. */
+    readonly refusal?: string;
+    /** An own-account ask was recognised this turn. Audit material — never the words themselves. */
+    readonly askRecognised: boolean;
+}
+/** What the caller knows about the routes out of a refusal. All facts about THIS chat, resolved by
+ *  the gate, never guessed here. */
+export interface ActingIdentityInput {
+    readonly connector: string;
+    /** The recognised ask, or undefined when the requester named no account. */
+    readonly ask?: OwnAccountAsk;
+    /** This chat holds a live personal grant for `connector`. */
+    readonly personalGrantHeld: boolean;
+    /**
+     * The personal-consent route can be raised from here at all. 🔴 It changes the SENTENCE, never the verdict:
+     * both arms refuse, and offering a route that is not mounted is the same silent failure one layer up.
+     */
+    readonly consentRouteAvailable: boolean;
+    /**
+     * The DEPLOYMENT half of the consent route. It separates a FIXABLE absence from a structural one: naming a
+     * domain fix for a vendor this tree lends nothing for sends an operator to a config that cannot help.
+     */
+    readonly deploymentAdmitsGrant: boolean;
+    /**
+     * THIS caller can issue the call under the requester's OWN credential. False for every team-credential read
+     * tool here: a personal grant is spent by the mounted `grant__…` tool, so a held grant does not let this run.
+     */
+    readonly callerCanSpendPersonal: boolean;
+}
+/**
+ * The decision, and the one place the four arms are written down. 🔴 No arm answers an own-account ask with
+ * the `install` identity — that combination is the defect, not a fallback and not the ambiguous answer.
+ */
+export declare function decideActingIdentity(input: ActingIdentityInput): ActingIdentityVerdict;
+/**
+ * What the model is told when an own-account ask has no personal grant behind it. It is an instruction to
+ * SPEAK, not an error to retry, and there are THREE route sentences because a member acts on each state.
+ */
+export declare function ownAccountRefusal(connector: string, consentRouteAvailable: boolean, deploymentAdmitsGrant: boolean): string;
+/**
+ * What the model is told when one sentence named BOTH accounts. It asks rather than guessing: both guesses
+ * are wrong in a way the member cannot see from the answer.
+ */
+export declare function ambiguousAccountRefusal(connector: string): string;
+/**
+ * What the model is told when the account IS lent to this chat but the calling tool has no arm to spend it.
+ * It names the route: the granted `grant__…` tool is the one that runs under their credential.
+ */
+export declare function personalRouteRefusal(connector: string): string;
+/**
+ * The audit action written at the DECISION POINT — the moment the host recognises that this delivery asks
+ * the agent to act with the requester's own account. 🔴 IT IS NOT A SECOND COPY OF
+ * `connector.acting_identity`, and the difference is the whole point: that row is written per
+ * gated connector READ, so a turn the seat answers by refusing WITHOUT reading writes none at all. Refusing
+ * without reading is the CORRECT outcome (own-account = honest refusal), and until this row it was the one
+ * outcome no auditor and no e2e leg could observe — an absence that reads exactly like a turn that never
+ * happened. The two rows join on the turn: this one says a person asked, the acting-identity rows say which
+ * credential each read then chose.
+ */
+export declare const CONNECTOR_OWN_ACCOUNT_ASK_ACTION = "connector.own_account_ask";
+/**
+ * The audit detail for one RECOGNISED own-account ask. 🔴 NO member words, ever — the same rule
+ * {@link actingIdentityAuditDetail} states, and for the same reason: the record has no delete path.
+ *
+ * `outcome` is the closed answer to "what must this turn do now", which is what makes the row scoreable
+ * on its own. It is NOT the credential the turn ended up spending: nothing has read a grant yet.
+ */
+export declare function ownAccountAskAuditDetail(ask: OwnAccountAsk, stamped: boolean): Record<string, unknown>;
+/**
+ * The audit detail for one acting-identity decision: identifiers and a closed reason. 🔴 NO member words,
+ * ever — the record is append-only, so a quoted sentence would sit outside the erasure path forever.
+ */
+export declare function actingIdentityAuditDetail(verdict: ActingIdentityVerdict, connector: string, tool: string): Record<string, unknown>;
+//# sourceMappingURL=own-account-ask.d.ts.map

package/dist/agent/connections/own-account-ask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"own-account-ask.d.ts","sourceRoot":"","sources":["../../../agent/connections/own-account-ask.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sGAAsG;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AA4ED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,aAAa,GAAG,SAAS,CAUlI;AAED;kFACkF;AAClF,MAAM,MAAM,oBAAoB;AAC9B,0FAA0F;AACxF,oBAAoB;AACtB,sGAAsG;GACpG,4BAA4B;AAC9B,mFAAmF;GACjF,0BAA0B;AAC5B,0FAA0F;GACxF,2BAA2B,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;IACjD,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED;oCACoC;AACpC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,GAAG,qBAAqB,CA0BtF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAG,MAAM,CAgB3H;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMjE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAO9D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,8BAA8B,CAAC;AAM5E;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYtG;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUlI"}

package/dist/agent/connections/own-account-ask.js

@@ -0,0 +1,204 @@
+// The "use my own account" ask, and the ACTING IDENTITY it decides. Once an account is named, no arm falls
+// back to the `install` credential: a silent substitution answers a member's question with the org's view.
+/** The ACCOUNT noun. Deliberately short and singular: every plural and every abstract noun that was
+ *  tried here ("accounts", "identity", "workspace access") matched ordinary business language. */
+const ACCOUNT_NOUN_RE = "(?:account|login|credential|credentials|oauth|token)";
+/**
+ * First-person possession of an account, WITHOUT naming the vendor. 🔴 NO FILLER between the possessive and
+ * the noun: a possessive clause that names some other account holder is not this vendor's ask.
+ */
+const OWN_POSSESSIVE_RE = new RegExp(String.raw `\bmy\s+(?:own|personal)\s+${ACCOUNT_NOUN_RE}\b`);
+/**
+ * How far from a vendor-free possessive clause the vendor's own name may sit and still be ITS name. The
+ * clause must be BOUND to the vendor, or "my own account at the bank" refuses a Notion read.
+ */
+const VENDOR_ADJACENCY_WORDS = 3;
+/** The one shape that makes a sentence AMBIGUOUS: it also names the team/org/shared account. A
+ *  member who writes "use my own account, not the team account" has named both, and picking either
+ *  silently is the defect in one direction or a broken tool in the other. */
+const TEAM_ACCOUNT_RE = /\b(?:team|org|organisation|organization|shared|company|workspace|deployment|default)(?:'s)?\s+(?:\S+\s+)?(?:account|integration|credential|credentials|key|token|login)\b/;
+/** Sentence split, on terminators and newlines. The grammar's window is ONE sentence: "read my own
+ *  page. Use Notion." names no account with a vendor and must not be read as if it did. */
+function sentencesOf(text) {
+    return text
+        .split(/(?<=[.!?;])\s+|\n+/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/** The words that name `vendor` — its connector id plus whatever aliases it declares, lower-cased,
+ *  regex-escaped (an alias like `notion.so` carries a metacharacter). */
+function vendorWords(vendor) {
+    return [vendor.connector, ...(vendor.aliases ?? [])]
+        .map((w) => w.toLowerCase())
+        .filter((w) => w.length > 0)
+        .map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+}
+/** `my <vendor> <account noun>` — the arm that lets bare `my` match, and only when the VENDOR's own
+ *  name sits between it and the noun. That is what tells "my notion account" from "my account
+ *  manager". */
+function vendorPossessiveRe(vendor) {
+    return new RegExp(String.raw `\bmy\s+(?:own\s+|personal\s+)?(?:${vendorWords(vendor).join("|")})\s+${ACCOUNT_NOUN_RE}\b`);
+}
+/**
+ * Is a vendor-free possessive clause bound to THIS vendor by adjacency? The window is words, counted out
+ * from the clause in both directions. A vendor word INSIDE the clause is arm A's business, not this one's.
+ */
+function possessiveBoundToVendor(lower, vendor) {
+    const match = OWN_POSSESSIVE_RE.exec(lower);
+    if (match === null)
+        return false;
+    const before = lower.slice(0, match.index).split(/\s+/).filter(Boolean).slice(-VENDOR_ADJACENCY_WORDS);
+    const after = lower
+        .slice(match.index + match[0].length)
+        .split(/\s+/)
+        .filter(Boolean)
+        .slice(0, VENDOR_ADJACENCY_WORDS);
+    const window = [...before, ...after].join(" ");
+    return vendorWords(vendor).some((w) => new RegExp(w).test(window));
+}
+/**
+ * Does this sentence name `vendor` AND ask for the requester's own account with it? 🔴 The possessive is
+ * BOUND to the vendor, never merely co-resident: arm A names it inside the clause, arm B requires adjacency.
+ */
+function sentenceNamesOwnAccount(sentence, vendor) {
+    const lower = sentence.toLowerCase();
+    if (!vendorWords(vendor).some((w) => new RegExp(w).test(lower)))
+        return false;
+    return vendorPossessiveRe(vendor).test(lower) || possessiveBoundToVendor(lower, vendor);
+}
+/**
+ * Which vendor the requester asked to act AS THEMSELVES for. 🔴 `messages` must be ONE person's own words:
+ * handing it tool output or an envelope would let somebody else's text ask for this requester's credential.
+ */
+export function namedOwnAccountVendor(messages, vendors) {
+    for (const message of messages) {
+        for (const sentence of sentencesOf(message)) {
+            for (const vendor of vendors) {
+                if (!sentenceNamesOwnAccount(sentence, vendor))
+                    continue;
+                return { ambiguous: TEAM_ACCOUNT_RE.test(sentence.toLowerCase()), connector: vendor.connector };
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * The decision, and the one place the four arms are written down. 🔴 No arm answers an own-account ask with
+ * the `install` identity — that combination is the defect, not a fallback and not the ambiguous answer.
+ */
+export function decideActingIdentity(input) {
+    if (input.ask === undefined)
+        return { askRecognised: false, identity: "install", reason: "no-own-account-ask", requiredIdentity: "install" };
+    // AMBIGUOUS FIRST. A sentence naming both accounts cannot be resolved by reading it harder, and
+    // the shipped behaviour it would otherwise fall back to IS the defect — so it asks.
+    if (input.ask.ambiguous) {
+        return {
+            askRecognised: true,
+            reason: "own-account-ask-ambiguous",
+            refusal: ambiguousAccountRefusal(input.connector),
+            requiredIdentity: "human-acting",
+        };
+    }
+    if (input.personalGrantHeld) {
+        return {
+            askRecognised: true,
+            reason: "own-account-ask-grant-held",
+            requiredIdentity: "human-acting",
+            ...(input.callerCanSpendPersonal ? { identity: "human-acting" } : { refusal: personalRouteRefusal(input.connector) }),
+        };
+    }
+    return {
+        askRecognised: true,
+        reason: "own-account-ask-no-grant",
+        refusal: ownAccountRefusal(input.connector, input.consentRouteAvailable, input.deploymentAdmitsGrant),
+        requiredIdentity: "human-acting",
+    };
+}
+/**
+ * What the model is told when an own-account ask has no personal grant behind it. It is an instruction to
+ * SPEAK, not an error to retry, and there are THREE route sentences because a member acts on each state.
+ */
+export function ownAccountRefusal(connector, consentRouteAvailable, deploymentAdmitsGrant) {
+    const opening = `Refused: this request asks to act with the requester's own ${connector} account, and this chat holds no personal ` +
+        `${connector} grant. Reading under the deployment's ${connector} integration would answer as the org, not as them, ` +
+        `and they would have no way to see the difference.`;
+    const route = consentRouteAvailable
+        ? `Hand this to a task: the task raises the ask with \`request_credential_grant\`, which lives there and nowhere else. ` +
+            `Then tell the room the ask went out.`
+        : deploymentAdmitsGrant
+            ? `This chat cannot raise a personal ${connector} grant — no domain here admits one — so there is no consent flow to start.`
+            : `This deployment cannot lend a personal ${connector} account at all: ${connector} admits no credential grant, so ` +
+                `there is no consent flow to start and no domain setting opens one. Do not tell them to connect their account.`;
+    const fallback = `Otherwise say plainly, in the room, that you cannot act as them on ${connector}, and that you will use the shared ` +
+        `${connector} integration only if they agree to it. Do not read under the shared integration until they say so.`;
+    return `${opening} ${route} ${fallback}`;
+}
+/**
+ * What the model is told when one sentence named BOTH accounts. It asks rather than guessing: both guesses
+ * are wrong in a way the member cannot see from the answer.
+ */
+export function ambiguousAccountRefusal(connector) {
+    return (`Refused: this request names the requester's own ${connector} account AND the shared ${connector} integration in one ` +
+        `sentence, so which account to act with cannot be read off it. Ask them in the room which they mean. Do not choose ` +
+        `for them — the two see different pages, and the answer would not say which one it came from.`);
+}
+/**
+ * What the model is told when the account IS lent to this chat but the calling tool has no arm to spend it.
+ * It names the route: the granted `grant__…` tool is the one that runs under their credential.
+ */
+export function personalRouteRefusal(connector) {
+    return (`Refused: this request asks to act with the requester's own ${connector} account, and they have already lent it to ` +
+        `this chat. This tool reads under the deployment's shared ${connector} integration, so running it here would answer ` +
+        `as the org after they said "as me". The granted \`grant__…_${connector}__…\` tool is the one that runs under their ` +
+        `credential, and it lives on this conversation's TASKS. Hand the read to a task.`);
+}
+/**
+ * The audit action written at the DECISION POINT — the moment the host recognises that this delivery asks
+ * the agent to act with the requester's own account. 🔴 IT IS NOT A SECOND COPY OF
+ * `connector.acting_identity`, and the difference is the whole point: that row is written per
+ * gated connector READ, so a turn the seat answers by refusing WITHOUT reading writes none at all. Refusing
+ * without reading is the CORRECT outcome (own-account = honest refusal), and until this row it was the one
+ * outcome no auditor and no e2e leg could observe — an absence that reads exactly like a turn that never
+ * happened. The two rows join on the turn: this one says a person asked, the acting-identity rows say which
+ * credential each read then chose.
+ */
+export const CONNECTOR_OWN_ACCOUNT_ASK_ACTION = "connector.own_account_ask";
+/** What an own-account ask REQUIRES, restated on the recognition row. The credential choice has not been
+ *  made at this point — no grant has been read — so the row reports the requirement, never a grant. */
+const OWN_ACCOUNT_REQUIRED_IDENTITY = "human-acting";
+/**
+ * The audit detail for one RECOGNISED own-account ask. 🔴 NO member words, ever — the same rule
+ * {@link actingIdentityAuditDetail} states, and for the same reason: the record has no delete path.
+ *
+ * `outcome` is the closed answer to "what must this turn do now", which is what makes the row scoreable
+ * on its own. It is NOT the credential the turn ended up spending: nothing has read a grant yet.
+ */
+export function ownAccountAskAuditDetail(ask, stamped) {
+    return {
+        askRecognised: true,
+        connector: ask.connector,
+        // Recognition can only tell the two refusals apart — an ambiguous sentence is refused by reading it,
+        // and every other ask is refused unless this chat turns out to hold a live personal grant.
+        outcome: ask.ambiguous ? "refuse-ambiguous" : "refuse-unless-grant-held",
+        requiredIdentity: OWN_ACCOUNT_REQUIRED_IDENTITY,
+        /** The stamp reached this delivery's auth bag, so a worker dispatched later this turn inherits the ask.
+         *  `false` means only the SEAT's own words carry it — a delegated read would not see it. */
+        stamped,
+    };
+}
+/**
+ * The audit detail for one acting-identity decision: identifiers and a closed reason. 🔴 NO member words,
+ * ever — the record is append-only, so a quoted sentence would sit outside the erasure path forever.
+ */
+export function actingIdentityAuditDetail(verdict, connector, tool) {
+    return {
+        askRecognised: verdict.askRecognised,
+        connector,
+        ...(verdict.identity === undefined ? {} : { identity: verdict.identity }),
+        reason: verdict.reason,
+        refused: verdict.refusal !== undefined,
+        requiredIdentity: verdict.requiredIdentity,
+        tool,
+    };
+}
+//# sourceMappingURL=own-account-ask.js.map

package/dist/agent/connections/own-account-ask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"own-account-ask.js","sourceRoot":"","sources":["../../../agent/connections/own-account-ask.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,2GAA2G;AA2B3G;kGACkG;AAClG,MAAM,eAAe,GAAG,sDAAsD,CAAC;AAE/E;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,6BAA6B,eAAe,IAAI,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;6EAE6E;AAC7E,MAAM,eAAe,GACnB,2KAA2K,CAAC;AAE9K;2FAC2F;AAC3F,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI;SACR,KAAK,CAAC,oBAAoB,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;yEACyE;AACzE,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;gBAEgB;AAChB,SAAS,kBAAkB,CAAC,MAAwB;IAClD,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,oCAAoC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,eAAe,IAAI,CAAC,CAAC;AAC3H,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,KAAa,EAAE,MAAwB;IACtE,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,KAAK;SAChB,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACpC,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,QAAgB,EAAE,MAAwB;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B,EAAE,OAAoC;IACrG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,SAAS;gBACzD,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YAClG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAuDD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;IAC7I,gGAAgG;IAChG,oFAAoF;IACpF,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC;YACjD,gBAAgB,EAAE,cAAc;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,4BAA4B;YACpC,gBAAgB,EAAE,cAAc;YAChC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;SAC/H,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,0BAA0B;QAClC,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAAC;QACrG,gBAAgB,EAAE,cAAc;KACjC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,qBAA8B,EAAE,qBAA8B;IACjH,MAAM,OAAO,GACX,8DAA8D,SAAS,4CAA4C;QACnH,GAAG,SAAS,0CAA0C,SAAS,qDAAqD;QACpH,mDAAmD,CAAC;IACtD,MAAM,KAAK,GAAG,qBAAqB;QACjC,CAAC,CAAC,sHAAsH;YACtH,sCAAsC;QACxC,CAAC,CAAC,qBAAqB;YACrB,CAAC,CAAC,qCAAqC,SAAS,4EAA4E;YAC5H,CAAC,CAAC,0CAA0C,SAAS,oBAAoB,SAAS,kCAAkC;gBAClH,+GAA+G,CAAC;IACtH,MAAM,QAAQ,GACZ,sEAAsE,SAAS,qCAAqC;QACpH,GAAG,SAAS,oGAAoG,CAAC;IACnH,OAAO,GAAG,OAAO,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,CACL,mDAAmD,SAAS,2BAA2B,SAAS,sBAAsB;QACtH,oHAAoH;QACpH,8FAA8F,CAC/F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,CACL,8DAA8D,SAAS,6CAA6C;QACpH,4DAA4D,SAAS,gDAAgD;QACrH,8DAA8D,SAAS,8CAA8C;QACrH,iFAAiF,CAClF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,2BAA2B,CAAC;AAE5E;uGACuG;AACvG,MAAM,6BAA6B,GAA0B,cAAc,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAkB,EAAE,OAAgB;IAC3E,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,qGAAqG;QACrG,2FAA2F;QAC3F,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,0BAA0B;QACxE,gBAAgB,EAAE,6BAA6B;QAC/C;oGAC4F;QAC5F,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA8B,EAAE,SAAiB,EAAE,IAAY;IACvG,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS;QACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/agent/connections/own-account-carriage.d.ts

@@ -0,0 +1,33 @@
+import { type BindableContext } from "../identity/binding.js";
+import type { OwnAccountAsk } from "./own-account-ask.js";
+/** Auth attribute carrying a recognised own-account ask. Host-set, model-unforgeable (see
+ *  channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE). */
+export declare const OE_OWN_ACCOUNT_ASK_ATTR = "oe_own_account_ask";
+/**
+ * The stamp's TURN half when the producer could not read a turn id. 🔴 A named absence, not an empty field:
+ * it keeps the wire shape unambiguous against a session id holding a `|`, and no real turn id collides.
+ */
+export declare const TURN_UNKNOWN = "-";
+/**
+ * The stamp's wire shape: `<sessionId>|<turnId>|<connector>`, plus `|ambiguous` when the sentence named the
+ * team's account too. Identifiers and one flag — never the sentence. `turnId` is {@link TURN_UNKNOWN} where the
+ * producer could not read one, and {@link turnHalfAdmits} states when the turn half is compared at all.
+ */
+export declare function renderOwnAccountStamp(sessionId: string, turnId: string | undefined, ask: OwnAccountAsk): string;
+/**
+ * The stamp's fields, or undefined when the value is not a shape this build wrote. 🔴 A stamp from an older
+ * build resolves undefined and reads as NO ask — today's behaviour, and the safe floor.
+ */
+export declare function parseOwnAccountStamp(raw: string | undefined): {
+    readonly sessionId: string;
+    readonly turnId: string;
+    readonly ask: OwnAccountAsk;
+} | undefined;
+/**
+ * The ask this session runs under, or undefined. THREE comparisons, and all must pass: the session half, the
+ * CONNECTOR half (else a Notion ask answers a Linear caller), and the turn half. Fail-soft to undefined.
+ */
+export declare function adoptedOwnAccountAsk(ctx: BindableContext, vendors: readonly {
+    readonly connector: string;
+}[]): OwnAccountAsk | undefined;
+//# sourceMappingURL=own-account-carriage.d.ts.map