blun-king-cli 9.1.390 → 9.1.391

package/bin/cognitive-memory-adapter.cjs

@@ -2,14 +2,25 @@
 
 const { openCognitiveStateStore } = require('./cognitive-state-store.cjs');
 
-const COGNITIVE_MEMORY_ADAPTER_VERSION = 5;
+const COGNITIVE_MEMORY_ADAPTER_VERSION = 6;
 const KIND_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 const RETENTION_CLASSES = new Set(['operational', 'durable', 'relationship', 'audit']);
-const ACCESS_KEYS = Object.freeze([
+const ACCESS_REQUIRED_KEYS = Object.freeze([
   'actorId', 'agentId', 'channelId', 'conversationId', 'permissionContext',
   'portalId', 'requestedScope', 'tenantId', 'userId',
 ]);
-const PERMISSION_KEYS = Object.freeze(['authority', 'decision', 'receiptId']);
+const ACCESS_OPTIONAL_KEYS = Object.freeze(['identityLink']);
+const PERMISSION_REQUIRED_KEYS = Object.freeze(['authority', 'decision', 'receiptId']);
+const PERMISSION_OPTIONAL_KEYS = Object.freeze(['identityReceiptId']);
+const IDENTITY_LINK_KEYS = Object.freeze([
+  'authority', 'canonicalUserId', 'confirmedAt', 'method', 'receiptId',
+  'sourcePortal', 'sourceSubjectId', 'status', 'tenantId', 'version',
+]);
+const IDENTITY_LINK_AUTHORITIES = new Map([
+  ['verified_oauth', 'oauth_verifier'],
+  ['secure_account_link', 'account_link_service'],
+  ['explicit_confirmed', 'identity_confirmation_service'],
+]);
 const REQUIRED_METHODS = Object.freeze([
   'commit',
   'read',
@@ -31,13 +42,70 @@ function exactKeys(value, expected) {
     && Object.keys(value).sort().join('\0') === [...expected].sort().join('\0');
 }
 
+function requiredAndOptionalKeys(value, required, optional) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const allowed = new Set([...required, ...optional]);
+  return required.every((key) => Object.prototype.hasOwnProperty.call(value, key))
+    && Object.keys(value).every((key) => allowed.has(key));
+}
+
 function safeId(value) {
   const text = String(value ?? '').trim();
   return KIND_RE.test(text) ? text : '';
 }
 
+function normalizeIdentityLink(access, normalized) {
+  const link = access.identityLink;
+  const identityReceiptId = normalized.permissionContext.identityReceiptId;
+  if (normalized.userId === normalized.actorId) {
+    if (link !== undefined || identityReceiptId !== undefined) fail('COGNITIVE_IDENTITY_LINK_INVALID');
+    return undefined;
+  }
+  if (link === undefined || link === null) fail('COGNITIVE_IDENTITY_LINK_REQUIRED');
+  if (!exactKeys(link, IDENTITY_LINK_KEYS)) fail('COGNITIVE_IDENTITY_LINK_INVALID');
+  if (String(link.status ?? '') === 'revoked') fail('COGNITIVE_IDENTITY_LINK_REVOKED');
+  const method = String(link.method ?? '');
+  const normalizedLink = {
+    version: Number(link.version),
+    tenantId: safeId(link.tenantId),
+    canonicalUserId: safeId(link.canonicalUserId),
+    sourcePortal: safeId(link.sourcePortal),
+    sourceSubjectId: safeId(link.sourceSubjectId),
+    method,
+    status: String(link.status ?? ''),
+    confirmedAt: String(link.confirmedAt ?? '').trim(),
+    authority: safeId(link.authority),
+    receiptId: safeId(link.receiptId),
+  };
+  if (normalizedLink.version !== 1 || normalizedLink.status !== 'active'
+      || Number.isNaN(Date.parse(normalizedLink.confirmedAt))
+      || IDENTITY_LINK_AUTHORITIES.get(method) !== normalizedLink.authority
+      || normalizedLink.tenantId !== normalized.tenantId
+      || normalizedLink.canonicalUserId !== normalized.userId
+      || normalizedLink.sourcePortal !== normalized.portalId
+      || normalizedLink.sourceSubjectId !== normalized.actorId
+      || !identityReceiptId || normalizedLink.receiptId !== identityReceiptId) {
+    fail('COGNITIVE_IDENTITY_LINK_INVALID');
+  }
+  const canonicalScope = `relationship:${normalized.userId}:private`;
+  const personalScope = `user:${normalized.userId}:private`;
+  if ((normalized.requestedScope.startsWith('relationship:') && normalized.requestedScope !== canonicalScope)
+      || (normalized.requestedScope.startsWith('user:') && normalized.requestedScope !== personalScope)) {
+    fail('COGNITIVE_IDENTITY_SCOPE_MISMATCH');
+  }
+  return Object.freeze({
+    ...normalizedLink,
+    confirmedAt: new Date(normalizedLink.confirmedAt).toISOString(),
+  });
+}
+
 function normalizeMemoryAccess(access, request) {
-  if (!exactKeys(access, ACCESS_KEYS) || !exactKeys(access.permissionContext, PERMISSION_KEYS)) {
+  if (!requiredAndOptionalKeys(access, ACCESS_REQUIRED_KEYS, ACCESS_OPTIONAL_KEYS)
+      || !requiredAndOptionalKeys(
+        access.permissionContext,
+        PERMISSION_REQUIRED_KEYS,
+        PERMISSION_OPTIONAL_KEYS,
+      )) {
     fail('COGNITIVE_MEMORY_ACCESS_INVALID');
   }
   const normalized = {
@@ -53,6 +121,9 @@ function normalizeMemoryAccess(access, request) {
       authority: safeId(access.permissionContext.authority),
       decision: String(access.permissionContext.decision ?? ''),
       receiptId: safeId(access.permissionContext.receiptId),
+      ...(Object.prototype.hasOwnProperty.call(access.permissionContext, 'identityReceiptId')
+        ? { identityReceiptId: safeId(access.permissionContext.identityReceiptId) }
+        : {}),
     },
   };
   if (!normalized.tenantId || !normalized.userId || !normalized.actorId || !normalized.agentId
@@ -66,6 +137,8 @@ function normalizeMemoryAccess(access, request) {
       || requestTenant !== normalized.tenantId || requestAgent !== normalized.agentId) {
     fail('COGNITIVE_MEMORY_ACCESS_SCOPE_MISMATCH');
   }
+  const identityLink = normalizeIdentityLink(access, normalized);
+  if (identityLink) normalized.identityLink = identityLink;
   normalized.permissionContext = Object.freeze(normalized.permissionContext);
   return Object.freeze(normalized);
 }

package/bin/cognitive-turn-lifecycle.cjs

@@ -473,7 +473,7 @@ function createCognitiveTurnLifecycle({
     const authorization = input?.authorization;
     const memoryAccess = {
       tenantId: tenant,
-      userId: String(candidate?.subject_id ?? ''),
+      userId: agent,
       actorId: agent,
       agentId: agent,
       portalId: 'cli',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.390",
+  "version": "9.1.391",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {