@open-everywhere/core 0.1.0

package/dist/agent/contributions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contributions.d.ts","sourceRoot":"","sources":["../../agent/contributions.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,aAAa;aACxB,aAAa,EAAE,CAAC;aAChB,OAAO,EAAE,uBAAuB;aAChC,aAAa;iBAET,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,gEAAgE;;iBAC9I,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,iCAAiC;iBAAE,OAAO,EAAE,kHAAkH;;iBAC9M,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,wNAAwN;;iBAC9S,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,QAAQ;iBAAE,MAAM,EAAE,uBAAuB;iBAAE,OAAO,EAAE,gFAAgF;;iBACxJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,KAAK;iBAAE,MAAM,EAAE,oBAAoB;iBAAE,OAAO,EAAE,oEAAoE;;iBACtI,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,kGAAkG;;iBACxL,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,oEAAoE;;iBAC5J,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,gLAAgL;;iBACxQ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,uGAAuG;;iBACjM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,iHAAiH;;iBACvM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,0BAA0B;iBAAE,MAAM,EAAE,yCAAyC;iBAAE,OAAO,EAAE,4KAA4K;;iBACxR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,mBAAmB;iBAAE,MAAM,EAAE,kCAAkC;iBAAE,OAAO,EAAE,+HAA+H;;iBAC7N,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,wHAAwH;;iBAC5M,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,wDAAwD;;iBAClJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,8LAA8L;;iBAClR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,kEAAkE;;iBAChJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,sHAAsH;;iBAC1M,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,0MAA0M;;iBAClS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,4KAA4K;;iBAChQ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,sHAAsH;;iBAC5M,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,wEAAwE;;iBAClK,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,gGAAgG;;iBACpL,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,iEAAiE;;iBACzJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,mMAAmM;;iBACjR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,2BAA2B;iBAAE,OAAO,EAAE,iFAAiF;;iBACjK,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,qLAAqL;;iBACzQ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,+LAA+L;;iBACvR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,oBAAoB;iBAAE,MAAM,EAAE,mCAAmC;iBAAE,OAAO,EAAE,sMAAsM;;iBACtS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,iHAAiH;;iBAEnM,IAAI,EAAE,MAAM;iBACZ,IAAI,EAAE,0BAA0B;iBAChC,MAAM,EAAE,yCAAyC;iBACjD,OAAO,EAAE,iJAAiJ;;iBAE1J,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,uMAAuM;;iBACjS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,MAAM;iBAAE,MAAM,EAAE,qBAAqB;iBAAE,OAAO,EAAE,4JAA4J;;iBAChO,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,sJAAsJ;;iBAC5O,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,oBAAoB;iBAAE,MAAM,EAAE,mCAAmC;iBAAE,OAAO,EAAE,+IAA+I;;iBAC/O,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,2BAA2B;iBAAE,OAAO,EAAE,oEAAoE;;iBACpJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,wMAAwM;;iBAC9R,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,gJAAgJ;;iBAClO,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,0MAA0M;;iBAChS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,mBAAmB;iBAAE,MAAM,EAAE,kCAAkC;iBAAE,OAAO,EAAE,0MAA0M;;iBACxS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,mBAAmB;iBAAE,MAAM,EAAE,kCAAkC;iBAAE,OAAO,EAAE,uMAAuM;;iBACrS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,qBAAqB;iBAAE,MAAM,EAAE,oCAAoC;iBAAE,OAAO,EAAE,wKAAwK;;iBAC1Q,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,UAAU;iBAAE,MAAM,EAAE,yBAAyB;iBAAE,OAAO,EAAE,wCAAwC;;iBACpH,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,mBAAmB;iBAAE,MAAM,EAAE,kCAAkC;iBAAE,OAAO,EAAE,yKAAyK;;iBACvQ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,uBAAuB;iBAAE,MAAM,EAAE,sCAAsC;iBAAE,OAAO,EAAE,6GAA6G;;iBACnN,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,4KAA4K;;iBAC1P,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,oNAAoN;;iBACxS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,qBAAqB;iBAAE,MAAM,EAAE,oCAAoC;iBAAE,OAAO,EAAE,wEAAwE;;iBAC1K,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,+MAA+M;;iBACnS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,6LAA6L;;iBACvR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,OAAO;iBAAE,MAAM,EAAE,sBAAsB;iBAAE,OAAO,EAAE,kEAAkE;;iBACxI,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,yGAAyG;;iBAC7L,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,mIAAmI;;iBACjN,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,iCAAiC;iBAAE,OAAO,EAAE,2GAA2G;;iBACvM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,yBAAyB;iBAAE,MAAM,EAAE,wCAAwC;iBAAE,OAAO,EAAE,gJAAgJ;;iBAC1P,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,qFAAqF;;iBACvK,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,iCAAiC;iBAAE,OAAO,EAAE,mKAAmK;;iBAC/P,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,sBAAsB;iBAAE,MAAM,EAAE,qCAAqC;iBAAE,OAAO,EAAE,wHAAwH;;iBAE5N,IAAI,EAAE,MAAM;iBACZ,IAAI,EAAE,mBAAmB;iBACzB,MAAM,EAAE,kCAAkC;iBAC1C,OAAO,EAAE,6IAA6I;;iBAGtJ,IAAI,EAAE,MAAM;iBACZ,IAAI,EAAE,kBAAkB;iBACxB,MAAM,EAAE,iCAAiC;iBACzC,OAAO,EAAE,sIAAsI;;iBAE/I,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,iCAAiC;iBAAE,OAAO,EAAE,uMAAuM;;iBACnS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,iCAAiC;iBAAE,OAAO,EAAE,iGAAiG;;iBAC7L,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,oBAAoB;iBAAE,MAAM,EAAE,mCAAmC;iBAAE,OAAO,EAAE,oGAAoG;;iBACpM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,qBAAqB;iBAAE,MAAM,EAAE,oCAAoC;iBAAE,OAAO,EAAE,uGAAuG;;iBACzM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,OAAO;iBAAE,MAAM,EAAE,sBAAsB;iBAAE,OAAO,EAAE,yFAAyF;;iBAC/J,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,mBAAmB;iBAAE,MAAM,EAAE,kCAAkC;iBAAE,OAAO,EAAE,uIAAuI;;iBACrO,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,uDAAuD;;iBAC/I,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,QAAQ;iBAAE,MAAM,EAAE,uBAAuB;iBAAE,OAAO,EAAE,+KAA+K;;iBACvP,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,iCAAiC;iBAAE,OAAO,EAAE,0DAA0D;;iBAEtJ,IAAI,EAAE,MAAM;iBACZ,IAAI,EAAE,yBAAyB;iBAC/B,MAAM,EAAE,wCAAwC;iBAChD,OAAO,EAAE,6HAA6H;;iBAEtI,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,4BAA4B;iBAAE,MAAM,EAAE,2CAA2C;iBAAE,OAAO,EAAE,mKAAmK;;iBACnR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,kGAAkG;;iBAC1L,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,0FAA0F;;iBACpL,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,gLAAgL;;iBAEtQ,IAAI,EAAE,MAAM;iBACZ,IAAI,EAAE,QAAQ;iBACd,MAAM,EAAE,uBAAuB;iBAC/B,OAAO,EAAE,8IAA8I;;iBAEvJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,wMAAwM;;iBAC5R,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,qJAAqJ;;iBAC/O,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,8MAA8M;;iBACxS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,4EAA4E;;iBAC1J,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,sBAAsB;iBAAE,MAAM,EAAE,qCAAqC;iBAAE,OAAO,EAAE,iJAAiJ;;iBACrP,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,iMAAiM;;iBACrR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,2BAA2B;iBAAE,OAAO,EAAE,uJAAuJ;;iBACvO,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,yMAAyM;;iBAC7R,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,oKAAoK;;iBAC9P,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,0JAA0J;;iBAChP,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,0MAA0M;;iBAC9R,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,SAAS;iBAAE,MAAM,EAAE,wBAAwB;iBAAE,OAAO,EAAE,mMAAmM;;iBAG7Q,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,oCAAoC;iBAAE,OAAO,EAAE,uLAAuL;;iBACzR,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,udAAud;;iBAC/iB,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,yMAAyM;;iBACnS,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,wBAAwB;iBAAE,MAAM,EAAE,0CAA0C;iBAAE,OAAO,EAAE,oIAAoI;;iBAClP,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,mBAAmB;iBAAE,MAAM,EAAE,qCAAqC;iBAAE,OAAO,EAAE,wJAAwJ;;iBAC5P,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,6UAA6U;;iBACva,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,oHAAoH;;iBACxM,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,kBAAkB;iBAAE,MAAM,EAAE,oCAAoC;iBAAE,OAAO,EAAE,oGAAoG;;iBACtM,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,SAAS;iBAAE,MAAM,EAAE,2BAA2B;iBAAE,OAAO,EAAE,2FAA2F;;iBAC3K,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,qBAAqB;iBAAE,MAAM,EAAE,uCAAuC;iBAAE,OAAO,EAAE,8KAA8K;;iBACtR,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,UAAU;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,iHAAiH;;iBAGnM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,8KAA8K;;iBACxQ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,qBAAqB;iBAAE,MAAM,EAAE,oCAAoC;iBAAE,OAAO,EAAE,oFAAoF;;iBACtL,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,kMAAkM;;iBAC1R,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,+HAA+H;;iBACzN,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,QAAQ;iBAAE,MAAM,EAAE,uBAAuB;iBAAE,OAAO,EAAE,kMAAkM;;iBAC1Q,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,oSAAoS;;iBAC5X,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,eAAe;iBAAE,MAAM,EAAE,8BAA8B;iBAAE,OAAO,EAAE,+OAA+O;;iBACrU,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,+OAA+O;;iBACnU,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,oMAAoM;;iBACtR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,wMAAwM;;iBACtR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,OAAO;iBAAE,MAAM,EAAE,sBAAsB;iBAAE,OAAO,EAAE,6HAA6H;;iBACnM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,2BAA2B;iBAAE,OAAO,EAAE,qHAAqH;;iBACrM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,uMAAuM;;iBACrR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,gMAAgM;;iBACpR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,QAAQ;iBAAE,MAAM,EAAE,uBAAuB;iBAAE,OAAO,EAAE,gFAAgF;;iBACxJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,oBAAoB;iBAAE,MAAM,EAAE,mCAAmC;iBAAE,OAAO,EAAE,4JAA4J;;iBAC5P,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,yKAAyK;;iBACnQ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,oBAAoB;iBAAE,MAAM,EAAE,mCAAmC;iBAAE,OAAO,EAAE,mMAAmM;;iBACnS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,oBAAoB;iBAAE,MAAM,EAAE,mCAAmC;iBAAE,OAAO,EAAE,0MAA0M;;iBAC1S,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,4DAA4D;;iBACtJ,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,0MAA0M;;iBACpS,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,cAAc;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,2FAA2F;;iBAC/K,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,mGAAmG;;iBACrL,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,OAAO;iBAAE,MAAM,EAAE,sBAAsB;iBAAE,OAAO,EAAE,2FAA2F;;iBACjK,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,mHAAmH;;iBACrM,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,OAAO,EAAE,yMAAyM;;iBACvR,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,4BAA4B;iBAAE,OAAO,EAAE,+FAA+F;;iBACjL,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,sBAAsB;iBAAE,MAAM,EAAE,qCAAqC;iBAAE,OAAO,EAAE,0MAA0M;;iBAC9S,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,iBAAiB;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,8JAA8J;;iBACxP,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,+BAA+B;iBAAE,OAAO,EAAE,kHAAkH;;iBAG1M,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,gBAAgB;iBAAE,MAAM,EAAE,mCAAmC;iBAAE,OAAO,EAAE,4EAA4E;;iBAC5K,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,UAAU;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,yIAAyI;;iBAC7N,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,aAAa;iBAAE,MAAM,EAAE,gCAAgC;iBAAE,OAAO,EAAE,oMAAoM;;iBAC9R,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,MAAM;iBAAE,MAAM,EAAE,yBAAyB;iBAAE,OAAO,EAAE,iGAAiG;;iBAG7K,IAAI,EAAE,YAAY;iBAAE,IAAI,EAAE,QAAQ;iBAAE,MAAM,EAAE,6BAA6B;iBAAE,OAAO,EAAE,yFAAyF;;iBAG7K,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,QAAQ;iBAAE,MAAM,EAAE,wBAAwB;iBAAE,OAAO,EAAE,kMAAkM;;CAExQ,CAAC"}

package/dist/agent/contributions.js

@@ -0,0 +1,192 @@
+// THE CONTRIBUTION MANIFEST for `@open-everywhere/core` (OPE-375) — the curated
+// catalogue of everything this package OFFERS an app's eve slot tree. `oe build` reads it;
+// the app's `roster.config.ts` decides about it, and `roster.lock.json` records the review.
+//
+// 🔴 CURATED, NOT SCANNED, AND THAT IS MEASURED RATHER THAN STYLISTIC. A directory scan cannot
+// enumerate contributions: core ships 47 files under `agent/channels/` of which 9 are channels, and
+// 13 under `agent/connections/` of which 1 is a connection. Shape predicates do not rescue it either
+// — only 8 of the 9 mounted core channels contain `defineChannel(`. A hand-kept list is the only
+// honest catalogue, so keeping it current is a real authoring duty (`npm run lint:contributions`
+// scan-compares the two kinds where a predicate IS sound — tools and hooks — and says plainly that
+// the other four are unguarded).
+//
+// 🔴 THIS FILE IMPORTS NOTHING, DELIBERATELY. A provider bundle may reach core only through the
+// `@open-everywhere/core/agent/adapter-api.js` barrel (the boundary lock, packages/core/scripts/
+// boundary-test.ts), so a manifest that imported its own types would be a boundary red — and
+// widening the barrel to admit a build-time type would be the wrong fix. Every manifest is therefore
+// import-free DATA whose shape `roster-plan.ts` validates at build time, exactly as it must for a
+// third-party package it has never seen. The types are in
+// `@open-everywhere/core/agent/scaffold/roster-config.js` for READERS.
+//
+// ERASABLE SYNTAX ONLY (no `enum`, no `namespace`) — `oe build` loads this with a bare import.
+export const CONTRIBUTIONS = {
+    schemaVersion: 1,
+    package: "@open-everywhere/core",
+    contributions: [
+        // ── tools ────────────────────────────────────────────────────────────────────────────────────
+        { kind: "tool", name: "add_label", module: "agent/tools/add_label.js", summary: "Add a label to a ticket — a Linear issue or a GitHub issue/PR." },
+        { kind: "tool", name: "add_routine_rule", module: "agent/tools/add_routine_rule.js", summary: "PROPOSE a standing rule for ONE routine — a short instruction every future run of that routine must follow, e.g." },
+        { kind: "tool", name: "agent_version", module: "agent/tools/agent_version.js", summary: "State which version of this agent is currently running: the OE package version, the deployment's commit sha, the eve framework version, and this deployment's context window with the token count compaction fires at." },
+        { kind: "tool", name: "assign", module: "agent/tools/assign.js", summary: "PROPOSE assigning a ticket — a Linear issue or a GitHub issue/PR — to someone." },
+        { kind: "tool", name: "aws", module: "agent/tools/aws.js", summary: "Run an AWS CLI command under this channel's granted AWS role (e.g." },
+        { kind: "tool", name: "browser_tools", module: "agent/tools/browser_tools.js", summary: "browser_tools — the resolver FILE that mounts the flag-gated agent-browser tool family (OPE-43)." },
+        { kind: "tool", name: "cancel_routine", module: "agent/tools/cancel_routine.js", summary: "PROPOSE cancelling (deleting) a routine on this surface by its id." },
+        { kind: "tool", name: "capture_events", module: "agent/tools/capture_events.js", summary: "Turn on temporary recording of a webhook's incoming deliveries so their shape can be inspected with list_recent_events and a subscription filter written against real traffic." },
+        { kind: "tool", name: "check_pr_status", module: "agent/tools/check_pr_status.js", summary: "Look up the current status of a GitHub pull request — open/closed/merged, draft, title, last updated." },
+        { kind: "tool", name: "checkout_repo", module: "agent/tools/checkout_repo.js", summary: "Clone one of the allowed repositories (see list_repos) into your workspace so you can read and change its code." },
+        { kind: "tool", name: "clear_connector_override", module: "agent/tools/clear_connector_override.js", summary: "PROPOSE reverting an earlier break-glass connector revoke, restoring this surface's config-as-code bundle grants for that connector — this does NOT clear anything itself." },
+        { kind: "tool", name: "clear_spend_limit", module: "agent/tools/clear_spend_limit.js", summary: "PROPOSE clearing a spend-limit override so the scope reverts to the config-as-code cap — this does NOT clear anything itself." },
+        { kind: "tool", name: "complete_job", module: "agent/tools/complete_job.js", summary: "Mark this DURABLE JOB done — call it once the WHOLE job you were set to drive is finished (not just this fire's step)." },
+        { kind: "tool", name: "complete_thread", module: "agent/tools/complete_thread.js", summary: "Mark this thread DONE and hand it back to the channel." },
+        { kind: "tool", name: "confirm_link", module: "agent/tools/confirm_link.js", summary: "Confirm (or deny) an account that belongs to this person — the second half of link_identity, and the one-tap confirmation for accounts an identity-directory sync (Okta) suggested for them." },
+        { kind: "tool", name: "connector", module: "agent/tools/connector.js", summary: "Post connect options for a provider so a human can authorize it." },
+        { kind: "tool", name: "create_agent", module: "agent/tools/create_agent.js", summary: "PROPOSE a new AGENT for THIS channel — a self-contained teammate with its OWN memory brain and its own capabilities." },
+        { kind: "tool", name: "create_routine", module: "agent/tools/create_routine.js", summary: "Create a durable ROUTINE so you act without being re-tagged: a scheduled job (cron/everyMinutes, with a required post policy — every run, only when something changed, or never, for work whose product…" },
+        { kind: "tool", name: "create_skill", module: "agent/tools/create_skill.js", summary: "PROPOSE creating or updating a SKILL for this channel's memory domain — a reusable markdown instruction package any future turn in the domain can invoke by its bare name." },
+        { kind: "tool", name: "create_ticket", module: "agent/tools/create_ticket.js", summary: "PROPOSE filing a NEW work item — a GitHub issue or a Linear issue — on a work surface this conversation is bound to." },
+        { kind: "tool", name: "declare_webhook", module: "agent/tools/declare_webhook.js", summary: "Propose an inbound webhook: an endpoint an outside system can POST to." },
+        { kind: "tool", name: "delete_skill", module: "agent/tools/delete_skill.js", summary: "PROPOSE deleting a domain skill created with create_skill, by its bare name (see list_skills)." },
+        { kind: "tool", name: "describe_image", module: "agent/tools/describe_image.js", summary: "describe_image — the host-side, text-out MULTIMODAL affordance." },
+        { kind: "tool", name: "dm_person", module: "agent/tools/dm_person.js", summary: "Send a direct message to a person an operator granted. The FIRST message to someone posts an approval card showing them and your exact text; after that your messages to them send straight away." },
+        { kind: "tool", name: "edit_reply", module: "agent/tools/edit_reply.js", summary: "Correct one of your own recent posts, in place, instead of posting a follow-up." },
+        { kind: "tool", name: "edit_routine", module: "agent/tools/edit_routine.js", summary: "PROPOSE rewriting what an existing routine DOES, keeping its schedule, its id, its history and everything it has learned (a watch's baseline, a durable job's progress and thread)." },
+        { kind: "tool", name: "enable_routine", module: "agent/tools/enable_routine.js", summary: "PROPOSE re-arming a routine that stopped itself after repeated failures, keeping its id, its history and everything it had learned (a watch's baseline, a durable job's progress and thread)." },
+        { kind: "tool", name: "explain_permission", module: "agent/tools/explain_permission.js", summary: "Explain what would happen if a named tool were used HERE: resolves the real approver chain for this scope (config approvers, surface controls, the consequence registry, the domain's approval mode…" },
+        { kind: "tool", name: "grant_tools", module: "agent/tools/grant_tools.js", summary: "grant_tools — the resolver FILE that mounts one tool per live CREDENTIAL GRANT in this conversation (OPE-1060)." },
+        {
+            kind: "tool",
+            name: "request_credential_grant",
+            module: "agent/tools/request_credential_grant.js",
+            summary: "ASK a named person to let this conversation spend their own connector credential — they answer in their own DM; this grants nothing (OPE-1060).",
+        },
+        { kind: "tool", name: "get_pr_feedback", module: "agent/tools/get_pr_feedback.js", summary: "Read the feedback on a GitHub pull request: review verdicts (approved / changes-requested), inline review comments (with file + line), issue-thread comments, and check runs (with a failure excerpt…" },
+        { kind: "tool", name: "halt", module: "agent/tools/halt.js", summary: "STOP EVERYTHING CONSEQUENTIAL, NOW — the break-glass halt. Use it the moment someone in the conversation asks you to stop, halt, freeze, or pull the plug." },
+        { kind: "tool", name: "link_identity", module: "agent/tools/link_identity.js", summary: "Start linking another account (GitHub, Linear, Slack, …) to the person you are talking to, so their work is attributed to ONE human across surfaces." },
+        { kind: "tool", name: "list_recent_events", module: "agent/tools/list_recent_events.js", summary: "Read the deliveries a webhook has actually sent, numbered, so a subscription filter can be written against real traffic instead of guesswork." },
+        { kind: "tool", name: "list_repos", module: "agent/tools/list_repos.js", summary: "List the GitHub repositories this channel is allowed to work with." },
+        { kind: "tool", name: "list_routines", module: "agent/tools/list_routines.js", summary: "List the routines (scheduled jobs, watches, event subscriptions) set up on this surface, with their status, next run time, recent run history (last session id, last time it posted, fires and tokens…" },
+        { kind: "tool", name: "list_skills", module: "agent/tools/list_skills.js", summary: "List the skills available to you right now in this session, with their provenance (bundle-granted, this channel's domain, or repo-discovered)." },
+        { kind: "tool", name: "list_webhooks", module: "agent/tools/list_webhooks.js", summary: "List the inbound webhooks declared for this deployment — which external systems can trigger work here, whether each one runs a fixed instruction or just emits events for routines to subscribe to, and…" },
+        { kind: "tool", name: "memory_admin_list", module: "agent/tools/memory_admin_list.js", summary: "ADMIN ONLY: enumerate every memory silo you are allowed to inspect — org -> domains -> silos -> files, with sizes — from ANY channel or DM, not just the one you\\'re speaking in right now (unlike the…" },
+        { kind: "tool", name: "memory_admin_read", module: "agent/tools/memory_admin_read.js", summary: "ADMIN ONLY: read one file's raw content out of one memory silo (memory_admin_list for silo names + file lists), from ANY channel or DM — the gate is YOUR role, not which channel you're speaking in." },
+        { kind: "tool", name: "message_thread_seat", module: "agent/tools/message_thread_seat.js", summary: "Send a message to a thread seat you opened — a steer, a correction, a fact it cannot see, or a question; `mirror` decides whether the people in the thread see it too." },
+        { kind: "tool", name: "no_reply", module: "agent/tools/no_reply.js", summary: "End this turn without posting a reply." },
+        { kind: "tool", name: "open_pull_request", module: "agent/tools/open_pull_request.js", summary: "PROPOSE pushing your committed branch and opening a GitHub pull request for it (this is the ONLY way changes leave the workspace — plain `git push` is not authorized)." },
+        { kind: "tool", name: "permission_fit_report", module: "agent/tools/permission_fit_report.js", summary: "Report whether this domain's PERMISSION GRANTS still fit the work — in both directions, from the audit log." },
+        { kind: "tool", name: "post_file", module: "agent/tools/post_file.js", summary: "Post one or more FILES/artifacts (screenshots, images, docs, data) to the current conversation on this surface — the delivery channel for things a text reply can't carry." },
+        { kind: "tool", name: "post_message", module: "agent/tools/post_message.js", summary: "Post a message into ANOTHER container your domain owns — not the one you are talking in (use reply for that). Consequential: an approval card renders the destination and the exact message before anything posts." },
+        { kind: "tool", name: "post_pr_walkthrough", module: "agent/tools/post_pr_walkthrough.js", summary: "Render the PR walkthrough and post it to the governance admin channel." },
+        { kind: "tool", name: "purge_memory", module: "agent/tools/purge_memory.js", summary: "PROPOSE ERASING remembered fact(s) from durable memory — the RARE, destructive path (corrections are plain file edits; every matching bullet across every writable silo is swept behind a confirmation card)." },
+        { kind: "tool", name: "query_analytics", module: "agent/tools/query_analytics.js", summary: "Query your org's own operational analytics in natural language — you form a STRUCTURED query object (never SQL) over a fixed schema, the host compiles + scopes it, and returns the answer." },
+        { kind: "tool", name: "react", module: "agent/tools/react.js", summary: "React to a message with an emoji, instead of (or as) your reply." },
+        { kind: "tool", name: "read_channel", module: "agent/tools/read_channel.js", summary: "Read recent messages from THIS conversation's channel — the room this turn arrived in. Takes no target." },
+        { kind: "tool", name: "read_docs", module: "agent/tools/read_docs.js", summary: "Read Open Everywhere's own shipped documentation — how this agent works, what it can do, how a capability is set up and governed." },
+        { kind: "tool", name: "read_file_upload", module: "agent/tools/read_file_upload.js", summary: "READ an uploaded TEXT file (CSV/TSV/JSON/markdown/log/plain text, up to 5 MB) that isn't visible as text." },
+        { kind: "tool", name: "read_routine_transcript", module: "agent/tools/read_routine_transcript.js", summary: "Read the transcript of a past routine run in THIS channel — what it was woken with, what it did, which tools it called and what they returned." },
+        { kind: "tool", name: "read_thread", module: "agent/tools/read_thread.js", summary: "Read all replies in THIS thread — the thread this turn arrived in. Takes no target." },
+        { kind: "tool", name: "read_thread_seat", module: "agent/tools/read_thread_seat.js", summary: "Read what you recorded about a thread you handed to a thread seat: which seat holds it, whether it is still open, and its closing report once it has handed back." },
+        { kind: "tool", name: "read_webhook_history", module: "agent/tools/read_webhook_history.js", summary: "Diagnose an inbound webhook: whether the sender is actually reaching us, and what each delivery did or didn't trigger." },
+        {
+            kind: "tool",
+            name: "read_work_channel",
+            module: "agent/tools/read_work_channel.js",
+            summary: "Read recent messages from the channel this task was delegated from — the work-surface read, under the domain's work grant. Takes no target.",
+        },
+        {
+            kind: "tool",
+            name: "read_work_thread",
+            module: "agent/tools/read_work_thread.js",
+            summary: "Read every reply in the thread this task was delegated from — the work-surface read, under the domain's work grant. Takes no target.",
+        },
+        { kind: "tool", name: "record_job_state", module: "agent/tools/record_job_state.js", summary: "Record your progress on this DURABLE JOB — a short, canonical note (goal, what's done, what's next) that survives even if this session is later replaced, so it's your reliable hand-off to the next…" },
+        { kind: "tool", name: "record_follow_up", module: "agent/tools/record_follow_up.js", summary: "Leave a named follow-up for the NEXT run of this same routine, or resolve one that is finished." },
+        { kind: "tool", name: "record_watch_state", module: "agent/tools/record_watch_state.js", summary: "Record the state a WATCH routine just observed, and learn whether it changed since the last check." },
+        { kind: "tool", name: "remove_routine_rule", module: "agent/tools/remove_routine_rule.js", summary: "PROPOSE removing ONE standing rule from a routine — the rule stops being applied to every future run." },
+        { kind: "tool", name: "reply", module: "agent/tools/reply.js", summary: "Post a reply into the conversation a specific wake came from, without ending your turn." },
+        { kind: "tool", name: "report_run_failed", module: "agent/tools/report_run_failed.js", summary: "Declare that THIS routine fire did not do its work — the thing you needed was down, a credential was rejected, the page never loaded." },
+        { kind: "tool", name: "request_access", module: "agent/tools/request_access.js", summary: "PROPOSE widening access — this grants nothing itself." },
+        { kind: "tool", name: "resume", module: "agent/tools/resume.js", summary: "PROPOSE lifting the break-glass halt — this does NOT lift it. Posts a confirmation card; an org admin must click Approve, because resuming WIDENS what the deployment may do." },
+        { kind: "tool", name: "revoke_connector", module: "agent/tools/revoke_connector.js", summary: "Break-glass PROPOSE: cut an Eve connector (by name, e.g." },
+        {
+            kind: "tool",
+            name: "revoke_credential_grant",
+            module: "agent/tools/revoke_credential_grant.js",
+            summary: "List, or END, the credential grants the person you are talking to is lending — DM only, and only ever their own (OPE-1637).",
+        },
+        { kind: "tool", name: "revoke_routine_permissions", module: "agent/tools/revoke_routine_permissions.js", summary: "Withdraw a routine's STANDING permissions — the things it was allowed to do unattended without asking — while leaving the routine itself running on its schedule." },
+        { kind: "tool", name: "rotate_webhook", module: "agent/tools/rotate_webhook.js", summary: "Issue a signing secret for a webhook that exists here, and send it privately as a one-time link." },
+        { kind: "tool", name: "run_routine_now", module: "agent/tools/run_routine_now.js", summary: "Run an existing routine ONCE right now, off its schedule, without changing the schedule." },
+        { kind: "tool", name: "sandbox_tools", module: "agent/tools/sandbox_tools.js", summary: "sandbox_tools — the per-GRAIN provider of the six framework sandbox/egress tools: `bash`, `glob`, `grep`, `read_file`, `write_file`, `web_fetch` (window-tool-gating Stage C)." },
+        {
+            kind: "tool",
+            name: "search",
+            module: "agent/tools/search.js",
+            summary: "Search this domain's connected work surfaces (GitHub, Notion, Linear, ...) by keyword, and get back ids + titles — a pointer, not an answer.",
+        },
+        { kind: "tool", name: "session_cost", module: "agent/tools/session_cost.js", summary: "What did THIS conversation cost so far — tokens (input/output/cache), an estimated $ (if a model can be assumed), and sandbox runtime seconds + an estimated $ for any sandbox time this session used." },
+        { kind: "tool", name: "set_dm_delivery", module: "agent/tools/set_dm_delivery.js", summary: "Turn the direct messages THIS agent starts with the person you are talking to on or off, at their request. No configuration overrides their choice." },
+        { kind: "tool", name: "set_spend_limit", module: "agent/tools/set_spend_limit.js", summary: "PROPOSE a monthly spend limit — token count and/or USD — for this surface (or, with level:\"workspace\", the whole workspace: the Slack workspace / Discord server; with level:\"domain\", every surface in…" },
+        { kind: "tool", name: "set_state", module: "agent/tools/set_state.js", summary: "PROPOSE changing a ticket's status — a Linear issue's workflow state (e.g." },
+        { kind: "tool", name: "spawn_thread_session", module: "agent/tools/spawn_thread_session.js", summary: "Open a lasting presence in a thread: spawn a conversational seat that owns the thread and stays live across messages (unlike a one-off worker)." },
+        { kind: "tool", name: "spend_report", module: "agent/tools/spend_report.js", summary: "Token spend rollup for your memory domain, or (org admins only) the whole org: tokens + estimated $ by surface and turn-origin kind, the existing monthly ledger totals (tokens AND $) against…" },
+        { kind: "tool", name: "stand_down", module: "agent/tools/stand_down.js", summary: "Stop following this conversation — call it when the people here have asked you to stop, to go quiet, or to leave them to it, however they phrased it." },
+        { kind: "tool", name: "subscribe_pr", module: "agent/tools/subscribe_pr.js", summary: "Subscribe this channel to a GitHub pull request: re-checks it on an interval (default 15 min) and posts here when something changes — reviews, comments, new commits, CI going red or green, merged or…" },
+        { kind: "tool", name: "unlink_identity", module: "agent/tools/unlink_identity.js", summary: "Remove a linked account from the caller's own identity link-set — their current account by default, or another account already on their set (platform + nativeId)." },
+        { kind: "tool", name: "update_status", module: "agent/tools/update_status.js", summary: "Record your current work status so the team can see it at a glance (it's mirrored to a pinned status message in the channel, shared across all threads)." },
+        { kind: "tool", name: "usage_report", module: "agent/tools/usage_report.js", summary: "Activity analytics for your memory domain, or (org admins only) the whole org: conversation count (an estimate — see note), turns, a per-user activity breakdown, and the busiest surfaces, over a time…" },
+        { kind: "tool", name: "walk_pr", module: "agent/tools/walk_pr.js", summary: "Gather everything needed to walk a human through a pull request before they merge it: the PR's state, its diff, and the resolved-config FACTS computed by CI (effective access per scope, domain…" },
+        // ── channels ─────────────────────────────────────────────────────────────────────────────────
+        { kind: "channel", name: "aws-sso-callback", module: "agent/channels/aws-sso-callback.js", summary: "Deployment mount for the OE-owned AWS IAM Identity Center link callback — `GET /oauth/v1/aws-sso/callback` (the Identity Center OIDC authorization-server redirect landing, Phase 1)." },
+        { kind: "channel", name: "control-mcp", module: "agent/channels/control-mcp.js", summary: "Deployment mount for the control plane's MCP WRITE transport — `POST /control/v1/mcp` — and the small OAuth 2.1 authorization server that guards it: `/control/v1/oauth/authorize`, `/control/v1/oauth/token`, and the RFC 8414 and RFC 9728 discovery documents (OPE-72). Fail-closed: every route 404s until `OE_CONTROL_OAUTH_SIGNING_SECRET` is set AND `CONTROL_OAUTH_ISSUER` is declared in tracked config; a registered client is then a further condition on issuing a token." },
+        { kind: "channel", name: "control-read", module: "agent/channels/control-read.js", summary: "Deployment mount for the control plane's READ side — `GET /control/v1/usage` (priced usage window), `GET /control/v1/audit` (the audit window: dispatched/replied/no_reply/rejected rows — the uniform…" },
+        { kind: "channel", name: "credential-intake-page", module: "agent/channels/credential-intake-page.js", summary: "Deployment mount for the one-shot credential-intake PAGE (task #113, stage 6) — GET renders the entry form, POST stores the value." },
+        { kind: "channel", name: "oe-oauth-callback", module: "agent/channels/oe-oauth-callback.js", summary: "Deployment mount for the OE-owned own-rolled OAuth callback — `GET /oauth/v1/callback` (the hosted-MCP authorization-server redirect landing, OPE-88)." },
+        { kind: "channel", name: "policy-pages", module: "agent/channels/policy-pages.js", summary: "Deployment mount for the two PUBLIC policy pages — `GET /privacy` and `GET /terms` (pages/policy-pages.ts). The text is the operator's, declared as `policyPages.privacy` / `policyPages.terms`; unset renders a placeholder and both routes always answer 200, because `teams-app/manifest.json` points `privacyUrl`/`termsOfUseUrl` here." },
+        { kind: "channel", name: "test-wake", module: "agent/channels/test-wake.js", summary: "Deployment mount for the TEST-WAKE INJECTION control route — `POST /control/v1/test/wake` (control/test-route.ts)." },
+        { kind: "channel", name: "transcript-relay", module: "agent/channels/transcript-relay.js", summary: "Deployment mount for the INTERNAL transcript relay — `POST /eve/v1/internal/transcript` (OPE-153)." },
+        { kind: "channel", name: "unified", module: "agent/channels/unified.js", summary: "The synthetic UNIFIED channel — the single-context cross-surface window's delivery spine." },
+        { kind: "channel", name: "webhook-reveal-page", module: "agent/channels/webhook-reveal-page.js", summary: "Deployment mount for the ONE-SHOT webhook-secret REVEAL page (OPE-150) — GET renders a confirm page with no secret on it, POST consumes the grant and shows the secret once." },
+        { kind: "channel", name: "webhooks", module: "agent/channels/webhooks.js", summary: "Generic inbound-webhook surface — the third leg of the trigger triad (manual mention, cron routines, webhooks)." },
+        // ── hooks ────────────────────────────────────────────────────────────────────────────────────
+        { kind: "hook", name: "approval-raised", module: "agent/hooks/approval-raised.js", summary: "APPROVAL-RAISED record hook (OPE-436) — marks a duplicate-approval fingerprint only once eve has DURABLY recorded that it actually raised a \"tool-approval\" input request." },
+        { kind: "hook", name: "approval-settlement", module: "agent/hooks/approval-settlement.js", summary: "EVE APPROVAL SETTLEMENT AUDIT (OPE-575, adopt-part C of the OPE-560 STAY verdict)." },
+        { kind: "hook", name: "binding-bridge", module: "agent/hooks/binding-bridge.js", summary: "Binding-bridge hook: stamp the session's platform identity into the per-session state slot so TOOL contexts that arrive identity-less (send()-created sessions — name-drop wake, engaged-thread…" },
+        { kind: "hook", name: "connector-audit", module: "agent/hooks/connector-audit.js", summary: "Per-OP connector audit (task #93 A3) — makes \"every action lands in an append-only audit log\" TRUE for the connector plane." },
+        { kind: "hook", name: "egress", module: "agent/hooks/egress.js", summary: "Egress enforcement: compile the resolved access into a sandbox NetworkPolicy and apply it, so the channel can only reach what its bundle grants (two-surface, default-deny) and credentials are…" },
+        { kind: "hook", name: "eve-patch-gate", module: "agent/hooks/eve-patch-gate.js", summary: "UNPATCHED-EVE REFUSAL, turn edge (OPE-2182) — reads every live eve patch part's runtime marker at `turn.started` and throws when one is absent, so a build that inlines eve (where no package root resolves and the boot probe cannot decide) fails its first turn instead of serving it unfenced." },
+        { kind: "hook", name: "fire-carriage", module: "agent/hooks/fire-carriage.js", summary: "FIRE-CARRIAGE probe, SESSION SIDE (OPE-483) — records the auth-attribute KEY NAMES a schedule-originated session's turn actually received, so the pair with the dispatcher's own row says which side of the session hop lost a fire's stamps." },
+        { kind: "hook", name: "fire-toolset", module: "agent/hooks/fire-toolset.js", summary: "FIRE-TIME DECLARED-OP MOUNT (OPE-2135) — seeds eve's own discovered-result slot with the connector operation a routine's declared permission names, so the fire starts holding the tool it exists to call instead of having to rediscover it." },
+        { kind: "hook", name: "job-posture", module: "agent/hooks/job-posture.js", summary: "JOB-WAKE classification hook (OPE-111) — the one site that holds BOTH the delivery auth and the eve context, so it is where a wake's shape is turned into the session slots the restriction reads…" },
+        { kind: "hook", name: "lean-seat", module: "agent/hooks/lean-seat.js", summary: "LEAN-SEAT classification hook (OPE-301) — the one site that holds BOTH the delivery auth and the session identity, so it is where a wake's seat shape is turned into the session slot the lean filter…" },
+        { kind: "hook", name: "learn", module: "agent/hooks/learn.js", summary: "Mode 1 — \"learn\": the GENERATIVE, per-request consolidation, as a SIBLING to the memory lifecycle hook (hooks/memory.ts)." },
+        { kind: "hook", name: "link-claim", module: "agent/hooks/link-claim.js", summary: "LINK-CLAIM HOOK — recognises an inbound `link <code>` and stamps the challenge with the WAKE'S OWN captured author." },
+        { kind: "hook", name: "log-flush", module: "agent/hooks/log-flush.js", summary: "Log-ship flush hook — give the batched log shipper (observability/ship.ts) a deterministic flush point at the end of every turn/session, so records queued during the turn leave the instance BEFORE…" },
+        { kind: "hook", name: "loop-breaker", module: "agent/hooks/loop-breaker.js", summary: "PER-TURN RESET hook for the two #101 resilience memos — the in-turn loop breaker (access/loop-breaker.ts) and the connector needsAuthorization short-circuit (connections/auth-retry-memo.ts)." },
+        { kind: "hook", name: "memory", module: "agent/hooks/memory.js", summary: "Lifecycle memory sync — turns the ephemeral sandbox into an agent that learns." },
+        { kind: "hook", name: "native-input-audit", module: "agent/hooks/native-input-audit.js", summary: "NATIVE-ROUTE input-request AUDIT (OPE-1275) — the observability half of a non-park `input.requested` batch on every surface OTHER than the unified window." },
+        { kind: "hook", name: "own-account-ask", module: "agent/hooks/own-account-ask.js", summary: "THE OWN-ACCOUNT PRODUCER (OPE-1525) — the one writer of the `oe_own_account_ask` stamp, so a member's \"use my own account\" reaches the workers the seat delegates to." },
+        { kind: "hook", name: "requester-identity", module: "agent/hooks/requester-identity.js", summary: "REQUESTER-IDENTITY CAPTURE (OPE-673) — fills access/requester-identity.ts's per-turn slot from `message.received`, and stamps the answer onto the delivery's auth so a delegated worker inherits…" },
+        { kind: "hook", name: "requester-messages", module: "agent/hooks/requester-messages.js", summary: "REQUESTER-MESSAGE CAPTURE (OPE-318 phase 2) — fills access/requester-messages.ts's per-turn slot from `message.received`, the one hook event that carries the host-normalised text of what the seat was…" },
+        { kind: "hook", name: "routine-outcome", module: "agent/hooks/routine-outcome.js", summary: "Routine outcome feedback — closes the loop on proactivity." },
+        { kind: "hook", name: "routine-silence", module: "agent/hooks/routine-silence.js", summary: "SILENT-FIRE classification hook (OPE-149) — the one site holding BOTH the delivery auth and the eve context, so it is where a fire's stored `report: {kind:\"silent\"}` becomes the per-turn signal the…" },
+        { kind: "hook", name: "session-park", module: "agent/hooks/session-park.js", summary: "SESSION-LIMIT PARK detection (OPE-171) — the observe-and-remedy seam for eve's HITL park." },
+        { kind: "hook", name: "spawn-taint", module: "agent/hooks/spawn-taint.js", summary: "THE TURN BOUNDARY for the taint signal — it does TWO things, in this order, and both belong here:" },
+        { kind: "hook", name: "spend", module: "agent/hooks/spend.js", summary: "Spend recording — accumulates usage per scope so caps can be enforced and usage observed." },
+        { kind: "hook", name: "stall-guard", module: "agent/hooks/stall-guard.js", summary: "Stall-guard DETECTION hook — the observe-only seam that feeds the within-loop stall guard (agent/stall/guard.ts)." },
+        { kind: "hook", name: "telemetry", module: "agent/hooks/telemetry.js", summary: "Turn-level telemetry — accumulates one turn's step count + token total + start time, then emits `oe.turn.completed`/`oe.turn.failed` (surface TYPE only, never a surfaceKey/session/principal id — see…" },
+        { kind: "hook", name: "turn-anchor", module: "agent/hooks/turn-anchor.js", summary: "THE TURN-ANCHOR HOOK (OPE-418) — the writer for the stop registry, and the whole ✋ lifecycle." },
+        { kind: "hook", name: "wake-accounting-turn", module: "agent/hooks/wake-accounting-turn.js", summary: "THE TURN EDGE FOR PER-WAKE ACCOUNTING (OPE-1013) — the second call site for channels/unified.ts's `auditUnaccountedWakesForTurn`, wired to turn.completed/turn.cancelled/session.failed so a turn whose…" },
+        { kind: "hook", name: "wake-turn-start", module: "agent/hooks/wake-turn-start.js", summary: "THE TURN-START ANCHOR (OPE-1716) — one audit row at the instant a wake's turn begins, so the stretch BEFORE the turn can be told apart from the turn itself." },
+        { kind: "hook", name: "window-routing", module: "agent/hooks/window-routing.js", summary: "Routing-invariant hook (OPE-121) — audit a wake that landed on a NATIVE seat even though its own domain windows." },
+        // ── schedules ────────────────────────────────────────────────────────────────────────────────
+        { kind: "schedule", name: "directory-sync", module: "agent/schedules/directory-sync.js", summary: "The DIRECTORY-SYNC SCHEDULE — the clock half of IdP pre-population (P2.3)." },
+        { kind: "schedule", name: "dispatch", module: "agent/schedules/dispatch.js", summary: "The routine DISPATCHER — the one bridge from Eve's static cron to OpenEverywhere's dynamic, NL-created, per-surface routines (Phase 3)." },
+        { kind: "schedule", name: "dream-mode3", module: "agent/schedules/dream-mode3.js", summary: "The Mode-3 (\"failure digest\") SCHEDULE — the weekly, harness-level learning pass (sibling to schedules/tidy.ts's daily Mode-2 pass; see memory/dream/mode3.ts for the pure logic this wires up)." },
+        { kind: "schedule", name: "tidy", module: "agent/schedules/tidy.js", summary: "The Mode-2 \"tidy\" SCHEDULE — the periodic, corrective maintenance pass over the memory silos." },
+        // ── connections ──────────────────────────────────────────────────────────────────────────────
+        { kind: "connection", name: "notion", module: "agent/connections/notion.js", summary: "An Eve *connection* — the host-side connector plane (NEW; see connector-auth decision)." },
+        // ── skills ───────────────────────────────────────────────────────────────────────────────────
+        { kind: "skill", name: "scoped", module: "agent/skills/scoped.js", summary: "Scoped skills: expose to the model the skills this session may see, merged from THREE sources (precedence, narrowest-wins-on-name-collision): bundle-GRANTED skills (plugin grants → resolver →…" },
+    ],
+};
+//# sourceMappingURL=contributions.js.map

package/dist/agent/contributions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contributions.js","sourceRoot":"","sources":["../../agent/contributions.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,2FAA2F;AAC3F,4FAA4F;AAC5F,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,iCAAiC;AACjC,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,qGAAqG;AACrG,kGAAkG;AAClG,0DAA0D;AAC1D,uEAAuE;AACvE,EAAE;AACF,+FAA+F;AAE/F,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,uBAAuB;IAChC,aAAa,EAAE;QACb,gGAAgG;QAChG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,gEAAgE,EAAE;QAClJ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,kHAAkH,EAAE;QAClN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,wNAAwN,EAAE;QAClT,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,gFAAgF,EAAE;QAC5J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,oEAAoE,EAAE;QAC1I,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,kGAAkG,EAAE;QAC5L,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,oEAAoE,EAAE;QAChK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,gLAAgL,EAAE;QAC5Q,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,uGAAuG,EAAE;QACrM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,iHAAiH,EAAE;QAC3M,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,yCAAyC,EAAE,OAAO,EAAE,4KAA4K,EAAE;QAC5R,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,+HAA+H,EAAE;QACjO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,wHAAwH,EAAE;QAChN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,wDAAwD,EAAE;QACtJ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,8LAA8L,EAAE;QACtR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,kEAAkE,EAAE;QACpJ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,sHAAsH,EAAE;QAC9M,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,0MAA0M,EAAE;QACtS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,4KAA4K,EAAE;QACpQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,sHAAsH,EAAE;QAChN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,wEAAwE,EAAE;QACtK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,gGAAgG,EAAE;QACxL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,iEAAiE,EAAE;QAC7J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,mMAAmM,EAAE;QACrR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,iFAAiF,EAAE;QACrK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,qLAAqL,EAAE;QAC7Q,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,+LAA+L,EAAE;QAC3R,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,sMAAsM,EAAE;QAC1S,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,iHAAiH,EAAE;QACvM;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,yCAAyC;YACjD,OAAO,EAAE,iJAAiJ;SAC3J;QACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,uMAAuM,EAAE;QACrS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,4JAA4J,EAAE;QACpO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,sJAAsJ,EAAE;QAChP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,+IAA+I,EAAE;QACnP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,oEAAoE,EAAE;QACxJ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,wMAAwM,EAAE;QAClS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,gJAAgJ,EAAE;QACtO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,0MAA0M,EAAE;QACpS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,0MAA0M,EAAE;QAC5S,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,uMAAuM,EAAE;QACzS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,wKAAwK,EAAE;QAC9Q,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,wCAAwC,EAAE;QACxH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,yKAAyK,EAAE;QAC3Q,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,sCAAsC,EAAE,OAAO,EAAE,6GAA6G,EAAE;QACvN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,4KAA4K,EAAE;QAC9P,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,oNAAoN,EAAE;QAC5S,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,wEAAwE,EAAE;QAC9K,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,+MAA+M,EAAE;QACvS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,6LAA6L,EAAE;QAC3R,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,kEAAkE,EAAE;QAC5I,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,yGAAyG,EAAE;QACjM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,mIAAmI,EAAE;QACrN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,2GAA2G,EAAE;QAC3M,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,wCAAwC,EAAE,OAAO,EAAE,gJAAgJ,EAAE;QAC9P,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,qFAAqF,EAAE;QAC3K,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,mKAAmK,EAAE;QACnQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,wHAAwH,EAAE;QAChO;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,kCAAkC;YAC1C,OAAO,EAAE,6IAA6I;SACvJ;QACD;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,iCAAiC;YACzC,OAAO,EAAE,sIAAsI;SAChJ;QACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,uMAAuM,EAAE;QACvS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,iGAAiG,EAAE;QACjM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,oGAAoG,EAAE;QACxM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,uGAAuG,EAAE;QAC7M,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,yFAAyF,EAAE;QACnK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,uIAAuI,EAAE;QACzO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,uDAAuD,EAAE;QACnJ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,+KAA+K,EAAE;QAC3P,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,0DAA0D,EAAE;QAC1J;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,wCAAwC;YAChD,OAAO,EAAE,6HAA6H;SACvI;QACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,mKAAmK,EAAE;QACvR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,kGAAkG,EAAE;QAC9L,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,0FAA0F,EAAE;QACxL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,gLAAgL,EAAE;QAC1Q;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,8IAA8I;SACxJ;QACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,wMAAwM,EAAE;QAChS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,qJAAqJ,EAAE;QACnP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,8MAA8M,EAAE;QAC5S,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,4EAA4E,EAAE;QAC9J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,iJAAiJ,EAAE;QACzP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,iMAAiM,EAAE;QACzR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,uJAAuJ,EAAE;QAC3O,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,yMAAyM,EAAE;QACjS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,oKAAoK,EAAE;QAClQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,0JAA0J,EAAE;QACpP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,0MAA0M,EAAE;QAClS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,mMAAmM,EAAE;QAEjR,gGAAgG;QAChG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,uLAAuL,EAAE;QAC7R,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,udAAud,EAAE;QACnjB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,yMAAyM,EAAE;QACvS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,0CAA0C,EAAE,OAAO,EAAE,oIAAoI,EAAE;QACtP,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,wJAAwJ,EAAE;QAChQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,6UAA6U,EAAE;QAC3a,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,oHAAoH,EAAE;QAC5M,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,oGAAoG,EAAE;QAC1M,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,2FAA2F,EAAE;QAC/K,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,8KAA8K,EAAE;QAC1R,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,iHAAiH,EAAE;QAEvM,gGAAgG;QAChG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,8KAA8K,EAAE;QAC5Q,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,oFAAoF,EAAE;QAC1L,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,kMAAkM,EAAE;QAC9R,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,+HAA+H,EAAE;QAC7N,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,kMAAkM,EAAE;QAC9Q,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,oSAAoS,EAAE;QAChY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,+OAA+O,EAAE;QACzU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,+OAA+O,EAAE;QACvU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,oMAAoM,EAAE;QAC1R,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,wMAAwM,EAAE;QAC1R,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,6HAA6H,EAAE;QACvM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,qHAAqH,EAAE;QACzM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,uMAAuM,EAAE;QACzR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,gMAAgM,EAAE;QACxR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,gFAAgF,EAAE;QAC5J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,4JAA4J,EAAE;QAChQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,yKAAyK,EAAE;QACvQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,mMAAmM,EAAE;QACvS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,0MAA0M,EAAE;QAC9S,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,4DAA4D,EAAE;QAC1J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,0MAA0M,EAAE;QACxS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,2FAA2F,EAAE;QACnL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,mGAAmG,EAAE;QACzL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,2FAA2F,EAAE;QACrK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,mHAAmH,EAAE;QACzM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,yMAAyM,EAAE;QAC3R,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,+FAA+F,EAAE;QACrL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,0MAA0M,EAAE;QAClT,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,8JAA8J,EAAE;QAC5P,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,kHAAkH,EAAE;QAE9M,gGAAgG;QAChG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,4EAA4E,EAAE;QAChL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,yIAAyI,EAAE;QACjO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,oMAAoM,EAAE;QAClS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,iGAAiG,EAAE;QAEjL,gGAAgG;QAChG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,yFAAyF,EAAE;QAEjL,gGAAgG;QAChG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,kMAAkM,EAAE;KACjR;CACO,CAAC"}

package/dist/agent/control/auth.d.ts

@@ -0,0 +1,291 @@
+import { type AuthFn } from "eve/channels/auth";
+import { type JWTVerifyGetKey } from "jose";
+import type { IncomingMessage } from "node:http";
+import { type Domain } from "../memory/domain.js";
+/** A resolved admin identity — what the http.ts handler gates on. */
+export interface AdminIdentity {
+    /** The issuer that authenticated this principal (the trust anchor). */
+    readonly issuer: string;
+    /** Stable per-issuer subject — the real identity key. */
+    readonly subject: string;
+    readonly email?: string;
+    /** Only ever true when the issuer asserted it; gates email-based role rules. */
+    readonly emailVerified: boolean;
+    /** Roles granted by the rules (e.g. ["admin"] / ["viewer"]). */
+    readonly roles: readonly string[];
+    /**
+     * READ-ONLY principal (service tokens, OE_CONTROL_READ_TOKENS): when true, http.ts
+     * builds this request's control server with the mutating tools UNREGISTERED
+     * (server.ts's `includeWrites && readOnly !== true` gate — the single choke point
+     * every write tool passes through), regardless of the mount's includeWrites. The
+     * roles then govern READ scope only. Absent/false = the pre-existing behaviour.
+     *
+     * The label is now LITERALLY true (OPE-136). It used not to be: the test-wake
+     * INJECTION route authenticated against this same OE_CONTROL_READ_TOKENS family, and
+     * wake injection transitively WRITES — so a "read-only" token could mint a full-kit
+     * task seat. Injection moved to its own {@link INJECT_TOKEN_ENV} family, verified by
+     * {@link verifyInjectToken}, which never produces an AdminIdentity at all.
+     */
+    readonly readOnly?: boolean;
+}
+/** The pre-role identity a verifier extracts from a token. */
+export interface RawIdentity {
+    readonly issuer: string;
+    readonly subject: string;
+    readonly email?: string;
+    readonly emailVerified: boolean;
+}
+/** A token verifier: validate a bearer token, return a raw identity or null. */
+export type TokenVerifier = (token: string, req: IncomingMessage) => Promise<RawIdentity | null>;
+/**
+ * A role-grant rule. `roles` are granted when every present matcher holds. Email /
+ * emailDomain matchers ALSO require emailVerified === true (enforced below) — so an
+ * unverified-email token can never satisfy them. Match on (issuer, subject) for a
+ * single exact identity; on (verified) email/domain to recognise one human across
+ * providers.
+ */
+export interface RoleRule {
+    readonly roles: readonly string[];
+    readonly issuer?: string;
+    readonly subject?: string;
+    readonly email?: string;
+    readonly emailDomain?: string;
+}
+/** Roles granted to a raw identity by the rule set (deduped). Default-deny: [] if none match. */
+export declare function resolveRoles(id: RawIdentity, rules: readonly RoleRule[]): string[];
+/** A control-plane request's scope, for the domain-role gate. `surfaceKey`/`domain` are
+ *  the SAME two ways a scope can be named as elsewhere (roles.ts): a fully-qualified
+ *  channel key, or the domain name directly. `org` names the partition the answer comes
+ *  from — see docs/security/control-plane.md for the org partitioning story.
+ *
+ *  🔴 CARRYING AN `org` IS NOT THE SAME AS CHECKING IT. {@link scopeDenial} and
+ *  {@link siloScopeDenial} refuse a foreign org ({@link foreignOrgDenial}) before they ask the
+ *  role question. {@link roleCoversScope} does NOT: it is a pure role predicate and never reads
+ *  `scope.org`, so a caller that uses it directly — a row-filtering view, as `pendingActionsView`
+ *  does — must call {@link foreignOrgDenial} itself, the way `control/server.ts` does for
+ *  `memory_list` and `pending_actions_list`. A view that copies the shape and skips that gate
+ *  filters another tenant's rows by role and answers with them. */
+export interface ScopeRequest {
+    readonly org: string;
+    readonly surfaceKey?: string;
+    readonly domain?: string;
+}
+/**
+ * Does this identity's roles cover the requested scope? "admin" covers everything.
+ * "domain:<name>" covers that domain by name, or by surfaceKey resolving to it
+ * (domainForChannel — the same channel→domain hop access/roles.ts uses). FAIL-CLOSED: an
+ * unscoped request (no surfaceKey/domain — an org-wide ask) is covered ONLY by "admin";
+ * an unresolvable surfaceKey (no matching domain) is covered by nothing. Pure — domains
+ * passed explicitly so this is matrix-testable without a registered AppConfig.
+ */
+export declare function roleCoversScope(roles: readonly string[], scope: ScopeRequest, domains: readonly Domain[]): boolean;
+/**
+ * Call-site convenience for control-plane tool handlers: like roleCoversScope, but pulls
+ * domains from the registered AppConfig LAZILY — only when a non-"admin" role actually
+ * needs domain resolution — so an admin caller (the common case, and every existing test)
+ * never requires getConfig() to be registered. Returns a denial message (drop straight into
+ * the tool's error result) or null when the scope is covered.
+ */
+export declare function scopeDenial(roles: readonly string[], scope: ScopeRequest): string | null;
+/**
+ * Refuse a control-plane ask whose `org` is not this deployment's, naming both. Null when
+ * the ask names this deployment's org.
+ *
+ * 🔴 THE ORG CHECK RUNS BEFORE THE ROLE CHECK, AND THAT ORDER IS THE WHOLE CONTROL (OPE-1438).
+ * `scopeDenial` used to short-circuit `null` on the "admin" role and never read
+ * `ScopeRequest.org` at all, so every gated read took its partition key from the CALLER: an
+ * admin-scoped principal — an org admin, or any read-only service token, which
+ * {@link verifyServiceToken} mints with roles ["admin"] — passed `org: "other-tenant"` to
+ * `routines_list` and was answered from that tenant's rows, routine PROMPTS included. The same
+ * hole stood behind `usage_window`, `usage_summary`, `overrides_list` and
+ * `unified_domain_audit`. A role model that scopes by DOMAIN cannot express "this org and no
+ * other", so the org is not a role question: it is a property of the deployment, read here from
+ * `deploymentOrg()` exactly as `audit_query` and the HTTP read route read it (OPE-1129).
+ *
+ * The deployment is SINGLE-ORG today, so this refuses nothing a real operator sends. A
+ * deployment that grows a second org builds a real multi-org role model; this refusal is what
+ * makes that a visible task rather than a quiet cross-tenant read.
+ */
+export declare function foreignOrgDenial(org: string): string | null;
+/**
+ * The EXPLICIT domain names that reference a memory silo (memory/domain.ts Domain.memory)
+ * — the memory-admin MCP's (control/views.ts memory_list/memory_read) scope-covering set
+ * for that silo. Deliberately excludes CRITERIA pseudo-domains (`org`/`public`/`dm` — the
+ * ones declared with `match`): the conventional org-wide brain (silo name "org-brain",
+ * referenced by the `org` pseudo-domain) and anything referenced only by `public`/`dm`
+ * stay admin-only even if a caller somehow holds "domain:org" — there is no legitimate
+ * way to grant that via OE_ADMIN_ROLE_RULES, but the exclusion is explicit rather than
+ * accidental (docs/control-plane.md "memory-admin"). A silo referenced by no domain at
+ * all (config drift, or a silo not yet wired to a domain) is likewise admin-only —
+ * nothing to attribute a covering domain role to.
+ */
+export declare function siloCoveringDomains(siloName: string, domains: readonly Domain[]): string[];
+/**
+ * Is a memory SILO covered by this identity's roles? Like roleCoversScope, but a silo
+ * can be referenced by SEVERAL explicit domains at once (a shared brain) — covered by
+ * "admin", or by a "domain:<name>" role matching ANY of {@link siloCoveringDomains}.
+ */
+export declare function siloScopeDenial(roles: readonly string[], org: string, siloName: string, domains: readonly Domain[]): string | null;
+/**
+ * Generic OIDC verifier — covers any standards-compliant OIDC issuer (Google, Auth0,
+ * Okta, Entra, WorkOS, …). Verifies the JWT's signature against the issuer's JWKS and
+ * checks iss + aud. Pass `jwks` to inject a key set (tests / non-discoverable issuers);
+ * otherwise the issuer's published JWKS is used (discovered from jwks_uri, or the
+ * conventional {issuer}/.well-known/jwks.json).
+ */
+export declare function genericOidcVerifier(opts: {
+    issuer: string;
+    audience: string;
+    jwks?: JWTVerifyGetKey;
+    jwksUri?: string;
+}): TokenVerifier;
+/**
+ * GitHub user-login verifier. GitHub is NOT a true OIDC IdP for user identity (OAuth2
+ * + REST, no ID token), so we validate the access token by calling the user API and
+ * read the verified primary email. `fetchUser` is injectable for tests.
+ */
+export declare function githubOAuthVerifier(opts?: {
+    fetchUser?: (token: string) => Promise<{
+        id: number | string;
+        login: string;
+        email?: string;
+        emailVerified?: boolean;
+    } | null>;
+}): TokenVerifier;
+/**
+ * Static shared-token verifier — for trivial self-host (one operator, one secret).
+ * No federation; the token IS the credential. Grants a fixed identity (default-admin)
+ * so a single-operator deploy needs no IdP.
+ */
+export declare function staticTokenVerifier(opts: {
+    token: string;
+    subject?: string;
+}): TokenVerifier;
+export declare const SERVICE_TOKEN_ISSUER = "service-token";
+/** The env var holding the WAKE-INJECTION family entries (test-route.ts only). */
+export declare const INJECT_TOKEN_ENV = "OE_CONTROL_INJECT_TOKENS";
+export interface ServiceTokenEntry {
+    /** Lowercase machine name ("e2e-harness") — becomes principal `svc:<name>`. */
+    readonly name: string;
+    /** Lowercase sha256 hex of the token VALUE (64 chars). */
+    readonly sha256: string;
+}
+/**
+ * Parse a service-token env ("name:sha256hex,name2:sha256hex") — the SHARED wire shape of
+ * both families (READ and INJECT), so `envName` exists only to name the offending variable
+ * in a warning. FAIL-CLOSED: unset/blank → [] (that family is fully off); a malformed entry
+ * is DROPPED (it can never authenticate anything), warned by POSITION ONLY — never echoing
+ * the entry, which could be a mis-pasted raw token. Rules: name must be lowercase [a-z0-9_-]
+ * starting alphanumeric (it becomes an audit principal — one canonical casing, no spoofing a
+ * twin by case); hash must be 64 hex chars (uppercase tolerated, normalised down).
+ */
+export declare function parseServiceTokenEntries(raw: string | undefined, envName?: string): ServiceTokenEntry[];
+/** The configured WAKE-INJECTION entries ({@link INJECT_TOKEN_ENV}). Fail-closed: unset ⇒ []
+ *  ⇒ `POST /control/v1/test/wake` 404s. Read at call time, never cached, so a test (and the
+ *  route's own gate) sees the live env exactly like the read family's parse does. */
+export declare function injectTokenEntries(env?: NodeJS.ProcessEnv): ServiceTokenEntry[];
+/** A WAKE-INJECTION principal — deliberately NOT an {@link AdminIdentity}. It carries no
+ *  roles and no `readOnly` flag because it is not a control-plane reader at all: its only
+ *  consumer is test-route.ts, which needs a name to stamp on the `control.service_call`
+ *  audit row. Keeping the type separate is what stops an inject token from ever being
+ *  handed to `buildControlServer` (which takes roles + readOnly) by a later refactor. */
+export interface InjectIdentity {
+    /** Audit principal, `svc:<name>` — same naming convention as a read service token. */
+    readonly subject: string;
+}
+/**
+ * Verify a presented WAKE-INJECTION token value against {@link injectTokenEntries}. Same
+ * constant-time compare as {@link verifyServiceToken}; the difference is what a match
+ * BUYS. This grants nothing on the control plane — no roles, no read views, no MCP mount —
+ * only the identity test-route.ts audits its injection under. FAIL-CLOSED: no entries
+ * (family unset) or no match ⇒ null ⇒ the route refuses.
+ *
+ * There is deliberately NO cross-check against the READ family here. A read token
+ * presented at the injection route hashes to no inject entry and is refused, which is the
+ * whole point of OPE-136 — see the family comment above for why additive was rejected.
+ */
+export declare function verifyInjectToken(token: string, entries: readonly ServiceTokenEntry[]): InjectIdentity | null;
+/**
+ * Verify a presented service-token VALUE against the configured entries: sha256 the
+ * bearer, constant-time-compare against each hash. A match authenticates as the
+ * READ-ONLY service principal `svc:<name>` — `readOnly: true` structurally strips
+ * every write tool from the per-request server (see AdminIdentity.readOnly); roles
+ * are ["admin"] so READ views with an org-wide scope gate (usage_window,
+ * overrides_list, usage_summary unscoped) are reachable, which is the point of a
+ * deployment-level harness credential. Pure and transport-neutral: the node:http MCP
+ * mount (makeServiceTokenAuthenticator) and the WHATWG-Request read route
+ * (control/read-route.ts) both resolve their bearer through this one compare.
+ *
+ * Callers must pass READ-family entries. It is NOT the injection verifier — the
+ * wake-injection seam uses {@link verifyInjectToken} over a disjoint env family, so this
+ * function's "READ-ONLY" contract is now structurally honest (OPE-136).
+ */
+export declare function verifyServiceToken(token: string, entries: readonly ServiceTokenEntry[]): AdminIdentity | null;
+/**
+ * Authenticator for service tokens over the node:http MCP transport — extracts the
+ * bearer and delegates to {@link verifyServiceToken}. No match / no bearer → null
+ * (compose with the OIDC authenticator; falls through).
+ */
+export declare function makeServiceTokenAuthenticator(entries: readonly ServiceTokenEntry[]): (req: IncomingMessage) => Promise<AdminIdentity | null>;
+/**
+ * Compose verifiers + role rules into the `authenticate` hook http.ts expects. Tries
+ * each verifier until one claims the token, then resolves roles. Returns null when no
+ * verifier matches OR the identity earns no roles (default-deny — an authenticated but
+ * un-granted principal is NOT admitted).
+ */
+export declare function makeAdminAuthenticator(verifiers: readonly TokenVerifier[], rules: readonly RoleRule[]): (req: IncomingMessage) => Promise<AdminIdentity | null>;
+/**
+ * Build the authenticator from env — the zero-code deploy path. Returns null when
+ * nothing is configured (so the caller stays FAIL-CLOSED rather than open):
+ *   OE_ADMIN_OIDC_ISSUER   + OE_ADMIN_OIDC_AUDIENCE   → generic OIDC (any provider)
+ *   OE_ADMIN_GITHUB=1                                       → GitHub user-login
+ *   OE_ADMIN_STATIC_TOKEN                                   → shared-token self-host
+ *   OE_ADMIN_ROLE_RULES  (JSON RoleRule[])                  → who gets which roles
+ *   OE_CONTROL_READ_TOKENS ("name:sha256hex,…")             → READ-ONLY service tokens
+ * A static token with no rules implies single-operator admin (a default admin rule).
+ * Service tokens are checked FIRST (a cheap constant-time hash compare, no network);
+ * a non-matching bearer falls through to the identity verifiers. OE_CONTROL_READ_TOKENS
+ * unset → the composed authenticator is byte-identical to before the mode existed.
+ *
+ * OE_CONTROL_INJECT_TOKENS is deliberately ABSENT from this list and must stay absent: the
+ * wake-injection family authenticates exactly one route (control/test-route.ts) via
+ * {@link verifyInjectToken}, and composing it here would silently make an injection
+ * credential a control-plane reader — the mirror image of the OPE-136 defect.
+ */
+export declare function adminAuthenticatorFromEnv(): ((req: IncomingMessage) => Promise<AdminIdentity | null>) | null;
+/**
+ * eve's verified-caller snapshot. eve does not export the `SessionAuthContext` NAME from any public
+ * subpath (it lives behind `#channel/types.js`), so it is derived structurally from the public
+ * {@link AuthFn} contract. An eve bump that changes the shape therefore reds `typecheck:all` here
+ * rather than at every call site.
+ */
+export type EveSessionAuth = NonNullable<Awaited<ReturnType<AuthFn<Request>>>>;
+/** `authenticator` stamped on a caller verified by the READ family. */
+export declare const SERVICE_TOKEN_AUTHENTICATOR = "oe-service-token";
+/** `authenticator` stamped on a caller verified by the WAKE-INJECTION family. */
+export declare const INJECT_TOKEN_AUTHENTICATOR = "oe-inject-token";
+/**
+ * eve route auth for the READ family ({@link verifyServiceToken}). A match becomes the service
+ * principal `svc:<name>` on `principalId`, the same string the hand-rolled gate audited. The
+ * `oe_token_family` attribute records WHICH family admitted the caller: the two families are
+ * disjoint by design (OPE-136), and a caller snapshot that cannot say which one verified it would
+ * hide the difference the split exists to keep.
+ *
+ * The bag comes from routines/fire-auth.ts {@link serviceTokenFireAttributes}, so it also carries
+ * the UNATTENDED-ORIGIN marker: `svc:<name>` is a non-empty principal, and a presence gate that
+ * read it WITHOUT the marker would answer as if a human were acting (OPE-278). No route hands this
+ * snapshot to a session today — read-route.ts takes `principalId` for its audit row and nothing
+ * else — so the marker is a STANDING property of the door, not a refusal any path exercises today.
+ * `serviceTokenFireAttributes` states that limit in full.
+ */
+export declare function serviceTokenAuth(entries: readonly ServiceTokenEntry[]): AuthFn<Request>;
+/**
+ * eve route auth for the WAKE-INJECTION family ({@link verifyInjectToken}). Deliberately a SEPARATE
+ * factory over a separate entry list: a read token hashes to no inject entry and is refused here,
+ * exactly as the hand-rolled gate refused it. Nothing composes the two into one walk.
+ *
+ * The bag comes from the same builder the READ door uses, with the other family value — so the
+ * UNATTENDED-ORIGIN marker cannot be present on one door and missing on the other.
+ */
+export declare function injectTokenAuth(entries: readonly ServiceTokenEntry[]): AuthFn<Request>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/agent/control/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../agent/control/auth.ts"],"names":[],"mappings":"AA+BA,OAAO,EAA0C,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAgC,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAKhF,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,EAAE,CAoBlF;AAED;;;;;;;;;;;mEAWmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAUlH;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAOxF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAK1F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAWlI;AASD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,aAAa,CAkBhB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE;IACzC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChI,GAAG,aAAa,CAgChB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAK5F;AAwCD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAIpD,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAKD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,GAAE,MAAuB,GAAG,iBAAiB,EAAE,CAkBvH;AAED;;qFAEqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,iBAAiB,EAAE,CAE5F;AAkBD;;;;yFAIyF;AACzF,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,cAAc,GAAG,IAAI,CAG7G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,aAAa,GAAG,IAAI,CAI7G;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAK5I;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,KAAK,EAAE,SAAS,QAAQ,EAAE,GACzB,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAazD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CA+B5G;AA2BD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAC9D,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAoBvF;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAetF"}