@sema-agent/server 7.132.0 → 7.134.0

package/dist/http/routes/fleet.js

@@ -2,12 +2,11 @@ import { hookNoticeWire } from "../../fleet/fleet-bus.js";
 import { FLEET_SNAPSHOT_TERMINAL_MAX_ROWS, isTerminalWorkflowRowStatus, recentTerminalWorkflowRows } from "../../fleet/fleet-terminal-window.js";
 import { taskNotificationFoldKey } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { fleetViewOf, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
     const { deps } = ctx;
-    const { sessionOwnerScope } = ctx.helpers;
     switch (match.decl.id) {
         case "fleet-stream": {
             const fleet = facts.fleetStream(deps);
@@ -15,7 +14,7 @@ export async function handleFleet(req, res, match, ctx) {
                 sendError(res, 501, "capability.self_orchestration_required", "fleet stream requires self-orchestration / fleet wiring");
                 return;
             }
-            const { fleetWide } = sessionOwnerScope(req);
+            const { fleetWide } = fleetViewOf(req, deps, "read");
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && !principal && !fleetWide) {
                 sendPrincipalRefusal(res, req, deps.config);
@@ -77,7 +76,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             return rest;
         };
         const SCOPED_WORKFLOW_KEY_DISPOSITION = {
-            id: "keep", status: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
+            id: "keep", status: "keep", errorCode: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
             startedCount: "keep", elapsedMs: "keep", tokens: "keep",
             name: "rewrite", scope: "strip", sessionId: "strip",
             description: "scrub",
@@ -90,6 +89,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                     id: rest.id,
                     status: rest.status,
                     name: "(unattributed)",
+                    ...(rest.errorCode !== undefined ? { errorCode: rest.errorCode } : {}),
                     ...(rest.doneCount !== undefined ? { doneCount: rest.doneCount } : {}),
                     ...(rest.totalCount !== undefined ? { totalCount: rest.totalCount } : {}),
                     ...(rest.failedCount !== undefined ? { failedCount: rest.failedCount } : {}),

package/dist/http/routes/images.js

@@ -49,8 +49,7 @@ export async function handleImages(req, res, match, ctx) {
         const bakes = deps.imageBakes;
         const idx = deps.imageIndex;
         const principal = gatedPrincipal(req, deps.config);
-        const operators = deps.config.operatorPrincipals;
-        const isExplicitOperator = explicitOperatorOk(principal, operators);
+        const isExplicitOperator = explicitOperatorOk(principal, deps.config);
         const operatorLane = facts.operatorLane(deps);
         const cfg = deps.config.imageBakes;
         const isRunner = source !== undefined && source !== null && source === cfg.runnerPrincipal;
@@ -239,12 +238,12 @@ export async function handleImages(req, res, match, ctx) {
             if (line.event === "heartbeat") {
                 const fresh = await bakes.getBake(bakeId);
                 if (!fresh || fresh.status !== "running") {
-                    sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false, errorCode: "conflict.bake_not_running" });
+                    sendError(res, 409, "conflict.bake_not_running", "bake is not running", { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
                     return;
                 }
                 const ok = bake.runnerId ? await bakes.heartbeatLease(bakeId, bake.runnerId, cfg.leaseMs) : false;
                 if (!ok) {
-                    sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh.cancelRequested, errorCode: "conflict.bake_lease_lost" });
+                    sendError(res, 409, "conflict.bake_lease_lost", "bake lease lost", { accepted: false, leaseValid: false, cancelRequested: fresh.cancelRequested });
                     return;
                 }
                 sendJson(res, 200, { accepted: true, leaseValid: true, cancelRequested: fresh.cancelRequested });
@@ -252,7 +251,7 @@ export async function handleImages(req, res, match, ctx) {
             }
             const fresh = await bakes.getBake(bakeId);
             if (!fresh || fresh.status !== "running") {
-                sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false, errorCode: "conflict.bake_not_running" });
+                sendError(res, 409, "conflict.bake_not_running", "bake is not running", { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
                 return;
             }
             if (fresh.runnerId) {
@@ -291,7 +290,7 @@ export async function handleImages(req, res, match, ctx) {
     if (pool.available && isIndexRouteId(match.decl.id)) {
         const idx = pool.imageIndex;
         const principal = gatedPrincipal(req, deps.config);
-        const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+        const operator = explicitOperatorOk(principal, deps.config);
         const viewer = { operator, tenantId: principal ?? null };
         const q = new URLSearchParams(match.search);
         if (match.decl.id === "images-index") {
@@ -345,7 +344,7 @@ export async function handleImages(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            if (!explicitOperatorOk(principal, deps.config)) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }

package/dist/http/routes/leader.js

@@ -30,14 +30,7 @@ export async function handleLeader(req, res, match, ctx) {
     if (match.decl.id === "leader-submit") {
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
             return;
-        let body;
-        try {
-            body = await readJson(req);
-        }
-        catch {
-            sendError(res, 400, "request.invalid_json", "invalid JSON body");
-            return;
-        }
+        const body = await readJson(req);
         const laneRefusal = leaderEntryRefusal(leaderRunEntry(deps.config.autonomy));
         if (laneRefusal !== undefined) {
             sendError(res, 422, "request.autonomy_lane_refused", laneRefusal);

package/dist/http/routes/mcp-reconnect.d.ts

@@ -34,7 +34,7 @@
  * 404 无 oracle,与 `POST /v1/sessions/:id/notify` 逐字同形)→ `getActiveTaskId` 取本会话的活 run →
  * `steerableRuns` 取本副本活流。非 live 的四臂一码 409 `steering.not_running`,判据取词表属主
  * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
- * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
+ * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;「谁是 operator」的唯一读法 `explicitOperatorOk`)。
  *
  * ── 应答期限(S-431)────────────────────────────────────────────────────────────────────────────
  * 修前这一口对 `live.reconnectMcpServer(server)` 是裸 `await`:server 侧没有期限,上界只来自 core 自己的启动期钟

package/dist/http/routes/mcp-reconnect.js

@@ -7,6 +7,7 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../pri
 import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { sessionOwnerCellOf } from "../../security.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 const NEUTRALIZED_TEXT_MAX = 200;
 const humanText = (s) => redactSecrets(s).slice(0, NEUTRALIZED_TEXT_MAX);
@@ -93,8 +94,8 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
+            const operator = explicitOperatorOk(principal, deps.config);
+            if (!operator && !ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(sessionStorage, sessionId, owner)))
                 return;
             const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);

package/dist/http/routes/memory-bundle.js

@@ -73,7 +73,7 @@ export async function handleMemoryBundle(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory governance bundles are an operator-only deployment action");
         return;
     }

package/dist/http/routes/memory-compliance.js

@@ -29,7 +29,7 @@ export async function handleMemoryCompliance(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory provenance and erasure are operator-only deployment actions");
         return;
     }

package/dist/http/routes/memory-consolidation.js

@@ -92,7 +92,7 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
         }
     }
     const faces = fact.valve;
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory consolidation is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
+        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/memory-origin.js

@@ -122,7 +122,7 @@ export async function handleMemoryOrigin(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", "memory origin marking and clearance are operator-only deployment actions");
         return;
     }

package/dist/http/routes/memory-policy.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— memory 导出/同步 + 只读策略面。
  *
  * 路由:`GET /v1/memory/export`、`POST /v1/memory/sync/:scope`、`GET /v1/policy`。
- * owner 门 = 「本人 user scope / 显式 operator / `org:` 键的目录成员」(见 {@link gateMemoryScope}),
+ * owner 门 = 「本人 user scope / 本人的项目层 / 显式 operator / `org:` 键的目录成员」(见 {@link gateMemoryScope}),
  * 越界一律 404(零存在性 oracle)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";

package/dist/http/routes/memory-policy.js

@@ -2,6 +2,7 @@ import { formatUserScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
 import { sendJson, sendError } from "../send.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
+import { parseProjectLayerKey } from "../../project-layer-key.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 const ORG_PREFIX = "org:";
@@ -33,9 +34,9 @@ function directoryDecidesThisFace(mode) {
     }
 }
 async function gateMemoryScope(deps, principal, scope, need) {
-    if (scope === formatUserScope(principal))
+    if (scope === formatUserScope(principal) || parseProjectLayerKey(scope)?.owner === principal)
         return { kind: "allow" };
-    if (explicitOperatorOk(principal, deps.config.operatorPrincipals))
+    if (explicitOperatorOk(principal, deps.config))
         return { kind: "allow" };
     const directory = deps.orgMemoryDirectory;
     if (!scope.startsWith(ORG_PREFIX) || directory === undefined || !directoryDecidesThisFace(deps.config.memoryOrgAdmissionMode)) {

package/dist/http/routes/notify-wake.js

@@ -1,6 +1,7 @@
-import { taskNotificationInboxEntry } from "../../orchestration/workflow-completion-inbox.js";
+import { externalNotificationInboxEntry } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCallerOf } from "../principal-gate.js";
+import { ownerlessRowOpen, sessionOwnerCellOf } from "../../security.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -23,14 +24,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            let nb;
-            try {
-                nb = (await readJson(req));
-            }
-            catch {
-                sendError(res, 400, "request.body_shape", "body must be JSON: { task_id, status, summary, result?, seq?, source? }");
-                return;
-            }
+            const nb = (await readJson(req));
             if (typeof nb.task_id !== "string" || nb.task_id.trim().length === 0 || nb.task_id.length > 190) {
                 sendError(res, 400, "request.field_invalid", "task_id must be a non-empty string of at most 190 characters");
                 return;
@@ -68,8 +62,8 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            const notifyOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!notifyOperator && notifyOwner !== null && notifyOwner !== principal) {
+            const notifyOperator = explicitOperatorOk(principal, deps.config);
+            if (!notifyOperator && notifyOwner !== principal && !ownerlessRowOpen(await sessionOwnerCellOf(owned.sessionStorage, notifySession, notifyOwner), sessionCallerOf(req, deps))) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
@@ -101,7 +95,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 501, "capability.workflow_store_required", "external notify requires the workflow completion inbox (WORKFLOW_RUN_STORE)");
                 return;
             }
-            await deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_id: payload.task_id, task_type: "external", status: payload.status, summary: payload.summary, ...(payload.result !== undefined ? { result: payload.result } : {}), ...(payload.seq !== undefined ? { seq: payload.seq } : {}), ...(payload.source !== undefined ? { source: payload.source } : {}) }, Date.now()));
+            await deps.workflowCompletionInbox.enqueue(externalNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_type: "external", ...payload }, Date.now()));
             sendJson(res, 202, { sessionId: notifySession, delivery: "parked", note: "no live stream — parked in the session inbox; drained as a task_notification on the next stream open" });
             return;
         }
@@ -122,14 +116,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            let wakeBody;
-            try {
-                wakeBody = (await readJson(req));
-            }
-            catch {
-                sendError(res, 400, "request.body_shape", "body must be JSON: { message?: string }");
-                return;
-            }
+            const wakeBody = (await readJson(req));
             if (wakeBody.message !== undefined && (typeof wakeBody.message !== "string" || wakeBody.message.length === 0)) {
                 sendError(res, 400, "request.field_invalid", "message must be a non-empty string when present");
                 return;

package/dist/http/routes/observability.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, isOperator, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { quotaWindowResetsAt } from "../../observability/cost-quota.js";
@@ -14,7 +14,7 @@ export async function handleObservability(req, res, match, ctx) {
             }
             if (deps.config.requirePrincipal) {
                 const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+                if (!explicitOperatorOk(principal, deps.config)) {
                     sendError(res, 403, "auth.operator_only", "outcomes view is operator-only on a multi-tenant worker");
                     return;
                 }

package/dist/http/routes/principal-inbox.d.ts

@@ -0,0 +1,39 @@
+/**
+ * 跨主体投递门的**受理口**:`POST /v1/principal-inbox/messages`。
+ *
+ * 本口只做三件事,其余全归门(`src/org-delivery-gate.ts`,规则全文在它的头注):
+ *  ① 取发件人 —— **只**取自验过的身份面(`gatedPrincipal`),交给门的 `authedFrom` 就是 `{ scope: <那位主体> }`;
+ *     体里没有发件人这个键(写了 = 词表外键,400)。没有验过的身份 ⇒ 401(身份面那一句),不论部署是否要求 principal ——
+ *     门要一个发件人 scope,匿名者没有。无凭证部署上 principal 头只是调用方自报 ⇒ 本口在分派器的无凭证写门内
+ *     (声明行 `credentialGated`,503 `auth.service_token_required`;本地开发显式 `ALLOW_UNAUTHED_WRITES=true` 才放行);
+ *  ② 判体形 —— `{ to: 非空串, content: 非空串(≤ {@link PRINCIPAL_INBOX_CONTENT_MAX_CHARS} 字), urgent?: 布尔 }`,
+ *     键闭集与提交口同一只组句器(`principalInboxBodyKeyIssue`);
+ *  ③ 调门、投影门的答案 —— 回执 ⇒ 200 `{ receiptId }`;拒绝 ⇒ core 的词原样做 `errorCode`、门的那一句原样做 `error`。
+ * 本口**不碰**任何店:一个店名、一个 `.append` 都没有(`test/org-delivery-gate-single-path.test.ts` 按源码钉)。
+ *
+ * 回执**不**带门回执里的 `seq`:那是收件人箱的序号,原样交给发件人就是把「收件人这只箱收过多少封」泄给 org 里的任何人。
+ *
+ * 拒绝词 → HTTP 状态(穷举 `switch`,core 加词 ⇒ 编译红):
+ *  · `not_member` → 404:「不同 org」「查无此人」「目录答不上来」同一份字节(门保证),404 与本仓反枚举的既有形一致;
+ *  · `rate_limited` → 429;
+ *  · `inbox_full` → 409(收件人那一侧的状态,不是发件人的速率;与 `steering.queue_full` 同档);
+ *  · `recipient_tombstoned` → 410(收件人正在被删除,这条路关了)。
+ * 门缺席(本部署没声明收件箱消费方)⇒ 501 `capability.unavailable`,能力位 `principalInboxDelivery` 读同一只事实。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+/**
+ * 一封信正文的字符上界。全局请求体上界(8 MiB)对一只收件箱太宽:箱里最多 50 封,而读它的是收件人的助理 ——
+ * 一封信是一段话,不是一份附件(要转一份长文,发它的出处)。
+ */
+export declare const PRINCIPAL_INBOX_CONTENT_MAX_CHARS = 32000;
+export declare function handlePrincipalInbox(req: IncomingMessage, res: ServerResponse, match: RouteMatch<PrincipalInboxRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const PRINCIPAL_INBOX_ROUTES: readonly [{
+    readonly id: "principal-inbox-messages";
+    readonly path: "/v1/principal-inbox/messages";
+    readonly credentialGated: readonly ["POST"];
+    readonly methods: readonly ["POST"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽。 */
+export type PrincipalInboxRouteId = RouteIdsOf<typeof PRINCIPAL_INBOX_ROUTES>;
+//# sourceMappingURL=principal-inbox.d.ts.map

package/dist/http/routes/principal-inbox.js

@@ -0,0 +1,76 @@
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, sendUnauthorized } from "../principal-gate.js";
+import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
+import { principalInboxBodyKeyIssue } from "../../request-key-closure.js";
+export const PRINCIPAL_INBOX_CONTENT_MAX_CHARS = 32_000;
+function sendRefusal(res, outcome) {
+    switch (outcome.code) {
+        case "org_delivery.not_member":
+            sendError(res, 404, "org_delivery.not_member", outcome.message);
+            return;
+        case "org_delivery.rate_limited":
+            sendError(res, 429, "org_delivery.rate_limited", outcome.message);
+            return;
+        case "org_delivery.inbox_full":
+            sendError(res, 409, "org_delivery.inbox_full", outcome.message);
+            return;
+        case "org_delivery.recipient_tombstoned":
+            sendError(res, 410, "org_delivery.recipient_tombstoned", outcome.message);
+            return;
+        default:
+            return assertNever(outcome.code);
+    }
+}
+export async function handlePrincipalInbox(req, res, match, ctx) {
+    const { deps } = ctx;
+    const { readJson } = ctx.helpers;
+    switch (match.decl.id) {
+        case "principal-inbox-messages": {
+            const principal = gatedPrincipal(req, deps.config);
+            if (principal === undefined) {
+                sendUnauthorized(res, "identity");
+                return;
+            }
+            const fact = facts.principalInboxDelivery(deps);
+            if (!fact.available) {
+                sendError(res, 501, "capability.unavailable", "cross-principal delivery is not available on this deployment (it declares no principal-inbox consumer, so no organization delivery gate is mounted)");
+                return;
+            }
+            const raw = await readJson(req);
+            if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+                sendError(res, 400, "request.field_invalid", "body must be a JSON object { to: string, content: string, urgent?: boolean }");
+                return;
+            }
+            const keyIssue = principalInboxBodyKeyIssue(raw);
+            if (keyIssue) {
+                sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                return;
+            }
+            const body = raw;
+            if (typeof body.to !== "string" || body.to === "") {
+                sendError(res, 400, "request.field_invalid", "to must be a non-empty string naming the recipient principal");
+                return;
+            }
+            if (typeof body.content !== "string" || body.content === "" || body.content.length > PRINCIPAL_INBOX_CONTENT_MAX_CHARS) {
+                sendError(res, 400, "request.field_invalid", `content must be a non-empty string of at most ${PRINCIPAL_INBOX_CONTENT_MAX_CHARS} characters`);
+                return;
+            }
+            if (body.urgent !== undefined && typeof body.urgent !== "boolean") {
+                sendError(res, 400, "request.field_invalid", "urgent must be a boolean when present");
+                return;
+            }
+            const outcome = await fact.gate.deliverCrossPrincipal({ scope: principal }, body.to, { content: body.content, ...(body.urgent !== undefined ? { urgent: body.urgent } : {}) });
+            if (!outcome.ok) {
+                sendRefusal(res, outcome);
+                return;
+            }
+            sendJson(res, 200, { receiptId: outcome.receipt.receiptId });
+            return;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const PRINCIPAL_INBOX_ROUTES = [{ id: "principal-inbox-messages", path: "/v1/principal-inbox/messages", credentialGated: ["POST"], methods: ["POST"] }];
+//# sourceMappingURL=principal-inbox.js.map

package/dist/http/routes/retention-ops.js

@@ -36,7 +36,7 @@ export async function handleRetention(req, res, match, ctx) {
         sendOperatorPrincipalsRequired(res);
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+    if (!explicitOperatorOk(principal, deps.config)) {
         sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
         return;
     }
@@ -71,14 +71,7 @@ async function handleHold(req, res, ctx, store, rawDomain, principal, held) {
     }
     let note;
     if (held) {
-        let raw;
-        try {
-            raw = await ctx.helpers.readJson(req);
-        }
-        catch {
-            sendError(res, 400, "request.invalid_json", "invalid JSON body");
-            return;
-        }
+        const raw = await ctx.helpers.readJson(req);
         if (raw !== undefined && raw !== null && raw !== "") {
             if (typeof raw !== "object" || Array.isArray(raw)) {
                 sendError(res, 400, "request.body_shape", "invalid retention hold body — expected an object with an optional `note` string");

package/dist/http/routes/rules.js

@@ -1,14 +1,13 @@
 import { z } from "zod";
-import { sendJson, sendError, sendHttpError } from "../send.js";
+import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, buildCcImportLayerRootRefusal, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
-import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
-import { HttpError } from "../../security.js";
-import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
-import { PERSISTED_RULE_MATCHES, isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
+import { hasControlOrBidi } from "@sema-agent/settings-schema";
+import { IMPORTED_SETTINGS_LAYERS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, RULE_ADD_ORIGINS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
+import { isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -24,7 +23,7 @@ const CcImportPrepareBodySchema = z
     layers: z
         .array(z
         .object({
-        layer: z.enum(["userSettings", "projectSettings", "localSettings"]),
+        layer: z.enum(IMPORTED_SETTINGS_LAYERS),
         path: z.string().min(1).max(1024),
         root: z.string().max(1024),
         content: z.string().max(MAX_LAYER_CONTENT_CHARS),
@@ -37,13 +36,12 @@ const CcImportPrepareBodySchema = z
 function ccImportRootRefused(layer) {
     return !isValidDurableScope({ kind: "project", root: layer.root });
 }
-const TICKET_CONTROL_CHARS_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
-const TicketStringSchema = z.string().min(1).max(190).refine((t) => !TICKET_CONTROL_CHARS_RE.test(t));
+const TicketStringSchema = z.string().min(1).max(190).refine((t) => !hasControlOrBidi(t));
 const CcImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
 const LocalImportAddSchema = z
     .object({
     dot: z.object({ actor: z.string().min(1).max(190), counter: z.number().int().nonnegative().safe() }).strict(),
-    origin: z.enum(["user", "imported-cc", "starter"]),
+    origin: z.enum(RULE_ADD_ORIGINS),
     createdAt: z.string().min(1).max(64),
 })
     .strict();
@@ -107,18 +105,7 @@ export async function handleRules(req, res, match, ctx) {
         await handleRuleList(res, match.search, principal, lane, deps.config);
         return;
     }
-    let rawBody;
-    try {
-        rawBody = await readJson(req);
-    }
-    catch (err) {
-        if (err instanceof HttpError && err.status !== 400) {
-            sendHttpError(res, err);
-            return;
-        }
-        sendError(res, 400, "request.body_shape", "body must be valid JSON");
-        return;
-    }
+    const rawBody = await readJson(req);
     if (match.decl.id === "rules-revoke") {
         await handleRuleRevoke(res, rawBody, principal, lane, deps.config);
         return;
@@ -216,7 +203,7 @@ function resolveTargetPrincipal(requested, caller, config) {
         return { ok: true, principal: caller };
     if (!facts.operatorLane({ config }).available)
         return { ok: false, why: "operator_principals_empty" };
-    if (!explicitOperatorOk(caller, config.operatorPrincipals))
+    if (!explicitOperatorOk(caller, config))
         return { ok: false, why: "not_operator" };
     return { ok: true, principal: requested };
 }

package/dist/http/routes/runs.d.ts

@@ -133,6 +133,11 @@ export declare const RUN_VERBS_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/tool-approvals/:id/respond";
     readonly methods: readonly ["POST"];
+}, {
+    readonly id: "tool-approval-read";
+    readonly pattern: RegExp;
+    readonly label: "/v1/tool-approvals/:id";
+    readonly methods: readonly ["GET"];
 }, {
     readonly id: "task-ask-decision";
     readonly pattern: RegExp;