@xema/omni-protocol 0.1.127 → 0.1.129

package/dist/index.d.ts

@@ -222,8 +222,8 @@ export interface Manifest<C extends Channel = Channel> {
     timeCheck?: true;
     /** Provider uses its own timestamps for final records; host timestamps are advisory. Omission makes no trust promise. */
     timestampAuthority?: "provider";
-    /** The organisation's whole ladder, stated outright, `person` included. Omitted for the typical four, `DEFAULT_LEVELS`. */
-    orgLevels?: LevelDeclaration[];
+    /** The organisation's whole ladder, stated outright, `person` included, each level labelled in the languages its agents read. */
+    orgLevels: LevelDeclaration[];
     /**
      * The outcomes this platform distinguishes when a dial ends, `answered` and at least one way of
      * not reaching the destination. Required of a provider that dials at all -- an idle dialpad, or
@@ -1026,35 +1026,15 @@ export interface TaskTakenOver {
     since: IsoTimestamp;
 }
 /**
- * A level of the organisation's structure, by the id its manifest declares -- or one of the four
- * a typical organisation has, `DEFAULT_LEVELS`, when the manifest declares no ladder. The protocol
- * never describes the chain: which levels a person passes through is the structure's to know.
+ * A level of the organisation's structure, by the id its manifest declares. The protocol never
+ * describes the chain: which levels a person passes through is the structure's to know.
  */
 export type Level = string;
-/** A level the structure has, with the label an agent computer shows for "who decided". */
+/** A level the structure has, with the label an agent computer shows for "who decided", per language: the agent application picks with `localizedText()`. */
 export interface LevelDeclaration {
     id: Level;
-    label: string;
+    label: LocalizedText;
 }
-/**
- * The levels a typical organisation has: the ladder in force when a manifest declares no
- * `orgLevels`. A manifest that declares any states its whole ladder outright.
- */
-export declare const DEFAULT_LEVELS: readonly [{
-    readonly id: "org";
-    readonly label: "Your organisation";
-}, {
-    readonly id: "site";
-    readonly label: "Your site";
-}, {
-    readonly id: "team";
-    readonly label: "Your team";
-}, {
-    readonly id: "person";
-    readonly label: "You";
-}];
-/** The ladder in force for a manifest: exactly what it declares, or the defaults when it declares none. */
-export declare function effectiveLevels(declared: readonly LevelDeclaration[] | undefined): LevelDeclaration[];
 /**
  * Something the queue could allow, locked above the person: the level that made it unchangeable,
  * and why if they said. `person` never locks their own value, and the queue is not a level --

package/dist/index.js

@@ -63,20 +63,6 @@ export function isAllowedBrowserUrl(url) {
     }
 }
 export const ON_CALL_ROLES = ["party", "agent", "conferenced"];
-/**
- * The levels a typical organisation has: the ladder in force when a manifest declares no
- * `orgLevels`. A manifest that declares any states its whole ladder outright.
- */
-export const DEFAULT_LEVELS = [
-    { id: "org", label: "Your organisation" },
-    { id: "site", label: "Your site" },
-    { id: "team", label: "Your team" },
-    { id: "person", label: "You" },
-];
-/** The ladder in force for a manifest: exactly what it declares, or the defaults when it declares none. */
-export function effectiveLevels(declared) {
-    return [...(declared ?? DEFAULT_LEVELS)];
-}
 export const CAPABILITY_SOURCES = ["queue", "dialer", "nobody", "not-yet-read"];
 // ---------------------------------------------------------------------------
 // Task commands.
@@ -160,7 +146,8 @@ export function localizedText(text, languages) {
         return undefined;
     const byTag = new Map(Object.entries(text).map(([tag, value]) => [tag.toLowerCase(), value]));
     for (const language of languages) {
-        for (let tag = language.toLowerCase(); tag !== ""; tag = tag.includes("-") ? tag.slice(0, tag.lastIndexOf("-")) : "") {
+        // RFC 4647 Lookup: drop subtags from the end, and a single-letter extension marker with the one before it.
+        for (let tag = language.toLowerCase(); tag !== ""; tag = shorterTag(tag)) {
             const found = byTag.get(tag);
             if (found !== undefined)
                 return found;
@@ -168,6 +155,12 @@ export function localizedText(text, languages) {
     }
     return undefined;
 }
+function shorterTag(tag) {
+    if (!tag.includes("-"))
+        return "";
+    const shorter = tag.slice(0, tag.lastIndexOf("-"));
+    return /-[a-z0-9]$/.test(shorter) ? shorter.slice(0, -2) : shorter;
+}
 // ---------------------------------------------------------------------------
 // Utilities.
 // ---------------------------------------------------------------------------

package/dist/testing.d.ts

@@ -80,9 +80,9 @@ export interface TestAdapterOptions {
 export declare function testAdapter<C extends Channel>(adapter: Adapter<C>, context: ConnectContext, options?: TestAdapterOptions): Promise<AdapterContractResult>;
 /**
  * Validates restored authentication followed by a refresh failure or expiry. Every state is
- * validated, and a `refreshing` state must carry over the login it refreshes.
+ * validated against the manifest's levels, and a `refreshing` state must carry over the login it refreshes.
  */
-export declare function assertAuthenticationRestoreAndExpiry(states: readonly AuthenticationState[]): void;
+export declare function assertAuthenticationRestoreAndExpiry(states: readonly AuthenticationState[], manifest: Manifest): void;
 /**
  * Capabilities are current, not fixed. A provider that withdraws one republishes `authenticated`
  * with the new set, and the next snapshot agrees with it. `states` is what the authentication

package/dist/testing.js

@@ -1,4 +1,4 @@
-import { browserSessionKey, effectiveLevels, sameCapabilities, } from "./index.js";
+import { browserSessionKey, sameCapabilities, } from "./index.js";
 import { assertNoViolations, validateAuthenticationState, validateBreakTransition, validateEventEnvelope, validateHostGuarantees, validateHostReport, validateUserDetails, observeRules, ruleTested, validateHostMute, validateHostRecording, validateLoginStore, validateHistoryReport, validateManifest, validateResult, validateSnapshot, validateTask, validateLanguages, validateTimeZone, validatePhone, validateTaskCommand, isTimeZone, sameTimeZone, } from "./validation.js";
 export { ProtocolConformanceError, assertNoViolations } from "./validation.js";
 /**
@@ -57,6 +57,10 @@ const CONTRACT_SUBJECTS = [
 // here assumes its shape; a subject is reached only by something the element rules would see.
 const isRecord = (value) => typeof value === "object" && value !== null;
 const some = (value) => Array.isArray(value) && value.length > 0;
+// A manifest without a ladder has been reported on, and declares no level: every level is refused.
+const declaredLevels = (manifest) => isRecord(manifest) && Array.isArray(manifest.orgLevels)
+    ? manifest.orgLevels.filter(isRecord).map(level => level.id).filter((id) => typeof id === "string")
+    : [];
 function observeTask(value, seen) {
     if (!isRecord(value))
         return;
@@ -249,7 +253,7 @@ export async function testAdapter(adapter, context, options = {}) {
     let disconnectWasClean = false;
     try {
         authenticationState = await authentication.state();
-        const levels = effectiveLevels(adapter.manifest.orgLevels).map(level => level.id);
+        const levels = declaredLevels(adapter.manifest);
         violations.push(...validateAuthenticationState(authenticationState, "authentication", { levels }));
         if (authenticationState.status !== "authenticated") {
             throw new Error(`Adapter contract exercise requires authenticated test state, received ${authenticationState.status}`);
@@ -955,12 +959,12 @@ function connectingReports(context, violations) {
     };
 }
 /** Validates each state of a published sequence, and that every `refreshing` carries over the login before it. */
-function assertLoginSequence(states, summary) {
+function assertLoginSequence(states, levels, summary) {
     const found = [];
     let login;
     states.forEach((state, index) => {
         const path = `states[${index}]`;
-        const own = validateAuthenticationState(state, path);
+        const own = validateAuthenticationState(state, path, { levels });
         found.push(...own);
         if (own.length > 0)
             return;
@@ -973,10 +977,10 @@ function assertLoginSequence(states, summary) {
 }
 /**
  * Validates restored authentication followed by a refresh failure or expiry. Every state is
- * validated, and a `refreshing` state must carry over the login it refreshes.
+ * validated against the manifest's levels, and a `refreshing` state must carry over the login it refreshes.
  */
-export function assertAuthenticationRestoreAndExpiry(states) {
-    assertLoginSequence(states, "Authentication scenario");
+export function assertAuthenticationRestoreAndExpiry(states, manifest) {
+    assertLoginSequence(states, declaredLevels(manifest), "Authentication scenario");
     if (states.length < 2 || states[0]?.status !== "authenticated") {
         throw new Error("Authentication scenario must start with a restored authenticated state");
     }
@@ -1041,7 +1045,7 @@ function notYetReadTasks(tasks, path) {
  * leads, or requests to one that may no longer join, is the failure.
  */
 export function assertCapabilityWithdrawal(states, snapshot, manifest) {
-    assertLoginSequence(states, "Capability withdrawal");
+    assertLoginSequence(states, declaredLevels(manifest), "Capability withdrawal");
     const stray = states.findIndex(state => state.status !== "authenticated" && state.status !== "refreshing");
     if (stray >= 0) {
         throw new Error(`Capability withdrawal passes only through usable states; states[${stray}] is ${states[stray]?.status}, which ends the login`);
@@ -1099,7 +1103,7 @@ export function assertTaskCapabilityWithdrawal(tasks, manifest, command) {
     }
     const context = {
         channel: manifest.channel,
-        levels: effectiveLevels(manifest.orgLevels).map(level => level.id),
+        levels: declaredLevels(manifest),
         dialOutcomesDeclared: manifest.dialOutcomes !== undefined,
     };
     tasks.forEach((task, index) => {
@@ -1690,7 +1694,7 @@ async function testOneCall(call) {
             // The reload is a restore before it is anything else: the second session stands authenticated
             // as the same person, from the secrets alone, or nothing it reads afterwards is this login's.
             const restored = await restoredSession.state();
-            found.push(...validateAuthenticationState(restored, "test.reload.login"));
+            found.push(...validateAuthenticationState(restored, "test.reload.login", { levels: declaredLevels(call.manifest) }));
             ruleTested("test.reload.login");
             const same = isRecord(restored) && restored.status === "authenticated" && isRecord(restored.identity) && restored.identity.id === call.reader().self;
             if (!same) {
@@ -1836,7 +1840,7 @@ async function testOneCall(call) {
     ruleTested("test.timeout");
     const send = async (command, dialId) => {
         const own = validateTaskCommand(command, latestTask(), `test.command.${String(command.type)}`, {
-            levels: effectiveLevels(call.manifest.orgLevels).map(level => level.id),
+            levels: declaredLevels(call.manifest),
             dialOutcomesDeclared: call.manifest.dialOutcomes !== undefined,
             calendarDeclared: call.manifest.idleCapabilities?.calendar === true,
             autoAcceptTasks: call.context.autoAcceptTasks,

package/dist/validation.d.ts

@@ -15,8 +15,8 @@ export declare function observeRules(listener: (rule: string) => void): () => vo
 /** Says a rule was evaluated, for code that decides outside a collector: the stream, the test. */
 export declare function ruleTested(...rules: readonly string[]): void;
 /** Every field is optional, so this checks what is present rather than what is missing. */
-export declare function validateContact(contact: unknown, path?: string): ProtocolViolation[];
-export declare function validateScheduledActivity(activity: unknown, path?: string): ProtocolViolation[];
+export declare function validateContact(contact: unknown, levels: readonly string[], path?: string): ProtocolViolation[];
+export declare function validateScheduledActivity(activity: unknown, levels: readonly string[], path?: string): ProtocolViolation[];
 /**
  * The host's choice of phone for a login, held to the manifest: one the platform listed, required
  * on voice, absent elsewhere.
@@ -37,8 +37,8 @@ export declare function validateLabels(value: unknown, path?: string): ProtocolV
 export interface TaskValidationContext {
     /** The provider's channel, from its manifest. A task must agree with it. */
     channel: string;
-    /** The level ids in force, from the manifest. The defaults when absent. */
-    levels?: readonly string[];
+    /** The level ids the manifest declares, `Manifest.orgLevels`: a level the task names must be one of them. */
+    levels: readonly string[];
     /** `ConnectContext.autoAcceptTasks` as sent: whether a pending task states its `acceptance`. Unknown to a caller without the context, and then unchecked. */
     autoAcceptTasks?: boolean;
     /** Whether the manifest declares `dialOutcomes`. A task that may dial needs it to; absent, the question is not asked. */
@@ -99,7 +99,7 @@ export interface ReaderContext {
      * snapshot carries a team member list, nobody else's does, and `requests` need `team.leadAssistControl`.
      */
     capabilities?: UserCapabilities;
-    /** The level ids in force. Filled from the manifest by `validateSnapshot` and `validateEventEnvelope`; the defaults otherwise. */
+    /** The level ids the manifest declares. `validateSnapshot` and `validateEventEnvelope` take them from the manifest unless given. */
     levels?: readonly string[];
     /** The login's `loginId`. A snapshot or event naming another belongs to a login that is gone. */
     loginId?: string;
@@ -125,15 +125,19 @@ export interface ReaderContext {
     /** `ConnectContext.autoAcceptTasks` as sent: whether a pending task states its `acceptance`. Unknown to a caller without the context, and then unchecked. */
     autoAcceptTasks?: boolean;
 }
-export declare function validateTeamMembers(teamMembers: unknown, path?: string, context?: ReaderContext): ProtocolViolation[];
+/** What a team member list is validated against: the reader, and the levels the manifest declares. */
+export type TeamValidationContext = ReaderContext & {
+    levels: readonly string[];
+};
+export declare function validateTeamMembers(teamMembers: unknown, path: string, context: TeamValidationContext): ProtocolViolation[];
 /** One member as the lead sees them, whole: on the list, and on `team-member-updated` alone. */
-export declare function validateTeamMember(member: unknown, path?: string, context?: ReaderContext): ProtocolViolation[];
+export declare function validateTeamMember(member: unknown, path: string, context: TeamValidationContext): ProtocolViolation[];
 export declare function validateSnapshot(snapshot: unknown, manifest: unknown, path?: string, context?: ReaderContext): ProtocolViolation[];
 export declare function validateEventEnvelope(envelope: unknown, manifest: unknown, path?: string, context?: ReaderContext): ProtocolViolation[];
 /** The agent's standing ask for the next call: since when. */
 export declare function validateNextCall(value: unknown, path?: string): ProtocolViolation[];
 /** A call waiting in the agent's own queue: the caller as shown to this audience, the queue, the waits, and whether the agent may let it go. */
-export declare function validateLinedUp(value: unknown, path?: string, levels?: readonly string[]): ProtocolViolation[];
+export declare function validateLinedUp(value: unknown, levels: readonly string[], path?: string): ProtocolViolation[];
 /** The phone as the platform sees it: the agent's device for this provider, whether it can take a call, its own mute where observed. */
 export declare function validatePhoneState(value: unknown, path?: string, context?: ReaderContext): ProtocolViolation[];
 /**
@@ -159,7 +163,7 @@ export declare function validateHostGuarantees(guarantees: unknown, path?: strin
 export declare function validateHistoryReport(report: unknown, path?: string, manifest?: unknown, task?: unknown): ProtocolViolation[];
 export declare function validateHostReport(report: unknown, path?: string): ProtocolViolation[];
 /** Validate the exact interaction/assignment target before provider command dispatch. */
-export declare function validateTaskCommandRequest(request: unknown, task: unknown, path?: string, taskContext?: Omit<TaskValidationContext, "channel">): ProtocolViolation[];
+export declare function validateTaskCommandRequest(request: unknown, task: unknown, path: string, taskContext: Omit<TaskValidationContext, "channel">): ProtocolViolation[];
 /**
  * What a command needs to be issuable, checked against the task it names: the capability the
  * guide's table gates it on, the phase it belongs to, and the state that has to stand -- a
@@ -167,7 +171,8 @@ export declare function validateTaskCommandRequest(request: unknown, task: unkno
  * own shape is checked. A host validates before sending, and an adapter before acting: a command
  * for a control the task never offered is the host's error, and this names it.
  */
-export declare function validateTaskCommand(command: unknown, task?: unknown, path?: string, taskContext?: Omit<TaskValidationContext, "channel">): ProtocolViolation[];
+export declare function validateTaskCommand(command: unknown): ProtocolViolation[];
+export declare function validateTaskCommand(command: unknown, task: unknown, path: string, taskContext: Omit<TaskValidationContext, "channel">): ProtocolViolation[];
 /** The connection methods whose results `validateResult` knows. */
 export type ResultMethod = "execute" | "dial" | "setCapacity" | "requestBreak" | "commitBreak" | "cancelBreak" | "endBreak" | "requestNextCall" | "cancelNextCall" | "releaseLinedUp" | "executeTeam" | "openAudio" | "setPreference" | "recordStep";
 /**
@@ -191,8 +196,8 @@ export declare function validateTimeZone(value: unknown, path?: string): Protoco
 export declare function validateUserDetails(users: unknown, asked: readonly string[], path?: string): ProtocolViolation[];
 /** What a login is validated against beyond its own shape. */
 export interface LoginValidationContext {
-    /** The level ids in force, from the manifest. The defaults when absent. */
-    levels?: readonly string[];
+    /** The level ids the manifest declares, `Manifest.orgLevels`: a level the login names must be one of them. */
+    levels: readonly string[];
 }
 export declare function validateAuthenticationFailure(failure: unknown, path?: string): ProtocolViolation[];
 /**
@@ -206,8 +211,8 @@ export declare function validateRedirectUri(value: unknown, path?: string): Prot
  * rejection from `complete`. A rejection carries a failure the host can show, and a login is held
  * to the same rules as any `authenticated` state.
  */
-export declare function validateAuthenticationResult(result: unknown, method: "start" | "complete", path?: string, context?: LoginValidationContext): ProtocolViolation[];
-export declare function validateAuthenticationState(state: unknown, path?: string, context?: LoginValidationContext): ProtocolViolation[];
+export declare function validateAuthenticationResult(result: unknown, method: "start" | "complete", path: string, context: LoginValidationContext): ProtocolViolation[];
+export declare function validateAuthenticationState(state: unknown, path: string, context: LoginValidationContext): ProtocolViolation[];
 /**
  * One recorder's recordings for one task, as published: each with its id, the side it follows,
  * its status, and a reason where it is paused or unknown; ids unique, and at most one recording
@@ -231,7 +236,7 @@ export declare function validateRecordingRequest(request: unknown, task: unknown
     hostReport?: unknown;
     softphone?: boolean;
     /** The same provider/task context used to validate the published task. */
-    taskContext?: Omit<TaskValidationContext, "channel">;
+    taskContext: Omit<TaskValidationContext, "channel">;
 }, path?: string): ProtocolViolation[];
 /**
  * A recording command's answer against the recordings published before and after it: applied

package/dist/validation.js

@@ -9,7 +9,7 @@
 // Each list is pinned to its type both ways -- a member the type lacks, or a member the list
 // lacks, fails to compile -- so what the validators accept cannot drift from what the
 // declarations say.
-import { RECORDING_ACTIONS, SHIFT_EVENT_KINDS, RECORDING_SIDES, RECORDING_STATUSES, RECORDING_PAUSED_REASONS, RECORDING_UNKNOWN_REASONS, ALLOWED_BROWSER_URL_SCHEMES, BREAK_KINDS, BROWSER_ISOLATION_SCHEMES, HISTORY_STEPS_THAT_DIAL, IDLE_CAPABILITIES, OMNI_FAILURE_CODES, OMNI_SUPPORTED_PROTOCOL_VERSIONS, TASK_COMMAND_NAMES, negotiateProtocolVersion, DEFAULT_LEVELS, effectiveLevels, } from "./index.js";
+import { RECORDING_ACTIONS, SHIFT_EVENT_KINDS, RECORDING_SIDES, RECORDING_STATUSES, RECORDING_PAUSED_REASONS, RECORDING_UNKNOWN_REASONS, ALLOWED_BROWSER_URL_SCHEMES, BREAK_KINDS, BROWSER_ISOLATION_SCHEMES, HISTORY_STEPS_THAT_DIAL, IDLE_CAPABILITIES, OMNI_FAILURE_CODES, OMNI_SUPPORTED_PROTOCOL_VERSIONS, TASK_COMMAND_NAMES, negotiateProtocolVersion, } from "./index.js";
 export class ProtocolConformanceError extends Error {
     violations;
     constructor(violations, summary = "Adapter violates the Omni protocol") {
@@ -217,9 +217,9 @@ function validateAttributes(value, path, into) {
     });
 }
 /** Every field is optional, so this checks what is present rather than what is missing. */
-export function validateContact(contact, path = "contact") {
+export function validateContact(contact, levels, path = "contact") {
     const into = new Collector();
-    validateContactInto(contact, path, into);
+    validateContactInto(contact, path, into, levels);
     return into.violations;
 }
 function validateContactInto(contact, path, into, levels) {
@@ -238,9 +238,9 @@ function validateContactInto(contact, path, into, levels) {
     }
     validateAttributes(contact.attributes, `${path}.attributes`, into);
 }
-export function validateScheduledActivity(activity, path = "scheduledActivity") {
+export function validateScheduledActivity(activity, levels, path = "scheduledActivity") {
     const into = new Collector();
-    validateScheduledActivityInto(activity, path, into);
+    validateScheduledActivityInto(activity, path, into, levels);
     return into.violations;
 }
 function validateScheduledActivityInto(activity, path, into, levels) {
@@ -528,9 +528,12 @@ export function validateManifest(manifest, path = "manifest") {
         into.require(!Object.hasOwn(manifest, former), "manifest.settleMs.renamed", `${path}.${former}`, "use settleMs; the former field is not accepted");
     }
     into.require(typeof manifest.settleMs === "number" && Number.isInteger(manifest.settleMs) && manifest.settleMs > 0, "manifest.settleMs", `${path}.settleMs`, "settleMs is how long after applied the wire shows what the provider did -- the task-ended after a complete, the calendar-updated after a schedule -- a positive whole number of milliseconds, stated by every provider");
-    if (manifest.orgLevels !== undefined) {
+    if (manifest.orgLevels === undefined) {
+        into.add("manifest.orgLevels.required", `${path}.orgLevels`, "orgLevels is required: the organisation's whole ladder, person included, each level labelled in the languages its agents read");
+    }
+    else {
         if (!Array.isArray(manifest.orgLevels)) {
-            into.add("manifest.orgLevels.shape", `${path}.orgLevels`, "orgLevels must be an array when present");
+            into.add("manifest.orgLevels.shape", `${path}.orgLevels`, "orgLevels must be an array");
         }
         else {
             const ids = new Set();
@@ -551,7 +554,9 @@ export function validateManifest(manifest, path = "manifest") {
                 }
                 else
                     wellFormed = false;
-                if (!into.filled(level.label, "manifest.orgLevel.label", `${at}.label`, "a level needs the label an agent computer shows for it"))
+                const before = into.violations.length;
+                validateLocalizedText(level.label, "manifest.orgLevel.label", `${at}.label`, into);
+                if (into.violations.length !== before)
                     wellFormed = false;
             });
             if (wellFormed && !ids.has("person")) {
@@ -561,8 +566,17 @@ export function validateManifest(manifest, path = "manifest") {
     }
     return into.violations;
 }
-/** Language tags as BCP 47 writes them: a language, then subtags of up to eight letters or digits. */
-const LANGUAGE_TAG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{1,8})*$/;
+/** A well-formed BCP 47 tag as ECMA-402 reads one, a Unicode locale identifier: judged by its spelling, never by what the machine has installed. */
+function isLanguageTag(value) {
+    if (typeof value !== "string" || value === "")
+        return false;
+    try {
+        return Intl.getCanonicalLocales(value).length === 1;
+    }
+    catch {
+        return false;
+    }
+}
 /** The agent's languages, as a host states them on both contexts: BCP 47 tags, most preferred first, at least one. */
 export function validateLanguages(value, path = "context.languages") {
     const into = new Collector();
@@ -572,7 +586,7 @@ export function validateLanguages(value, path = "context.languages") {
     }
     const seen = new Set();
     value.forEach((tag, index) => {
-        if (typeof tag !== "string" || !LANGUAGE_TAG.test(tag)) {
+        if (!isLanguageTag(tag)) {
             into.add("context.languages.tag", `${path}[${index}]`, `${describeValue(tag)} is not a BCP 47 language tag`);
             return;
         }
@@ -633,7 +647,7 @@ function validateLocalizedText(value, rule, path, into) {
     }
     const seen = new Set();
     for (const [tag, text] of Object.entries(value)) {
-        if (!into.require(LANGUAGE_TAG.test(tag), `${rule}.language`, `${path}.${tag}`, `${describeValue(tag)} is not a language tag such as en, hi or en-IN`))
+        if (!into.require(isLanguageTag(tag), `${rule}.language`, `${path}.${tag}`, `${describeValue(tag)} is not a language tag such as en, hi or en-IN`))
             continue;
         into.require(!seen.has(tag.toLowerCase()), `${rule}.language.unique`, `${path}.${tag}`, "language tags are case-insensitive, and each language is stated once");
         seen.add(tag.toLowerCase());
@@ -757,15 +771,12 @@ function validateCustomCapabilities(value, path, into) {
         }
     });
 }
-const DEFAULT_LEVEL_IDS = DEFAULT_LEVELS.map(level => level.id);
 const POLICY_SETTINGS = membersOf({ on: true, off: true, person: true });
 const POLICY_KEYS = new Set([
     ...TASK_CAPABILITIES.voice, ...TASK_CAPABILITIES.chat, ...TASK_CAPABILITIES.email, "dial",
 ].filter(name => name !== "browsers" && name !== "outcomes" && name !== "custom"));
 const PERSON_SETTABLE = /^(hold|skill:.+)$/;
 const isLocked = (value) => isPlainObject(value) && value.lockedBy !== undefined;
-/** The level ids in force: the manifest's, or the defaults when the caller holds no manifest. */
-const levelIds = (levels) => levels ?? DEFAULT_LEVEL_IDS;
 /**
  * What the queue locks is locked on the whole task. Given the locked values, every other field an
  * agent reads -- the title, the reference, an attribute, a custom control's label, a browser URL the
@@ -818,7 +829,7 @@ function validateLockedByInto(value, rule, path, levels, into) {
     if (!into.filled(value, rule, path, "lockedBy names the level that locked it"))
         return;
     into.require(value !== "person", `${rule}.person`, path, "a person never locks their own value");
-    into.require(levelIds(levels).includes(value), `${rule}.unknown`, path, `${describeValue(value)} is not a level this manifest declares: in force are ${levelIds(levels).join(", ")}`);
+    into.require(levels.includes(value), `${rule}.unknown`, path, `${describeValue(value)} is not a level this manifest declares: ${inForce(levels)}`);
 }
 /** `{ lockedBy, reason? }` standing in for a value: who locked it, and a reason if given. */
 function validateLockedInto(value, rule, path, levels, into) {
@@ -829,7 +840,7 @@ function validateLockedInto(value, rule, path, levels, into) {
 /** What every resolved value carries: who set it, and who locked it if anyone. */
 function validateResolvedInto(value, rule, path, levels, into) {
     if (into.filled(value.setBy, `${rule}.setBy`, `${path}.setBy`, "setBy names who stated the value: a level, or provider")) {
-        into.require(value.setBy === "provider" || levelIds(levels).includes(value.setBy), `${rule}.setBy.unknown`, `${path}.setBy`, `${describeValue(value.setBy)} is neither provider nor a level this manifest declares`);
+        into.require(value.setBy === "provider" || levels.includes(value.setBy), `${rule}.setBy.unknown`, `${path}.setBy`, `${describeValue(value.setBy)} is neither provider nor a level this manifest declares: ${inForce(levels)}`);
     }
     if (value.lockedBy !== undefined)
         validateLockedByInto(value.lockedBy, `${rule}.lockedBy`, `${path}.lockedBy`, levels, into);
@@ -838,14 +849,22 @@ function validateResolvedInto(value, rule, path, levels, into) {
         into.require(value.lockedBy !== undefined, `${rule}.reason.unexpected`, `${path}.reason`, "a reason goes with lockedBy: it says why it was locked");
     }
 }
-/** The level ids a manifest puts in force, for validators that receive one. */
+/** A command context's `levels`, the manifest's level ids the login is validated against. */
+function contextLevels(context, rule, path, into) {
+    const levels = context.levels;
+    if (Array.isArray(levels) && levels.every(level => typeof level === "string"))
+        return levels;
+    into.add(rule, `${path}.levels`, "the context carries levels, the ids of the manifest's orgLevels, to validate the login against");
+    return [];
+}
+const inForce = (levels) => levels.length === 0 ? "it declares no ladder" : `in force are ${levels.join(", ")}`;
+/** The level ids a manifest declares, for validators that receive one. A manifest without a ladder declares none, and every level is refused. */
 function manifestLevels(manifest) {
-    if (!isPlainObject(manifest))
-        return undefined;
-    const declared = Array.isArray(manifest.orgLevels)
-        ? manifest.orgLevels.filter((level) => isPlainObject(level) && typeof level.id === "string")
-        : undefined;
-    return effectiveLevels(declared).map(level => level.id);
+    if (!isPlainObject(manifest) || !Array.isArray(manifest.orgLevels))
+        return [];
+    return manifest.orgLevels
+        .filter((level) => isPlainObject(level) && typeof level.id === "string")
+        .map(level => level.id);
 }
 const CUSTOM_RENDERS = membersOf({ inline: true, page: true });
 const CREDENTIAL_FIELD_TYPES = membersOf({ text: true, password: true });
@@ -1435,7 +1454,7 @@ export function validateTeamCommand(request, context, path = "teamCommand") {
         return into.violations;
     }
     const auth = isPlainObject(context.authentication) ? context.authentication : {};
-    into.violations.push(...validateAuthenticationState(auth, `${path}.authentication`));
+    into.violations.push(...validateAuthenticationState(auth, `${path}.authentication`, { levels: contextLevels(context, "team.command.levels", path, into) }));
     const caps = isPlainObject(auth.capabilities) ? auth.capabilities : {};
     into.require((auth.status === "authenticated" || auth.status === "refreshing") && context.transport === "active", "team.command.connection", path, "lead commands require a live login and active transport");
     into.require(caps.lead === true, "team.command.capability", path, "the login must declare lead");
@@ -1529,7 +1548,7 @@ export function validateBreakCommand(method, request, state, context, path = "br
         into.add("break.command.context", path, "current authentication and transport are required");
         return into.violations;
     }
-    into.violations.push(...validateAuthenticationState(context.authentication, `${path}.authentication`));
+    into.violations.push(...validateAuthenticationState(context.authentication, `${path}.authentication`, { levels: contextLevels(context, "break.command.levels", path, into) }));
     const auth = isPlainObject(context.authentication) ? context.authentication : {};
     into.require(auth.status === "authenticated" || auth.status === "refreshing", "break.command.authentication", path, "break commands require a live authenticated login");
     into.require(isPlainObject(auth.capabilities) && auth.capabilities.breaks === true, "break.command.capability", path, "the login must declare breaks");
@@ -1677,7 +1696,7 @@ function validateBreakState(value, path, into) {
         into.require(typeof value.activeReasonId === "string" && value.activeReasonId.length > 0, "break.activeReasonId.required", `${path}.activeReasonId`, `a break ${describeValue(value.status)} on a provider that publishes reasons names the one it is on`);
     }
 }
-export function validateTeamMembers(teamMembers, path = "team", context = {}) {
+export function validateTeamMembers(teamMembers, path, context) {
     const into = new Collector();
     validateTeamMembersInto(teamMembers, path, context, into);
     return into.violations;
@@ -1724,7 +1743,7 @@ function validateTeamMembersInto(teamMembers, path, context, into) {
     }
 }
 /** One member as the lead sees them, whole: on the list, and on `team-member-updated` alone. */
-export function validateTeamMember(member, path = "member", context = {}) {
+export function validateTeamMember(member, path, context) {
     const into = new Collector();
     validateTeamMemberInto(member, path, context, into);
     return into.violations;
@@ -2299,7 +2318,7 @@ function validateNextCallInto(value, path, into) {
         into.require(key === "since", "nextCall.field", `${path}.${key}`, "unsupported field on the ask");
 }
 /** A call waiting in the agent's own queue: the caller as shown to this audience, the queue, the waits, and whether the agent may let it go. */
-export function validateLinedUp(value, path = "linedUp", levels) {
+export function validateLinedUp(value, levels, path = "linedUp") {
     const into = new Collector();
     validateLinedUpInto(value, path, into, levels);
     return into.violations;
@@ -2651,7 +2670,7 @@ export function validateHostReport(report, path = "host") {
 const LEAD_ASSIST_ACTIONS = ["request", "cancel"];
 const CONFERENCE_ACTIONS = ["add", "remove"];
 /** Validate the exact interaction/assignment target before provider command dispatch. */
-export function validateTaskCommandRequest(request, task, path = "request", taskContext) {
+export function validateTaskCommandRequest(request, task, path, taskContext) {
     const into = new Collector();
     if (!isPlainObject(request) || !isPlainObject(task)) {
         into.add("command.request.shape", path, "a request and the current published task are required");
@@ -2665,13 +2684,6 @@ export function validateTaskCommandRequest(request, task, path = "request", task
     into.violations.push(...validateTaskCommand(request.command, task, `${path}.command`, taskContext));
     return into.violations;
 }
-/**
- * What a command needs to be issuable, checked against the task it names: the capability the
- * guide's table gates it on, the phase it belongs to, and the state that has to stand -- a
- * lead requested, somebody else on the call. Without a task only the command's
- * own shape is checked. A host validates before sending, and an adapter before acting: a command
- * for a control the task never offered is the host's error, and this names it.
- */
 export function validateTaskCommand(command, task, path = "command", taskContext) {
     const into = new Collector();
     if (!isPlainObject(command)) {
@@ -2762,6 +2774,8 @@ export function validateTaskCommand(command, task, path = "command", taskContext
     }
     if (task === undefined)
         return into.violations;
+    if (taskContext === undefined)
+        throw new TypeError("validateTaskCommand: a task is validated against the manifest's levels; pass taskContext with it");
     // The task the command is held to has to be one the wire published. A host's own mapping of it,
     // handed in for want of the original, is not, and checking a command against it would be
     // checking against a task nobody has -- so the task is validated first, and a command is held
@@ -3182,7 +3196,7 @@ function validateAuthenticationChallenge(value, path, into) {
  * rejection from `complete`. A rejection carries a failure the host can show, and a login is held
  * to the same rules as any `authenticated` state.
  */
-export function validateAuthenticationResult(result, method, path = "result", context = {}) {
+export function validateAuthenticationResult(result, method, path, context) {
     const into = new Collector();
     if (!isPlainObject(result)) {
         into.add("authentication.result.shape", path, `${method} must answer an object`);
@@ -3206,7 +3220,7 @@ export function validateAuthenticationResult(result, method, path = "result", co
     }
     return into.violations;
 }
-export function validateAuthenticationState(state, path = "authentication", context = {}) {
+export function validateAuthenticationState(state, path, context) {
     const into = new Collector();
     if (!isPlainObject(state)) {
         into.add("authentication.shape", path, "an authentication state must be an object");

package/guide/agent.md

@@ -1081,7 +1081,7 @@ it no longer owns. Omni shows these controls only in the two interaction phases,
 The commands with a phase of their own -- `answer`, `accept` and `decline` in `pending`,
 `dial` in `preview`, `connect-back` in `completing`, `complete` in any -- are not among them.
 
-`validateTaskCommand(command, task)` holds a command to this table at runtime, both ways: the
+`validateTaskCommand(command, task, path, { levels })` holds a command to this table at runtime, both ways: the
 capability it needs, the phase it belongs to, and the state that has to stand. The task it wants
 is the one the provider published, not an agent application's own mapping of it: an agent application that keeps only its
 mapped shape has nothing honest to pass, and then checks shape alone, which is still worth doing

package/guide/queue.md

@@ -91,7 +91,8 @@ carries `nextCall` and `linedUp` as the member's own snapshot does, republished
 ### Runtime break prerequisite checks
 
 Use `validateBreakCommand(method, request, state, context)` from the validation entry point
-before any agent break dispatch. The context supplies current authentication and transport;
+before any agent break dispatch. The context supplies current authentication and transport, and
+the manifest's `levels` the login is validated against;
 all four methods require the live login's break capability and active transport. Pass the
 request object only to the request method, and undefined to the other three.
 
@@ -102,7 +103,7 @@ request object only to the request method, and undefined to the other three.
 | `cancelBreak` | `awaiting-approval` or `granted`. A concurrent commit winning still answers `omni.break-already-committed` and requires recovery. |
 | `endBreak` | `on-break` or `starting-after-task` during reconciliation; the agent may explicitly end a requested or forced break. |
 
-Use `validateTeamCommand(request, context)` before every lead act: the team feature switch, break
+Use `validateTeamCommand(request, context)` before every lead act, its context carrying the manifest's `levels` as the break check's does: the team feature switch, break
 decisions, forcing and ending a forced break, policy, and every act on a member's call. It requires
 the live `lead` flag and active transport, a current team member list for any command naming a
 member, and the target's complete break state for forcing/ending a break. Approve/deny requires an

package/guide.md

@@ -233,7 +233,7 @@ type Manifest<C extends Channel = Channel> = {
   idleCapabilities?: IdleCapabilities<C>;
   timeCheck?: true;
   timestampAuthority?: "provider";
-  orgLevels?: LevelDeclaration[];
+  orgLevels: LevelDeclaration[];
   dialOutcomes?: C extends "voice" ? DialOutcome[] : never;
   phones?: C extends "voice" ? Phone[] : never;
   phoneStatus?: C extends "voice" ? true : never;
@@ -765,7 +765,7 @@ type Level = string;
 
 type LevelDeclaration = {
   id: Level;
-  label: string;
+  label: LocalizedText;
 };
 
 type Locked = {
@@ -913,13 +913,13 @@ are the provider's ladder: each level states only what it sets, an enforcing pol
 the person settles the value for everyone below it, and where nothing enforces the most specific
 level that says anything wins. The protocol names a level by the id the manifest declares for it and
 never describes the chain between them: which levels a person passes through is the structure's to
-know. A typical organisation has four, and they are the defaults — `DEFAULT_LEVELS`: `org`, `site`,
-`team`, `person`, each with the label an agent computer shows. A structure that differs states its whole
-ladder in `Manifest.orgLevels`, `person` included: what the list carries is in force, and what it
+know. Every provider states its whole ladder in `Manifest.orgLevels` — a typical organisation's is
+`org`, `site`, `team`, `person` — each level with the label an agent computer shows, in the languages
+its agents read. There is no ladder by default: a default would carry its labels in one language
+only. The ladder includes `person`, and it is the whole ladder: what the list carries is in force, and what it
 leaves out does not exist — a structure with no site level declares `org`, `team`, `person`, and
 `site` is refused on its wire. A declared level is one the provider's own store actually resolves
-at: a label with no policy behind it decides nothing. A manifest that declares none has exactly
-the four. `lockedBy` is any level in force except `person`, who never locks their own value;
+at: a label with no policy behind it decides nothing. `lockedBy` is any level in force except `person`, who never locks their own value;
 `setBy` is any level in force, or `provider`, the protocol's word for "no level has said
 anything and the provider's own configuration supplied the value". An agent application renders "who decided" from the
 declared labels and needs no others, and validates every republished `authenticated` state
@@ -1319,13 +1319,6 @@ const ALLOWED_BROWSER_URL_SCHEMES = ["http:", "https:"] as const;
 const IDLE_CAPABILITIES = ["dial", "personalBrowser", "calendar", "contacts"] as const;
 type IdleCapability = (typeof IDLE_CAPABILITIES)[number];
 
-const DEFAULT_LEVELS = [
-  { id: "org", label: "Your organisation" },
-  { id: "site", label: "Your site" },
-  { id: "team", label: "Your team" },
-  { id: "person", label: "You" },
-] as const satisfies readonly LevelDeclaration[];
-
 const IDLE_CAPABILITY_UI = {
   dial: "Dialpad",
   personalBrowser: "Browser",
@@ -1762,6 +1755,12 @@ export default defineAdapter({
     supportedProtocolVersions: [OMNI_PROTOCOL_VERSION],
     authenticationMethods: ["browser-sso"],
     settleMs: 5000,
+    orgLevels: [
+      { id: "org", label: { en: "Your organisation", hi: "आपका संगठन" } },
+      { id: "site", label: { en: "Your site", hi: "आपकी साइट" } },
+      { id: "team", label: { en: "Your team", hi: "आपकी टीम" } },
+      { id: "person", label: { en: "You", hi: "आप" } },
+    ],
     idleCapabilities: {
       dial: { destinations: "any-number" },
     },
@@ -1791,7 +1790,7 @@ compile time.
 | `supportedProtocolVersions` | Required non-empty list of versions this adapter can speak. Must share at least one with Omni. |
 | `authenticationMethods` | Required non-empty list of supported login methods. |
 | `idleCapabilities` | Declares actions Omni may offer while the agent has no active task, such as voice dialing. Task controls do not belong here. |
-| `orgLevels` | The organisation's whole ladder as the provider calls it, each level with the label an agent computer shows for "who decided". Stated outright, `person` included: what it leaves out does not exist. Omitted for the typical four, `DEFAULT_LEVELS`. See **Who decides what an agent may do**. |
+| `orgLevels` | The organisation's whole ladder as the provider calls it, each level with the label an agent computer shows for "who decided", one text per language as `{ en: "Your region", hi: "आपका क्षेत्र" }`, from which the agent application picks with `localizedText()` (`manifest.orgLevel.label`, `.language`, `.text`). Required of every provider (`manifest.orgLevels.required`), stated outright, `person` included: what it leaves out does not exist. There is no default ladder. See **Who decides what an agent may do**. |
 | `phones` | Voice only, and required there: the phones this platform can put an agent on, `softphone` (the call's audio lands in the agent application) and/or `hardphone` (a handset the platform rings; the agent application shows the call and opens nothing). The agent application picks one per login. See **How the agent hears the call** in `guide/phone.md`. |
 | `phoneStatus` | Voice only, declared by presence as `true`: the platform sees the phone itself -- its registration, its do-not-disturb, its hook, its calls -- and publishes it as `Snapshot.phone` and `phone-updated`. A platform that cannot see the phone omits it, and then publishes no phone (`manifest.phoneStatus`). See **The phone's own view** in `guide/phone.md`. |
 | `dialOutcomes` | Voice only. How a dial can end on this platform, as it distinguishes them: `answered` and at least one way of not reaching the destination. Required of a provider that dials at all — an idle dialpad, or tasks that conference or call back — and a `dial-outcome` carries only a declared member. See **Every dial has an outcome** in `guide/voice.md`. |
@@ -3080,11 +3079,11 @@ same exported checks are used by Omni and adapter tests so their interpretations
 | Function | Validates |
 | --- | --- |
 | `validateManifest(manifest)` | Identity, protocol-version interoperability, authentication methods, and idle-capability shapes. |
-| `validateTask(task, { channel, locked? })` | Identity, channel agreement, phase, wrap allowance, capability shapes, custom controls, and browsers. Given `locked`, the values the queue locked, a task whose party stands locked carries none of them anywhere else (`task.locked.leak`). |
+| `validateTask(task, { channel, levels, locked? })` | Identity, channel agreement, phase, wrap allowance, capability shapes, custom controls, and browsers. Given `locked`, the values the queue locked, a task whose party stands locked carries none of them anywhere else (`task.locked.leak`). |
 | `validateSnapshot(snapshot, manifest)` | Status, break state, break reasons, team member list, the stated `taskCount` reconciled against the tasks carried, and every task, contact, and activity, including idle-capability gating both ways: a contribution the manifest never declared is refused, and one it declares is required, `[]` included. |
 | `validateEventEnvelope(envelope, manifest)` | Envelope identity, timestamp, and the payload for each event type. |
-| `validateContact(contact)` | Contact field shapes and attribute keys. Every field is optional, so this checks what is present rather than what is missing. |
-| `validateScheduledActivity(activity)` | Required activity fields and start/end ordering. |
+| `validateContact(contact, levels)` | Contact field shapes and attribute keys, and a locked number or email locked by a level `levels` names. Every field is optional, so this checks what is present rather than what is missing. |
+| `validateScheduledActivity(activity, levels)` | Required activity fields and start/end ordering, and its party as `validateContact` holds one. |
 | `validateHostGuarantees(guarantees, path?, phone?)` | What an agent application promises: only the guarantees this contract names, each declared by presence and never `false`. Given the login's phone, the mute promise is held to it: `muteUnavailableOnHold` required of a softphone login's agent application and refused of any other (`host.guarantee.muteUnavailableOnHold.required` / `.unexpected`). The harness validates the guarantees of whatever agent application a test hands the adapter, against the phone it chose. |
 | `validateProviderTimeCheckPolicy(policy)` | Explicit optional polling settings, positive safe-integer durations and round-trip/timeout/interval ordering. |
 | `validateProviderTimeCheckRequest(request)` | Fresh-request shape; the agent application enforces actual uniqueness and outstanding-request lifetime. |
@@ -3093,18 +3092,23 @@ same exported checks are used by Omni and adapter tests so their interpretations
 | `validateHistoryReport(report, path?, manifest?, task?)` | What the agent application reports of a leg it performed, for an adapter to check before forwarding: a task, a step, when it began, a positive `seconds` where stated, and an explicit `ended` that carries the final duration. Given the manifest, a running report is refused unless it declares `runningStepReports`. Given the task, the agent application's own mute beginning on a `paused` task is refused (`historyReport.muted.held`): the Mute waits for resume. |
 | `validateHostReport(report)` | The agent application's own report as published to an adapter: `online`, and where there is audio, an input that is `available` with the microphone and `flowing`, or `unavailable` with a reason and the failure that says why, and an output that is `available` or `unavailable` with its failure. The harness validates whatever agent application a test hands the adapter; `stillHost(report)` builds one that never changes. |
 | `validateNextCall(value)` | The agent's standing ask for the next call, on its own as `next-call` and `Snapshot.nextCall` carry it: since when, and nothing else (`nextCall.since`, `nextCall.field`). |
-| `validateLinedUp(value, path?, levels?)` | A call lined up in the agent's own queue, on its own as `lined-up` and `Snapshot.linedUp` carry it: the caller under the same contact rules as a task's party, the queue's label, the waits, and `release` by presence (`linedUp.*`). |
+| `validateLinedUp(value, levels, path?)` | A call lined up in the agent's own queue, on its own as `lined-up` and `Snapshot.linedUp` carry it: the caller under the same contact rules as a task's party, the queue's label, the waits, and `release` by presence (`linedUp.*`). |
 | `validateLabels(value, path?)` | The customer's words on their own, as `labels-updated` and `Snapshot.labels` carry them: renames of the protocol's phases and steps only, and every word one text per well-formed language tag (`labels.*`). |
 | `validatePhoneState(value, path?, context?)` | The phone as the platform sees it, on its own as `phone-updated` and `Snapshot.phone` carry it: its status, its one active channel, its mute where a hardphone's is observed (`phone.*`). |
 | `validateHostMute(mute, softphone)` | What the agent application's Mute does, stated on a softphone login and nowhere else: `stream` or `station` (`host.mute`), required where the agent application holds a microphone (`host.mute.required`) and refused where it does not (`host.mute.unexpected`). The harness holds `ConnectContext.host.mute` to it. |
 | `validateLanguages(languages)` | The agent's languages a host states on both contexts: a non-empty list (`context.languages`) of well-formed BCP 47 tags (`context.languages.tag`), none twice ignoring case (`context.languages.unique`). The harness holds `ConnectContext.languages` to it. |
 | `validateLoginStore(store)` | The login's store the agent application hands every connection: an object with `get`, `set` and `delete` (`store.shape`, `store.get`, `.set`, `.delete`). The harness holds `ConnectContext.store` to it. |
 | `validateCapacity(capacity)` | What the agent application states as capacity: a whole number of zero or more (`capacity.count`), zero being agent application-stopped. The harness states one on connect and two, one and zero after the test, each answered `applied`, and holds any offer to the count in force (`stream.taskOffered.overCapacity`). |
-| `validateAuthenticationResult(result, method)` | What `start()` or `complete()` answered: a challenge or a rejection, a login or a rejection. A rejection's failure is held to its rules -- an `omni.` code the contract lists, and `omni.phone-not-permitted` never retryable, since the agent's station is configuration. `validateAuthenticationFailure(failure)` is the same check on a failure alone. |
+| `validateAuthenticationResult(result, method, path, { levels })` | What `start()` or `complete()` answered: a challenge or a rejection, a login or a rejection. A rejection's failure is held to its rules -- an `omni.` code the contract lists, and `omni.phone-not-permitted` never retryable, since the agent's station is configuration. `validateAuthenticationFailure(failure)` is the same check on a failure alone. |
 | `validateRedirectUri(uri, path?)` | A host's fixed redirect URI in one of RFC 8252's forms: `https`, a reverse-domain private-use scheme, or loopback http to `127.0.0.1` or `[::1]`, with no fragment (`redirectUri.*`). |
-| `validateTaskCommand(command, task?)` | What a command needs to be issuable, against the task it names: its own shape -- a dial's `dialId`, a conference's item, a schedule's time, a remove naming exactly one person -- and, with the task, the capability the table above gates it on (`command.capability.<name>`, `.locked`), the phase it belongs to (`command.phase.*`, `command.phase.interaction` for every control on the call or the conversation), and the state that has to stand: a lead requested, somebody else still on the call (`command.conference.remove.alone`), the caller off hold before the agent's part ends (`command.endCall.held`). An agent application validates before sending and an adapter before acting. |
+| `validateTaskCommand(command, task?, path, { levels })` | What a command needs to be issuable, against the task it names: its own shape -- a dial's `dialId`, a conference's item, a schedule's time, a remove naming exactly one person -- and, with the task, the capability the table above gates it on (`command.capability.<name>`, `.locked`), the phase it belongs to (`command.phase.*`, `command.phase.interaction` for every control on the call or the conversation), and the state that has to stand: a lead requested, somebody else still on the call (`command.conference.remove.alone`), the caller off hold before the agent's part ends (`command.endCall.held`). An agent application validates before sending and an adapter before acting. |
 | `validateResult(result, method)` | What a connection method answered: the status it gives, a failure where the status says so and nowhere else, the failure's shape, and that an `omni.` code is one this contract names. |
-| `validateAuthenticationState(state)` | The identity each state must carry, the capabilities a usable login declares, and the expiry that only `authenticated` may. Omni applies it to every state a session publishes — the republished as much as the first. |
+| `validateAuthenticationState(state, path, { levels })` | The identity each state must carry, the capabilities a usable login declares, and the expiry that only `authenticated` may. Omni applies it to every state a session publishes — the republished as much as the first. |
+
+Every check that reads a level — a `lockedBy`, a `setBy` — is given `levels`, the ids of the
+manifest's `orgLevels`, and refuses any other; `validateSnapshot` and `validateEventEnvelope` take
+them from the manifest they are given, and `validateTeamCommand` and `validateBreakCommand` from
+their context's `levels` (`team.command.levels`, `break.command.levels`). No check guesses a ladder.
 
 Each returns `ProtocolViolation[]` rather than throwing, so a caller can report every problem at
 once. A violation carries a stable `rule` id such as `task.browser.url.scheme`, the `path` it was
@@ -3301,7 +3305,7 @@ cannot be established from TypeScript structure alone.
 | `assertTaskCapabilityWithdrawal(tasks, manifest, command)` | A capability withdrawn by a republish of the task is gone from the task: every task in the sequence is validated, all carry the offer's id, at least one capability the offer declared is absent at the end (a locked control is present, not withdrawn), and `command` is clean against the first task and refused against the last for want of a withdrawn capability and nothing else. Pair it with `assertCommandRefusedAfterWithdrawal` on the provider's answer. |
 | `assertCommandRefusedAfterWithdrawal(result)` | A command that arrives after its capability was withdrawn fails with `omni.capability-not-enabled`, named by the provider. The same assertion serves a command the provider never supported under a capability it declares. |
 | `assertReached(result, subjects)` | The exercise met every subject named; throws listing those it did not. Pair it with a clean `testAdapter` result. |
-| `assertAuthenticationRestoreAndExpiry(states)` | A restored authenticated session can refresh and ends in expiry. Every state is validated. |
+| `assertAuthenticationRestoreAndExpiry(states, manifest)` | A restored authenticated session can refresh and ends in expiry. Every state is validated, against the manifest's levels. |
 | `assertReconnectWithMissedAssignments(before, reconnect, ids)` | A reconnect snapshot restores assignments received while offline. |
 | `stillHost(report?, guarantees?, mute?)` | An agent application that reports one thing and never changes, for a test context: `{ online: true }` by default, a report with audio for a softphone voice adapter, and never for a hardphone. |
 | `TaskStream`, `BreakStream` | The cross-event models the harness applies after the connect snapshot, exported for an agent application that wants the same rules at its boundary: `seed(snapshot)`, then `apply(envelope)` returns the violations. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xema/omni-protocol",
-  "version": "0.1.127",
+  "version": "0.1.129",
   "description": "The Omni protocol: the contract every provider adapter implements",
   "type": "module",
   "license": "MIT",