@peers-app/peers-sdk 0.25.17 → 0.25.19

package/dist/contracts/system/contract-catalog-contract.d.ts

@@ -0,0 +1,40 @@
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System Contract Catalog. */
+export declare const CONTRACT_CATALOG_VERSION = 1;
+/** Package id of the System Contract Catalog provider. */
+export declare const contractCatalogProviderPackageId = "000peers0system0000000001";
+/** One registered provider of a contract version. */
+export interface IContractProviderInfo {
+    packageId: string;
+    /** Display name from the Packages row, or the package id for the system provider. */
+    name: string;
+    /** True when this package is the active provider for the contract version. */
+    active: boolean;
+    /** Executable package selectors for this trusted turn. Missing metadata grants no actions. */
+    authorizedActions?: string[];
+}
+/** Input for listing providers of one contract version. */
+export interface IListContractProvidersInput {
+    contractId: string;
+    version: number;
+}
+/**
+ * Consumer shape for the System Contract Catalog.
+ *
+ * Hub packages use this to discover every provider of a shared contract.
+ */
+export interface IContractCatalogConsumer extends IContractConsumerBase {
+    tools: {
+        listContractProviders(input: IListContractProvidersInput): Promise<{
+            providers: IContractProviderInfo[];
+        }>;
+    };
+}
+/**
+ * Return the local-only catalog contract that lists providers of another contract.
+ *
+ * The active provider remains the default for ordinary calls. This tool exists so a
+ * consumer can address every registered provider, not only the active one.
+ */
+export declare function getContractCatalogDefinition(): IContractDefinition;

package/dist/contracts/system/contract-catalog-contract.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contractCatalogProviderPackageId = exports.CONTRACT_CATALOG_VERSION = void 0;
+exports.getContractCatalogDefinition = getContractCatalogDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System Contract Catalog. */
+exports.CONTRACT_CATALOG_VERSION = 1;
+/** Package id of the System Contract Catalog provider. */
+exports.contractCatalogProviderPackageId = system_ids_1.peersSystemPackageId;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+let definition;
+/**
+ * Return the local-only catalog contract that lists providers of another contract.
+ *
+ * The active provider remains the default for ordinary calls. This tool exists so a
+ * consumer can address every registered provider, not only the active one.
+ */
+function getContractCatalogDefinition() {
+    definition ??= {
+        contractId: system_ids_1.contractCatalogContractId,
+        version: exports.CONTRACT_CATALOG_VERSION,
+        devTag: "dev",
+        name: "System Contract Catalog",
+        description: "Lists the packages registered as providers of a contract version.",
+        tables: [],
+        tools: [
+            {
+                name: "listContractProviders",
+                usageDescription: "List every package registered for a contract version, including inactive ones.",
+                inputFields: [
+                    field("contractId", field_type_1.FieldType.id, "Contract to look up."),
+                    field("version", field_type_1.FieldType.number, "Contract version."),
+                ],
+                outputFields: [
+                    field("providers", field_type_1.FieldType.object, "Registered providers in registration order, with packageId, name, and active.", { isArray: true }),
+                ],
+            },
+        ],
+        observables: [],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: exports.contractCatalogProviderPackageId,
+    contractId: system_ids_1.contractCatalogContractId,
+    version: exports.CONTRACT_CATALOG_VERSION,
+    getDefinition: getContractCatalogDefinition,
+});

package/dist/contracts/system/http-contract.d.ts

@@ -0,0 +1,80 @@
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System HTTP contract. */
+export declare const HTTP_CONTRACT_VERSION = 1;
+/** Default request deadline when the caller omits `timeoutMs`. */
+export declare const HTTP_DEFAULT_TIMEOUT_MS = 30000;
+/** Longest request deadline System HTTP will honor. */
+export declare const HTTP_MAX_TIMEOUT_MS = 120000;
+/** Largest request or response body, in decoded bytes. */
+export declare const HTTP_MAX_BODY_BYTES: number;
+/** Package id of the System HTTP provider. */
+export declare const httpProviderPackageId = "000peers0system0000000001";
+/** One multipart part. Use `text` for a form field or `bodyBase64` for bytes. */
+export interface IHttpMultipartPart {
+    name: string;
+    filename?: string;
+    contentType?: string;
+    /** UTF-8 form field. Used instead of `bodyBase64` when set. */
+    text?: string;
+    bodyBase64?: string;
+}
+/** Input for {@link IHttpConsumer tools.request}. */
+export interface IHttpRequestInput {
+    requestId: string;
+    method: string;
+    url: string;
+    headers?: Record<string, string>;
+    body?: string;
+    bodyBase64?: string;
+    multipart?: IHttpMultipartPart[];
+    credentialRef?: string;
+    responseType?: "json" | "text" | "base64";
+    timeoutMs?: number;
+}
+/** Result of one System HTTP request. Non-2xx responses are returned, not thrown. */
+export interface IHttpRequestResult {
+    status: number;
+    ok: boolean;
+    contentType: string;
+    body: unknown;
+}
+/** Input for cancelling an in-flight request owned by the calling package. */
+export interface IHttpCancelInput {
+    requestId: string;
+}
+/** One credential declaration safe to show in the admin UI. The secret value is omitted. */
+export interface IHttpCredentialInfo {
+    ref: string;
+    header: string;
+    secretVar: string;
+    scope: "user" | "device";
+}
+/** Network declaration for one package, as shown to the operator. */
+export interface IHttpPolicyInfo {
+    allowedHosts: string[];
+    credentials: IHttpCredentialInfo[];
+}
+/**
+ * Consumer shape for System HTTP.
+ *
+ * Isolated packages call `request` and `cancel`. The Packages screen calls `describePolicy`.
+ */
+export interface IHttpConsumer extends IContractConsumerBase {
+    tools: {
+        request(input: IHttpRequestInput): Promise<IHttpRequestResult>;
+        cancel(input: IHttpCancelInput): Promise<{
+            cancelled: boolean;
+        }>;
+        describePolicy(input: {
+            packageId: string;
+        }): Promise<IHttpPolicyInfo>;
+    };
+}
+/**
+ * Return the local-only System HTTP contract shape.
+ *
+ * The host performs `fetch`. Guests name an allowlisted URL and an optional
+ * credential ref; they never receive the secret or an open network.
+ */
+export declare function getHttpContractDefinition(): IContractDefinition;

package/dist/contracts/system/http-contract.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.httpProviderPackageId = exports.HTTP_MAX_BODY_BYTES = exports.HTTP_MAX_TIMEOUT_MS = exports.HTTP_DEFAULT_TIMEOUT_MS = exports.HTTP_CONTRACT_VERSION = void 0;
+exports.getHttpContractDefinition = getHttpContractDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System HTTP contract. */
+exports.HTTP_CONTRACT_VERSION = 1;
+/** Default request deadline when the caller omits `timeoutMs`. */
+exports.HTTP_DEFAULT_TIMEOUT_MS = 30_000;
+/** Longest request deadline System HTTP will honor. */
+exports.HTTP_MAX_TIMEOUT_MS = 120_000;
+/** Largest request or response body, in decoded bytes. */
+exports.HTTP_MAX_BODY_BYTES = 8 * 1024 * 1024;
+/** Package id of the System HTTP provider. */
+exports.httpProviderPackageId = system_ids_1.peersSystemPackageId;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+let definition;
+/**
+ * Return the local-only System HTTP contract shape.
+ *
+ * The host performs `fetch`. Guests name an allowlisted URL and an optional
+ * credential ref; they never receive the secret or an open network.
+ */
+function getHttpContractDefinition() {
+    definition ??= {
+        contractId: system_ids_1.httpContractId,
+        version: exports.HTTP_CONTRACT_VERSION,
+        devTag: "dev",
+        name: "System HTTP",
+        description: "Host-mediated HTTPS for isolated packages. Hosts must be declared on the package, and credentials are injected by reference.",
+        tables: [],
+        tools: [
+            {
+                name: "request",
+                usageDescription: "Perform one HTTPS request to a host this package declared. Non-2xx responses are returned.",
+                inputFields: [
+                    field("requestId", field_type_1.FieldType.string, "Caller-chosen id used to cancel this request."),
+                    field("method", field_type_1.FieldType.string, "HTTP method: GET, POST, PUT, PATCH, DELETE, or HEAD."),
+                    field("url", field_type_1.FieldType.string, "Absolute https URL whose host is on this package's allowlist."),
+                    field("headers", field_type_1.FieldType.object, "Optional request headers. Credential headers are overwritten.", {
+                        optional: true,
+                    }),
+                    field("body", field_type_1.FieldType.string, "UTF-8 request body.", { optional: true }),
+                    field("bodyBase64", field_type_1.FieldType.string, "Base64 request body. Used instead of body when set.", {
+                        optional: true,
+                    }),
+                    field("multipart", field_type_1.FieldType.object, "Multipart parts with name and bodyBase64. Used instead of body when set.", { optional: true, isArray: true }),
+                    field("credentialRef", field_type_1.FieldType.string, "Credential ref from this package's network declaration.", { optional: true }),
+                    field("responseType", field_type_1.FieldType.string, 'How to decode the response: "json", "text", or "base64". Defaults to json.', { optional: true }),
+                    field("timeoutMs", field_type_1.FieldType.number, `Deadline in milliseconds. Defaults to ${exports.HTTP_DEFAULT_TIMEOUT_MS} and is capped at ${exports.HTTP_MAX_TIMEOUT_MS}.`, { optional: true }),
+                ],
+                outputFields: [
+                    field("status", field_type_1.FieldType.number, "HTTP status code."),
+                    field("ok", field_type_1.FieldType.boolean, "True when the status is 2xx."),
+                    field("contentType", field_type_1.FieldType.string, "Response Content-Type, or empty."),
+                    field("body", field_type_1.FieldType.any, "Decoded response body."),
+                ],
+            },
+            {
+                name: "cancel",
+                usageDescription: "Abort one in-flight request started by this package.",
+                inputFields: [field("requestId", field_type_1.FieldType.string, "Id passed to request.")],
+                outputFields: [
+                    field("cancelled", field_type_1.FieldType.boolean, "True when a matching request was aborted."),
+                ],
+            },
+            {
+                name: "describePolicy",
+                usageDescription: "Return the host allowlist and credential refs declared by a package. Secret values are omitted.",
+                inputFields: [
+                    field("packageId", field_type_1.FieldType.id, "Package whose network declaration to read."),
+                ],
+                outputFields: [
+                    field("allowedHosts", field_type_1.FieldType.string, "Hostnames the package may request.", {
+                        isArray: true,
+                    }),
+                    field("credentials", field_type_1.FieldType.object, "Credential refs, headers, and logical secret names. Values are not included.", { isArray: true }),
+                ],
+            },
+        ],
+        observables: [],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: exports.httpProviderPackageId,
+    contractId: system_ids_1.httpContractId,
+    version: exports.HTTP_CONTRACT_VERSION,
+    getDefinition: getHttpContractDefinition,
+});

package/dist/contracts/system/index.d.ts

@@ -2,11 +2,14 @@
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+import "./contract-catalog-contract";
 import "./device-operations-contract";
+import "./http-contract";
 import "./identity-contract";
 import "./invites-contract";
 import "./logs-contract";
 import "./network-contracts";
+import "./scheduler-contract";
 import "./tool-access-control-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./device-operations-contract";
 export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentityKeyInfo, type IIdentityRegistryKey, type IIdentityRotateKeyInput, type IIdentityRotateKeyResult, type IIdentitySessionInfo, } from "./identity-contract";

package/dist/contracts/system/index.js

@@ -19,11 +19,14 @@ exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContr
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+require("./contract-catalog-contract");
 require("./device-operations-contract");
+require("./http-contract");
 require("./identity-contract");
 require("./invites-contract");
 require("./logs-contract");
 require("./network-contracts");
+require("./scheduler-contract");
 require("./tool-access-control-contract");
 var device_operations_contract_1 = require("./device-operations-contract");
 Object.defineProperty(exports, "DEVICE_OPERATIONS_CONTRACT_VERSION", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_CONTRACT_VERSION; } });

package/dist/contracts/system/scheduler-contract.d.ts

@@ -0,0 +1,54 @@
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System Scheduler contract. */
+export declare const SCHEDULER_CONTRACT_VERSION = 1;
+/** Package id of the System Scheduler provider. */
+export declare const schedulerProviderPackageId = "000peers0system0000000001";
+/** Furthest a schedule may sit in the future. */
+export declare const SCHEDULER_MAX_DELAY_MS: number;
+/** Input for scheduling a wake-up of the caller's own tool. */
+export interface IScheduleInput {
+    /** Unix epoch milliseconds when the tool should run. */
+    at: number;
+    contractId: string;
+    version: number;
+    toolName: string;
+    payload?: unknown;
+}
+/** One device-local schedule owned by a package. */
+export interface IScheduleInfo {
+    scheduleId: string;
+    packageId: string;
+    dataContextId: string;
+    contractId: string;
+    version: number;
+    toolName: string;
+    at: number;
+}
+/**
+ * Consumer shape for System Scheduler.
+ *
+ * Schedules are stored on this device only. Another device does not run them.
+ */
+export interface ISchedulerConsumer extends IContractConsumerBase {
+    tools: {
+        schedule(input: IScheduleInput): Promise<{
+            scheduleId: string;
+        }>;
+        cancel(input: {
+            scheduleId: string;
+        }): Promise<{
+            cancelled: boolean;
+        }>;
+        list(): Promise<{
+            schedules: IScheduleInfo[];
+        }>;
+    };
+}
+/**
+ * Return the local-only System Scheduler contract shape.
+ *
+ * A package may schedule a tool that it provides. When `at` arrives, the host
+ * starts that package's worker if needed and runs the tool as Self.
+ */
+export declare function getSchedulerContractDefinition(): IContractDefinition;

package/dist/contracts/system/scheduler-contract.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCHEDULER_MAX_DELAY_MS = exports.schedulerProviderPackageId = exports.SCHEDULER_CONTRACT_VERSION = void 0;
+exports.getSchedulerContractDefinition = getSchedulerContractDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System Scheduler contract. */
+exports.SCHEDULER_CONTRACT_VERSION = 1;
+/** Package id of the System Scheduler provider. */
+exports.schedulerProviderPackageId = system_ids_1.peersSystemPackageId;
+/** Furthest a schedule may sit in the future. */
+exports.SCHEDULER_MAX_DELAY_MS = 366 * 24 * 60 * 60 * 1000;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+let definition;
+/**
+ * Return the local-only System Scheduler contract shape.
+ *
+ * A package may schedule a tool that it provides. When `at` arrives, the host
+ * starts that package's worker if needed and runs the tool as Self.
+ */
+function getSchedulerContractDefinition() {
+    definition ??= {
+        contractId: system_ids_1.schedulerContractId,
+        version: exports.SCHEDULER_CONTRACT_VERSION,
+        devTag: "dev",
+        name: "System Scheduler",
+        description: "Device-local schedules that wake a package's own tool. Schedules do not sync to other devices.",
+        tables: [],
+        tools: [
+            {
+                name: "schedule",
+                usageDescription: "Run one of this package's tools at a future time on this device. Returns a scheduleId.",
+                inputFields: [
+                    field("at", field_type_1.FieldType.number, "Unix epoch milliseconds when the tool should run."),
+                    field("contractId", field_type_1.FieldType.id, "Contract this package provides."),
+                    field("version", field_type_1.FieldType.number, "Contract version."),
+                    field("toolName", field_type_1.FieldType.string, "Tool on that contract to run."),
+                    field("payload", field_type_1.FieldType.any, "JSON value passed to the tool.", { optional: true }),
+                ],
+                outputFields: [field("scheduleId", field_type_1.FieldType.id, "Id to pass to cancel.")],
+            },
+            {
+                name: "cancel",
+                usageDescription: "Cancel a schedule this package created.",
+                inputFields: [field("scheduleId", field_type_1.FieldType.id, "Schedule to cancel.")],
+                outputFields: [
+                    field("cancelled", field_type_1.FieldType.boolean, "True when the schedule existed and was removed."),
+                ],
+            },
+            {
+                name: "list",
+                usageDescription: "List schedules owned by the calling package on this device.",
+                inputFields: [],
+                outputFields: [
+                    field("schedules", field_type_1.FieldType.object, "Schedules with scheduleId, contractId, version, toolName, and at.", { isArray: true }),
+                ],
+            },
+        ],
+        observables: [],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: exports.schedulerProviderPackageId,
+    contractId: system_ids_1.schedulerContractId,
+    version: exports.SCHEDULER_CONTRACT_VERSION,
+    getDefinition: getSchedulerContractDefinition,
+});

package/dist/data/messages.d.ts

@@ -18,8 +18,8 @@ export declare const messageSchema: z.ZodObject<{
     channelId: string;
     messageId: string;
     assistantId?: string | undefined;
-    vars?: z.objectOutputType<{}, z.ZodAny, "strip"> | undefined;
     messageParentId?: string | undefined;
+    vars?: z.objectOutputType<{}, z.ZodAny, "strip"> | undefined;
     editedAt?: Date | undefined;
     fileIds?: string[] | undefined;
 }, {
@@ -29,8 +29,8 @@ export declare const messageSchema: z.ZodObject<{
     channelId: string;
     messageId: string;
     assistantId?: string | undefined;
-    vars?: z.objectInputType<{}, z.ZodAny, "strip"> | undefined;
     messageParentId?: string | undefined;
+    vars?: z.objectInputType<{}, z.ZodAny, "strip"> | undefined;
     editedAt?: Date | undefined;
     fileIds?: string[] | undefined;
 }>;
@@ -42,8 +42,8 @@ export declare function Messages(dataContext?: DataContext): import("..").Table<
     channelId: string;
     messageId: string;
     assistantId?: string | undefined;
-    vars?: z.objectOutputType<{}, z.ZodAny, "strip"> | undefined;
     messageParentId?: string | undefined;
+    vars?: z.objectOutputType<{}, z.ZodAny, "strip"> | undefined;
     editedAt?: Date | undefined;
     fileIds?: string[] | undefined;
 }>;

package/dist/data/package-versions.d.ts

@@ -66,17 +66,17 @@ declare const schema: z.ZodObject<{
         signature: string;
         by: string;
     }[] | undefined;
-    versionTag?: string | undefined;
-    routesBundleFileId?: string | undefined;
-    routesBundleFileHash?: string | undefined;
-    uiBundleFileId?: string | undefined;
-    uiBundleFileHash?: string | undefined;
     appNavs?: {
         name: string;
         iconClassName: string;
         navigationPath: string;
         displayName?: string | undefined;
     }[] | undefined;
+    versionTag?: string | undefined;
+    routesBundleFileId?: string | undefined;
+    routesBundleFileHash?: string | undefined;
+    uiBundleFileId?: string | undefined;
+    uiBundleFileHash?: string | undefined;
     packageAuthorSignature?: string | undefined;
 }, {
     version: string;
@@ -94,17 +94,17 @@ declare const schema: z.ZodObject<{
         signature: string;
         by: string;
     }[] | undefined;
-    versionTag?: string | undefined;
-    routesBundleFileId?: string | undefined;
-    routesBundleFileHash?: string | undefined;
-    uiBundleFileId?: string | undefined;
-    uiBundleFileHash?: string | undefined;
     appNavs?: {
         name: string;
         iconClassName: string;
         navigationPath: string;
         displayName?: string | undefined;
     }[] | undefined;
+    versionTag?: string | undefined;
+    routesBundleFileId?: string | undefined;
+    routesBundleFileHash?: string | undefined;
+    uiBundleFileId?: string | undefined;
+    uiBundleFileHash?: string | undefined;
     packageAuthorSignature?: string | undefined;
 }>;
 export type IPackageVersion = z.infer<typeof schema>;

package/dist/data/tool-access-approvals.d.ts

@@ -52,8 +52,8 @@ export declare const toolAccessApprovalSchema: z.ZodObject<{
     dataContextId: string;
     createdAt: Date;
     expiresAt: Date;
-    toolAccessApprovalId: string;
     toolName: string;
+    toolAccessApprovalId: string;
     argsHash: string;
     argsPreview: string;
     frozenArgs: {} & {
@@ -73,8 +73,8 @@ export declare const toolAccessApprovalSchema: z.ZodObject<{
     toolId: string;
     dataContextId: string;
     expiresAt: Date;
-    toolAccessApprovalId: string;
     toolName: string;
+    toolAccessApprovalId: string;
     argsHash: string;
     frozenArgs: {} & {
         [k: string]: any;
@@ -108,8 +108,8 @@ export declare function ToolAccessApprovals(dataContext?: DataContext): import("
     dataContextId: string;
     createdAt: Date;
     expiresAt: Date;
-    toolAccessApprovalId: string;
     toolName: string;
+    toolAccessApprovalId: string;
     argsHash: string;
     argsPreview: string;
     frozenArgs: {} & {

package/dist/data/tool-access.d.ts

@@ -65,12 +65,14 @@ export declare function hashToolArgs(args: Record<string, unknown> | undefined):
  */
 export declare function annotateToolAccessDescription(usageDescription: string, accessLevel: unknown): string;
 /**
- * Return the fail-closed access level for a record that may omit the field.
+ * Resolve admission from record metadata. Omitted preservation-request tools enter at None;
+ * ordinary tools and Assistants retain the fail-closed Self default.
  *
  * @param record - Tool or Assistant-like object.
  */
 export declare function recordAccessLevel(record: {
     accessLevel?: unknown;
+    authorityPropagation?: unknown;
 } | undefined): number;
 /**
  * Choose the delegated Assistant ceiling for a run.

package/dist/data/tool-access.js

@@ -105,13 +105,16 @@ function annotateToolAccessDescription(usageDescription, accessLevel) {
     return `${usageDescription}\n\n${annotation}`;
 }
 /**
- * Return the fail-closed access level for a record that may omit the field.
+ * Resolve admission from record metadata. Omitted preservation-request tools enter at None;
+ * ordinary tools and Assistants retain the fail-closed Self default.
  *
  * @param record - Tool or Assistant-like object.
  */
 function recordAccessLevel(record) {
     return record?.accessLevel == null
-        ? access_level_1.DEFAULT_ACCESS_LEVEL
+        ? record?.authorityPropagation === "preserve"
+            ? access_level_1.AccessLevel.None
+            : access_level_1.DEFAULT_ACCESS_LEVEL
         : (0, access_level_1.resolveAccessLevel)(record.accessLevel);
 }
 /**

package/dist/data/tool-access.test.js

@@ -59,6 +59,13 @@ describe("annotateToolAccessDescription", () => {
         expect((0, tool_access_1.annotateToolAccessDescription)(once, 40)).toBe(once);
     });
 });
+test("legacy host admission and descriptions use the preservation request, not a grant", () => {
+    const tool = { authorityPropagation: "preserve" };
+    expect((0, tool_access_1.recordAccessLevel)(tool)).toBe(0);
+    expect((0, tool_access_1.annotateToolAccessDescription)("route", (0, tool_access_1.recordAccessLevel)(tool))).toContain("None (0)");
+    expect((0, tool_access_1.recordAccessLevel)({})).toBe(100);
+    expect((0, tool_access_1.recordAccessLevel)({ ...tool, accessLevel: 40 })).toBe(40);
+});
 describe("recordAccessLevel", () => {
     it("defaults missing records to 100", () => {
         expect((0, tool_access_1.recordAccessLevel)(undefined)).toBe(100);

package/dist/data/tools.d.ts

@@ -219,7 +219,8 @@ export declare const toolSchema: z.ZodObject<{
     codeRepository: z.ZodOptional<z.ZodString>;
     isAssistantRunner: z.ZodOptional<z.ZodBoolean>;
     packageId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    accessLevel: z.ZodDefault<z.ZodNumber>;
+    authorityPropagation: z.ZodOptional<z.ZodEnum<["cap", "preserve"]>>;
+    accessLevel: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
     remoteAccessLevel: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     code: string;
@@ -250,7 +251,6 @@ export declare const toolSchema: z.ZodObject<{
             subType?: string | undefined;
         }[];
     };
-    accessLevel: number;
     detailedDescription?: string | undefined;
     configSchema?: {
         type: IOSchemaType;
@@ -267,6 +267,8 @@ export declare const toolSchema: z.ZodObject<{
     codeRepository?: string | undefined;
     isAssistantRunner?: boolean | undefined;
     packageId?: string | undefined;
+    authorityPropagation?: "preserve" | "cap" | undefined;
+    accessLevel?: number | undefined;
     remoteAccessLevel?: number | undefined;
 }, {
     name: string;
@@ -313,6 +315,7 @@ export declare const toolSchema: z.ZodObject<{
     codeRepository?: string | undefined;
     isAssistantRunner?: boolean | undefined;
     packageId?: string | undefined;
+    authorityPropagation?: "preserve" | "cap" | undefined;
     accessLevel?: number | undefined;
     remoteAccessLevel?: number | undefined;
 }>;
@@ -359,7 +362,6 @@ export declare function Tools(dataContext?: DataContext): import("..").Table<{
             subType?: string | undefined;
         }[];
     };
-    accessLevel: number;
     detailedDescription?: string | undefined;
     configSchema?: {
         type: IOSchemaType;
@@ -376,5 +378,7 @@ export declare function Tools(dataContext?: DataContext): import("..").Table<{
     codeRepository?: string | undefined;
     isAssistantRunner?: boolean | undefined;
     packageId?: string | undefined;
+    authorityPropagation?: "preserve" | "cap" | undefined;
+    accessLevel?: number | undefined;
     remoteAccessLevel?: number | undefined;
 }>;

package/dist/data/tools.js

@@ -48,7 +48,13 @@ exports.toolSchema = zod_1.z.object({
         .optional()
         .describe("Whether this tool is a model that can be used to run an assistant"),
     packageId: zod_types_1.zodPeerId.optional().describe("The package that installed this tool, if any"),
-    accessLevel: access_level_1.accessLevelSchema.describe("Required access level (0-100) to run this tool. Unclassified tools default to 100 (Self)."),
+    authorityPropagation: zod_1.z
+        .enum(["cap", "preserve"])
+        .optional()
+        .describe("Declared outgoing authority behavior in strict dispatch. 'cap' (default) includes this tool's level in the outgoing ceiling; 'preserve' omits it and passes the caller's authority through."),
+    accessLevel: access_level_1.accessLevelSchema
+        .optional()
+        .describe("Admission level (0-100). Omitted 'preserve' tools enter at None (0); other omitted tools require Self (100)."),
     remoteAccessLevel: zod_1.z
         .number()
         .int()