@ouro.bot/cli 0.1.0-alpha.81 → 0.1.0-alpha.810

package/dist/repertoire/plugin-mcp.js

@@ -0,0 +1,175 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listPluginMcpServers = listPluginMcpServers;
+exports.pluginMcpServerToConfig = pluginMcpServerToConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const identity_1 = require("../heart/identity");
+const runtime_1 = require("../nerves/runtime");
+const plugins_1 = require("./plugins");
+/**
+ * Resolve `${VAR}` and `${VAR:-default}` against the process env (with a
+ * caller-supplied override map applied first — used to inject the `DESK`
+ * fallback bound to the agent's bundle desk root).
+ *
+ * Anything that isn't a recognized `${...}` token passes through verbatim.
+ * Multiple substitutions per string are supported.
+ */
+function resolveVars(input, overrides) {
+    return input.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:-([^}]*))?\}/g, (_match, varName, _full, def) => {
+        if (overrides[varName] !== undefined)
+            return overrides[varName];
+        const fromEnv = process.env[varName];
+        if (fromEnv !== undefined)
+            return fromEnv;
+        if (def !== undefined)
+            return def;
+        return "";
+    });
+}
+function resolveArgs(args, overrides) {
+    return args.map((a) => resolveVars(a, overrides));
+}
+function resolveEnv(env, overrides) {
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        out[k] = resolveVars(v, overrides);
+    }
+    return out;
+}
+function readPluginMcpManifest(pluginRoot) {
+    const manifestPath = path.join(pluginRoot, ".mcp.json");
+    if (!fs.existsSync(manifestPath))
+        return null;
+    const raw = fs.readFileSync(manifestPath, "utf-8");
+    try {
+        const parsed = JSON.parse(raw);
+        const servers = parsed?.mcpServers;
+        if (!servers || typeof servers !== "object")
+            return {};
+        return servers;
+    }
+    catch (err) {
+        /* v8 ignore next -- err.message vs String(err) branch is defensive @preserve */
+        const reason = err instanceof Error ? err.message : String(err);
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "plugin_mcp.parse_error",
+            component: "repertoire",
+            message: `failed to parse plugin .mcp.json at ${manifestPath}: ${reason}`,
+            meta: { manifestPath, reason },
+        });
+        return null;
+    }
+}
+/**
+ * List the MCP servers declared across the current agent's enabled plugins.
+ *
+ * Returns a flat list — one entry per `(plugin, server-name)` pair — already
+ * resolved against process env + the `DESK` bundle-default. The result is
+ * suitable for direct hand-off to `McpManager.start()` after key-flattening.
+ *
+ * `homeDir` is an optional override for the `~/.ouro-cli/` root (test-only).
+ */
+function listPluginMcpServers(homeDir) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugin_mcp.list_start",
+        component: "repertoire",
+        message: "discovering plugin-declared MCP servers",
+        meta: { operation: "listPluginMcpServers" },
+    });
+    const config = (0, identity_1.loadAgentConfig)();
+    const declaredPlugins = config.plugins ?? [];
+    const pluginsRoot = (0, plugins_1.getPluginsRoot)(homeDir);
+    // Per-agent override: DESK defaults to <bundleRoot>/desk/ when not explicitly set.
+    const overrides = {};
+    if (process.env.DESK === undefined) {
+        overrides.DESK = path.join((0, identity_1.getAgentRoot)(), "desk");
+    }
+    const out = [];
+    for (const plugin of declaredPlugins) {
+        if (!plugin.enabled)
+            continue;
+        const pluginDir = (0, plugins_1.getPluginDir)(plugin.id, homeDir);
+        // If the plugins root or plugin dir doesn't exist, skip (installed-but-removed
+        // or never-installed). The manifest read does its own .mcp.json existence
+        // check; we only need to avoid touching missing plugin dirs.
+        if (!fs.existsSync(pluginsRoot))
+            break;
+        if (!fs.existsSync(pluginDir))
+            continue;
+        const manifest = readPluginMcpManifest(pluginDir);
+        if (!manifest)
+            continue;
+        for (const [serverName, entry] of Object.entries(manifest)) {
+            if (!entry || typeof entry.command !== "string" || entry.command.length === 0) {
+                continue;
+            }
+            out.push({
+                pluginId: plugin.id,
+                serverName,
+                command: resolveVars(entry.command, overrides),
+                args: resolveArgs(entry.args ?? [], overrides),
+                env: resolveEnv(entry.env ?? {}, overrides),
+                cwd: pluginDir,
+            });
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugin_mcp.list_end",
+        component: "repertoire",
+        message: "discovered plugin-declared MCP servers",
+        meta: {
+            operation: "listPluginMcpServers",
+            pluginCount: declaredPlugins.length,
+            serverCount: out.length,
+        },
+    });
+    return out;
+}
+/**
+ * Adapter: convert a `PluginMcpServer` into the shape `McpManager.start()`
+ * already consumes (`McpServerConfig`). Used by `getSharedMcpManager()` so
+ * builtin + plugin servers can be merged into one start call.
+ */
+function pluginMcpServerToConfig(server) {
+    return {
+        command: server.command,
+        args: server.args,
+        env: server.env,
+        cwd: server.cwd,
+    };
+}

package/dist/repertoire/plugins.js

@@ -0,0 +1,253 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPluginsRoot = getPluginsRoot;
+exports.getPluginDir = getPluginDir;
+exports.getPluginSkillsDir = getPluginSkillsDir;
+exports.listPlugins = listPlugins;
+exports.listEnabledPlugins = listEnabledPlugins;
+exports.listPluginSkills = listPluginSkills;
+exports.loadPluginSkill = loadPluginSkill;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const identity_1 = require("../heart/identity");
+const ouro_version_manager_1 = require("../heart/versioning/ouro-version-manager");
+const runtime_1 = require("../nerves/runtime");
+/**
+ * Plugin support for ouroboros (W5.2 of the worker-generalization extraction).
+ *
+ * Plugins are installed machine-locally at `~/.ouro-cli/plugins/<plugin-id>/`
+ * via `ouro plugin install` (W5.3). Each agent's bundle declares which plugins
+ * it has enabled via the `plugins[]` field in agent.json (W5.1).
+ *
+ * This module exposes the loader half: list installed plugins, list the skills
+ * a plugin provides, and load a specific plugin skill's body. Mirrors
+ * `src/repertoire/skills.ts` priority-chain pattern.
+ *
+ * Integration with prompt assembly (W5.4): `listPluginSkills(enabledPlugins)`
+ * is called from `src/mind/prompt.ts` alongside `listSkills()` so plugin
+ * skills appear in the agent's skill index via the same `load_skill` tool.
+ */
+/** ~/.ouro-cli/plugins/ — machine-scoped plugin install root. */
+function getPluginsRoot(homeDir) {
+    return path.join((0, ouro_version_manager_1.getOuroCliHome)(homeDir), "plugins");
+}
+/** ~/.ouro-cli/plugins/<plugin-id>/ — install dir for a specific plugin. */
+function getPluginDir(pluginId, homeDir) {
+    return path.join(getPluginsRoot(homeDir), pluginId);
+}
+/** ~/.ouro-cli/plugins/<plugin-id>/skills/ — the plugin's skill directory. */
+function getPluginSkillsDir(pluginId, homeDir) {
+    return path.join(getPluginDir(pluginId, homeDir), "skills");
+}
+function listSkillDirNames(dir) {
+    // Industry-standard plugin skill layout: each skill is a directory under
+    // `skills/`, containing a `SKILL.md` (Claude Code + Copilot CLI convention;
+    // SKILL.md is the cross-vendor "agent skill" format with YAML frontmatter +
+    // markdown body). Older flat-file layouts (`skills/<name>.md`) are not part
+    // of the spec and not supported.
+    if (!fs.existsSync(dir))
+        return [];
+    return fs
+        .readdirSync(dir)
+        .filter((name) => {
+        const candidate = path.join(dir, name);
+        try {
+            if (!fs.statSync(candidate).isDirectory())
+                return false;
+            return fs.existsSync(path.join(candidate, "SKILL.md"));
+        }
+        catch {
+            return false;
+        }
+    })
+        .sort();
+}
+/**
+ * List installed plugins under ~/.ouro-cli/plugins/.
+ *
+ * Returns plugin IDs — directory names under the plugins root. Does NOT
+ * filter by enabled-for-this-agent; that's `listEnabledPlugins()`'s job.
+ */
+function listPlugins(homeDir) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.list_start",
+        component: "repertoire",
+        message: "listing installed plugins",
+        meta: { operation: "listPlugins" },
+    });
+    const root = getPluginsRoot(homeDir);
+    if (!fs.existsSync(root)) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "plugins.list_end",
+            component: "repertoire",
+            message: "no plugins root yet",
+            meta: { operation: "listPlugins", count: 0, root },
+        });
+        return [];
+    }
+    const plugins = fs
+        .readdirSync(root)
+        .filter((name) => {
+        const fullPath = path.join(root, name);
+        try {
+            return fs.statSync(fullPath).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    })
+        .sort();
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.list_end",
+        component: "repertoire",
+        message: "listed installed plugins",
+        meta: { operation: "listPlugins", count: plugins.length },
+    });
+    return plugins;
+}
+/**
+ * List plugins this agent has enabled via agent.json `plugins[]`.
+ *
+ * Reads the agent config + filters to entries with `enabled: true` whose
+ * plugin directory actually exists under ~/.ouro-cli/plugins/. Returns
+ * the matched PluginConfig entries (not just IDs) so callers have access
+ * to source + version metadata.
+ */
+function listEnabledPlugins(homeDir) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.list_enabled_start",
+        component: "repertoire",
+        message: "listing enabled plugins for agent",
+        meta: { operation: "listEnabledPlugins" },
+    });
+    const config = (0, identity_1.loadAgentConfig)();
+    const declared = config.plugins ?? [];
+    const installed = new Set(listPlugins(homeDir));
+    const enabled = declared.filter((p) => p.enabled && installed.has(p.id));
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.list_enabled_end",
+        component: "repertoire",
+        message: "filtered to enabled + installed plugins",
+        meta: {
+            operation: "listEnabledPlugins",
+            declared: declared.length,
+            enabled: enabled.length,
+        },
+    });
+    return enabled;
+}
+/**
+ * List skill names provided by the given enabled plugins.
+ *
+ * Walks each plugin's `skills/` directory using the industry-standard
+ * directory-per-skill layout (`skills/<name>/SKILL.md`). The SKILL.md
+ * convention is shared across Claude Code and Copilot CLI.
+ *
+ * Returns a deduplicated sorted list across all plugins. If two plugins
+ * declare a skill with the same name, the later-sorted plugin's skill wins
+ * (Set dedupe by name; callers concerned with collision can call this per
+ * plugin instead).
+ */
+function listPluginSkills(enabledPlugins, homeDir) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.list_skills_start",
+        component: "repertoire",
+        message: "listing skills across enabled plugins",
+        meta: { operation: "listPluginSkills", pluginCount: enabledPlugins.length },
+    });
+    const all = [];
+    for (const plugin of enabledPlugins) {
+        const skillsDir = getPluginSkillsDir(plugin.id, homeDir);
+        const skills = listSkillDirNames(skillsDir);
+        all.push(...skills);
+    }
+    const deduped = [...new Set(all)].sort();
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.list_skills_end",
+        component: "repertoire",
+        message: "listed plugin skills",
+        meta: {
+            operation: "listPluginSkills",
+            pluginCount: enabledPlugins.length,
+            skillCount: deduped.length,
+        },
+    });
+    return deduped;
+}
+/**
+ * Load the body of a specific skill from a specific plugin.
+ *
+ * Resolves the industry-standard directory-per-skill layout:
+ * `skills/<skillName>/SKILL.md`. Throws if not found.
+ */
+function loadPluginSkill(pluginId, skillName, homeDir) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.load_skill_start",
+        component: "repertoire",
+        message: "loading plugin skill",
+        meta: { operation: "loadPluginSkill", plugin: pluginId, skill: skillName },
+    });
+    const skillsDir = getPluginSkillsDir(pluginId, homeDir);
+    const skillPath = path.join(skillsDir, skillName, "SKILL.md");
+    if (!fs.existsSync(skillPath)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "plugins.load_skill_error",
+            component: "repertoire",
+            message: "plugin skill not found",
+            meta: {
+                operation: "loadPluginSkill",
+                plugin: pluginId,
+                skill: skillName,
+                checkedPath: skillPath,
+            },
+        });
+        throw new Error(`plugin skill '${pluginId}:${skillName}' not found at ${skillPath}`);
+    }
+    const content = fs.readFileSync(skillPath, "utf-8");
+    (0, runtime_1.emitNervesEvent)({
+        event: "plugins.load_skill_end",
+        component: "repertoire",
+        message: "loaded plugin skill",
+        meta: {
+            operation: "loadPluginSkill",
+            plugin: pluginId,
+            skill: skillName,
+            path: skillPath,
+        },
+    });
+    return content;
+}

package/dist/repertoire/relationship-authorization.js

@@ -0,0 +1,194 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderRelationshipPreferences = renderRelationshipPreferences;
+exports.withRelationshipPreference = withRelationshipPreference;
+exports.loadRelationshipCapabilityRegistry = loadRelationshipCapabilityRegistry;
+exports.relationshipSubjectFromFriend = relationshipSubjectFromFriend;
+exports.createRelationshipAuthorizationEvaluator = createRelationshipAuthorizationEvaluator;
+exports.resolveProfileScopedRelationshipAuthorization = resolveProfileScopedRelationshipAuthorization;
+exports.authorizeRelationshipAccess = authorizeRelationshipAccess;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+function renderRelationshipPreferences(friend) {
+    const now = Date.now();
+    return Object.entries(friend.relationshipPolicy?.preferences ?? {})
+        .filter(([, preference]) => !preference.expiresAt || Date.parse(preference.expiresAt) > now)
+        .slice(0, 20)
+        .map(([category, preference]) => `- source=${preference.source}; provenance=${preference.provenance}; category=${category}; value=${String(preference.value).replace(/\s+/gu, " ").trim().slice(0, 500)}; version=${preference.version}; precedence=current${preference.expiresAt ? `; expires=${preference.expiresAt}` : ""}`);
+}
+function withRelationshipPreference(friend, input) {
+    const current = friend.relationshipPolicy ?? { schemaVersion: 1, version: 0, preferences: {} };
+    const previous = current.preferences[input.category];
+    return {
+        ...friend,
+        relationshipPolicy: {
+            schemaVersion: 1,
+            version: current.version + 1,
+            preferences: { ...current.preferences, [input.category]: { value: input.value, provenance: input.provenance, source: input.source, version: (previous?.version ?? 0) + 1 } },
+        },
+        updatedAt: new Date().toISOString(),
+    };
+}
+const deny = (reason) => ({ allowed: false, reason });
+function authorizationReceipt(value) {
+    return `relationship-${(0, node_crypto_1.createHash)("sha256").update(JSON.stringify(value)).digest("hex")}`;
+}
+function stringList(value, label) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || !entry.trim()))
+        throw new Error(`${label} must be a string array`);
+    return [...new Set(value)];
+}
+function loadRelationshipCapabilityRegistry(agentRoot) {
+    const filePath = path.join(agentRoot, "tool-profiles.json");
+    const raw = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    if (raw.version !== 2 || !raw.profiles || typeof raw.profiles !== "object" || Array.isArray(raw.profiles))
+        throw new Error("relationship capability registry version 2 is required");
+    const profiles = {};
+    for (const [id, value] of Object.entries(raw.profiles)) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error(`relationship capability profile ${id} is invalid`);
+        const candidate = value;
+        if (!Number.isInteger(candidate.version) || Number(candidate.version) < 1)
+            throw new Error(`relationship capability profile ${id} version is invalid`);
+        profiles[id] = {
+            id,
+            version: Number(candidate.version),
+            contextScopes: stringList(candidate.contextScopes, `${id}.contextScopes`),
+            toolNames: stringList(candidate.toolNames, `${id}.toolNames`),
+            effectScopes: stringList(candidate.effectScopes, `${id}.effectScopes`),
+        };
+    }
+    return { version: 2, profiles };
+}
+function relationshipSubjectFromFriend(friend) {
+    return {
+        friendId: friend.id,
+        trustLevel: friend.trustLevel ?? "stranger",
+        admissionState: friend.admissionState ?? "unverified",
+        initiativePolicy: friend.initiativePolicy ?? "none",
+        ...(friend.capabilityProfileId ? { capabilityProfileId: friend.capabilityProfileId } : {}),
+    };
+}
+function createRelationshipAuthorizationEvaluator(input) {
+    const subject = relationshipSubjectFromFriend(input.friend);
+    const relationshipProfile = subject.capabilityProfileId ? input.registry.profiles[subject.capabilityProfileId] : undefined;
+    const turnProfile = input.profileId ? input.registry.profiles[input.profileId] : relationshipProfile;
+    const profile = relationshipProfile && turnProfile
+        ? {
+            id: turnProfile.id,
+            version: turnProfile.version,
+            contextScopes: turnProfile.contextScopes.filter((scope) => relationshipProfile.contextScopes.includes(scope)),
+            toolNames: turnProfile.toolNames.filter((name) => relationshipProfile.toolNames.includes(name)),
+            effectScopes: turnProfile.effectScopes.filter((scope) => relationshipProfile.effectScopes.includes(scope)),
+        }
+        : undefined;
+    const effectiveSubject = { ...subject, ...(profile ? { capabilityProfileId: profile.id } : {}) };
+    const profiles = profile ? [profile] : [];
+    const evaluate = (request) => authorizeRelationshipAccess({
+        relationship: effectiveSubject,
+        profiles,
+        request,
+        activeRequestId: input.requestId,
+        requestPhase: input.requestPhase,
+    });
+    const advertisedToolNames = profile?.toolNames.filter((name) => evaluate({ kind: "tool", name, ...(input.requestId ? { requestId: input.requestId, returnTargetFriendId: subject.friendId } : {}) }).allowed) ?? [];
+    const authorizedContextScopes = profile?.contextScopes.filter((scope) => evaluate({ kind: "context", scope }).allowed) ?? [];
+    return {
+        subject,
+        ...(profile ? { profileId: profile.id } : {}),
+        authorizedContextScopes,
+        advertisedToolNames,
+        ...(input.sessionEventId ? { actor: { friendId: subject.friendId, trustLevel: subject.trustLevel, sessionEventId: input.sessionEventId } } : {}),
+        authorizeContext: (scope) => evaluate({ kind: "context", scope }),
+        authorizeTool: (name) => evaluate({ kind: "tool", name, ...(input.requestId ? { requestId: input.requestId, returnTargetFriendId: subject.friendId } : {}) }),
+        authorizeEffect: (scope) => evaluate({ kind: "effect", scope, ...(input.requestId ? { requestId: input.requestId, returnTargetFriendId: subject.friendId } : {}) }),
+    };
+}
+async function resolveProfileScopedRelationshipAuthorization(input) {
+    const friends = await input.store.listAll?.() ?? [];
+    const matches = friends.filter((friend) => friend.capabilityProfileId === input.relationshipProfileId);
+    if (matches.length !== 1)
+        throw new Error(`relationship profile ${input.relationshipProfileId} must resolve to exactly one Friend`);
+    return createRelationshipAuthorizationEvaluator({
+        friend: matches[0],
+        registry: input.registry,
+        ...(input.profileId ? { profileId: input.profileId } : {}),
+        ...(input.requestId ? { requestId: input.requestId } : {}),
+        ...(input.requestPhase ? { requestPhase: input.requestPhase } : {}),
+        ...(input.sessionEventId ? { sessionEventId: input.sessionEventId } : {}),
+    });
+}
+function authorizeRelationshipAccess(input) {
+    if (input.request.kind === "admission_gate") {
+        const pending = input.pendingAdmission;
+        const now = Date.parse(input.now ?? new Date().toISOString());
+        if (!pending || pending.admissionId !== input.request.admissionId || pending.botId !== input.request.botId || pending.userId !== input.request.userId || pending.chatId !== input.request.chatId || pending.expiresAt !== input.request.expiresAt || now >= Date.parse(input.request.expiresAt) || input.request.idempotencyKey !== `ack:${input.request.admissionId}`) {
+            return deny("admission gate authorization does not match a current pending admission");
+        }
+        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.relationship_authorized", message: "authorized fixed admission gate acknowledgement", meta: { authorizationKind: "admission_gate", admissionId: input.request.admissionId } });
+        return { allowed: true, authorizationKind: "admission_gate", receiptId: authorizationReceipt(input.request), admissionId: input.request.admissionId, idempotencyKey: input.request.idempotencyKey, expiresAt: input.request.expiresAt };
+    }
+    const relationship = input.relationship;
+    if (!relationship || relationship.admissionState !== "active")
+        return deny("relationship admission is not active");
+    if (relationship.trustLevel !== "friend" && relationship.trustLevel !== "family")
+        return deny("relationship trust is insufficient");
+    const profile = input.profiles.find((candidate) => candidate.id === relationship.capabilityProfileId);
+    if (!profile || !Number.isInteger(profile.version) || profile.version < 1)
+        return deny("relationship capability profile is missing or stale");
+    if (input.request.kind === "context" && !profile.contextScopes.includes(input.request.scope))
+        return deny("context scope is not authorized by the relationship profile");
+    if (input.request.kind === "tool" && !profile.toolNames.includes(input.request.name))
+        return deny("tool is not authorized by the relationship profile");
+    if (input.request.kind === "effect" && !profile.effectScopes.includes(input.request.scope))
+        return deny("effect is not authorized by the relationship profile");
+    const requestId = input.request.kind === "context" ? undefined : input.request.requestId;
+    const returnTarget = input.request.kind === "context" ? undefined : input.request.returnTargetFriendId;
+    if (relationship.initiativePolicy === "none")
+        return deny("initiative policy denies contact");
+    if (relationship.initiativePolicy === "reactive_only" && input.request.kind !== "context") {
+        if (input.requestPhase !== "inbound" || !requestId || requestId !== input.activeRequestId || returnTarget !== relationship.friendId)
+            return deny("initiative policy is reactive only");
+    }
+    if (relationship.initiativePolicy === "request_follow_up_only" && input.request.kind !== "context") {
+        if (!requestId || requestId !== input.activeRequestId || returnTarget !== relationship.friendId)
+            return deny("initiative policy requires the matching active request and return target");
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.relationship_authorized", message: "authorized relationship access", meta: { authorizationKind: "relationship", friendId: relationship.friendId, profileId: profile.id, profileVersion: profile.version, requestKind: input.request.kind } });
+    return { allowed: true, authorizationKind: "relationship", receiptId: authorizationReceipt({ relationship, request: input.request, activeRequestId: input.activeRequestId, requestPhase: input.requestPhase, profile }), friendId: relationship.friendId, profileId: profile.id, profileVersion: profile.version, requestId: requestId ?? null };
+}