@open-everywhere/core 0.1.0

package/dist/agent/identity/link-initiator.js

@@ -0,0 +1,25 @@
+// The gate on who may START or COMMIT an identity link, and it is deliberately SCOPED: it refuses only on a platform whose trust verdict was actually checked (BINDING_TRUSTED_PLATFORMS).
+// Elsewhere `trust !== "internal"` means nobody checked, so an unscoped refusal would not refuse guests — it would delete the feature for every caller on the platforms that cannot produce an internal verdict.
+import { BINDING_TRUSTED_PLATFORMS } from "../memory/domain.js";
+/**
+ * The refusal a link-growing verb must throw, or `undefined` when the caller may proceed.
+ *
+ * A REFUSAL IS A VALUE here rather than a throw so the caller keeps its own error shape and the
+ * sentence is written once for both verbs. `act` completes "I can't ⟨act⟩ from here" — a short
+ * verb phrase ("start a link", "confirm a link"), never anything interpolated from content.
+ *
+ * The text is deliberately readable by the person who is refused: a guest DMing the agent should
+ * learn that membership is what is missing, not that something went wrong.
+ */
+export function linkInitiatorRefusal(binding, act) {
+    if (binding.trust === "internal")
+        return undefined;
+    // Absence of evidence is not refusal — see the header. Only a platform whose verdict was actually
+    // checked may refuse on it.
+    if (!BINDING_TRUSTED_PLATFORMS.has(binding.platform))
+        return undefined;
+    return (`I can't ${act} from here — I can't confirm you're inside this organisation. ` +
+        `Linking accounts gives one person's identity reach across every surface I can see, so I only ` +
+        `do it for confirmed members. If you are one, ask an admin why this surface reads as external.`);
+}
+//# sourceMappingURL=link-initiator.js.map

package/dist/agent/identity/link-initiator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-initiator.js","sourceRoot":"","sources":["../../../agent/identity/link-initiator.ts"],"names":[],"mappings":"AAAA,2LAA2L;AAC3L,iNAAiN;AAEjN,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAGhE;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6D,EAAE,GAAW;IAC7G,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACnD,kGAAkG;IAClG,4BAA4B;IAC5B,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,OAAO,CACL,WAAW,GAAG,gEAAgE;QAC9E,+FAA+F;QAC/F,+FAA+F,CAChG,CAAC;AACJ,CAAC"}

package/dist/agent/identity/link-resolve.d.ts

@@ -0,0 +1,40 @@
+import { type Principal, type PrincipalSurfaceIds } from "./principals.js";
+/** One confirmed link-set, flattened for the union. `handle` is DISPLAY ONLY (it becomes the
+ *  entry's `name` when there is no config entry to take a real name from); `ids` are the CONFIRMED
+ *  accounts only — the caller filters, because `expandLinkSet` already does. */
+export interface LinkSetPrincipal {
+    readonly linkSetId: string;
+    readonly handle: string;
+    readonly ids: PrincipalSurfaceIds;
+}
+export interface UnionWarning {
+    /** The account the two sides disagree about — its PRINCIPAL KEY when the grammar can compose one,
+     *  and an explicitly un-key-shaped sentence when it cannot. See {@link conflictWarning}. */
+    readonly key: string;
+    readonly message: string;
+}
+export interface PrincipalUnion {
+    /** The merged roster, in CONFIG ORDER first then DB-only entries — so a consumer that renders
+     *  this list sees the reviewed entries where it always saw them. */
+    readonly principals: readonly Principal[];
+    /** Every account dropped for conflicting ownership, with the reason. Non-empty means an operator
+     *  has an identity disagreement to resolve; consumers surface it rather than swallow it. */
+    readonly warnings: readonly UnionWarning[];
+}
+/**
+ * Union the config map with confirmed link-sets.
+ *
+ * Three cases, and the third is the one that matters:
+ *  • an account only config knows → the config entry, unchanged;
+ *  • an account only the DB knows → a new entry named by the link-set's handle;
+ *  • an account BOTH know:
+ *      – if the two entries share it and their other accounts are compatible (neither claims an
+ *        account the other assigns to somebody else), they are the SAME person and merge — the
+ *        config entry keeps its reviewed `name`/`handle`/`email` and gains the DB's extra accounts;
+ *      – otherwise the account is CONFLICTED: removed from both entries, warning emitted.
+ *
+ * Deterministic and total: no I/O, no clock, no config lookup, and the output order is config order
+ * then link-set order.
+ */
+export declare function unionPrincipals(config: readonly Principal[], linkSets: readonly LinkSetPrincipal[]): PrincipalUnion;
+//# sourceMappingURL=link-resolve.d.ts.map

package/dist/agent/identity/link-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-resolve.d.ts","sourceRoot":"","sources":["../../../agent/identity/link-resolve.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2C,KAAK,SAAS,EAA4B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG9I;;gFAEgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B;gGAC4F;IAC5F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B;wEACoE;IACpE,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C;gGAC4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;CAC5C;AA2DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,cAAc,CAgHnH"}

package/dist/agent/identity/link-resolve.js

@@ -0,0 +1,195 @@
+// The pure union read path: the config principals map plus confirmed DB link-sets, composed for attribution consumers. When both sides give one account to different people the account is dropped from both and a warning is emitted — never merged, and never matched on a display name.
+import { surfaceAccounts, surfaceIdsFromAccounts } from "./principals.js";
+import { isTenantScopedPlatform, tryPrincipalKey } from "./principal-key.js";
+/** The exact account key: the (platform, tenant, id) triple as a JSON tuple, which is injective by construction, so no separator character can collide. */
+function strictKey(a) {
+    return JSON.stringify([a.platform, a.tenant ?? "", a.id]);
+}
+/** The account key with the workspace rung REMOVED — what an UNQUALIFIED entry can be matched on.
+ *  Never used as an identity, only as a lookup into {@link byLoose}; see {@link sameAccount}. */
+function looseKey(a) {
+    return JSON.stringify([a.platform, a.id]);
+}
+/**
+ * Are these two written accounts THE SAME ACCOUNT?
+ *
+ * 🔴 THE ASYMMETRIC ARM IS THE COMPATIBILITY GUARANTEE (OPE-350). Equal platform and equal id is
+ * necessary always. On a tenant-scoped platform, two QUALIFIED accounts must additionally agree on
+ * the workspace — that is the aliasing OPE-309 deleted, and it is not being re-opened here. But a
+ * QUALIFIED account and an UNQUALIFIED one with the same id ARE the same account, because "bare"
+ * means "this id, in whichever workspace this deployment serves" (principals.ts's header) and the
+ * qualified side simply says which one that is. Without this arm every existing single-workspace
+ * deployment would stop joining its config map to its own link-sets the moment the link tables
+ * started reporting a real tenant — the config entry says `slack: "U1"`, the confirmed row says
+ * `slack/T1/U1`, and a strict comparison calls them two people.
+ *
+ * The ambiguity that arm could create — one bare entry matching TWO qualified accounts in different
+ * workspaces — is not resolved by picking one. It is detected in {@link unionPrincipals} and treated
+ * as a conflict, which costs the account its cross-surface treatment and grants nothing.
+ */
+function sameAccount(a, b) {
+    if (a.platform !== b.platform || a.id !== b.id)
+        return false;
+    if (!isTenantScopedPlatform(a.platform))
+        return true;
+    if (a.tenant === undefined || b.tenant === undefined)
+        return true;
+    return a.tenant === b.tenant;
+}
+function indexAccounts(sides) {
+    const byStrict = new Map();
+    const byLoose = new Map();
+    for (const [i, s] of sides.entries()) {
+        for (const a of surfaceAccounts(s.ids)) {
+            if (!byStrict.has(strictKey(a)))
+                byStrict.set(strictKey(a), i);
+            const list = byLoose.get(looseKey(a)) ?? [];
+            list.push({ account: a, owner: i });
+            byLoose.set(looseKey(a), list);
+        }
+    }
+    return { byStrict, byLoose };
+}
+/**
+ * Union the config map with confirmed link-sets.
+ *
+ * Three cases, and the third is the one that matters:
+ *  • an account only config knows → the config entry, unchanged;
+ *  • an account only the DB knows → a new entry named by the link-set's handle;
+ *  • an account BOTH know:
+ *      – if the two entries share it and their other accounts are compatible (neither claims an
+ *        account the other assigns to somebody else), they are the SAME person and merge — the
+ *        config entry keeps its reviewed `name`/`handle`/`email` and gains the DB's extra accounts;
+ *      – otherwise the account is CONFLICTED: removed from both entries, warning emitted.
+ *
+ * Deterministic and total: no I/O, no clock, no config lookup, and the output order is config order
+ * then link-set order.
+ */
+export function unionPrincipals(config, linkSets) {
+    const warnings = [];
+    const conflicted = new Map(); // strictKey → the account, for the warning
+    const flag = (a) => {
+        if (!conflicted.has(strictKey(a)))
+            conflicted.set(strictKey(a), a);
+    };
+    // Which link-set (if any) each config entry corresponds to, and vice versa. A correspondence is
+    // established by a SHARED ACCOUNT — the only join key either side is allowed to be matched on.
+    const setIndex = indexAccounts(linkSets);
+    for (const [k, holders] of setIndex.byLoose) {
+        void k;
+        // Two link-sets claiming one account cannot happen through link-store.ts (the PK forbids it),
+        // but this function is total over whatever it is handed — so it is treated as a conflict rather
+        // than resolved by list order. Compared with `sameAccount` so two link-sets holding the SAME id
+        // in DIFFERENT workspaces (the whole point of OPE-350) are two accounts, not a collision.
+        for (const x of holders) {
+            for (const y of holders) {
+                if (x.owner === y.owner || !sameAccount(x.account, y.account))
+                    continue;
+                flag(x.account);
+                flag(y.account);
+            }
+        }
+    }
+    const setsMatching = (a) => (setIndex.byLoose.get(looseKey(a)) ?? []).filter((h) => sameAccount(a, h.account));
+    const configForSet = new Map(); // link-set index → config index
+    for (const [ci, p] of config.entries()) {
+        const hits = new Set();
+        for (const a of surfaceAccounts(p.ids)) {
+            const matches = setsMatching(a);
+            // 🔴 ONE BARE ENTRY MATCHING TWO WORKSPACES' ACCOUNTS IS A CONFLICT, NOT A CHOICE. This is the
+            // only ambiguity the unqualified arm of `sameAccount` can introduce, and it is answered the
+            // same way every other identity disagreement here is: drop the account, say so, and let the
+            // operator qualify the entry. Picking a workspace would be inventing a tenant rung, which the
+            // grammar refuses to do everywhere else in the tree.
+            if (matches.length > 1 && new Set(matches.map((m) => m.account.tenant ?? "")).size > 1) {
+                flag(a);
+                for (const m of matches)
+                    flag(m.account);
+                continue;
+            }
+            for (const m of matches)
+                hits.add(m.owner);
+        }
+        if (hits.size === 0)
+            continue;
+        if (hits.size > 1) {
+            // This config entry's accounts are spread across several link-sets: config says one person,
+            // the DB says several. No merge — every shared account is conflicted.
+            for (const a of surfaceAccounts(p.ids)) {
+                const matches = setsMatching(a);
+                if (matches.length === 0)
+                    continue;
+                flag(a);
+                for (const m of matches)
+                    flag(m.account);
+            }
+            continue;
+        }
+        const si = [...hits][0];
+        const already = configForSet.get(si);
+        if (already !== undefined && already !== ci) {
+            // Two config entries share accounts with ONE link-set: the DB says one person, config says
+            // two. Same refusal, from the other direction.
+            for (const entry of [config[already], p]) {
+                for (const a of surfaceAccounts(entry.ids)) {
+                    const matches = setsMatching(a).filter((m) => m.owner === si);
+                    if (matches.length === 0)
+                        continue;
+                    flag(a);
+                    for (const m of matches)
+                        flag(m.account);
+                }
+            }
+            continue;
+        }
+        configForSet.set(si, ci);
+    }
+    for (const a of conflicted.values())
+        warnings.push(conflictWarning(a));
+    const dropped = (a) => conflicted.has(strictKey(a));
+    const mergedSets = new Set();
+    const principals = [];
+    for (const [ci, p] of config.entries()) {
+        const si = [...configForSet.entries()].find(([, c]) => c === ci)?.[0];
+        const accounts = surfaceAccounts(p.ids).filter((a) => !dropped(a));
+        if (si !== undefined) {
+            mergedSets.add(si);
+            for (const b of surfaceAccounts(linkSets[si].ids)) {
+                if (dropped(b))
+                    continue;
+                // A confirmed DB account is added even when config already names accounts on that platform — it is a challenge-proven row, not a rival spelling of the same account. Only a genuine dispute between two owners refuses to merge, and that drops the account from both sides.
+                const same = accounts.find((a) => sameAccount(a, b));
+                if (same === undefined) {
+                    accounts.push(b);
+                    continue;
+                }
+                // The unqualified/qualified heal: config said `slack: "U1"`, the confirmed row says which
+                // workspace that was. Keep the QUALIFIED spelling — it is strictly more addressable, and it
+                // is the one that composes a principal key.
+                if (same.tenant === undefined && b.tenant !== undefined)
+                    accounts[accounts.indexOf(same)] = b;
+            }
+        }
+        principals.push({ ...p, ids: surfaceIdsFromAccounts(accounts) });
+    }
+    for (const [si, s] of linkSets.entries()) {
+        if (mergedSets.has(si))
+            continue;
+        const accounts = surfaceAccounts(s.ids).filter((a) => !dropped(a));
+        if (accounts.length === 0)
+            continue;
+        principals.push({ name: s.handle, handle: s.handle, ids: surfaceIdsFromAccounts(accounts) });
+    }
+    return { principals, warnings };
+}
+/** The warning names the account's principal key when the grammar can compose one. An unqualified account on a tenant-scoped platform composes none, so the fallback stays prose rather than a key-shaped string that addresses nobody. */
+function conflictWarning(a) {
+    const key = tryPrincipalKey(a.platform, a.tenant, a.id) ?? `the ${a.platform} account "${a.id}" (workspace unnamed)`;
+    return {
+        key,
+        message: `identity conflict: ${key} is claimed by two different people across the config principals map and the DB link-sets. ` +
+            `NO merge was applied for that account (fail-closed on merge) — it stays a distinct per-surface identity until the ` +
+            `disagreement is resolved (edit agent/identity/principals.ts, or revoke the link-set).`,
+    };
+}
+//# sourceMappingURL=link-resolve.js.map

package/dist/agent/identity/link-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-resolve.js","sourceRoot":"","sources":["../../../agent/identity/link-resolve.ts"],"names":[],"mappings":"AAAA,2RAA2R;AAE3R,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAsE,MAAM,iBAAiB,CAAC;AAC9I,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA2B7E,2JAA2J;AAC3J,SAAS,SAAS,CAAC,CAAsB;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;iGACiG;AACjG,SAAS,QAAQ,CAAC,CAAsB;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAAC,CAAsB,EAAE,CAAsB;IACjE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAUD,SAAS,aAAa,CAAC,KAAuD;IAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6D,CAAC;IACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,MAA4B,EAAE,QAAqC;IACjG,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC,CAAC,2CAA2C;IAEtG,MAAM,IAAI,GAAG,CAAC,CAAsB,EAAQ,EAAE;QAC5C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC5C,KAAK,CAAC,CAAC;QACP,8FAA8F;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,0FAA0F;QAC1F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACxE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAChB,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,CAAsB,EAAuE,EAAE,CACnH,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAErF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,gCAAgC;IAChF,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAChC,+FAA+F;YAC/F,4FAA4F;YAC5F,4FAA4F;YAC5F,8FAA8F;YAC9F,qDAAqD;YACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACvF,IAAI,CAAC,CAAC,CAAC,CAAC;gBACR,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClB,4FAA4F;YAC5F,sEAAsE;YACtE,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACnC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACR,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;QACzB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YAC5C,2FAA2F;YAC3F,+CAA+C;YAC/C,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;oBAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBACnC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACR,KAAK,MAAM,CAAC,IAAI,OAAO;wBAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,CAAC,CAAsB,EAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,QAAQ,GAA0B,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,IAAI,OAAO,CAAC,CAAC,CAAC;oBAAE,SAAS;gBACzB,6QAA6Q;gBAC7Q,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,0FAA0F;gBAC1F,4FAA4F;gBAC5F,4CAA4C;gBAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;oBAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACjC,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,2OAA2O;AAC3O,SAAS,eAAe,CAAC,CAAsB;IAC7C,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACrH,OAAO;QACL,GAAG;QACH,OAAO,EACL,sBAAsB,GAAG,6FAA6F;YACtH,oHAAoH;YACpH,uFAAuF;KAC1F,CAAC;AACJ,CAAC"}

package/dist/agent/identity/link-set-ref.d.ts

@@ -0,0 +1,16 @@
+/** Does this string use the link-set-reference shape at all (prefix present)? A cheap discriminant
+ *  the matchers run BEFORE trying to read it as a principal key. A `true` here does not mean the ref
+ *  is well-formed — {@link parseLinkSetRef} is the validating read. */
+export declare function isLinkSetRef(value: string): boolean;
+/**
+ * The link-set id a ref names, or `undefined` when the string is not a WELL-FORMED ref. A VALUE, not
+ * a throw: config-load asserts turn `undefined` into a loud refusal, and the runtime matchers turn it
+ * into "no match" — both fail-closed. A well-formed ref is the prefix followed by a non-empty id that
+ * carries neither a "/" (which would make it look like a principal key) nor whitespace.
+ */
+export declare function parseLinkSetRef(value: string): string | undefined;
+/** The config-load test: is this a well-formed link-set ref? A `false` means the entry can never
+ *  match anything, which is why the callers (assertDomainsValid / assertBindingsValid) throw on a
+ *  string that is neither this nor a qualified principal key. */
+export declare function isValidLinkSetRef(value: string): boolean;
+//# sourceMappingURL=link-set-ref.d.ts.map

package/dist/agent/identity/link-set-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-set-ref.d.ts","sourceRoot":"","sources":["../../../agent/identity/link-set-ref.ts"],"names":[],"mappings":"AAOA;;uEAEuE;AACvE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKjE;AAED;;iEAEiE;AACjE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/agent/identity/link-set-ref.js

@@ -0,0 +1,32 @@
+// The one spelling of "this HUMAN, by their link-set" inside a `principal` binding: `linkSet:<uuid>`. It can never be confused with a principal key, because a principal key always contains "/" and this grammar refuses one outright.
+// `Domain.admins` does NOT take this form — admin standing stays exact `platform/<id>`, and config load rejects a `linkSet:` admin entry.
+/** The reserved prefix. Camel-cased with a ":" so it can never be mistaken for a platform token
+ *  (`[a-z0-9][a-z0-9-]*`, lowercase, no ":") in a principal key. */
+const LINK_SET_REF_PREFIX = "linkSet:";
+/** Does this string use the link-set-reference shape at all (prefix present)? A cheap discriminant
+ *  the matchers run BEFORE trying to read it as a principal key. A `true` here does not mean the ref
+ *  is well-formed — {@link parseLinkSetRef} is the validating read. */
+export function isLinkSetRef(value) {
+    return value.startsWith(LINK_SET_REF_PREFIX);
+}
+/**
+ * The link-set id a ref names, or `undefined` when the string is not a WELL-FORMED ref. A VALUE, not
+ * a throw: config-load asserts turn `undefined` into a loud refusal, and the runtime matchers turn it
+ * into "no match" — both fail-closed. A well-formed ref is the prefix followed by a non-empty id that
+ * carries neither a "/" (which would make it look like a principal key) nor whitespace.
+ */
+export function parseLinkSetRef(value) {
+    if (!value.startsWith(LINK_SET_REF_PREFIX))
+        return undefined;
+    const id = value.slice(LINK_SET_REF_PREFIX.length);
+    if (id.length === 0 || /[/\s]/u.test(id))
+        return undefined;
+    return id;
+}
+/** The config-load test: is this a well-formed link-set ref? A `false` means the entry can never
+ *  match anything, which is why the callers (assertDomainsValid / assertBindingsValid) throw on a
+ *  string that is neither this nor a qualified principal key. */
+export function isValidLinkSetRef(value) {
+    return parseLinkSetRef(value) !== undefined;
+}
+//# sourceMappingURL=link-set-ref.js.map

package/dist/agent/identity/link-set-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-set-ref.js","sourceRoot":"","sources":["../../../agent/identity/link-set-ref.ts"],"names":[],"mappings":"AAAA,wOAAwO;AACxO,0IAA0I;AAE1I;oEACoE;AACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAEvC;;uEAEuE;AACvE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;iEAEiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;AAC9C,CAAC"}