@open-everywhere/core 0.1.0

package/dist/agent/identity/surface-parity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-parity.js","sourceRoot":"","sources":["../../../agent/identity/surface-parity.ts"],"names":[],"mappings":"AAAA,wRAAwR;AAExR,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAmBhE;;;;;;GAMG;AACH,mGAAmG;AACnG,iFAAiF;AACjF,4FAA4F;AAC5F,kGAAkG;AAClG,kGAAkG;AAClG,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,gGAAgG;IAChG,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACnF,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC3F,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACrE,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACvF,iGAAiG;IACjG,oGAAoG;IACpG,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,iGAAiG;IACjG,gGAAgG;IAChG,oGAAoG;IACpG,iGAAiG;IACjG,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,wDAAwD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC/H,wFAAwF;IACxF,mGAAmG;IACnG,kGAAkG;IAClG,oGAAoG;IACpG,8FAA8F;IAC9F,oGAAoG;IACpG,oGAAoG;IACpG,yFAAyF;IACzF,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,mEAAmE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC5I,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC7E,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,8BAA8B,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACzG,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;IACnG,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACvG,iGAAiG;IACjG,4FAA4F;IAC5F,kGAAkG;IAClG,mGAAmG;IACnG,+FAA+F;IAC/F,kGAAkG;IAClG,iGAAiG;IACjG,kGAAkG;IAClG,yFAAyF;IACzF,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,kDAAkD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC1H,+FAA+F;IAC/F,4FAA4F;IAC5F,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACxG,6FAA6F;IAC7F,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,8FAA8F;IAC9F,gGAAgG;IAChG,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,0CAA0C,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC1G,6FAA6F;IAC7F,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,2DAA2D;IAC3D,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,uDAAuD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAChI,kGAAkG;IAClG,mGAAmG;IACnG,kGAAkG;IAClG,oGAAoG;IACpG,kGAAkG;IAClG,oGAAoG;IACpG,EAAE;IACF,oGAAoG;IACpG,iGAAiG;IACjG,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,oGAAoG;IACpG,mGAAmG;IACnG,iGAAiG;IACjG,qFAAqF;IACrF,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,6CAA6C,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC7G,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,4FAA4F;IAC5F,kGAAkG;IAClG,iGAAiG;IACjG,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,qDAAqD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAEzH,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;IAC3F,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;IAC1F,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,gCAAgC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;IACrG,oFAAoF;IACpF,mGAAmG;IACnG,iGAAiG;IACjG,iGAAiG;IACjG,yFAAyF;IACzF,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;IACxF,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;IACpE,iGAAiG;IACjG,6FAA6F;IAC7F,gGAAgG;IAChG,mGAAmG;IACnG,8FAA8F;IAC9F,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,wDAAwD,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IACnH,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IACnE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IAE7E,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC3E,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACjE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACvE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC/E,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC7E,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACnE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;IACtF,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;IAChF,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;IACvG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACvE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACjF,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACtF,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE;IAC5E,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;CAC1B,CAAC;AAclD,MAAM,KAAK,GAA2C,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1G,2MAA2M;AAE3M,MAAM,YAAY,GAAG,kBAAkB,CAA2B,mBAAmB,CAAC,CAAC;AAEvF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,WAAqC;IAC3F,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACnE,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAA2B;IACrD,OAAO,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;AACjE,CAAC;AAYD,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,OAAQ,KAAiC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAA0C,EAC1C,MAAM,GAAoB,IAAI,GAAG,EAAE;IAEnC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ;gBACR,OAAO,EAAE,8DAA8D,OAAO,QAAQ,IAAI;aAC3F,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAmC,CAAC;QAEjD,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAEjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ;oBACR,UAAU,EAAE,UAAU,CAAC,EAAE;oBACzB,OAAO,EACL,sBAAsB,UAAU,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,KAAK;wBACtF,0EAA0E;wBAC1E,0EAA0E;iBAC7E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ;oBACR,UAAU,EAAE,UAAU,CAAC,EAAE;oBACzB,OAAO,EACL,cAAc,UAAU,CAAC,EAAE,sDAAsD;wBACjF,uFAAuF;iBAC1F,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC7D,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ;oBACR,UAAU,EAAE,UAAU,CAAC,EAAE;oBACzB,OAAO,EACL,cAAc,UAAU,CAAC,EAAE,aAAa,IAAI,uBAAuB,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI;wBAC/G,CAAC,IAAI,KAAK,aAAa;4BACrB,CAAC,CAAC,6DAA6D;4BAC/D,CAAC,CAAC,4DAA4D,CAAC;iBACpE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC7C,wFAAwF;gBACxF,2FAA2F;gBAC3F,uEAAuE;gBACvE,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ;oBACR,UAAU,EAAE,UAAU,CAAC,EAAE;oBACzB,OAAO,EACL,cAAc,UAAU,CAAC,EAAE,sEAAsE;wBACjG,oGAAoG;wBACpG,6DAA6D;iBAChE,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ;oBACR,UAAU,EAAE,UAAU,CAAC,EAAE;oBACzB,OAAO,EACL,cAAc,UAAU,CAAC,EAAE,oBAAoB,IAAI,IAAI,EAAE,0CAA0C;wBACnG,6FAA6F;wBAC7F,0BAA0B;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ;oBACR,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,cAAc,EAAE,4EAA4E;iBACtG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,IAA2B;IAC7C,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,WAAW,IAAI,IAAI;QAAE,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAClE,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,YAA2D,EAC3D,SAA4B;IAE5B,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,kBAAkB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAG,QAAQ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrC,4FAA4F;YAC5F,4FAA4F;YAC5F,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,mBAAmB,CAAC;YACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAyB,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAA2D,EAC3D,SAA4B;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAExF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEjG,IAAI,KAAkC,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACtB,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAyB,CAAC,CAAC;YACnD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC;YAClC,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,GAAG,oBAAoB,CAAC,MAAM,mBAAmB,SAAS,CAAC,MAAM,cAAc;QAC7E,GAAG,oBAAoB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,WAAW,IAAI,wBAAwB;QACxF,0CAA0C,CAC7C,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/agent/identity/trust-preflight.d.ts

@@ -0,0 +1,83 @@
+import type { Check } from "../ops/quickstart.js";
+import { type Surface } from "./trust.js";
+/**
+ * One surface the deployment has actually seen, as the preflight reads it. `firstSeen` is what
+ * makes check 3 possible without persisting a snapshot between runs: "newly matching" is "this
+ * surface's traffic STARTED recently", which is exactly what a renamed repo or a new room looks
+ * like — a key with no history.
+ */
+export interface SurfaceTraffic {
+    /** The DOMAIN-grain surface key (`platform/tenant/surface`) the traffic was attributed to. */
+    readonly surfaceKey: string;
+    /** ISO 8601. The earliest activity recorded for this key. */
+    readonly firstSeen: string;
+    /** ISO 8601. The most recent activity recorded for this key. */
+    readonly lastSeen: string;
+    /**
+     * The enterprise-grain key (platform/<enterpriseId>) this surface's workspace sits under, when the platform has that rung and the caller knows it (Slack Enterprise Grid). The checks walk it, because a check that did not would call a Grid's traffic undeclared and the Grid's own line dead.
+     * The live loader cannot fill it yet — an audit row carries no rung above the workspace (OPE-1560) — so on a deployment it is undefined and both checks behave as they did before the rung existed.
+     */
+    readonly enterpriseKey?: string;
+    /**
+     * The group-grain key (platform/tenant/<marker>:<id>) this surface sits inside, when the platform has a container the surface key does not name (Teams contributes teams/<tenant>/team:<teamId>). The checks walk it between the surface and the tenant, or a group-declared room reports undeclared and the group line reports dead.
+     * The live loader cannot fill it: a caller reads the group off the request's auth attributes, which the audit row never records, and no rule derives one key from the other (OPE-1560).
+     */
+    readonly groupKey?: string;
+    /**
+     * The container-grain surface key, when the platform's domain grain differs from its raw surface grain (a Teams conversation is one reply chain inside a channel). It is the second, less preferred entry of the resolver's surfaceKeys, exactly as bindFrom and isVouchedSurface order the pair.
+     * The live loader cannot fill it: an audit row stows the RAW surface, so a channel-grain Teams declaration matches no reply-chain row and reports as dead (OPE-1560).
+     */
+    readonly containerKey?: string;
+}
+export interface SurfaceTrustPreflightInput {
+    /** Every registered entry, in declaration order (identity/trust.ts `registeredSurfaces()`). */
+    readonly entries: readonly Surface[];
+    /** Surfaces the deployment has seen. An EMPTY list is "no traffic recorded", not "no traffic". */
+    readonly traffic: readonly SurfaceTraffic[];
+    /** Now. Injected so the two age rules are testable without a clock. */
+    readonly now: Date;
+    /** A declaration with no matching traffic for this many days is DEAD (check 2). */
+    readonly deadEntryDays?: number;
+    /** Traffic that STARTED within this many days is NEW (check 3). */
+    readonly newSurfaceDays?: number;
+}
+/**
+ * The remedy line for undeclared surfaces. Teams needs an extra sentence: its tenant-grain declaration also admits every room under the tenant, a cross-tenant Connect or shared channel included, because an inbound activity usually omits membershipType and an absent signal does not demote.
+ * Exported because the branch IS the fix — a remedy string nothing asserts rots back to the wrong advice on the next edit.
+ */
+export declare function undeclaredSurfacesFix(undeclared: readonly string[]): string;
+/**
+ * Status mapping, and it is deliberate: an undeclared surface with traffic is `missing` (the red that flips ready to false), while a dead entry and a claim diff are `info`, because both describe config working exactly as written.
+ * A deployment with no traffic recorded gets one `info` row saying so — reporting every declaration dead would be noise, and reporting no undeclared surfaces would be a false green.
+ */
+export declare function surfaceTrustPreflightChecks(input: SurfaceTrustPreflightInput): Check[];
+/** One audit row as the traffic fold reads it — the fields every surface-scoped row carries. */
+export interface SurfaceAuditRow {
+    readonly ts: string;
+    readonly platform: string;
+    readonly workspace: string;
+    readonly surface?: string;
+}
+/**
+ * Fold audit rows into per-surface traffic. PURE, so the rule is testable against a fixture. The audit log is the source because it carries a real timestamp per row; the spend ledger keys on a calendar month and cannot answer when a surface's traffic started.
+ * A row with no surface is skipped: an org-scoped event names no room to declare.
+ */
+export declare function surfaceTrafficFromAudit(rows: readonly SurfaceAuditRow[]): SurfaceTraffic[];
+/** How the probe reaches its two inputs. Injectable so a test drives it with no store. */
+export interface SurfaceTrustProbeDeps {
+    readonly entries?: () => readonly Surface[];
+    readonly auditRows?: () => Promise<readonly SurfaceAuditRow[]>;
+    readonly now?: () => Date;
+}
+/**
+ * Register the surface-trust preflight probe (`preflight` / the ops MCP). The app-tier ops entry
+ * calls this AFTER importing `agent/identity/surfaces.js`, so the register is populated — the same
+ * boot-order rule agent/lib/register-config.ts follows for the config-load assertions.
+ *
+ * FAIL-SOFT, like every probe: a deployment whose operational store is not reachable from the
+ * operator's shell reports ONE `info` row saying the traffic could not be read. It must never report
+ * `missing` on an unreadable store — that would be a red about the OPERATOR's environment wearing
+ * the costume of a red about the DEPLOYMENT's config.
+ */
+export declare function registerSurfaceTrustPreflight(deps?: SurfaceTrustProbeDeps): void;
+//# sourceMappingURL=trust-preflight.d.ts.map

package/dist/agent/identity/trust-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-preflight.d.ts","sourceRoot":"","sources":["../../../agent/identity/trust-preflight.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAGlD,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAmBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAmB3E;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,0BAA0B,GAAG,KAAK,EAAE,CAgGtF;AAED,gGAAgG;AAChG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,EAAE,CAY1F;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;IAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,GAAE,qBAA0B,GAAG,IAAI,CAgCpF"}

package/dist/agent/identity/trust-preflight.js

@@ -0,0 +1,196 @@
+// Config-time loudness for the surface trust registry: an undeclared room with traffic is a red check, a declaration that matches no traffic and a surface that newly matches a pattern are amber ones.
+// The pattern check is a DETECTOR, not a fence, because a pattern admits surfaces nobody enumerated. This module is pure: it takes the register, a traffic list and a clock, and returns checks.
+import { registerPreflightProbe } from "../ops/probes.js";
+import { parseSurfaceKeyEntry, surfaceKeyEntryMatches, surfaceKeyEntrySpecificity } from "./surface-key-grammar.js";
+import { registeredSurfaces } from "./trust.js";
+const DEFAULT_DEAD_ENTRY_DAYS = 30;
+const DEFAULT_NEW_SURFACE_DAYS = 7;
+const DAY_MS = 86_400_000;
+/** Names in a check detail, capped so one over-broad tenant claim cannot produce a wall of text. */
+const MAX_NAMED = 8;
+function nameList(keys) {
+    const shown = keys.slice(0, MAX_NAMED).join(", ");
+    return keys.length > MAX_NAMED ? `${shown}, … (+${keys.length - MAX_NAMED} more)` : shown;
+}
+function ageDays(now, iso) {
+    const t = Date.parse(iso);
+    return Number.isFinite(t) ? (now.getTime() - t) / DAY_MS : undefined;
+}
+/**
+ * The remedy line for undeclared surfaces. Teams needs an extra sentence: its tenant-grain declaration also admits every room under the tenant, a cross-tenant Connect or shared channel included, because an inbound activity usually omits membershipType and an absent signal does not demote.
+ * Exported because the branch IS the fix — a remedy string nothing asserts rots back to the wrong advice on the next edit.
+ */
+export function undeclaredSurfacesFix(undeclared) {
+    const example = undeclared[0] ?? "";
+    const teamsRemedy = `add a line to agent/identity/surfaces.ts declaring the TENANT — defineSurface({ key: "teams/<tenantId>", ` +
+        `trust: "internal" }). A declaration counts at any rung, so that covers every room under the tenant; declare a ` +
+        `single "teams/<tenantId>/<threadId>" key instead to narrow it to one channel. ONE line is enough either way, ` +
+        `including for a member of a cross-surface SINGLE WINDOW: the window privacy floor walks the declaration rungs ` +
+        `too (OPE-1521), so a tenant declaration admits the room. 🔴 Weigh the REACH before you pick the tenant grain — it ` +
+        `covers rooms you never named, a cross-tenant Connect/shared channel among them, because an inbound Teams activity ` +
+        `usually omits membershipType. Declare the channel to narrow it. See docs/deploy/surfaces/teams.md`;
+    if (example.startsWith("teams/"))
+        return `${teamsRemedy} — this deployment's undeclared example is "${example}".`;
+    const generic = `add a line per surface to agent/identity/surfaces.ts — defineSurface({ key: "${example}", trust: "internal" }) ` +
+        `if only organisation members can type there, or trust: "public" if anyone can. Declaring the tenant ` +
+        `(e.g. "${example.split("/").slice(0, 2).join("/")}") covers every room under it.`;
+    // A mixed list: the example is not Teams, but a Teams key behind it would still be mis-served by
+    // the two sentences above. Say so rather than let the example decide for the whole list.
+    return undeclared.some((k) => k.startsWith("teams/")) ? `${generic} FOR THE TEAMS SURFACE(S) ABOVE, instead: ${teamsRemedy}.` : generic;
+}
+/**
+ * Status mapping, and it is deliberate: an undeclared surface with traffic is `missing` (the red that flips ready to false), while a dead entry and a claim diff are `info`, because both describe config working exactly as written.
+ * A deployment with no traffic recorded gets one `info` row saying so — reporting every declaration dead would be noise, and reporting no undeclared surfaces would be a false green.
+ */
+export function surfaceTrustPreflightChecks(input) {
+    const deadDays = input.deadEntryDays ?? DEFAULT_DEAD_ENTRY_DAYS;
+    const newDays = input.newSurfaceDays ?? DEFAULT_NEW_SURFACE_DAYS;
+    const checks = [];
+    const parsed = input.entries.flatMap((surface) => {
+        const entry = parseSurfaceKeyEntry(surface.key);
+        return entry ? [{ surface, entry }] : [];
+    });
+    if (input.traffic.length === 0) {
+        checks.push({
+            name: "surface trust: traffic",
+            status: "info",
+            detail: parsed.length === 0
+                ? "no surfaces declared and no traffic recorded — declare each room in agent/identity/surfaces.ts once it starts being used"
+                : `${parsed.length} surface declaration(s), no traffic recorded yet — the undeclared-surface check cannot run`,
+        });
+        return checks;
+    }
+    const undeclared = [];
+    const matchedEntries = new Set();
+    const matchedByPattern = new Map(); // pattern entry key → surfaces it swept in
+    for (const t of input.traffic) {
+        const segs = t.surfaceKey.split("/");
+        const tenantKey = segs.slice(0, 2).join("/");
+        // These are the five KEYS one traffic row offers, not the five declared entry shapes identity/trust.ts ranks: a glob is a shape an entry takes, never a key a row carries. Walking fewer keys than the resolver makes a covered surface report undeclared and the declaration covering it report dead.
+        // Key order changes no answer here — this is a membership test, not most-specific-wins — and three of the five come from the caller, which the live loader cannot supply (OPE-1560).
+        const rungs = [
+            t.surfaceKey,
+            ...(t.containerKey === undefined || t.containerKey === t.surfaceKey ? [] : [t.containerKey]),
+            ...(t.groupKey === undefined ? [] : [t.groupKey]),
+            tenantKey,
+            ...(t.enterpriseKey === undefined ? [] : [t.enterpriseKey]),
+        ];
+        const hits = parsed.filter(({ entry }) => rungs.some((k) => surfaceKeyEntryMatches(entry, k)));
+        if (hits.length === 0) {
+            undeclared.push(t.surfaceKey);
+            continue;
+        }
+        for (const h of hits)
+            matchedEntries.add(h.surface.key);
+        // isPattern asks ONE question: can this entry annex a surface nobody enumerated? A tenant, a group and a glob can, so a group entry must count — leave it out and a group line takes the decision from a tenant line that was reporting new matches, and the row goes silent.
+        // Known gap: an exact channel entry matched through the containerKey rung is a pattern too and isPattern answers false for it. It is unreachable until the loader fills that key (OPE-1560), where the fix belongs.
+        const decider = hits.reduce((a, b) => (surfaceKeyEntrySpecificity(b.entry) > surfaceKeyEntrySpecificity(a.entry) ? b : a));
+        const isPattern = decider.entry.kind === "tenant" || decider.entry.kind === "group" || decider.entry.glob;
+        const age = ageDays(input.now, t.firstSeen);
+        if (isPattern && age !== undefined && age <= newDays) {
+            matchedByPattern.set(decider.surface.key, [...(matchedByPattern.get(decider.surface.key) ?? []), t.surfaceKey]);
+        }
+    }
+    checks.push(undeclared.length === 0
+        ? {
+            name: "surface trust: undeclared surfaces",
+            status: "ok",
+            detail: `every surface with traffic (${input.traffic.length}) is covered by a declaration`,
+        }
+        : {
+            name: "surface trust: undeclared surfaces",
+            status: "missing",
+            detail: `${undeclared.length} surface(s) have traffic but NO trust declaration: ${nameList(undeclared)}`,
+            fix: undeclaredSurfacesFix(undeclared),
+        });
+    // --- 2. DEAD ENTRY ⇒ amber --------------------------------------------------------------------
+    // "Dead" needs BOTH halves: no entry-matching traffic at all, AND the deployment has been seeing
+    // traffic for long enough that absence means something. Newest traffic is the deployment's clock.
+    const newestTraffic = input.traffic.reduce((a, t) => Math.max(a, Date.parse(t.lastSeen) || 0), 0);
+    const observedDays = ageDays(input.now, new Date(newestTraffic).toISOString());
+    const dead = parsed.filter(({ surface }) => !matchedEntries.has(surface.key)).map(({ surface }) => surface.key);
+    if (dead.length > 0 && observedDays !== undefined && observedDays <= deadDays) {
+        checks.push({
+            name: "surface trust: dead declarations",
+            status: "info",
+            detail: `${dead.length} declaration(s) matched no traffic in the last ${deadDays} days: ${nameList(dead)}`,
+            fix: "a room can be archived, a repo transferred, a Linear team deleted — the key then stops matching and the surface falls back to fail-closed external, which is correct but silent. " +
+                "🔴 CHECK THE GRAIN BEFORE YOU DELETE ANYTHING. A traffic row names ONE workspace and ONE room, so a live declaration written at any CONTAINER matches no row and still lands here. THREE shapes do that. (1) A Slack Enterprise Grid line (`slack/E…`) vouches whole workspaces (OPE-1508). (2) A Teams group line (`teams/<tenant>/team:…`) vouches a team's channels (OPE-490). (3) A Teams CHANNEL line (`teams/<tenant>/<channelId>`) vouches the reply chains inside that channel — and a traffic row names the reply CHAIN, because the deployment records the conversation id as the room. This check reads all three, but only when the traffic row carries them, and the live loader carries none of them yet — OPE-1560 holds that half. So a working Grid, group or channel declaration reports as dead. Deleting one silently returns every workspace, channel or reply chain under it to non-member. " +
+                "Confirm each is intentional, then delete the line or fix the key.",
+        });
+    }
+    // This check is a detector, not a fence. The check row itself has to say so, not only this file.
+    for (const [entryKey, surfaces] of [...matchedByPattern.entries()].sort()) {
+        checks.push({
+            name: `surface trust: new matches for "${entryKey}"`,
+            status: "info",
+            detail: `${surfaces.length} surface(s) started matching this pattern in the last ${newDays} days: ${nameList(surfaces)}`,
+            fix: `confirm each one should carry this declaration's trust. A pattern admits surfaces nobody enumerated, so a rename INTO its prefix inherits it — this row DETECTS that, it cannot prevent it. To pin one surface, add an exact entry: an exact key always beats a pattern.`,
+        });
+    }
+    return checks;
+}
+/**
+ * Fold audit rows into per-surface traffic. PURE, so the rule is testable against a fixture. The audit log is the source because it carries a real timestamp per row; the spend ledger keys on a calendar month and cannot answer when a surface's traffic started.
+ * A row with no surface is skipped: an org-scoped event names no room to declare.
+ */
+export function surfaceTrafficFromAudit(rows) {
+    const byKey = new Map();
+    for (const r of rows) {
+        if (!r.surface || !r.platform || !r.workspace)
+            continue;
+        const key = `${r.platform}/${r.workspace}/${r.surface}`;
+        const seen = byKey.get(key);
+        if (!seen)
+            byKey.set(key, { first: r.ts, last: r.ts });
+        else
+            byKey.set(key, { first: r.ts < seen.first ? r.ts : seen.first, last: r.ts > seen.last ? r.ts : seen.last });
+    }
+    return [...byKey.entries()]
+        .map(([surfaceKey, v]) => ({ surfaceKey, firstSeen: v.first, lastSeen: v.last }))
+        .sort((a, b) => a.surfaceKey.localeCompare(b.surfaceKey));
+}
+/**
+ * Register the surface-trust preflight probe (`preflight` / the ops MCP). The app-tier ops entry
+ * calls this AFTER importing `agent/identity/surfaces.js`, so the register is populated — the same
+ * boot-order rule agent/lib/register-config.ts follows for the config-load assertions.
+ *
+ * FAIL-SOFT, like every probe: a deployment whose operational store is not reachable from the
+ * operator's shell reports ONE `info` row saying the traffic could not be read. It must never report
+ * `missing` on an unreadable store — that would be a red about the OPERATOR's environment wearing
+ * the costume of a red about the DEPLOYMENT's config.
+ */
+export function registerSurfaceTrustPreflight(deps = {}) {
+    registerPreflightProbe("surface-trust", async () => {
+        const entries = (deps.entries ?? registeredSurfaces)();
+        const now = (deps.now ?? (() => new Date()))();
+        const read = deps.auditRows ??
+            (async () => {
+                const { readAudit } = await import("../audit/audit.js");
+                const { deploymentOrg } = await import("./binding.js");
+                const since = new Date(now.getTime() - 90 * DAY_MS).toISOString();
+                // 🔴 SCOPED TO THIS DEPLOYMENT'S ORG (OPE-1435). Both stores add `org_id = ?` only when the
+                // filter names an org, so an unscoped page is every tenant's rows: `surfaceTrafficFromAudit`
+                // then keys another org's channels and `surfaceTrustPreflightChecks` reports them to THIS
+                // operator as undeclared traffic — naming rooms they cannot see, and asking them to declare
+                // rooms that are not theirs. The probe answers about the deployment it runs against.
+                return (await readAudit({ org: deploymentOrg(), since, limit: 5000 }));
+            });
+        let traffic;
+        try {
+            traffic = surfaceTrafficFromAudit(await read());
+        }
+        catch (err) {
+            return [
+                {
+                    name: "surface trust: traffic",
+                    status: "info",
+                    detail: `could not read the audit log to find which surfaces have traffic — ${err instanceof Error ? err.message : String(err)}`,
+                    fix: "the undeclared-surface check needs the deployment's operational store; set DATABASE_URL (or OE_SQLITE_PATH) in the project's .env.local and re-run",
+                },
+            ];
+        }
+        return surfaceTrustPreflightChecks({ entries, traffic, now });
+    });
+}
+//# sourceMappingURL=trust-preflight.js.map

package/dist/agent/identity/trust-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-preflight.js","sourceRoot":"","sources":["../../../agent/identity/trust-preflight.ts"],"names":[],"mappings":"AAAA,wMAAwM;AACxM,iMAAiM;AAGjM,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACpH,OAAO,EAAE,kBAAkB,EAAgB,MAAM,YAAY,CAAC;AA6C9D,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,oGAAoG;AACpG,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,SAAS,QAAQ,CAAC,IAAuB;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5F,CAAC;AAED,SAAS,OAAO,CAAC,GAAS,EAAE,GAAW;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA6B;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GACf,2GAA2G;QAC3G,gHAAgH;QAChH,+GAA+G;QAC/G,gHAAgH;QAChH,oHAAoH;QACpH,oHAAoH;QACpH,mGAAmG,CAAC;IACtG,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,WAAW,+CAA+C,OAAO,IAAI,CAAC;IAElH,MAAM,OAAO,GACX,gFAAgF,OAAO,0BAA0B;QACjH,sGAAsG;QACtG,UAAU,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACrF,iGAAiG;IACjG,yFAAyF;IACzF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,6CAA6C,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1I,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAiC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAC;IACjE,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,MAAM,CAAC,MAAM,KAAK,CAAC;gBACjB,CAAC,CAAC,0HAA0H;gBAC5H,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,4FAA4F;SACnH,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAoB,CAAC,CAAC,2CAA2C;IACjG,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,uSAAuS;QACvS,qLAAqL;QACrL,MAAM,KAAK,GAAG;YACZ,CAAC,CAAC,UAAU;YACZ,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC5F,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjD,SAAS;YACT,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;SAC5D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxD,8QAA8Q;QAC9Q,oNAAoN;QACpN,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1G,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;YACrD,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,CAAC;YACE,IAAI,EAAE,oCAAoC;YAC1C,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,+BAA+B,KAAK,CAAC,OAAO,CAAC,MAAM,+BAA+B;SAC3F;QACH,CAAC,CAAC;YACE,IAAI,EAAE,oCAAoC;YAC1C,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,sDAAsD,QAAQ,CAAC,UAAU,CAAC,EAAE;YACxG,GAAG,EAAE,qBAAqB,CAAC,UAAU,CAAC;SACvC,CACN,CAAC;IAEF,iGAAiG;IACjG,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kCAAkC;YACxC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,kDAAkD,QAAQ,UAAU,QAAQ,CAAC,IAAI,CAAC,EAAE;YAC1G,GAAG,EACD,mLAAmL;gBACnL,o3BAAo3B;gBACp3B,mEAAmE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,iGAAiG;IACjG,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAmC,QAAQ,GAAG;YACpD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,yDAAyD,OAAO,UAAU,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACxH,GAAG,EAAE,0QAA0Q;SAChR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAgC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2C,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;;YAClD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAChF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAC9D,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAI,GAA0B,EAAE;IAC5E,sBAAsB,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GACR,IAAI,CAAC,SAAS;YACd,CAAC,KAAK,IAAI,EAAE;gBACV,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBACxD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;gBACvD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClE,4FAA4F;gBAC5F,6FAA6F;gBAC7F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,qFAAqF;gBACrF,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAA+B,CAAC;YACvG,CAAC,CAAC,CAAC;QACL,IAAI,OAAkC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,GAAG,uBAAuB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,MAAM,EAAE,MAAe;oBACvB,MAAM,EAAE,sEAAsE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;oBAChI,GAAG,EAAE,oJAAoJ;iBAC1J;aACF,CAAC;QACJ,CAAC;QACD,OAAO,2BAA2B,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/identity/trust.d.ts

@@ -0,0 +1,217 @@
+/**
+ * The trust an entry declares. TWO values, and `"external"` is deliberately ABSENT — `public` IS
+ * the external declaration, and it says something `external` does not: that a HUMAN asserted it.
+ * The fail-closed default of an unlisted surface is also `external`, and the audit trail has to
+ * keep those two apart ("we could not ask" must never read as "we asked and it was fine").
+ */
+export type SurfaceTrust = "internal" | "public";
+/** One entry in the per-surface registry: a qualified key and the trust the operator declares for it. Future per-surface properties belong on this interface and are validated in defineSurface — do not add a speculative field before a behaviour needs it. */
+export interface Surface {
+    readonly key: string;
+    readonly trust: SurfaceTrust;
+    /**
+     * Does this entry vouch the surface's whole subtree, or only that one surface? It is opt-in on the line, so every plain entry an operator already wrote still vouches exactly one surface, and it is declarable only with trust: "internal" on an exact surface key.
+     * Only a platform whose key carries no hierarchy honours it, declared through registerSubtreePlatform; a claim on any other platform is a boot error, and the vendor adapter resolves the walk because this registry is pure and synchronous.
+     */
+    readonly subtree?: boolean;
+}
+/**
+ * Build a validated Surface, fail-LOUD (config-time): the key must parse in the shared grammar and
+ * the trust must be known. The app's surfaces.ts wraps every entry in this so a typo in the key
+ * grammar or an unknown trust is a boot error, not a silently-ignored line.
+ *
+ * `subtree` is validated here as far as ONE LINE can decide it — the value's type, the key grain and
+ * the trust. Whether the PLATFORM honours the claim is decided at {@link applySubtreeSurfaceClaims},
+ * which is the one check this function cannot make (see there for why).
+ */
+export declare function defineSurface(input: Surface): Surface;
+/**
+ * Register the deploy's declared surfaces (app boot; a later call REPLACES the previous register —
+ * same convention as registerModelPricing). Pass the full list each time.
+ *
+ * Fail-LOUD on two kinds of self-contradiction, both checked BEFORE the register is swapped in:
+ *  1. the same key listed twice with DIFFERENT trust (a duplicate with the same trust is
+ *     idempotent and harmless);
+ *  2. two entries at the SAME specificity tier whose patterns could match ONE key with DIFFERENT
+ *     values — e.g. `github/acme/pay-*` public vs `github/acme/payments-*` internal. Most-specific-
+ *     wins breaks a cross-TIER tie by construction; a within-tier tie would be decided by
+ *     declaration order, which is a coin flip wearing a config's clothes. Decidable because the
+ *     pattern language is one trailing `*` (surface-key-grammar.ts surfaceKeyEntriesIntersect) —
+ *     the same argument memory/domain.ts's assertChannelExclusivity makes.
+ */
+export declare function registerSurfaces(input: Iterable<Surface>): void;
+/** Test seam: drop the register (a fresh test must not inherit another's declarations). */
+export declare function _resetSurfacesForTest(): void;
+/**
+ * What a platform does with the `subtree` entries an operator declared for it — the second half of
+ * {@link registerSubtreePlatform}. It receives every declared key for that platform, in declaration
+ * order, and it may THROW: a key this registry accepts can still be wrong in a way only the vendor
+ * knows (a Notion key whose last segment is not a page id), and that must be a boot error the
+ * operator reads rather than a line they assume is covered.
+ */
+export type SubtreeSurfaceHandler = (keys: readonly string[]) => void;
+/**
+ * THE CAPABILITY SEAM (OPE-539): "this platform honours `subtree`, and here is what to do with the
+ * entries that carry it". A provider bundle calls this from its own `registerXProvider()`; core
+ * names no vendor, so a deployment that de-selects the bundle also removes the capability and every
+ * `subtree` claim for it becomes the boot error it should be.
+ *
+ * Gated on the provider selection like every other platform-keyed registration seam — an unselected
+ * bundle cannot declare a capability, so the refusal path is the same one every other registry uses.
+ *
+ * A later call for the same platform REPLACES the handler (the registerSurfaces convention). The
+ * handler runs IMMEDIATELY against whatever is already registered, and again on every subsequent
+ * {@link registerSurfaces}, so the two boot orders (surfaces-then-bundles, bundles-then-surfaces)
+ * reach the same state. Only the REFUSAL of an unowned claim has to wait for the last bundle — that
+ * is {@link applySubtreeSurfaceClaims}.
+ */
+export declare function registerSubtreePlatform(platform: string, handler: SubtreeSurfaceHandler): void;
+/** Test seam: drop the capability registry (a fresh test must not inherit another's platforms). */
+export declare function _resetSubtreePlatformsForTest(): void;
+/** The keys of every `subtree: true` entry for one platform, in declaration order. The input a
+ *  {@link SubtreeSurfaceHandler} receives, exposed by name so a bundle can also re-read it. */
+export declare function subtreeSurfaceKeys(platform: string): readonly string[];
+/**
+ * THE BOOT CHECK for the `subtree` claim — call it ONCE, after BOTH the surfaces register and every
+ * provider bundle has registered. It does two things and throws on either:
+ *
+ *  1. REFUSES a `subtree: true` entry whose platform never declared the capability. This is the
+ *     check that cannot be made earlier and cannot be made by `defineSurface`: the app registers its
+ *     surfaces before the provider bundles register (agent/agent.ts imports register-config.ts ahead
+ *     of register-adapters.ts), so at `defineSurface` time the capability registry is still empty and
+ *     an eager refusal would reject every legal claim. Deferring the decision to one explicit boot
+ *     call is the same shape, and the same boot-order reason, as `assertConnectorMemoryGrants`.
+ *  2. HANDS each platform its own keys, so the vendor's own key validation is a boot error too.
+ *
+ * 🔴 SKIPPING THIS CALL IS THE ONE WAY A CLAIM GETS ACCEPTED AND IGNORED. It is wired in
+ * agent/lib/register-adapters.ts, after the bundle loop and beside `assertConnectorMemoryGrants`.
+ * `scripts/boot-smoke-test.ts` loads that module, so a throw from here fails the cold-start gate —
+ * but nothing detects the call being DELETED, which is the same residual `assertConnectorMemoryGrants`
+ * carries. The failure direction is closed (no roots, no promotion), not open.
+ */
+export declare function applySubtreeSurfaceClaims(): void;
+/**
+ * The keys one binding can be declared at, MOST SPECIFIC FIRST within each grain. Every trust read
+ * goes through this shape so the grains cannot drift apart between callers.
+ */
+export interface SurfaceTrustQuery {
+    /** `platform/tenant` — memory/partition.ts's workspaceKey. */
+    readonly tenantKey: string;
+    /**
+     * Surface-grain keys (`platform/tenant/surface`), MOST SPECIFIC FIRST. Usually one. A provider
+     * whose DOMAIN grain differs from its raw surface grain (a Discord thread inside a channel, a
+     * Teams conversation inside a channel) passes both — raw first, container second — so a
+     * declaration written on the container still reaches the room inside it.
+     */
+    readonly surfaceKeys: readonly string[];
+    /**
+     * The GROUP-grain key (`platform/tenant/<marker>:<id>`), when the platform has a container the
+     * surface key does not carry. Teams contributes `teams/<tenant>/team:<teamId>` (OPE-490).
+     * Optional and absent everywhere else — a platform with no intermediate rung passes nothing and
+     * the tier is simply skipped.
+     */
+    readonly groupKey?: string;
+    /**
+     * The ENTERPRISE-grain key (`platform/<enterpriseId>`) — a rung ABOVE the tenant, for a platform
+     * whose workspaces sit inside a larger organisation the workspace key does not name. Slack
+     * Enterprise Grid contributes `slack/E<enterpriseId>` (OPE-1508). Optional and absent everywhere
+     * else.
+     *
+     * 🔴 IT IS SPELLED AS A TENANT ENTRY, and that is why it needs no grammar of its own. A Grid
+     * enterprise id occupies the same slot a workspace id does, so `slack/E0GRID` parses as
+     * `kind: "tenant"` and one `defineSurface` line declares it. What this field adds is the WALK: a
+     * binding in workspace `T0SIB` also asks the register about `slack/E0GRID`, so one enterprise
+     * declaration vouches every workspace under it (Tommy's ruling, 2026-09-07).
+     *
+     * 🔴 THE WORKSPACE RUNG WINS, because it is the more specific statement about the room. Both keys
+     * parse at the same specificity tier, so the resolver's SECOND tiebreak decides — the caller's key
+     * order, and this key is passed LAST. So `slack/T0SIB` public under `slack/E0GRID` internal binds
+     * that workspace `external`, exactly as a surface-grain carve-out narrows a tenant. The reverse
+     * (`slack/E0GRID` public, `slack/T0SIB` internal) leaves the declared workspace internal: a rung
+     * declaration never overrides the narrower line an operator wrote beneath it.
+     */
+    readonly enterpriseKey?: string;
+}
+/**
+ * THE ONE RESOLVER. The operator's declaration for a surface, or `undefined` when they declared
+ * nothing about it. MOST SPECIFIC WINS:
+ *
+ *   1. an exact surface entry            `slack/T0ACME/C0BOARD`
+ *   2. a same-level surface glob         `github/acme/payments-*`
+ *   3. a group entry                     `teams/T0/team:<teamId>`      (exact or globbed)
+ *   4. a tenant entry                    `slack/T0ACME`
+ *   5. an enterprise entry               `slack/E0GRID`                (the rung ABOVE the tenant)
+ *   6. nothing                           ⇒ undeclared
+ *
+ * 🔴 RUNGS 4 AND 5 SHARE A SPECIFICITY TIER, so the ORDER of `keys` below is what separates them —
+ * see {@link SurfaceTrustQuery.enterpriseKey}. An enterprise entry is a tenant entry by grammar; it
+ * is a lower rung only because the caller offers it last.
+ *
+ * Same tier order as memory/domain.ts's `resolveDomainForChannel`, for the same reason: an
+ * explicitly-listed surface can never be ANNEXED by a broader pattern. That is the property
+ * notion-scope.ts was built to preserve on the ACL plane, and it transfers unchanged.
+ *
+ * Within a tier the earliest declaration wins — and `registerSurfaces` has already proved at boot
+ * that no two same-tier entries which could match one key DISAGREE, so that tiebreak can only ever
+ * pick between entries that say the same thing.
+ *
+ * 🔴 UNDECLARED RETURNS `undefined`, NEVER `"public"`. The registry is assertion-only: silence
+ * means "the operator has not declared", which is not the same claim as "the operator declared this
+ * public". Manufacturing `"public"` from silence would erase exactly the distinction the audit
+ * trail exists to keep — see the module header.
+ *
+ * PURE and SYNCHRONOUS, no I/O. Trust is upstream of authorization, so it inherits domain.ts's
+ * purity contract rather than a looser one.
+ */
+export declare function declaredSurfaceTrust(q: SurfaceTrustQuery): SurfaceTrust | undefined;
+/**
+ * The declaration for a plain (workspaceKey, surfaceKey) pair — the shape most callers hold. Kept
+ * as a named function rather than an inline object literal so the two-grain question is asked one
+ * way everywhere.
+ */
+export declare function declaredTrustForKeys(workspaceKey: string, surfaceKey: string): SurfaceTrust | undefined;
+/**
+ * Has the operator declared this surface INTERNAL? True only when the most-specific declaration that matches it says `internal`, so a `public` carve-out under an internal tenant correctly reports NOT internal.
+ * Fail-closed: an empty or unregistered register means nothing is declared here and the caller falls through to the platform default, which is external for real platforms. Never throws.
+ */
+export declare function isVouchedInternal(workspaceKey: string, surfaceKey: string): boolean;
+/**
+ * The privacy floor for a caller that holds the SURFACE KEY alone. It walks the declaration rungs, so a tenant line vouches every room under that tenant — a cross-tenant Teams Connect or shared room included, because an inbound activity usually omits membershipType and an absent signal does not demote. Only a positive external signal refuses a vouched surface.
+ * `opts` supplies the container and group rungs the caller cannot derive, but never the enterprise rung, so this floor can answer false where bindFrom binds internal; that divergence is fail-closed and recorded in FLOOR_UNREACHABLE_RUNGS. Supplying a rung can promote as well as demote.
+ */
+export declare function isVouchedSurface(surfaceKey: string, opts?: {
+    /** The CONTAINER-grain key, when the caller's domain grain differs from its surface grain
+     *  (a Teams reply chain inside a channel) — the second entry of `bindFrom`'s own `surfaceKeys`,
+     *  and less preferred than `surfaceKey`, exactly as there. */
+    readonly containerKey?: string;
+    /** The GROUP-grain key (`platform/tenant/<marker>:<id>`), for a platform with a rung between
+     *  the tenant and the surface. Teams contributes `teams/<tenant>/team:<teamId>`. */
+    readonly groupKey?: string;
+}): boolean;
+/**
+ * The {@link SurfaceTrustQuery} rungs {@link isVouchedSurface} SUPPLIES: the tenant it derives from
+ * the key, the one or two surface grains it is handed, and the optional group.
+ */
+type FloorSuppliedRung = "tenantKey" | "surfaceKeys" | "groupKey";
+/**
+ * Every SurfaceTrustQuery rung bindFrom passes that isVouchedSurface does not, keyed by field name, with what the gap costs. A new field on SurfaceTrustQuery must be named here or in FloorSuppliedRung or the compiler refuses, which forces the author to classify it.
+ * It checks the CLASSIFICATION, never the code, so it buys a forced decision and not a proof. The proof is scripts/surface-trust-test.ts, which drives both readers over one Grid declaration and pins the answers apart.
+ */
+export declare const FLOOR_UNREACHABLE_RUNGS: Readonly<Record<Exclude<keyof SurfaceTrustQuery, FloorSuppliedRung>, string>>;
+/**
+ * The bound WORKSPACE's declared tier, the input access/taint-tiers.ts needs. Workspace grain only: a page- or channel-level declaration says nothing about the workspace, and a read tool commonly reads a different page from the one the session sits on.
+ * Undeclared still returns undefined, never "public". Pass enterpriseKey to walk the Slack Grid rung above the workspace; the workspace's own declaration still wins.
+ */
+export declare function declaredWorkspaceTrust(workspaceKey: string, enterpriseKey?: string): SurfaceTrust | undefined;
+/**
+ * Every registered entry, in declaration order — the one diagnostic read and the preflight's input. Read-only: a caller cannot mutate the register through it.
+ * A caller asking whether a surface is internal must call isVouchedInternal instead. Matching these entries at either grain by hand misses a `public` carve-out under an internal tenant, so a room declared open to the world would read as vouched.
+ */
+export declare function registeredSurfaces(): readonly Surface[];
+/**
+ * Memo TTL for a LIVE trust verification, ms — the identity.dmTrustTtlMs setting. It resolves FRESH per call rather than once at import, and callers use it only as an expiry, so a re-read moves an expiry and never a verdict and a shortened TTL takes effect on a warm process.
+ * Every miss re-verifies against the platform and every failure fails closed, so this TTL bounds how long a stale-but-positive verdict can survive.
+ */
+export declare function dmTrustTtlMs(): number;
+export {};
+//# sourceMappingURL=trust.d.ts.map

package/dist/agent/identity/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../../agent/identity/trust.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEjD,iQAAiQ;AACjQ,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAKD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgCrD;AAeD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,IAAI,CA2C/D;AAED,2FAA2F;AAC3F,wBAAgB,qBAAqB,IAAI,IAAI,CAK5C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;AAOtE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAI9F;AAED,mGAAmG;AACnG,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED;+FAC+F;AAC/F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEtE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAShD;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,iBAAiB,GAAG,YAAY,GAAG,SAAS,CA2BnF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEvG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IACL;;kEAE8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;wFACoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GACA,OAAO,CAaT;AAED;;;GAGG;AACH,KAAK,iBAAiB,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAGjH,CAAC;AAUF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM7G;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,OAAO,EAAE,CAEvD;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC"}