@peers-app/peers-sdk 0.25.18 → 0.25.19

package/README.md

@@ -69,6 +69,14 @@ The fastest way to build a Peers package is to start from the template:
 - [Documentation](https://peers-app.github.io) — architecture, package development, and API reference
 - [GitHub](https://github.com/peers-app) — source repositories and package template
 
+## Tool authority propagation
+
+Dynamic tool dispatch carries trusted signed identity and a strict delegated ceiling. A tool declares `authorityPropagation: "cap"` (default) or `"preserve"` in its metadata, and the runtime honors the declaration the same way it honors a declared `accessLevel`: installing a package is the trust decision. There is no separate operator grant.
+
+`accessLevel` is independent admission policy. A `preserve` tool with no entry level admits at None (0); an ordinary unclassified tool retains Self (100). Inside strict dispatch, an ordinary tool contributes its own effective level to the outgoing ceiling, while a `preserve` tool omits it but still retains the live user role, any inherited ceiling, and the contract consume ceiling. An Admin entering a Reader `preserve` router can therefore select an Admin target, but an Admin arriving through an ordinary Reader tool stays capped at Reader. Even None `preserve` tools require trusted identity and context. Strict dispatch denies step-up and unsupported remote or cross-context hops.
+
+Host packages select public targets through `context.dispatchTool({contractId, version, toolName, providerPackageId}, args)` and package-owned canonical aliases through `context.dispatchAction(alias, args)`. Isolated packages use `callConsumedTool`; all use the same runtime authorizer. Private aliases stay pinned to their owning implementation and target levels are read live on every call. Catalog `authorizedActions` is advisory; execution rechecks. Tool arguments never supply authority.
+
 ## License
 
-MIT
+MIT

package/dist/contracts/__tests__/action-dispatch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/contracts/__tests__/action-dispatch.test.js

@@ -0,0 +1,339 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const group_member_roles_1 = require("../../data/group-member-roles");
+const utils_1 = require("../../utils");
+const VOICE_ACTION_CONTRACT_ID = "00muxgugn6xvs8f2r80ru205t";
+const contract_provider_router_1 = require("../contract-provider-router");
+const contract_proxy_1 = require("../contract-proxy");
+const contract_transport_1 = require("../contract-transport");
+function groupContext() {
+    const userId = (0, utils_1.newid)();
+    const groupId = (0, utils_1.newid)();
+    const founderUserId = (0, utils_1.newid)();
+    let role = group_member_roles_1.GroupMemberRole.Writer;
+    const dataContext = {
+        dataContextId: groupId,
+        groupId,
+        tableContainer: {
+            getTable: (meta) => {
+                if (meta.name === "Groups")
+                    return { get: async () => ({ groupId, founderUserId }) };
+                if (meta.name === "GroupMembers")
+                    return { findOne: async () => ({ userId, role }) };
+                throw new Error(`Unexpected table ${meta.name}`);
+            },
+        },
+    };
+    Object.assign(dataContext, {
+        userContext: {
+            userId,
+            loadingPromise: Promise.resolve(),
+            userDataContext: dataContext,
+            getDataContext: () => dataContext,
+        },
+    });
+    return {
+        dataContext,
+        userId,
+        groupId,
+        setRole: (value) => {
+            role = value;
+        },
+    };
+}
+function tool(name, level, toolFn) {
+    return {
+        tool: {
+            name,
+            toolId: (0, utils_1.newid)(),
+            usageDescription: name,
+            accessLevel: level,
+            code: "",
+            inputSchema: { type: "simple", fields: [] },
+            outputSchema: { type: "simple", fields: [] },
+        },
+        toolFn,
+    };
+}
+describe("strict voice/touch action transport in a group", () => {
+    it("leaves ordinary host-tool admission outside the action scope on its existing user-role path", async () => {
+        const group = groupContext();
+        const contractId = (0, utils_1.newid)();
+        const effect = jest.fn(async () => "written");
+        const dispatch = (0, contract_proxy_1.createContractProvider)({
+            contractId,
+            version: 1,
+            tools: { write: tool("write", 40, effect) },
+        });
+        const call = {
+            contractId,
+            version: 1,
+            member: "tool",
+            name: "write",
+            operation: "run",
+            args: [{}],
+        };
+        const context = {
+            callerUserId: group.userId,
+            dataContext: group.dataContext,
+            authority: {
+                userId: group.userId,
+                userAccessLevel: 40,
+                assistantAccessLevel: 20,
+                callingToolAccessLevel: 20,
+                strictActionScope: false,
+            },
+        };
+        await expect(dispatch(call, context)).resolves.toBe("written");
+        group.setRole(group_member_roles_1.GroupMemberRole.Reader);
+        await expect(dispatch(call, context)).rejects.toThrow("Reader (20)");
+        expect(effect).toHaveBeenCalledTimes(1);
+    });
+    function setup(authority) {
+        const group = groupContext();
+        const writes = jest.fn(async () => ({ result: "milk" }));
+        const resolution = {
+            contractId: VOICE_ACTION_CONTRACT_ID,
+            version: 1,
+            tools: {
+                invoke: tool("invoke", 20, (input, context) => context.dispatchAction?.(input.tool, input.args ?? {})),
+            },
+            actionAliases: {
+                list_items: "list",
+                add_item: "add",
+                reader_hop: "reader",
+                writer_hop: "writer",
+                writer_self: "writer-self",
+                owner: "history",
+                self: "self",
+            },
+            actionTools: {
+                list: tool("list", 20, async () => ({ result: [] })),
+                add: tool("add", 40, writes),
+                reader: tool("reader", 20, (_, context) => context.dispatchAction?.("add_item", {})),
+                writer: tool("writer", 40, (_, context) => context.dispatchAction?.("owner", {})),
+                "writer-self": tool("writer-self", 40, (_, context) => context.dispatchAction?.("self", {})),
+                history: tool("history", 80, writes),
+                self: tool("self", undefined, writes),
+            },
+        };
+        Object.assign(resolution.tools.invoke.tool, { authorityPropagation: "preserve" });
+        const context = {
+            callerUserId: group.userId,
+            localUserId: group.userId,
+            dataContext: group.dataContext,
+            authority,
+        };
+        const [client, server] = (0, contract_transport_1.inProcessTransportPair)();
+        const session = (0, contract_proxy_1.createContractProviderSession)(resolution, server, { context });
+        const consumer = (0, contract_proxy_1.createContractConsumer)({
+            contractId: VOICE_ACTION_CONTRACT_ID,
+            version: 1,
+            name: "Voice Skill",
+            description: "",
+            tables: [],
+            observables: [],
+            events: [],
+            tools: [{ name: "invoke", usageDescription: "invoke", inputFields: [], outputFields: [] }],
+        }, client, { dataContextId: group.groupId });
+        return {
+            ...group,
+            writes,
+            resolution,
+            context,
+            consumer,
+            dispose: () => {
+                consumer.dispose();
+                session.dispose();
+            },
+        };
+    }
+    it("allows direct Writer dispatch while a group Reader can only list, including touch envelopes", async () => {
+        const p = setup();
+        try {
+            await expect(p.consumer.tools.invoke({ tool: "add_item", args: { name: "milk" } })).resolves.toEqual({ result: "milk" });
+            p.setRole(group_member_roles_1.GroupMemberRole.Reader);
+            await expect(p.consumer.tools.invoke({ tool: "list_items" })).resolves.toEqual({
+                result: [],
+            });
+            await expect(p.consumer.tools.invoke({
+                tool: "add_item",
+                args: {
+                    name: "milk",
+                    userId: p.userId,
+                    userAccessLevel: 100,
+                    assistantAccessLevel: 100,
+                    directUserInvocation: true,
+                    hostApprovedApprovalId: (0, utils_1.newid)(),
+                },
+            })).rejects.toThrow("Permission denied");
+            expect(p.writes).toHaveBeenCalledTimes(1);
+            expect(await (0, contract_proxy_1.authorizedContractActionNames)(p.resolution, p.context)).toEqual(expect.not.arrayContaining(["add_item", "owner", "self"]));
+        }
+        finally {
+            p.dispose();
+        }
+    });
+    it("caps Reader tools through invoke, denies Owner and Self from Writer tools, and ignores grants", async () => {
+        const p = setup();
+        try {
+            await expect(p.consumer.tools.invoke({ tool: "reader_hop" })).rejects.toThrow("Permission denied");
+            await expect(p.consumer.tools.invoke({ tool: "writer_hop" })).rejects.toThrow("Permission denied");
+            await expect(p.consumer.tools.invoke({ tool: "self" })).rejects.toThrow("Permission denied");
+            p.setRole(group_member_roles_1.GroupMemberRole.Owner);
+            await expect(p.consumer.tools.invoke({ tool: "writer_hop" })).rejects.toThrow("Permission denied");
+            p.setRole(group_member_roles_1.GroupMemberRole.Founder);
+            await expect(p.consumer.tools.invoke({ tool: "writer_self" })).rejects.toThrow("Permission denied");
+            expect(p.writes).not.toHaveBeenCalled();
+        }
+        finally {
+            p.dispose();
+        }
+    });
+    it("rechecks role and live metadata after catalog projection", async () => {
+        const p = setup();
+        try {
+            expect(await (0, contract_proxy_1.authorizedContractActionNames)(p.resolution, p.context)).toContain("add_item");
+            p.setRole(group_member_roles_1.GroupMemberRole.Reader);
+            await expect(p.consumer.tools.invoke({ tool: "add_item" })).rejects.toThrow("Permission denied");
+            p.setRole(group_member_roles_1.GroupMemberRole.Writer);
+            if (!p.resolution.actionTools)
+                throw new Error("Missing actions");
+            p.resolution.actionTools.add.tool.accessLevel = 80;
+            await expect(p.consumer.tools.invoke({ tool: "add_item" })).rejects.toThrow("Permission denied");
+            await expect(p.consumer.tools.invoke({ tool: "invented" })).rejects.toThrow("Unknown action");
+            expect(p.writes).not.toHaveBeenCalled();
+        }
+        finally {
+            p.dispose();
+        }
+    });
+    it("refuses a Reader wrapper with no checked actions before an old raw handler can run", async () => {
+        const p = setup();
+        try {
+            delete p.resolution.actionAliases;
+            await expect(p.consumer.tools.invoke({ tool: "add_item" })).rejects.toThrow("Action dispatcher requires registered checked actions");
+            expect(p.writes).not.toHaveBeenCalled();
+        }
+        finally {
+            p.dispose();
+        }
+    });
+    it("retains a delegated Reader frame from a trusted caller and fails missing identity closed", async () => {
+        const p = setup({ userAccessLevel: 40, assistantAccessLevel: 20, strictActionScope: true });
+        try {
+            await expect(p.consumer.tools.invoke({ tool: "add_item" })).rejects.toThrow("Permission denied");
+            delete p.context.callerUserId;
+            delete p.context.localUserId;
+            await expect(p.consumer.tools.invoke({ tool: "list_items", args: { callerUserId: p.userId } })).rejects.toThrow("missing caller identity");
+            expect(p.writes).not.toHaveBeenCalled();
+        }
+        finally {
+            p.dispose();
+        }
+    });
+    it("refuses remote forwarding rather than dropping a strict ceiling", async () => {
+        const [client, server] = (0, contract_transport_1.inProcessTransportPair)();
+        const resolveEndpoint = jest.fn();
+        const router = (0, contract_provider_router_1.createContractProviderRouter)(server, {
+            context: {
+                authority: { userAccessLevel: 40, assistantAccessLevel: 20, strictActionScope: true },
+            },
+            authorizeCall: () => ({ context: {} }),
+            resolveEndpoint,
+        });
+        try {
+            await expect(client.emit(contract_transport_1.CONTRACT_REQUEST_CHANNEL, {
+                contractId: (0, utils_1.newid)(),
+                version: 1,
+                member: "tool",
+                name: "write",
+                operation: "run",
+                args: [],
+                targetDeviceId: (0, utils_1.newid)(),
+            })).rejects.toThrow("cannot target another device");
+            expect(resolveEndpoint).not.toHaveBeenCalled();
+        }
+        finally {
+            router.dispose();
+        }
+    });
+});
+describe("declared tool authority propagation", () => {
+    it.each([
+        [60, undefined, 20, true, 60, true],
+        [60, 20, 20, true, 40, false],
+        [60, undefined, 20, false, 40, false],
+        [0, undefined, undefined, true, 0, true],
+        [0, undefined, undefined, true, 20, false],
+        [20, undefined, 40, true, 20, false],
+    ])("generic host propagation U=%s A=%s entry=%s preserve=%s target=%s", async (userLevel, ceiling, entryLevel, preserve, targetLevel, allowed) => {
+        const group = groupContext();
+        group.setRole(userLevel);
+        const effect = jest.fn(() => "executed");
+        const router = tool("route", entryLevel, (_, context) => context.dispatchAction?.("act", {}));
+        if (preserve)
+            Object.assign(router.tool, { authorityPropagation: "preserve" });
+        const contractId = (0, utils_1.newid)();
+        const dispatch = (0, contract_proxy_1.createContractProvider)({
+            contractId,
+            version: 1,
+            tools: { route: router },
+            actionAliases: { act: "target" },
+            actionTools: { target: tool("target", targetLevel, effect) },
+        });
+        const result = dispatch({ contractId, version: 1, member: "tool", name: "route", operation: "run", args: [{}] }, {
+            callerUserId: group.userId,
+            dataContext: group.dataContext,
+            authority: { userAccessLevel: userLevel, assistantAccessLevel: ceiling },
+        });
+        if (allowed)
+            await expect(result).resolves.toBe("executed");
+        else
+            await expect(result).rejects.toThrow(/Permission denied/);
+        expect(effect).toHaveBeenCalledTimes(allowed ? 1 : 0);
+    });
+    it.each([
+        [VOICE_ACTION_CONTRACT_ID, 1, "invoke"],
+        ["00mskqamhdq1327mqehy58pps", 3, "voice-hub-run-action"],
+    ])("honors declared preserve on %s v%s %s without raising an inherited ceiling", async (contractId, version, name) => {
+        const group = groupContext();
+        const effect = jest.fn(() => ({ writerTargetExecuted: true }));
+        const resolution = {
+            contractId,
+            version,
+            tools: {
+                [name]: tool(name, 20, (_, context) => context.dispatchAction?.("write", {})),
+            },
+            actionAliases: { write: "write" },
+            actionTools: { write: tool("write", 40, effect) },
+        };
+        const call = {
+            contractId,
+            version,
+            member: "tool",
+            name,
+            operation: "run",
+            args: [{}],
+        };
+        const context = { callerUserId: group.userId, dataContext: group.dataContext };
+        // An ordinary Reader wrapper caps a direct Writer at Reader inside the action scope.
+        const capped = (0, contract_proxy_1.createContractProvider)(resolution);
+        await expect(capped(call, context)).rejects.toThrow("Permission denied: strict delegation");
+        expect(effect).not.toHaveBeenCalled();
+        // The same wrapper declared preserve passes the Writer through to a Writer target.
+        Object.assign(resolution.tools[name].tool, { authorityPropagation: "preserve" });
+        const preserving = (0, contract_proxy_1.createContractProvider)(resolution);
+        await expect(preserving(call, context)).resolves.toEqual({ writerTargetExecuted: true });
+        // An inherited Reader frame from an upstream ordinary tool is never raised.
+        await expect(preserving(call, {
+            ...context,
+            authority: {
+                userAccessLevel: 40,
+                assistantAccessLevel: 20,
+                strictActionScope: true,
+            },
+        })).rejects.toThrow("Permission denied: strict delegation");
+        expect(effect).toHaveBeenCalledTimes(1);
+    });
+});

package/dist/contracts/__tests__/generic-tool-dispatch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/contracts/__tests__/generic-tool-dispatch.test.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("../../index");
+test("host admission for an omitted preserve level is None and the declared mode is honored", async () => {
+    const userId = (0, index_1.newid)();
+    const groupId = (0, index_1.newid)();
+    const contractId = (0, index_1.newid)();
+    let role = index_1.GroupMemberRole.None;
+    const dc = {
+        dataContextId: groupId,
+        groupId,
+        tableContainer: {
+            getTable: (meta) => meta.name === "Groups"
+                ? { get: async () => ({ founderUserId: (0, index_1.newid)() }) }
+                : { findOne: async () => ({ role }) },
+        },
+    };
+    Object.assign(dc, {
+        userContext: {
+            userId,
+            loadingPromise: Promise.resolve(),
+            userDataContext: dc,
+            getDataContext: () => dc,
+        },
+    });
+    const route = {
+        tool: { toolId: (0, index_1.newid)(), name: "route", authorityPropagation: "preserve" },
+        toolFn: (name, ctx) => ctx.dispatchAction(name, {}),
+    };
+    const ordinary = {
+        tool: { toolId: (0, index_1.newid)(), name: "ordinary" },
+        toolFn: () => "ordinary",
+    };
+    const targets = Object.fromEntries([0, 20].map((level) => [
+        String(level),
+        {
+            tool: { toolId: (0, index_1.newid)(), name: String(level), accessLevel: level },
+            toolFn: () => "executed",
+        },
+    ]));
+    const provider = (0, index_1.createContractProvider)({
+        contractId,
+        version: 1,
+        tools: { route, ordinary },
+        actionAliases: { zero: "0", reader: "20" },
+        actionTools: targets,
+    });
+    const call = (name, action = "zero") => provider({
+        contractId,
+        version: 1,
+        member: "tool",
+        name,
+        operation: "run",
+        args: [action],
+        dataContextId: groupId,
+    }, { callerUserId: userId, dataContext: dc });
+    role = index_1.GroupMemberRole.None;
+    await expect(call("route")).resolves.toBe("executed");
+    await expect(call("route", "reader")).rejects.toThrow(/Permission denied/);
+    await expect(call("ordinary")).rejects.toThrow(/Permission denied/);
+    role = index_1.GroupMemberRole.Admin;
+    await expect(call("route", "reader")).resolves.toBe("executed");
+    // The same wrapper without a preserve declaration is an ordinary unclassified (Self) tool.
+    route.tool.authorityPropagation = undefined;
+    await expect(call("route", "reader")).rejects.toThrow(/Permission denied/);
+});
+test("host tool schema retains omitted admission for request-based defaults", () => {
+    const tool = index_1.toolSchema.parse({
+        toolId: (0, index_1.newid)(),
+        name: "route",
+        usageDescription: "route",
+        inputSchema: { type: "simple" },
+        outputSchema: { type: "simple" },
+        authorityPropagation: "preserve",
+    });
+    expect(tool.accessLevel).toBeUndefined();
+});
+test("generic dispatch binds a capped strict frame and rejects cross-context and remote targets", async () => {
+    const userId = (0, index_1.newid)();
+    const groupId = (0, index_1.newid)();
+    const contractId = (0, index_1.newid)();
+    const dc = {
+        dataContextId: groupId,
+        groupId,
+        tableContainer: {
+            getTable: (meta) => meta.name === "Groups"
+                ? { get: async () => ({ founderUserId: (0, index_1.newid)() }) }
+                : { findOne: async () => ({ role: index_1.GroupMemberRole.Admin }) },
+        },
+    };
+    Object.assign(dc, {
+        userContext: {
+            userId,
+            loadingPromise: Promise.resolve(),
+            userDataContext: dc,
+            getDataContext: () => dc,
+        },
+    });
+    const selected = {
+        contractId: (0, index_1.newid)(),
+        version: 1,
+        toolName: "write",
+        providerPackageId: (0, index_1.newid)(),
+    };
+    const bridge = jest.fn(async (_ref, _args, context) => {
+        expect(context.authority).toMatchObject({
+            userId,
+            assistantAccessLevel: 20,
+            strictActionScope: true,
+        });
+        return "routed";
+    });
+    const router = {
+        tool: { name: "route", toolId: (0, index_1.newid)(), accessLevel: 20 },
+        toolFn: (args, ctx) => ctx.dispatchTool(args, {}),
+    };
+    const dispatch = (0, index_1.createContractProvider)({ contractId, version: 1, forwardCallContext: true, tools: { route: router } }, { dispatchTool: bridge });
+    const call = (ref) => dispatch({
+        contractId,
+        version: 1,
+        member: "tool",
+        name: "route",
+        operation: "run",
+        args: [ref],
+        dataContextId: groupId,
+    }, { callerUserId: userId, dataContext: dc });
+    await expect(call(selected)).resolves.toBe("routed");
+    await expect(call({ ...selected, dataContextId: (0, index_1.newid)() })).rejects.toThrow("Cross-context");
+    await expect(call({ ...selected, targetDeviceId: (0, index_1.newid)() })).rejects.toThrow("cannot target another device");
+    expect(bridge).toHaveBeenCalledTimes(1);
+});
+test("host catalogs use declared preservation for an omitted target admission level", async () => {
+    const { authorizedContractActionNames } = await Promise.resolve().then(() => require("../../index"));
+    const userId = (0, index_1.newid)();
+    const groupId = (0, index_1.newid)();
+    const contractId = (0, index_1.newid)();
+    const dc = {
+        dataContextId: groupId,
+        groupId,
+        tableContainer: {
+            getTable: (meta) => meta.name === "Groups"
+                ? { get: async () => ({ founderUserId: (0, index_1.newid)() }) }
+                : { findOne: async () => ({ role: index_1.GroupMemberRole.Reader }) },
+        },
+    };
+    Object.assign(dc, {
+        userContext: {
+            userId,
+            loadingPromise: Promise.resolve(),
+            userDataContext: dc,
+            getDataContext: () => dc,
+        },
+    });
+    const zero = {
+        tool: { name: "zero", toolId: (0, index_1.newid)(), authorityPropagation: "preserve" },
+        toolFn: () => "executed",
+    };
+    const route = {
+        tool: { name: "route", toolId: (0, index_1.newid)(), accessLevel: 20, authorityPropagation: "preserve" },
+        toolFn: (_, ctx) => ctx.dispatchAction("none", {}),
+    };
+    const resolution = {
+        contractId,
+        version: 1,
+        tools: { route, zero },
+        actionAliases: { none: "zero" },
+        actionTools: { zero },
+    };
+    const context = { callerUserId: userId, dataContext: dc };
+    expect(await authorizedContractActionNames(resolution, context)).toEqual(["none"]);
+    const provider = (0, index_1.createContractProvider)(resolution);
+    await expect(provider({ contractId, version: 1, member: "tool", name: "route", operation: "run", args: [{}] }, context)).resolves.toBe("executed");
+});

package/dist/contracts/action-dispatch.d.ts

@@ -0,0 +1,12 @@
+import type { IIsolatedCallPrincipal } from "../package-loader/isolated-runtime";
+import type { IContractToolTarget } from "./contract-proxy";
+/** Declared outgoing authority mode for a tool; honored like a declared access level. */
+export type AuthorityPropagation = "cap" | "preserve";
+/** Resolve omitted admission from the declared propagation mode: None for `preserve`, Self otherwise. */
+export declare function dispatchAdmissionLevel(level: number | undefined, requested?: AuthorityPropagation): number;
+/** Apply the shared dispatch decision to a host-resolved role and effective target level. */
+export declare function authorizeToolDispatch(principal: IIsolatedCallPrincipal, toolAccessLevel: number, mode: AuthorityPropagation, strict: boolean): IIsolatedCallPrincipal;
+/** Narrow a trusted call frame at an edge; ordinary-tool capping applies only in the action scope. */
+export declare function narrowActionPrincipal(principal: IIsolatedCallPrincipal, strictActionScope: boolean, consumeCeiling?: number): IIsolatedCallPrincipal;
+/** Invoke a selected package tool over the signed-in UI host transport. */
+export declare function invokeHostTool(target: IContractToolTarget, args: unknown): Promise<any>;

package/dist/contracts/action-dispatch.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dispatchAdmissionLevel = dispatchAdmissionLevel;
+exports.authorizeToolDispatch = authorizeToolDispatch;
+exports.narrowActionPrincipal = narrowActionPrincipal;
+exports.invokeHostTool = invokeHostTool;
+const tool_access_1 = require("../data/tool-access");
+const contract_proxy_1 = require("./contract-proxy");
+const host_contract_transport_1 = require("./host-contract-transport");
+/** Resolve omitted admission from the declared propagation mode: None for `preserve`, Self otherwise. */
+function dispatchAdmissionLevel(level, requested = "cap") {
+    return (0, tool_access_1.recordAccessLevel)({ accessLevel: level, authorityPropagation: requested });
+}
+/** Apply the shared dispatch decision to a host-resolved role and effective target level. */
+function authorizeToolDispatch(principal, toolAccessLevel, mode, strict) {
+    const incoming = strict ? narrowActionPrincipal(principal, true) : principal;
+    const decision = (0, tool_access_1.decideToolAccess)({
+        userAccessLevel: incoming.userAccessLevel,
+        assistantAccessLevel: strict ? incoming.assistantAccessLevel : undefined,
+        toolAccessLevel,
+    });
+    if (decision.kind !== "allow")
+        throw new Error(`Permission denied: ${decision.kind === "approval_required" ? "strict delegation. " : ""}${decision.reason}`);
+    return {
+        ...incoming,
+        strictActionScope: strict,
+        callingToolAccessLevel: toolAccessLevel,
+        authorityPropagation: mode,
+    };
+}
+/** Narrow a trusted call frame at an edge; ordinary-tool capping applies only in the action scope. */
+function narrowActionPrincipal(principal, strictActionScope, consumeCeiling = 100) {
+    const levels = [
+        principal.userAccessLevel,
+        principal.assistantAccessLevel ?? principal.userAccessLevel,
+        consumeCeiling,
+    ];
+    if (strictActionScope &&
+        principal.authorityPropagation !== "preserve" &&
+        principal.callingToolAccessLevel !== undefined) {
+        levels.push(principal.callingToolAccessLevel);
+    }
+    return { ...principal, strictActionScope, assistantAccessLevel: Math.min(...levels) };
+}
+/** Invoke a selected package tool over the signed-in UI host transport. */
+async function invokeHostTool(target, args) {
+    if (target.targetDeviceId)
+        throw new Error("Strict delegated calls cannot target another device until authority transport is supported");
+    const transport = await (0, host_contract_transport_1.waitForHostContractTransport)({ timeoutMs: 10_000 });
+    const consumer = (0, contract_proxy_1.createContractConsumer)({
+        contractId: target.contractId,
+        version: target.version,
+        name: "Runtime Tool",
+        description: "Checked package tool",
+        tables: [],
+        observables: [],
+        events: [],
+        tools: [
+            {
+                name: target.toolName,
+                usageDescription: "Invoke a tool",
+                inputFields: [],
+                outputFields: [],
+            },
+        ],
+    }, transport, { providerPackageId: target.providerPackageId, dataContextId: target.dataContextId });
+    try {
+        return await consumer.tools[target.toolName](args);
+    }
+    finally {
+        consumer.dispose();
+    }
+}

package/dist/contracts/contract-provider-router.js

@@ -116,7 +116,13 @@ function createContractProviderRouter(transport, opts) {
             if (disposed) {
                 throw new Error("Contract provider router is disposed");
             }
-            const context = authorization.context ?? inboundContext;
+            const context = {
+                ...(authorization.context ?? inboundContext),
+                authority: inboundContext.authority,
+            };
+            if (targetDeviceId && context.authority?.strictActionScope) {
+                throw new Error("Strict delegated calls cannot target another device until authority transport is supported");
+            }
             const routedCall = {
                 ...call,
                 dataContextId: authorization.dataContextId,