@sema-agent/core 7.8.0 → 7.9.0

package/dist/core/permission-rule-provider.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure } from "./permission-rule-model.js";
-import { PERMISSION_RULE_WRITER, errText, normalizePersistedRule, sameScope, writerOf, } from "./permission-rule-store.js";
+import { PERMISSION_RULE_WRITER, errText, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
 import { UNGOVERNED_ORG_RESOLUTION, compileOrgShadowPredicate, createOrgRulePartition } from "./permission-rule-org.js";
 export function ruleSourceOf(scope) {
     return scope.kind === "global" ? "user" : scope.kind;
@@ -61,6 +61,9 @@ class UnifiedPermissionRuleStore {
             this.readSessionRows(usableSessionId(query?.sessionId), disclosures),
         ]);
         const orgResolution = orgSettled;
+        if ("unreadable" in sessionRows) {
+            return { rules: [], removed: [], org: orgResolution, rev: 0, disclosures, unreadable: sessionRows.unreadable };
+        }
         if (!durableSettled.ok) {
             return { rules: [], removed: [], org: orgResolution, rev: 0, disclosures, unreadable: errText(durableSettled.e) };
         }
@@ -68,17 +71,17 @@ class UnifiedPermissionRuleStore {
         const shadowed = compileOrgShadowPredicate(orgResolution.rules);
         const rules = [];
         for (const r of [...sessionRows, ...durableRead.rules]) {
-            rules.push({ ...r, source: ruleSourceOf(r.scope), status: shadowed(r) ? "shadowed-by-org" : "live" });
+            rules.push({ ...r, source: ruleSourceOf(r.scope), status: r.behavior === "allow" && shadowed(r) ? "shadowed-by-org" : "live" });
         }
         const removed = [];
         for (const t of durableRead.tombstones) {
-            if (durableRead.rules.some((r) => r.rule === t.rule && sameScope(r.scope, t.scope)))
+            if (durableRead.rules.some((r) => sameRuleIdentity(r, t)))
                 continue;
-            if (removed.some((e) => e.rule === t.rule && sameScope(e.scope, t.scope)))
+            if (removed.some((e) => sameRuleIdentity(e, t)))
                 continue;
             if (t.scope.kind === "session")
                 continue;
-            removed.push({ rule: t.rule, scope: t.scope, source: ruleSourceOf(t.scope), status: "removed" });
+            removed.push({ behavior: t.behavior, rule: t.rule, scope: t.scope, source: ruleSourceOf(t.scope), status: "removed" });
         }
         return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures };
     }
@@ -97,8 +100,9 @@ class UnifiedPermissionRuleStore {
             return rows;
         }
         catch (err) {
-            disclosures.push(`the session rule partition could not be read: ${escapeForDisclosure(errText(err))}`);
-            return [];
+            const why = `the session rule partition could not be read: ${escapeForDisclosure(errText(err))}`;
+            disclosures.push(why);
+            return { unreadable: why };
         }
     }
 }
@@ -115,7 +119,7 @@ function routingWriter(durable, session) {
                 e.code = "unsupported.session_scope_store";
                 throw e;
             }
-            const outcome = await session.apply(scope.sessionId, { rule: delta.rule, tool: delta.tool, match: delta.match, command: delta.command, add: delta.add });
+            const outcome = await session.apply(scope.sessionId, { behavior: delta.behavior, rule: delta.rule, tool: delta.tool, match: delta.match, command: delta.command, add: delta.add });
             return "refused" in outcome ? { refused: "session_ended", rev: opts.expectedRev } : { rev: opts.expectedRev };
         },
     };

package/dist/core/permission-rule-session.d.ts

@@ -3,7 +3,7 @@
  * `{kind:"session"}` scoped allow rule lives.
  *
  * A session authorization's home is the session's own lifetime — never the durable CRDT partition. The
- * rows are ordinary {@link PersistedAllowRule}s (scope `session`), and the unified store's ONE read
+ * rows are ordinary {@link PersistedRule}s (scope `session`), and the unified store's ONE read
  * query (`PermissionRuleStore.effective({ sessionId })`) splices this partition's rows IN FRONT of the
  * durable partition's (the §4.1 narrowest-first reporting order: session > project > global), so every
  * read-side consumer — the gate's conjunction arm, the coverage table, the consent prepare — takes them
@@ -40,12 +40,13 @@
  * (`permission-rule-store.ts`, the durable two-member face); this module is the OTHER side of that
  * wall, and the wall is the design.
  */
-import type { PersistedAllowRule, RuleAdd, PersistedRuleMatch, PersistedRuleTool } from "./permission-rule-model.js";
+import type { PersistedRule, RuleAdd, RuleBehavior, PersistedRuleMatch, PersistedRuleTool } from "./permission-rule-model.js";
 /** One redeemed authorization landing in a session's overlay: the rule's canonical shape plus the
  *  redemption's own add (dot + provenance) — the same fields a `redemption-add` delta carries, minus
  *  the scope (the verb's `sessionId` IS the scope, constructed here so a caller cannot land a row
  *  whose scope names a different session than the one it addressed). */
 export interface SessionRuleAdd {
+    behavior: RuleBehavior;
     rule: string;
     tool: PersistedRuleTool;
     match: PersistedRuleMatch;
@@ -68,7 +69,7 @@ export type SessionRuleApplyResult = {
  */
 export interface SessionRulePartition {
     /** The live session-scoped rows of ONE session. An ended (or never-written) session reads as `[]`. */
-    read(sessionId: string): Promise<readonly PersistedAllowRule[]>;
+    read(sessionId: string): Promise<readonly PersistedRule[]>;
     /** Land one redeemed authorization — idempotent by dot, refused once the session ended. */
     apply(sessionId: string, add: SessionRuleAdd): Promise<SessionRuleApplyResult>;
 }
@@ -99,7 +100,7 @@ export declare class InMemorySessionRulePartition implements SessionRulePartitio
      *  termination; read across `restoreSession`'s snapshot. */
     private readonly epochs;
     private bumpEpoch;
-    read(sessionId: string): Promise<readonly PersistedAllowRule[]>;
+    read(sessionId: string): Promise<readonly PersistedRule[]>;
     apply(sessionId: string, add: SessionRuleAdd): Promise<SessionRuleApplyResult>;
     /**
      * The termination transfer: SEAL the lifetime epoch first (one atomic membership flip — after this
@@ -109,7 +110,7 @@ export declare class InMemorySessionRulePartition implements SessionRulePartitio
      */
     endSession(sessionId: string): void;
     /** The park half of the checkpoint carriage: this session's rows, serializable as-is. */
-    snapshotSession(sessionId: string): Promise<readonly PersistedAllowRule[]>;
+    snapshotSession(sessionId: string): Promise<readonly PersistedRule[]>;
     /**
      * The resume half. Fail-closed on every axis: a sealed session never rehydrates (termination is
      * one-way), and every row must be a well-formed SESSION row of exactly this session — anything else
@@ -124,5 +125,5 @@ export declare class InMemorySessionRulePartition implements SessionRulePartitio
      * so the two doors agree on what a session row is and a snapshot of this overlay always restores —
      * which is what makes a refusal here foreign damage, refused whole.
      */
-    restoreSession(sessionId: string, rows: readonly PersistedAllowRule[]): Promise<void>;
+    restoreSession(sessionId: string, rows: readonly PersistedRule[]): Promise<void>;
 }

package/dist/core/permission-rule-session.js

@@ -1,3 +1,4 @@
+import { readRowBehavior } from "./permission-rule-model.js";
 import { isValidConsentScope, normalizePersistedRule } from "./permission-rule-store.js";
 function isValidOverlayAdd(add) {
     const a = add;
@@ -30,7 +31,7 @@ export class InMemorySessionRulePartition {
         if (!isValidConsentScope(scope)) {
             throw new Error("SessionRulePartition.apply was addressed with an unusable session id — a session nobody can name is not a scope a grant can live under");
         }
-        const projected = { rule: add.rule, tool: add.tool, match: add.match, command: add.command, scope, adds: [add.add] };
+        const projected = { behavior: add.behavior, rule: add.rule, tool: add.tool, match: add.match, command: add.command, scope, adds: [add.add] };
         if ("reject" in normalizePersistedRule(projected)) {
             throw new Error("SessionRulePartition.apply was handed a row whose text/metadata do not survive the canonical re-projection — a row the engine cannot re-project can never adjudicate, and would refuse its own restore");
         }
@@ -40,13 +41,13 @@ export class InMemorySessionRulePartition {
         const sameDotAs = (a) => a.dot.actor === add.add.dot.actor && a.dot.counter === add.add.dot.counter;
         for (const [heldSession, heldRows] of this.rows) {
             const holder = heldRows.find((r) => r.adds.some(sameDotAs));
-            if (holder !== undefined && (heldSession !== sessionId || holder.rule !== add.rule)) {
-                throw new Error(`SessionRulePartition.apply: dot ${add.add.dot.actor}#${add.add.dot.counter} already vouches for another grant — a dot identifies one add of one (rule, session), ever`);
+            if (holder !== undefined && (heldSession !== sessionId || holder.rule !== add.rule || holder.behavior !== add.behavior)) {
+                throw new Error(`SessionRulePartition.apply: dot ${add.add.dot.actor}#${add.add.dot.counter} already vouches for another grant — a dot identifies one add of one (behavior, rule, session), ever`);
             }
         }
-        const existing = rows.find((r) => r.rule === add.rule);
+        const existing = rows.find((r) => r.rule === add.rule && r.behavior === add.behavior);
         if (existing === undefined) {
-            rows.push({ rule: add.rule, tool: add.tool, match: add.match, command: add.command, scope, adds: [structuredClone(add.add)] });
+            rows.push({ behavior: add.behavior, rule: add.rule, tool: add.tool, match: add.match, command: add.command, scope, adds: [structuredClone(add.add)] });
             this.bumpEpoch(sessionId);
             return { landed: true };
         }
@@ -77,6 +78,9 @@ export class InMemorySessionRulePartition {
             throw new Error(`restoreSession("${sessionId}") raced a landing on the same session — refusing the whole restore (this door replaces the session's rows, and a grant that already answered landed must not be erased by a resume)`);
         }
         for (const r of rows) {
+            const behavior = readRowBehavior(r?.behavior);
+            if (behavior !== undefined && r !== null && typeof r === "object")
+                r.behavior = behavior;
             const scope = r?.scope;
             if (scope?.kind !== "session" || scope.sessionId !== sessionId || !isValidConsentScope(scope)) {
                 throw new Error(`restoreSession("${sessionId}") was handed a row that is not a session row of that session — refusing the whole restore (a foreign-scope row through this door would reach adjudication)`);
@@ -85,10 +89,11 @@ export class InMemorySessionRulePartition {
                 throw new Error(`restoreSession("${sessionId}") was handed a row whose text/metadata do not survive the canonical re-projection — refusing the whole restore (a row the engine cannot re-project must not reach adjudication)`);
             }
         }
+        const identityOf = (r) => `${r.behavior}|${r.rule}`;
         const ownDotRule = new Map();
         for (const held of this.rows.get(sessionId) ?? []) {
             for (const h of held.adds)
-                ownDotRule.set(`${h.dot.actor}#${h.dot.counter}`, held.rule);
+                ownDotRule.set(`${h.dot.actor}#${h.dot.counter}`, identityOf(held));
         }
         const seenDots = new Map();
         for (const r of rows) {
@@ -98,12 +103,12 @@ export class InMemorySessionRulePartition {
             for (const a of r.adds) {
                 const key = `${a.dot.actor}#${a.dot.counter}`;
                 const holder = seenDots.get(key);
-                if (holder !== undefined && holder !== r.rule) {
+                if (holder !== undefined && holder !== identityOf(r)) {
                     throw new Error(`restoreSession("${sessionId}"): dot ${key} vouches for two different rules — refusing the whole restore`);
                 }
-                seenDots.set(key, r.rule);
+                seenDots.set(key, identityOf(r));
                 const ownHolder = ownDotRule.get(key);
-                if (ownHolder !== undefined && ownHolder !== r.rule) {
+                if (ownHolder !== undefined && ownHolder !== identityOf(r)) {
                     throw new Error(`restoreSession("${sessionId}"): dot ${key} is live in this session under a different rule — a restore may replay a grant, never reassign its dot; refusing the whole restore`);
                 }
                 for (const [heldSession, heldRows] of this.rows) {
@@ -115,7 +120,21 @@ export class InMemorySessionRulePartition {
                 }
             }
         }
-        this.rows.set(sessionId, rows);
+        const restoredDots = new Set(rows.flatMap((r) => r.adds.map((a) => `${a.dot.actor}#${a.dot.counter}`)));
+        const carried = [];
+        for (const held of this.rows.get(sessionId) ?? []) {
+            if (held.behavior === "allow")
+                continue;
+            const adds = held.adds.filter((a) => !restoredDots.has(`${a.dot.actor}#${a.dot.counter}`));
+            if (adds.length === 0)
+                continue;
+            const same = rows.find((r) => r.behavior === held.behavior && r.rule === held.rule);
+            if (same !== undefined)
+                same.adds.push(...structuredClone(adds));
+            else
+                carried.push({ ...structuredClone(held), adds: structuredClone(adds) });
+        }
+        this.rows.set(sessionId, [...rows, ...carried]);
         this.bumpEpoch(sessionId);
     }
 }

package/dist/core/permission-rule-store.d.ts

@@ -41,13 +41,14 @@
  * restart is a NEW delete intent (a new observation, a new tombstone) — which is the correct reading of a
  * person pressing delete a second time.
  */
-import type { PersistedAllowRule, RuleAdd, RuleDot, RuleScope, RuleTombstone } from "./permission-rule-model.js";
+import type { PersistedRule, RuleAdd, RuleDot, RuleScope, RuleTombstone } from "./permission-rule-model.js";
+import { type RuleBehavior } from "./permission-rule-model.js";
 import type { RuleSyncDropReason, RuleQuarantineReason } from "./governance-codes.js";
 import type { StoreDurability, StoreFidelity } from "./checkpoint-store.js";
 /** One store read: the rules as persisted, their tombstones, and the revision they were read at. */
-export interface StoredAllowRules {
+export interface StoredRules {
     /** Rules with their FULL add sets — tombstoned dots already removed by the backend on read. */
-    rules: PersistedAllowRule[];
+    rules: PersistedRule[];
     tombstones: RuleTombstone[];
     /** Monotonic revision of this store, for optimistic concurrency on every write. */
     rev: number;
@@ -64,7 +65,7 @@ export interface StoredAllowRules {
  * more than they allow; only one of them is honest about why.
  */
 export interface DurableRulePartition {
-    list(): Promise<StoredAllowRules>;
+    list(): Promise<StoredRules>;
     /**
      * design/182 §5.2/§8.3 — the quarantine area, for introspection. Rows a sync round moved out of the
      * live view (fence arm, server rejection, validator rejection): bytes kept, never silently deleted,
@@ -139,10 +140,12 @@ export interface RedemptionAuthorization {
 /** The add half of the write union: one redeemed approval becoming one dot on one (rule, scope). */
 export interface RuleAddDelta {
     kind: "redemption-add";
+    /** The identity's behavior member (a redemption lands one dot on one (behavior, text, scope)). */
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
-    tool: PersistedAllowRule["tool"];
-    match: PersistedAllowRule["match"];
+    tool: PersistedRule["tool"];
+    match: PersistedRule["match"];
     command: string;
     add: RuleAdd;
     redemption: RedemptionAuthorization;
@@ -176,6 +179,7 @@ export interface RuleSyncJoinDelta {
      * disclosed — they can re-enter only through a NEW consent (a new ask, a new record, a new dot).
      */
     quarantine?: Array<{
+        behavior: RuleBehavior;
         rule: string;
         scope: RuleScope;
         dots: RuleDot[];
@@ -222,7 +226,7 @@ export interface RawRuleSyncState {
     /** The highest counter this replica has minted — the own-actor forgery fence's local truth. */
     counter: number;
     rev: number;
-    rules: PersistedAllowRule[];
+    rules: PersistedRule[];
     tombstones: RuleTombstone[];
     /** The persisted observation vector (absent = never completed a clean round). */
     observedVector?: RuleSyncFrontier;
@@ -244,18 +248,30 @@ export declare function writerOf(store: DurableRulePartition | import("./permiss
 /** Do two scopes name the same place? Three members (design/382 §4.1): global, project-by-root,
  *  session-by-sessionId. */
 export declare function sameScope(a: RuleScope, b: RuleScope): boolean;
+/** Do two rows/tombstones/quarantine rows name the SAME logical rule — the (behavior, text, scope)
+ *  triple? Every identity comparison in this module goes through this one predicate: a comparison
+ *  that forgot the behavior member would let a delete aimed at an allow take the same-text deny. */
+export declare function sameRuleIdentity(a: {
+    behavior: RuleBehavior;
+    rule: string;
+    scope: RuleScope;
+}, b: {
+    behavior: RuleBehavior;
+    rule: string;
+    scope: RuleScope;
+}): boolean;
 /**
  * Apply tombstones to a raw persisted set: an add survives iff its dot appears in no tombstone for the
- * same (rule, scope). The criterion is dot IDENTITY — single dots across replicas carry no order to
+ * same (behavior, rule, scope). The criterion is dot IDENTITY — single dots across replicas carry no order to
  * compare — and an add the deleting replica never observed survives (add-wins), because behind every add
  * there is one real human approval.
  */
-export declare function applyTombstones(rules: readonly PersistedAllowRule[], tombstones: readonly RuleTombstone[]): PersistedAllowRule[];
+export declare function applyTombstones(rules: readonly PersistedRule[], tombstones: readonly RuleTombstone[]): PersistedRule[];
 /** Fold one delta into a raw rule set, returning the new set. Pure — the backends share it so the file and
  *  in-memory forms cannot drift in what a delta MEANS. */
-export declare function foldDelta(rules: readonly PersistedAllowRule[], delta: RuleAddDelta): PersistedAllowRule[];
+export declare function foldDelta(rules: readonly PersistedRule[], delta: RuleAddDelta): PersistedRule[];
 /** Every add dot present in a rule set. */
-export declare function addDotsOf(rules: readonly PersistedAllowRule[]): RuleDot[];
+export declare function addDotsOf(rules: readonly PersistedRule[]): RuleDot[];
 /**
  * The runtime half of the delete-arm authorization, shared by every backend so the two cannot drift on
  * what a delta MEANS.
@@ -299,7 +315,7 @@ export declare function assertWriteDeltaScopeDurable(delta: RuleAddDelta | RuleD
  * `permissionRuleSyncContract` against its own reimplementation).
  */
 export interface RuleSyncState {
-    rules: PersistedAllowRule[];
+    rules: PersistedRule[];
     tombstones: RuleTombstone[];
 }
 /**
@@ -319,6 +335,7 @@ export type RuleSyncFrontier = Record<string, number>;
  *  as a JSON blob; `rule`/`scope`/`reason`/`atMs` are query axes and belong in structured columns
  *  (`at_ms` on the SQL side). */
 export interface QuarantinedRuleAdd {
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
     add: RuleAdd;
@@ -328,6 +345,7 @@ export interface QuarantinedRuleAdd {
 /** One dropped/quarantined disclosure line. `reason` is a closed, typed code (RULE_SYNC_DROP_CODES in
  *  governance-codes.ts) — "silently dropped" must be machine-checkable, so free text is not a member. */
 export interface RuleSyncDrop {
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
     dot: RuleDot;
@@ -384,8 +402,8 @@ export declare function joinFrontiers(a: RuleSyncFrontier, b: RuleSyncFrontier):
  * would break the join's commutativity, and "take the wider" would widen a matching surface nobody
  * approved. Returns the normalized record or the refusal reason.
  */
-export declare function normalizePersistedRule(r: PersistedAllowRule): {
-    rule: PersistedAllowRule;
+export declare function normalizePersistedRule(r: PersistedRule): {
+    rule: PersistedRule;
 } | {
     reject: Extract<RuleSyncDropReason, "invalid_rule_text" | "metadata_mismatch">;
 };
@@ -413,10 +431,10 @@ export declare function screenRuleSyncState(state: RuleSyncState): {
  * (a join only ever unions, it never deletes). The output is CANONICALLY ORDERED so equal states are
  * deep-equal, which is what lets the contract suite assert the three laws structurally.
  *
- * - rules: grouped by (rule, scope); a group's adds are the dot-identity union (provenance rides each
+ * - rules: grouped by (behavior, rule, scope); a group's adds are the dot-identity union (provenance rides each
  *   add; two payloads under ONE dot — unreachable in a healthy protocol — resolve by canonical-json
  *   byte order, determinism only, detection belongs to the screening layer);
- * - tombstones: grouped by (rule, scope, deletedBy); same identity with differing `removedDots` takes
+ * - tombstones: grouped by (behavior, rule, scope, deletedBy); same identity with differing `removedDots` takes
  *   the UNION (any one-sided pick breaks commutativity and can drop an observed removal — the union is
  *   the only convergent answer, and it only ever tightens);
  * - both inputs pass {@link screenRuleSyncState} first (refused records are dropped deterministically;
@@ -437,7 +455,7 @@ export declare function collectBelowFrontier(state: RuleSyncState, frontier: Rul
 export interface RuleSyncJoinBase {
     actor: string;
     counter: number;
-    rules: PersistedAllowRule[];
+    rules: PersistedRule[];
     tombstones: RuleTombstone[];
     quarantined: QuarantinedRuleAdd[];
     observedVector?: RuleSyncFrontier;
@@ -513,6 +531,10 @@ export type RemoveResult =
  * does not.
  */
 export declare function removePersistedRule(opts: {
+    /** The identity's behavior member — `removePersistedRule({ behavior: "allow", … })` for a standing
+     *  approval, `"deny"`/`"ask"` for a standing refusal/question. Required: the same text can stand in
+     *  more than one behavior, and a removal that named only the text would delete one nobody asked about. */
+    behavior: RuleBehavior;
     rule: string;
     scope: RuleScope;
     /** Whose bucket. A bare string stays the principal shorthand (unchanged callers); the structural
@@ -541,7 +563,7 @@ export declare class InMemoryDurableRulePartition implements WritableDurableRule
     private rev;
     private counter;
     constructor(actor?: string, now?: () => number);
-    list(): Promise<StoredAllowRules>;
+    list(): Promise<StoredRules>;
     quarantined(): Promise<QuarantinedRuleAdd[]>;
     readonly [PERMISSION_RULE_WRITER]: PermissionRuleWriter;
 }