@sema-agent/server 7.147.0 → 7.148.0

package/dist/owner-faces.d.ts

@@ -0,0 +1,531 @@
+/**
+ * 🔴 **属主律**([ref] RH-3 第二期):「这个调用方看得见 / 动得了这一行 run / 会话吗」只有**一只事实函数 + 一张政策表**。
+ *
+ * ## 律(三句)
+ *  1. **事实一处算**:调用方对这一行持有哪些资格 = {@link qualsOf}(调用方四格事实 + 部署两格 × 行格 → 资格集合)。别处不再判「是不是属主 / 是不是哨兵 /
+ *     是不是存量无主 / 是不是 fleet」—— 此前六只判官(run 面 / 会话面 / 无主臂 / 存量互认臂 / fleet 视域 / 各口手抄)各判一份。
+ *  2. **政策一张表**:每口放哪些资格 = {@link FACES} 一行(行资格 `grants` + fleet 资格 `fleet` + 运维位 `operator`)。可见 = 资格集合与该口三列之并有交
+ *     ({@link visibleOn})—— 是集合交,不是首中:精确属主不会被别的分支吞,也没有「先判哪条臂」的序。
+ *  3. **看不见 ≡ 该口「没有这一行」的那一答**:每口登记一只投影 `projection`(闭集 {@link FaceProjection},码按口的既有契约:404 族 / 200 `{deleted:false}` /
+ *     409 / 401),「没有这一行」与「这一行你看不见」走同一只投影(下发口在 `http/owner-access.ts` 的 `refuse`,一只)。
+ *
+ * ## 调用方与证明(两种身份不并成一只)
+ * {@link Caller} 是**这一次判定**的调用方:一般口是这次请求验过的主体(`http/owner-access.ts` 的 `callerOf`);决定门(计划审阅)上是**这一次决定的证明**推出的主体
+ * —— 证明主体替换请求主体时,与主体相连的资格(`operator`)随之重算、fleet 两格清空(决定口不放 fleet;`callerOfDecision`)。
+ * 部署两格(`principalRequired` / `multiTenant`)随调用方一起铸(`multiTenant` 是 `j4` 一格的输入,`principalRequired` 是身份前门的输入),不在判定时另读配置。
+ *
+ * ## D1 列
+ * `fleet` 列是「只持部署 service 凭据、不报主体的调用方」(`deployment_token`)在哪些口算数的**唯一一处**:读面(run 轮询 / 事件 / 按幂等键;会话视图 / 记忆状态 /
+ * 头 / 事件流 / 执行放置;trace 五口)与存续面(fork / 删除 / 同步族)放,驱动面与键面不放。改成「部署凭据看不见任何用户行」= 把这一列里的 `deployment_token` 全删,
+ * 别处不动(列表的过滤参数随后由同一列派生)。
+ *
+ * ## 资源(五类同表)
+run 行、会话行之外,**停驻行**(检查点 scope 列,`scope.*`)、**ask 行 / 活登记 / 活问**(`ask.*`)、**收件条目**(`inbox.*`)与**列表面**(`list.*` / `session.list`)
+同在 {@link FACES} 里:「这个调用方是不是这一行的属主」在全仓只有 `visibleOn(face, qualsOf(caller, cell))` 一种判法 —— 单行门、ask 门、检查点 scope 门
+({@link keyAdmits} / {@link keyAdmission}:行资格只有 owner / open 的面)、列表过滤({@link listFilterOf}:过滤参数从同一行的列派生)同读。
+行属主列的读数只经 {@link ownerCellOf}(铸 `DurableOwnerKey`),调用方与行属主只经 {@link sameParty} / {@link sameKey} 两座桥比。
+
+本模块是叶子:只 import 两个品牌与铸造口(`owner-brands.ts`)与行格型(`security.ts`,type-only),不读请求、不读店、不读配置 —— 判定是纯函数,读与发在 `http/owner-access.ts`。
+ */
+import type { SessionOwnerCell } from "./security.js";
+import { type DurableOwnerKey, type Subject } from "./owner-brands.js";
+/** 行资格:调用方对**这一行**的关系(四格,见 {@link qualsOf})。 */
+export type RowQual = "owner" | "open" | "j4" | "anon_tree";
+/** fleet 资格:与行无关的调用方事实 —— 没有身份边界的部署(`dev_open`)、代部署本人说话的 service 凭据(`deployment_token`)、只读 trace 凭据(`trace_read`)。 */
+export type FleetQual = "dev_open" | "deployment_token" | "trace_read";
+/** 资格闭集:行资格 ∪ fleet 资格 ∪ 运维(`operator`,与行无关的调用方事实)。 */
+export type Qual = RowQual | FleetQual | "operator";
+/**
+ * 一次判定的调用方(四格事实 + 部署两格)。铸点闭集:`http/owner-access.ts` 的 `callerOf`(请求口)/ `callerOfDecision`(决定口),`security.ts` 的 `claimCallerOf`(认领面与协议口:不放 fleet、不放运维),别处不手搓。
+ *  · `subject` —— 验过的主体(分区键,`owner-brands.ts`;`gatedSubject`;决定口是证明推出的人的主体);载体只带这一格,人经 `personOf(subject)` 读;
+ *  · `operator` —— `explicitOperatorOk(personOf(subject))`(运维名册的唯一读法:读人,不读分区),与 `subject` 同一次铸;
+ *  · `fleet` —— `dev_open`(装配没接任何身份来源)/ `deployment_token`(出示 service 凭据、不报主体、部署没声明关掉)/ 缺席;两来源互斥;
+ *  · `traceRead` —— 出示了只读 trace 凭据;
+ *  · `principalRequired` / `multiTenant` —— 部署形表的两只谓词(身份前门的条件 / `j4` 的条件)。
+ */
+export interface Caller {
+    readonly subject: Subject | undefined;
+    readonly operator: boolean;
+    readonly fleet: "dev_open" | "deployment_token" | undefined;
+    readonly traceRead: boolean;
+    readonly principalRequired: boolean;
+    readonly multiTenant: boolean;
+}
+/** 单机形下 core 写侧 `spec.principal ?? "default"` 铸出的租户键(壳随请求带的那一个):`j4` 一格的调用方条件。它是单机形的真租户键,不是哨兵。 */
+export declare const LEGACY_UNOWNED_AMNESTY_TENANT = "default";
+/**
+ * 🔴 **调用方与行属主之间唯一的桥**:两个品牌在类型上不可比(`Subject === DurableOwnerKey` 编译红),只在这里按字节比。调用方一侧是**主体**(分区键):
+ * 人不上桥(`Person` 收不进这只形参)—— 带场景的请求只看得见它自己那一格分区里的行。
+ * 全仓「调用方 vs 行属主」的比较只经这一只(普查门 ② 的允许集只有本函数与 {@link qualsOf} 的体)。
+ */
+export declare function sameParty(subject: Subject, owner: DurableOwnerKey): boolean;
+/**
+ * 🔴 **存储键的桥**(null 同 null):一份落下的属主键(`null` = 匿名写下的那一格)是不是这位调用方的键(调用方的键 = 主体,没有主体 = `null`)。
+ * 与 {@link sameParty} 的差只在两侧缺席:这里缺席只等于缺席(匿名写下的锚只投给匿名读者,有主体的读者看不见它;有主体写下的只投给那一位)——
+ * 这是「行属主将成存储键」的读法(回退锚、同步暂存句柄),不是可见性(可见性的无主开放臂是面表的 `open` 格,走 {@link qualsOf})。
+ */
+export declare function sameKey(subject: Subject | null | undefined, key: DurableOwnerKey | null): boolean;
+/**
+ * 🔴 **属主列读数的唯一铸法**(`DurableOwnerKey` 铸点之一;另一只是 `security.ts` 的 `decodeCheckpointScope`):行上 / 条目上 / 锚上读出的那一格属主,
+ * `null` = 无主(匿名写下)。run / 会话 / ask 行、活登记、活问、收件条目、回退锚、同步暂存句柄的属主都经这一只成键。
+ */
+export declare function ownerKeyOf(persisted: string | null): DurableOwnerKey | null;
+/**
+ * 一格属主读数的行格(不问 placed 位:run 行 / ask 行 / 活登记 / 收件条目恒非 placed;会话行的 placed 位由 `security.ts` 的 `sessionOwnerCellOf` 另问店):
+ * 串 = 有主,`null` = 普通无主行,`undefined` = 属主格坏了(盘上少了这个键)⇒ 坏格(行资格一格不给,fail-closed,不猜成无主)。
+ */
+export declare function ownerCellOf(owner: string | null | undefined): SessionOwnerCell | undefined;
+/**
+ * **收纯串的协议内部口**的主体读法(恢复管线;不是铸点):活登记的应答口 / 按问读口(`tool-approval.ts` 协调器)、活问的应答口(`elicitation.ts` / `question.ts`)、
+ * 迟到决定的赎回席(`http/approval-sweeps.ts`)、停驻完成收件箱的排空门、peer 目录席 —— 这几扇口经纯串收「上游已铸的那一只主体」(HTTP 路由层的 `gatedSubject`
+ * 读数、续跑腿交来的 run 属主、引擎交来的 scope)。串就是一只已落成字节的属主键,按 {@link ownerKeyOf} → `partsOf` 恢复(坏形的 `_scn:` 串响亮抛),
+ * 不重判保留前缀 / 在册 / 宽度(那三判只在外部管线)。公开面改收 `Subject` 品牌是另一车(这几扇口的测试调用面数以百计)。
+ */
+export declare function recoveredSubject(persisted: string): Subject;
+export declare function recoveredSubject(persisted: string | null | undefined): Subject | undefined;
+/**
+ * 🔴 **调用方对一行持有的全部资格**(唯一事实函数)。`cell` = 行格(`SessionOwnerCell`:有主 / 无主 + 是否委派子代 placed 行;run 行恒 `placed: false`);
+ * `undefined` = 行在、属主格坏了(run 行盘上少了 `owner` 键)⇒ 一个行资格都不给(fail-closed,不猜成无主),与行无关的资格照给。
+ *  · `owner` —— 有主 ∧ 同一主体({@link sameParty});
+ *  · `open` —— 无主 ∧ 不是 placed 行(普通无主行对任何调用方开放;placed 行是别人那棵委派树的子代转录,不是公共行);
+ *  · `j4` —— `open` ∧ 单机形(`¬multiTenant`)∧ 调用方恰为 {@link LEGACY_UNOWNED_AMNESTY_TENANT}(存量无主行判给单机唯一的那位用户);
+ *  · `anon_tree` —— 无主 ∧ placed ∧ 调用方是 fleet(委派树的子代只对代部署说话的调用方开放);
+ *  · `operator` / `dev_open` / `deployment_token` / `trace_read` —— 调用方事实,与行无关。
+ */
+export declare function qualsOf(caller: Caller, cell: SessionOwnerCell | undefined): ReadonlySet<Qual>;
+/**
+ * 身份前门(闭集):没有主体、也不持有本口 `fleet` 列里任何一格的调用方,在读行之前答什么。
+ *  · `P401` —— 部署要求主体时答主体拒(`sendPrincipalRefusal`:`auth.principal_required` / 证明验不过 `principal_unverified`);不要求时不拦;
+ *  · `I401` —— 一律答 401 `auth.unauthorized`(identity 面):这一口要一位验过的调用方或 fleet;
+ *  · `I401r` —— 部署要求主体时答 401 `auth.unauthorized`(identity 面);不要求时不拦;
+ *  · `none` —— 本口没有身份前门(认领面由提交管线自己的门先判 / 决定口由证明门判 / 协议口由各自入口判)。
+ */
+export type FaceDoor = "P401" | "I401" | "I401r" | "none";
+/**
+ * 「没有这一行 / 看不见这一行」的那一答(闭集;码与句是各口既有的契约,本表只登记)。
+ *  · `run_missing` —— 404 `not_found.run`,句 = `runNotFoundMessage(id)`(没有路径 id 的口取常量句);
+ *  · `task_missing` —— 404 `not_found.run` "task not found"(trace 五口 / 续跑 / preempt 的既有句);
+ *  · `decision_missing` —— 直连门上 401 `principal_unverified` "principal proof required"(查无此行与坏证明同体),否则 404 `not_found.run` "task not found";
+ *  · `session_missing` —— 404 `not_found.session` "session not found";
+ *  · `exemption_missing` —— 404 `not_found.session` "not found"(审批豁免面的既有句);
+ *  · `deleted_false` —— 200 `{deleted:false}`(删除口幂等形:没删到东西);
+ *  · `run_exists` —— 409 `conflict.run_exists`(提交重放:这把键 / 这只 taskId 已被占用);
+ *  · `attach_absent` —— 404 `resume.session_not_found`「requireExistingSession: session does not exist …」(提交挂接:认领面没有「没有就建」可镜像,占用 = 不存在那一体);
+ *  · `omit` —— 本模块不下发:调用点把「看不见」当「没有」走它自己的缺席路径(协议口的 RpcError / leader 404 / 嵌套可选字段省略)。
+ */
+export type FaceProjection = "run_missing" | "task_missing" | "decision_missing" | "session_missing" | "exemption_missing" | "deleted_false" | "run_exists" | "attach_absent" | "omit";
+/** 属主读不出(会话店交出具名拒「属主读不出」)时本口怎么读:`fold` = 读作没有这一行(同一只投影,原故障进运维日志一行);`raise` = 原故障照常上抛。 */
+export type FaceUnreadable = "fold" | "raise";
+/**
+ * 无主行的 placed 位要读、而这只会话的**存档读不出**(placed 位住在存档行头 —— 本机文件后端;core `SessionError` 的两个结构码)时本口怎么读:
+ *  · `raise` —— 原故障照常上抛(500 `corrupt_session`;与读存档内容的口同码);
+ *  · `ordinary` —— 读作普通无主行。只给「普通无主行这一答对两种假设都不放出内容」的口:认领面(放给执行席判目标合法性,存档的故障由读存档那一步按腿答)、
+ *    策略口(无主行在这里只有 409 一答 —— 键列:无主行没有那把存储键,placed 行同样无主)。
+ * 只管「存档读不出」这一件;店的连接类故障一律照常上抛(各口按店故障的码族答,如同步族 503 transient)。
+ */
+export type FacePlacementUnreadable = "raise" | "ordinary";
+export interface Face {
+    /** 行的种类:run / 会话行(路由经 `http/owner-access.ts` 的门判)、停驻行 scope 列(`scope`)、ask 行 / 活登记 / 活问(`ask`)、收件条目(`inbox`)、列表面(`list`)。 */
+    readonly resource: "run" | "session" | "scope" | "ask" | "inbox" | "list";
+    /** 行资格里本口放哪几格。 */
+    readonly grants: readonly RowQual[];
+    /** fleet 资格里本口放哪几格(D1 列,见模块头注)。 */
+    readonly fleet: readonly FleetQual[];
+    /** 显式运维能不能越过属主看 / 动这一行。 */
+    readonly operator: boolean;
+    readonly door: FaceDoor;
+    readonly projection: FaceProjection;
+    readonly unreadable: FaceUnreadable;
+    readonly placementUnreadable: FacePlacementUnreadable;
+}
+/**
+ * 🔴 **面表**(闭集;每口一行)。行名 = `资源.用途`;路由经 `http/owner-access.ts` 的 `ROUTE_FACES`(路由 id → 面)取面,路由自己不挑词。
+ * 用途:读(看内容)/ 驱动(动内容,运维可越)/ 存续(fork / 删除 / 同步,改存续或归属)/ 键(行属主将落成存储键:策略、通知)/ 认领(没有就建)/ 协议口(A2A、leader、
+ * 提交重放、preempt、嵌套可选读)。
+ */
+export declare const FACES: {
+    readonly "run.read": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly ["dev_open", "deployment_token"];
+        readonly operator: false;
+        readonly door: "P401";
+        readonly projection: "run_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.drive": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "P401";
+        readonly projection: "run_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.supervise": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: true;
+        readonly door: "P401";
+        readonly projection: "run_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.resume": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: true;
+        readonly door: "P401";
+        readonly projection: "task_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.decision": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: true;
+        readonly door: "none";
+        readonly projection: "decision_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.trace": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly ["dev_open", "deployment_token", "trace_read"];
+        readonly operator: false;
+        readonly door: "I401";
+        readonly projection: "task_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.preempt": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: true;
+        readonly door: "P401";
+        readonly projection: "task_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.replay": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "none";
+        readonly projection: "run_exists";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.a2a": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.leader": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.preview": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: true;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.panel": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly ["dev_open"];
+        readonly operator: true;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "run.anchor": {
+        readonly resource: "run";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.read": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open", "deployment_token"];
+        readonly operator: false;
+        readonly door: "P401";
+        readonly projection: "session_missing";
+        readonly unreadable: "fold";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.placement": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open", "deployment_token"];
+        readonly operator: true;
+        readonly door: "P401";
+        readonly projection: "session_missing";
+        readonly unreadable: "fold";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.erase": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open"];
+        readonly operator: false;
+        readonly door: "P401";
+        readonly projection: "session_missing";
+        readonly unreadable: "fold";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.act": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open"];
+        readonly operator: false;
+        readonly door: "P401";
+        readonly projection: "session_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.supervise": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open"];
+        readonly operator: true;
+        readonly door: "P401";
+        readonly projection: "session_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.exemption": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open"];
+        readonly operator: true;
+        readonly door: "none";
+        readonly projection: "exemption_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.own": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "j4"];
+        readonly fleet: readonly ["dev_open", "deployment_token"];
+        readonly operator: false;
+        readonly door: "I401";
+        readonly projection: "session_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.delete": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "j4"];
+        readonly fleet: readonly ["dev_open", "deployment_token"];
+        readonly operator: false;
+        readonly door: "I401";
+        readonly projection: "deleted_false";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.policy": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open"];
+        readonly operator: true;
+        readonly door: "I401r";
+        readonly projection: "session_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "ordinary";
+    };
+    readonly "session.notify": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open", "anon_tree"];
+        readonly fleet: readonly ["dev_open"];
+        readonly operator: true;
+        readonly door: "P401";
+        readonly projection: "session_missing";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.attach": {
+        readonly resource: "session";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "none";
+        readonly projection: "attach_absent";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "ordinary";
+    };
+    readonly "scope.decide": {
+        readonly resource: "scope";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: true;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "ask.decide": {
+        readonly resource: "ask";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: true;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "ask.answer": {
+        readonly resource: "ask";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "inbox.drain": {
+        readonly resource: "inbox";
+        readonly grants: readonly ["owner", "open"];
+        readonly fleet: readonly [];
+        readonly operator: false;
+        readonly door: "none";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "list.read": {
+        readonly resource: "list";
+        readonly grants: readonly ["owner"];
+        readonly fleet: readonly ["dev_open", "deployment_token", "trace_read"];
+        readonly operator: false;
+        readonly door: "I401";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+    readonly "session.list": {
+        readonly resource: "list";
+        readonly grants: readonly ["owner", "j4"];
+        readonly fleet: readonly ["dev_open", "deployment_token", "trace_read"];
+        readonly operator: false;
+        readonly door: "I401";
+        readonly projection: "omit";
+        readonly unreadable: "raise";
+        readonly placementUnreadable: "raise";
+    };
+};
+export type FaceId = keyof typeof FACES;
+export type RunFaceId = {
+    [F in FaceId]: (typeof FACES)[F]["resource"] extends "run" ? F : never;
+}[FaceId];
+export type SessionFaceId = {
+    [F in FaceId]: (typeof FACES)[F]["resource"] extends "session" ? F : never;
+}[FaceId];
+export type ListFaceId = {
+    [F in FaceId]: (typeof FACES)[F]["resource"] extends "list" ? F : never;
+}[FaceId];
+/**
+ * **只看「验过的主体 + 运维位」的面**(派生型:行资格 ⊆ {owner, open} ∧ fleet 列空):这几只面的可见性与部署形、fleet 事实都无关 ——
+ * 面表里给其中一行加上 `j4` / 任一 fleet 格,它就掉出本型,{@link keyAdmits} 的调用点编译红(那时它要一只完整的 {@link Caller})。
+ */
+export type KeyFaceId = {
+    [F in FaceId]: (typeof FACES)[F]["grants"][number] extends "owner" | "open" ? ((typeof FACES)[F]["fleet"] extends readonly [] ? F : never) : never;
+}[FaceId];
+/** 本口对这份资格集合可见吗 —— 集合交:`quals ∩ (grants ∪ fleet ∪ {operator 若本口放})` 非空。 */
+export declare function visibleOn(face: FaceId, quals: ReadonlySet<Qual>): boolean;
+/**
+ * 🔴 **无主行的 placed 位什么时候不问店**:只在两种假设(普通无主行 / 委派子代的 placed 行)下本口对这只调用方**都放行**的时候 —— 交回 placed 假设的行格
+ * (按较窄的那一形记,不替行声称它是公共行),调用点不读店;否则交回 `undefined`,调用点去读。
+ * 为什么都放行才不读:placed 位住在会话存档的行头(文件后端),存档读不出那一读就拒 —— 用不上它也放得行的调用方(fleet、运维旁路、普通与 placed 同放的口)
+ * 不为一只用不上的读答 500(契约:只判归属的口门不碰存档)。为什么都拒也照读:那一读的店故障要按店故障的码族答(如同步族 503 transient,客户端重试),
+ * 不能被「没有这一行」(404,客户端当不存在)盖住 —— 不读只许省掉一次放行,不许改掉一个拒的码。读的故障怎么答见面表的 `placementUnreadable` 列。
+ */
+export declare function ownerlessCellWithoutRead(face: FaceId, caller: Caller): SessionOwnerCell | undefined;
+/** 普通无主行的行格(面表 `placementUnreadable: "ordinary"` 的口在存档读不出时读作它;停驻行匿名 scope 的行格)。 */
+export declare const OWNERLESS_ORDINARY_CELL: SessionOwnerCell;
+/** {@link KeyFaceId} 的调用方:只要验过的主体与运维位(`Caller` 结构上就是它 —— 有完整调用方的口直接交 `Caller`)。 */
+export interface KeyCaller {
+    readonly subject: Subject | undefined;
+    readonly operator: boolean;
+}
+/**
+ * 🔴 **只看主体的面上的承认**(检查点 scope / ask / 收件条目):`"row"` = 经行资格(属主 ∨ 无主开放),`"operator"` = 经本口的运维越域,`undefined` = 看不见。
+ * 事实仍只由 {@link qualsOf} 算、政策仍只读 {@link FACES} 那一行 —— 本函数只是把 {@link KeyFaceId} 的调用方补成一只完整调用方:部署两格对这几只面不改判
+ * (它们不放 `j4`,{@link KeyFaceId} 在型上保证),按最窄形填;fleet / 只读 trace 两格恒缺(这几只面的 fleet 列空)。
+ * 「经哪一格」只有一处读:ask 决定的出处 `via`(经行资格 ⇒ 属主自决;经运维 ⇒ 运维代决)读它,不再各自重判「是不是属主 / 是不是运维」。
+ */
+export declare function keyAdmission(face: KeyFaceId, who: KeyCaller, cell: SessionOwnerCell | undefined): "row" | "operator" | undefined;
+/** {@link keyAdmission} 的可见性读法:看得见吗(看不见 ≡ 没有,调用点按它自己的缺席形答)。 */
+export declare function keyAdmits(face: KeyFaceId, who: KeyCaller, cell: SessionOwnerCell | undefined): boolean;
+/**
+ * 一只调用方在一口上的**属主视域**:`fleetWide` = 不钉人(持有本口 fleet 列的一格);否则 `gateOwner` = 钉住的那位验过的主体(分区键;`null` = 没有可用身份,调用点按它的
+ * 身份前门答);`includeUnowned` = 钉人时并上无主行(本口的行资格里有一格对「普通无主行」成立 —— 今天只有 `session.list` 的 `j4`)。
+ */
+export interface ListFilter {
+    readonly fleetWide: boolean;
+    readonly gateOwner: Subject | null;
+    readonly includeUnowned: boolean;
+}
+/**
+ * 🔴 **列表口的属主过滤只有这一只**(列表读的 SQL 过滤参数从面表派生,不在路由里各写一份):舰队流、会话列表、发件链接列表、后台名册、用量三口、
+ * `/v1/tasks/source-summary`、trace 列表、项目登记簿、peer 目录席,以及同步族的暂存句柄归属(同步面的视域)同读。
+ * 派生:fleet 列有一格成立 ⇒ 不钉人;否则钉主体;行资格里对普通无主行成立的格({@link qualsOf} 对无主普通行算)⇒ 并上无主行(store 的 `owner IS NULL` 谓词)。
+ * 列表 SQL 只表达「属主 = 我 ∨ 属主为空」两格 ⇒ 列表面的行资格只许 `owner` 与无主格(`j4` / `open`);placed 位与哨兵格在列表上表达不了,结构钉在 `test/owner-access.test.ts`。
+ */
+export declare function listFilterOf(face: FaceId, caller: Caller): ListFilter;
+/** 调用方持有本口 `fleet` 列里的某一格吗 —— 持有则可见与行无关(身份前门放过它;trace 口据此不做逐 id 读)。 */
+export declare function fleetOn(face: FaceId, caller: Caller): boolean;
+/**
+ * 承认:门放过的那一行 + 调用方对**这一行**持有的全部资格(含与行无关的 `operator` / fleet 两格)—— 不是「放行的那一格」。
+ * 无主行的 placement 没读时(它改不了本口的判,见 {@link ownerlessCellWithoutRead}),行资格按 placed 假设记;与行无关的格恒全。
+ * 下游要「按哪一格派生」的(fork 新属主 / 会话断言的运维旁路)读 `quals`,不再各自重判运维或 fleet。
+ * 再读(两读之间行可能易主)= 对新读数再判一次同一只({@link qualsOf} + {@link visibleOn}),交回新的资格集合;住客(化身)绑定不在这里 ——
+ * 各写口既有的 CAS(行期望 / `expectedOwner` / 执行席住客复核)是它唯一的真源。
+ */
+export interface Admitted<R extends OwnedReading> {
+    readonly row: OwnedRow<R>;
+    readonly quals: ReadonlySet<Qual>;
+}
+/** 门读的那一读的最小形:带属主那一格(`null` = 无主)。 */
+export type OwnedReading = {
+    readonly owner: string | null;
+};
+/**
+ * 🔴 **门放过的行**:属主那一格带 `DurableOwnerKey` 品牌(铸点 = 存取器判行处,经 `owner-brands.ts` 的 `mintOwnedRow`:同一个行对象原样交出,不展开 —— 行上可能有惰性读的格)。路由拿到的承认行上,
+ * 属主与调用方身份(`Subject`)直接比较编译红 —— 要比只经 {@link sameParty} / {@link sameKey}。
+ */
+export type OwnedRow<R extends OwnedReading> = R & {
+    readonly owner: DurableOwnerKey | null;
+};
+//# sourceMappingURL=owner-faces.d.ts.map