ec-web 0.0.20 → 0.0.22

package/dist/sources/relation-roles.js

@@ -1,26 +1,16 @@
 import fs from 'fs';
 import path from 'path';
 import { resolvePaths } from '../paths.js';
-import { getSessionsAunDir, listPeers, readJsonFile, readMessages, } from '../fs-utils.js';
+import { getSessionsAunDir, isTransientProtocolMessage, readJsonFile, readAllJsonlLines, scanChatDirs, } from '../fs-utils.js';
 import { resolveParentDistModule, toFileUrl } from './parent-package.js';
-import { ipcQuery } from '../ipc-client.js';
-async function execRoleMenu(aid, payload, auth) {
-    const response = await ipcQuery(resolvePaths().socket, {
-        type: 'menu.exec',
-        payload: { ...payload, name: 'role', agent: aid, args: { self: aid, ...(payload.args ?? {}) } },
-        auth: { source: 'ecweb', actorAid: auth.actorAid ?? null, localDirect: !!auth.localDirect },
-    }, 10_000);
-    if (!response?.ok || !response.response)
-        throw new Error(response?.error || 'Role Menu is unavailable');
-    return response.response;
-}
-function sendRoleMenuError(res, response) {
-    const error = response?.error ?? { code: 'INTERNAL_ERROR', message: 'Role Menu request failed' };
-    const status = error.code === 'NOT_FOUND' ? 404
-        : error.code === 'CONFLICT' ? 409
-            : error.code === 'PERMISSION_DENIED' || error.code === 'NOT_ALLOWED' ? 403
-                : error.code === 'TEMPORARILY_UNAVAILABLE' ? 503 : 400;
-    sendJson(res, status, { error: error.message, code: error.code, data: error.data });
+import crypto from 'node:crypto';
+function ecwebAuditContext(auth, aid, operation) {
+    return {
+        ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+        targetAgentAid: aid,
+        endpoint: auth.endpoint ?? 'ECWeb relation roles',
+        logicalToolName: operation,
+    };
 }
 async function getParentModules() {
     const configPath = resolveParentDistModule('config', 'config-manager.js');
@@ -32,8 +22,8 @@ async function getParentModules() {
     return { config, roles, resolver };
 }
 async function getCommandModules() {
-    const permissionPath = resolveParentDistModule('core', 'command', 'command-permission.js');
-    const auditPath = resolveParentDistModule('core', 'command', 'command-audit.js');
+    const permissionPath = resolveParentDistModule('core', 'auth', 'operation-authorizer.js');
+    const auditPath = resolveParentDistModule('core', 'auth', 'authorization-audit.js');
     const permission = await import(toFileUrl(permissionPath));
     const audit = await import(toFileUrl(auditPath));
     return { permission, audit };
@@ -77,9 +67,15 @@ async function getAgentsFromIpc() {
         return [];
     }
 }
-async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targetRole, args) {
-    const { permission, audit } = await getCommandModules();
-    const actorRole = auth.localDirect
+function resolveEcwebActor(modules, aid, auth) {
+    const processConfig = modules.config?.read && modules.config?.ConfigTarget
+        ? modules.config.read(modules.config.ConfigTarget.Process)
+        : undefined;
+    const processOwners = Array.isArray(processConfig?.owners)
+        ? processConfig.owners.map((value) => String(value || '').trim()).filter(Boolean)
+        : [];
+    const daemonOwner = !!auth.localDirect || (!!auth.actorAid && processOwners.includes(auth.actorAid));
+    const actorRole = daemonOwner
         ? 'owner'
         : auth.actorAid
             ? (modules.resolver.resolvePeerRoleDetail({
@@ -90,6 +86,62 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
                 conversationId: auth.actorAid,
             }).effectiveRole || 'none')
             : 'none';
+    return {
+        daemonOwner,
+        actorRole,
+        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+    };
+}
+async function authorizeRoleAssignmentRead(modules, aid, auth) {
+    const { permission, audit } = await getCommandModules();
+    const actor = resolveEcwebActor(modules, aid, auth);
+    const decision = permission.authorizeCommand({
+        intent: {
+            operation: 'role.relation.read',
+            scope: 'agent',
+            source: 'ecweb',
+            args: { self: aid },
+        },
+        actorId: actor.actorId,
+        selfAid: aid,
+        role: actor.actorRole,
+        processRole: actor.daemonOwner ? 'daemon-owner' : 'none',
+        isDaemonOwner: actor.daemonOwner,
+        source: 'ecweb',
+    });
+    await audit.auditCommandAuthorization({
+        ts: Date.now(),
+        source: 'ecweb',
+        operation: 'role.relation.read',
+        scope: 'agent',
+        dangerous: false,
+        actorId: actor.actorId,
+        selfAid: aid,
+        role: actor.actorRole,
+        processRole: actor.daemonOwner ? 'daemon-owner' : 'none',
+        isDaemonOwner: actor.daemonOwner,
+        decision: decision.allow ? 'allow' : 'deny',
+        code: decision.allow ? undefined : decision.code,
+        reason: decision.allow ? undefined : decision.reason,
+        matchedRule: decision.matchedRule,
+        argsSummary: { self: aid },
+        ...ecwebAuditContext(auth, aid, 'role.relation.read'),
+    });
+    if (decision.allow)
+        return { allow: true, actorRole: actor.actorRole };
+    return {
+        allow: false,
+        status: 403,
+        error: 'forbidden: role assignment read not allowed',
+        code: decision.code,
+        reason: decision.reason,
+        actorRole: actor.actorRole,
+    };
+}
+async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targetRole, args) {
+    const { permission, audit } = await getCommandModules();
+    const actor = resolveEcwebActor(modules, aid, auth);
+    const { daemonOwner, actorRole } = actor;
     const targetPeerId = typeof args.peerId === 'string' ? args.peerId : undefined;
     if (targetPeerId && modules.resolver.isStaticAgentOwner?.(aid, targetPeerId)) {
         const reason = `Static owner ${targetPeerId} is defined in agents/${aid}/config.json and cannot be changed by relation role assignments`;
@@ -99,13 +151,16 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             operation,
             scope: 'agent',
             dangerous: false,
-            actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+            actorId: actor.actorId,
             selfAid: aid,
             role: actorRole,
+            processRole: daemonOwner ? 'daemon-owner' : 'none',
+            isDaemonOwner: daemonOwner,
             decision: 'deny',
             code: 'IMMUTABLE_STATIC_OWNER',
             reason,
             argsSummary: { ...args, targetRole },
+            ...ecwebAuditContext(auth, aid, operation),
         });
         return {
             allow: false,
@@ -126,9 +181,11 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
                 targetRole,
             },
         },
-        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+        actorId: actor.actorId,
         selfAid: aid,
         role: actorRole,
+        processRole: daemonOwner ? 'daemon-owner' : 'none',
+        isDaemonOwner: daemonOwner,
         source: 'ecweb',
     });
     if (!decision.allow) {
@@ -138,14 +195,17 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             operation,
             scope: 'agent',
             dangerous: false,
-            actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+            actorId: actor.actorId,
             selfAid: aid,
             role: actorRole,
+            processRole: daemonOwner ? 'daemon-owner' : 'none',
+            isDaemonOwner: daemonOwner,
             decision: 'deny',
             code: decision.code,
             reason: decision.reason,
             matchedRule: decision.matchedRule,
             argsSummary: { ...args, targetRole },
+            ...ecwebAuditContext(auth, aid, operation),
         });
         return {
             allow: false,
@@ -156,9 +216,9 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             actorRole,
         };
     }
-    const policyAllowed = operation === 'role.assign'
+    const policyAllowed = daemonOwner || (operation === 'role.assign'
         ? !!targetRole && canAssignRole(actorRole, targetRole)
-        : canRevokeRole(actorRole, targetRole);
+        : canRevokeRole(actorRole, targetRole));
     if (!policyAllowed) {
         const reason = operation === 'role.assign'
             ? `Role ${actorRole} cannot assign target role ${targetRole || '(missing)'}`
@@ -169,14 +229,17 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             operation,
             scope: 'agent',
             dangerous: false,
-            actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+            actorId: actor.actorId,
             selfAid: aid,
             role: actorRole,
+            processRole: daemonOwner ? 'daemon-owner' : 'none',
+            isDaemonOwner: daemonOwner,
             decision: 'deny',
             code: 'NOT_ALLOWED',
             reason,
             matchedRule: decision.matchedRule,
             argsSummary: { ...args, targetRole },
+            ...ecwebAuditContext(auth, aid, operation),
         });
         return {
             allow: false,
@@ -193,12 +256,15 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
         operation,
         scope: 'agent',
         dangerous: false,
-        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+        actorId: actor.actorId,
         selfAid: aid,
         role: actorRole,
+        processRole: daemonOwner ? 'daemon-owner' : 'none',
+        isDaemonOwner: daemonOwner,
         decision: 'allow',
         matchedRule: decision.matchedRule,
         argsSummary: { ...args, targetRole },
+        ...ecwebAuditContext(auth, aid, operation),
     });
     return { allow: true, actorRole };
 }
@@ -271,12 +337,6 @@ function relationTargetFromId(raw) {
     }
     return { peerKey: formatPeerKey('aun', value), channelId: value };
 }
-function readActive(aunDir, aid, conversationId) {
-    return readJsonFile(path.join(aunDir, encodeSegmentForRoleSource(aid), encodeSegmentForRoleSource(conversationId), 'active.json'));
-}
-function encodeSegmentForRoleSource(s) {
-    return s.replace(/[<>:"/\\|?*\x00-\x1F%]/g, ch => '%' + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
-}
 function frontmatterValue(frontmatter, key) {
     const re = new RegExp(`^${key}:\\s*(?:"([^"]*)"|'([^']*)'|([^\\r\\n#]*))\\s*(?:#.*)?$`, 'm');
     const match = frontmatter.match(re);
@@ -328,6 +388,20 @@ function createLocalAgentMdLookup() {
         return info;
     };
 }
+function readPeerVerificationStatus(selfAid, peerId) {
+    if (!selfAid || !peerId)
+        return 'unknown';
+    const peerKey = formatPeerKey('aun', peerId);
+    const identity = readJsonFile(path.join(resolvePaths().root, 'agents', selfAid, 'relations', peerKey, 'peer-identity.json'));
+    const raw = String(identity?.source ?? identity?.verifyStatus ?? identity?.verify_status ?? '').trim().toLowerCase();
+    if (raw === 'agentmd' || raw === 'verified')
+        return 'agentmd';
+    if (raw === 'agentmd-unverified' || raw === 'unverified')
+        return 'agentmd-unverified';
+    if (raw === 'invalid')
+        return 'invalid';
+    return 'unknown';
+}
 function latestMessageAt(messages) {
     let lastAt = 0;
     for (const message of messages) {
@@ -366,7 +440,7 @@ function firstMessagePeerType(messages, peerId) {
 function conversationSortName(seed) {
     return (seed.name || seed.peerAid || seed.groupId || seed.conversationId).toLowerCase();
 }
-function groupMembersFromMessages(selfAid, messages, localAgentMdLookup) {
+function groupMembersFromMessages(selfAid, messages, localAgentMdLookup, peerVerificationLookup) {
     const members = new Map();
     for (const message of messages) {
         const sender = message.from;
@@ -396,6 +470,7 @@ function groupMembersFromMessages(selfAid, messages, localAgentMdLookup) {
         const localInfo = localAgentMdLookup(member.peerId);
         member.peerName = localInfo?.name ?? member.peerName;
         member.peerType = localInfo?.peerType ?? member.peerType;
+        member.verifyStatus = peerVerificationLookup(selfAid, member.peerId);
     }
     return [...members.values()].sort((a, b) => {
         const lastDiff = (b.lastAt ?? 0) - (a.lastAt ?? 0);
@@ -404,7 +479,7 @@ function groupMembersFromMessages(selfAid, messages, localAgentMdLookup) {
         return (a.peerName || a.peerAid).localeCompare(b.peerName || b.peerAid);
     });
 }
-export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () => undefined) {
+export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () => undefined, peerVerificationLookup = readPeerVerificationStatus) {
     const seeds = [];
     for (const peer of peerInfos) {
         const messages = peer.messages || [];
@@ -426,7 +501,7 @@ export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () =
                 lastAt,
                 inbound: counts.inbound,
                 outbound: counts.outbound,
-                members: groupMembersFromMessages(aid, messages, localAgentMdLookup),
+                members: groupMembersFromMessages(aid, messages, localAgentMdLookup, peerVerificationLookup),
             });
             continue;
         }
@@ -447,6 +522,7 @@ export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () =
             peerKey: peerId,
             peerName,
             peerType,
+            verifyStatus: peerVerificationLookup(aid, peerId),
             lastAt,
             inbound: counts.inbound,
             outbound: counts.outbound,
@@ -463,13 +539,20 @@ export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () =
 }
 function loadConversationSeeds(aid) {
     const aunDir = getSessionsAunDir();
+    const peerInfoById = new Map();
+    for (const chat of scanChatDirs(aunDir).filter(item => item.channelType === 'aun' && item.selfAID === aid)) {
+        const current = peerInfoById.get(chat.channelId) ?? { conversationId: chat.channelId, messages: [] };
+        const active = readJsonFile(path.join(chat.dirPath, 'active.json'));
+        if (active && (!current.active || Number(active.updatedAt || 0) >= Number(current.active.updatedAt || 0))) {
+            current.active = active;
+        }
+        current.messages.push(...readAllJsonlLines(path.join(chat.dirPath, 'messages.jsonl'))
+            .filter(message => !isTransientProtocolMessage(message)));
+        peerInfoById.set(chat.channelId, current);
+    }
     const localAgentMdLookup = createLocalAgentMdLookup();
-    const peerInfos = listPeers(aunDir, aid).map(conversationId => ({
-        conversationId,
-        active: readActive(aunDir, aid, conversationId),
-        messages: readMessages(aunDir, aid, conversationId),
-    }));
-    return buildConversationSeeds(aid, peerInfos, localAgentMdLookup);
+    const peerInfos = [...peerInfoById.values()];
+    return buildConversationSeeds(aid, peerInfos, localAgentMdLookup, readPeerVerificationStatus);
 }
 function readRelationConfig(config, aid, peerKey) {
     return config.read(config.ConfigTarget.Relation, { self: aid, peerKey }, { cache: true }) || {};
@@ -492,8 +575,8 @@ function explicitAssignment(scope, peerKey, role, ids) {
 function resolveGroupRoleDetail(modules, aid, groupId) {
     const target = relationTargetFromId(groupId);
     const relation = readRelationConfig(modules.config, aid, target.peerKey);
-    const assigned = typeof relation.roles?.assigned === 'string' && roleExists(modules.roles, aid, relation.roles.assigned)
-        ? relation.roles.assigned
+    const assigned = typeof relation.role === 'string' && roleExists(modules.roles, aid, relation.role)
+        ? relation.role
         : null;
     if (assigned) {
         return {
@@ -519,7 +602,7 @@ function assignmentForDetail(detail, modules, seed, member) {
     if (member && detail.source === 'group-member') {
         return explicitAssignment('group-member', groupTarget.peerKey, role, { groupId: groupTarget.channelId, peerId: member.peerId });
     }
-    if (member && detail.source === 'private-inherited') {
+    if (member && (detail.source === 'private-inherited' || detail.source === 'relation-actor')) {
         const privateTarget = relationTargetFromId(member.peerId);
         return explicitAssignment('private', privateTarget.peerKey, role, { peerId: member.peerId });
     }
@@ -584,38 +667,23 @@ function listRelationRoleAssignments(config, aid) {
             continue;
         const peerKey = entry.name;
         const relation = readRelationConfig(config, aid, peerKey);
-        const roles = relation.roles;
-        if (!roles || typeof roles !== 'object')
-            continue;
         const parsed = parsePeerKey(peerKey);
-        const hasMembers = roles.members && typeof roles.members === 'object' && Object.keys(roles.members).length > 0;
-        if (typeof roles.assigned === 'string') {
-            out.push({
-                scope: hasMembers ? 'group' : 'private',
-                peerKey,
-                role: roles.assigned,
-                ...(hasMembers ? { groupId: parsed.channelId } : { peerId: parsed.channelId }),
-                source: 'relation-config',
-            });
-        }
-        if (roles.members && typeof roles.members === 'object') {
-            for (const [peerId, role] of Object.entries(roles.members)) {
-                if (typeof role !== 'string')
-                    continue;
-                out.push({
-                    scope: 'group-member',
-                    peerKey,
-                    groupId: parsed.channelId,
-                    peerId,
-                    role,
-                    source: 'relation-config',
-                });
-            }
-        }
+        if (typeof relation.role !== 'string')
+            continue;
+        const isGroup = relation.targetKind === 'group'
+            || /^group\.agentid\.pub\//i.test(parsed.channelId);
+        out.push(isGroup
+            ? { scope: 'group', groupId: parsed.channelId, peerKey, role: relation.role, source: 'relation-config' }
+            : { scope: 'private', peerId: parsed.channelId, peerKey, role: relation.role, source: 'relation-config' });
     }
     return out;
 }
 async function buildSnapshot(auth = {}) {
+    auth = {
+        ...auth,
+        ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+        endpoint: auth.endpoint ?? 'WS snapshot:roles',
+    };
     const modules = await getParentModules();
     const agents = await getAgentsFromIpc();
     const snapshotAgents = [];
@@ -624,26 +692,17 @@ async function buildSnapshot(auth = {}) {
         const aid = agent.aid;
         if (!aid)
             continue;
-        const [roleOptions, defaults, assignmentResult] = await Promise.all([
-            execRoleMenu(aid, {
-                type: 'menu.options', id: `ecweb-relation-role-options-${Date.now()}`,
-                args: { option: 'roles' },
-            }, auth),
-            execRoleMenu(aid, {
-                type: 'menu.query', id: `ecweb-relation-role-defaults-${Date.now()}`,
-                args: { view: 'defaults' },
-            }, auth),
-            listAssignmentsThroughMenu(aid, auth),
-        ]);
-        if (roleOptions.error || defaults.error || assignmentResult.error)
+        const readDecision = await authorizeRoleAssignmentRead(modules, aid, auth);
+        if (!readDecision.allow)
             continue;
+        const roleConfig = modules.roles.readRolesConfig(aid);
         snapshotAgents.push({
             aid,
             displayName: agent.displayName ?? agent.personalName,
             name: agent.name,
-            roles: roleOptions.data.filter((item) => item.assignable).map((item) => item.value),
-            defaultRoles: defaults.data.defaultRoles,
-            assignments: assignmentResult.data.assignments,
+            roles: Object.keys(roleConfig.roles || {}).filter(role => isAssignableUserRole(role)),
+            defaultRoles: roleConfig.defaultRoles ?? { private: null, group: null },
+            assignments: listRelationRoleAssignments(modules.config, aid),
         });
         for (const seed of loadConversationSeeds(aid)) {
             conversations.push(withResolvedRoles(seed, modules));
@@ -655,7 +714,11 @@ export const relationRolesSource = {
     kind: 'roles',
     async snapshot(params = {}) {
         try {
-            return await buildSnapshot(params.__menuAuth ?? {});
+            return await buildSnapshot({
+                ...(params.__menuAuth ?? {}),
+                ecwebRequestId: params.__ecwebRequestId,
+                endpoint: params.__ecwebEndpoint,
+            });
         }
         catch (err) {
             return { agents: [], conversations: [], error: String(err) };
@@ -691,80 +754,12 @@ function scopedAssignmentArgs(body, fallbackTargetId) {
     const peerId = body.peerId || fallbackTargetId;
     if (!groupRaw || !peerId)
         throw new Error('groupId and peerId are required');
-    const target = relationTargetFromId(groupRaw);
-    return { scope, groupId: target.channelId, peerId, peerKey: target.peerKey };
-}
-function toMenuTarget(target) {
-    if (target.scope === 'private')
-        return { kind: 'private', peerAid: target.peerId };
-    if (target.scope === 'group')
-        return { kind: 'group', groupId: target.groupId };
-    return { kind: 'group-member', groupId: target.groupId, memberAid: target.peerId };
-}
-function toLegacyAssignment(target, role) {
-    if (target.scope === 'private')
-        return { scope: 'private', peerId: target.peerId, peerKey: target.peerKey, role, source: 'relation-config' };
-    if (target.scope === 'group')
-        return { scope: 'group', groupId: target.groupId, peerKey: target.peerKey, role, source: 'relation-config' };
-    return { scope: 'group-member', groupId: target.groupId, peerId: target.peerId, peerKey: target.peerKey, role, source: 'relation-config' };
-}
-async function updateAssignmentThroughMenu(aid, body, fallbackTargetId, role, auth) {
-    const target = scopedAssignmentArgs(body, fallbackTargetId);
-    const menuTarget = toMenuTarget(target);
-    const snapshot = await execRoleMenu(aid, {
-        type: 'menu.query', id: `ecweb-assignment-target-${Date.now()}`,
-        args: { view: 'target', target: menuTarget },
-    }, auth);
-    if (snapshot.error)
-        return { response: snapshot, target };
-    const response = await execRoleMenu(aid, {
-        type: 'menu.update', id: `ecweb-assignment-update-${Date.now()}`,
-        args: {
-            resource: 'assignment',
-            target: menuTarget,
-            expectedPolicyRevision: snapshot.data.policyRevision,
-            expectedRelationRevision: snapshot.data.relationRevision,
-        },
-        value: JSON.stringify(role),
-    }, auth);
-    return { response, target };
-}
-async function listAssignmentsThroughMenu(aid, auth) {
-    const items = [];
-    let cursor = null;
-    do {
-        const response = await execRoleMenu(aid, {
-            type: 'menu.query', id: `ecweb-assignment-list-${Date.now()}-${items.length}`,
-            args: { view: 'assignments', limit: 200, cursor },
-        }, auth);
-        if (response.error)
-            return response;
-        items.push(...response.data.items);
-        cursor = response.data.nextCursor;
-    } while (cursor);
-    const assignments = items
-        .filter((item) => item.target?.kind !== 'default' && item.target?.kind !== 'unknown')
-        .map((item) => {
-        const target = item.target;
-        if (target.kind === 'private')
-            return { scope: 'private', peerId: target.peerAid, peerKey: target.peerKey, role: item.roleId, source: 'relation-config' };
-        if (target.kind === 'group')
-            return { scope: 'group', groupId: target.groupId, peerKey: target.peerKey, role: item.roleId, source: 'relation-config' };
-        return { scope: 'group-member', groupId: target.groupId, peerId: target.memberAid, peerKey: target.peerKey, role: item.roleId, source: 'relation-config' };
-    });
-    return { data: { $schema_version: 1, assignments } };
-}
-function pruneEmptyRoles(config) {
-    const roles = config.roles;
-    if (!roles || typeof roles !== 'object')
-        return config;
-    if (roles.members && typeof roles.members === 'object' && Object.keys(roles.members).length === 0) {
-        delete roles.members;
-    }
-    if (!Object.prototype.hasOwnProperty.call(roles, 'assigned') && !roles.members) {
-        delete config.roles;
-    }
-    return config;
+    const groupTarget = relationTargetFromId(groupRaw);
+    // The canonical relation schema has one role per relation. A member override
+    // is therefore stored on that member's private relation; groupId is retained
+    // only for the ECWeb presentation layer.
+    const memberTarget = relationTargetFromId(peerId);
+    return { scope, groupId: groupTarget.channelId, peerId, peerKey: memberTarget.peerKey };
 }
 function setScopedAssignment(configMod, aid, body, fallbackTargetId) {
     const target = scopedAssignmentArgs(body, fallbackTargetId);
@@ -772,15 +767,12 @@ function setScopedAssignment(configMod, aid, body, fallbackTargetId) {
     if (!role)
         throw new Error('role is required');
     const config = readRelationConfig(configMod, aid, target.peerKey);
-    const roles = config.roles && typeof config.roles === 'object' ? { ...config.roles } : {};
-    if (target.scope === 'group-member') {
-        roles.members = roles.members && typeof roles.members === 'object' ? { ...roles.members } : {};
-        roles.members[target.peerId] = role;
-    }
-    else {
-        roles.assigned = role;
-    }
-    writeRelationConfig(configMod, aid, target.peerKey, { ...config, roles });
+    const next = { ...config };
+    delete next.roles;
+    next.$schema_version = 8;
+    next.targetKind = target.scope === 'group' ? 'group' : 'private';
+    next.role = role;
+    writeRelationConfig(configMod, aid, target.peerKey, next);
     if (target.scope === 'private')
         return { scope: 'private', peerId: target.peerId, peerKey: target.peerKey, role, source: 'relation-config' };
     if (target.scope === 'group')
@@ -790,11 +782,10 @@ function setScopedAssignment(configMod, aid, body, fallbackTargetId) {
 function getScopedAssignment(configMod, aid, body, fallbackTargetId) {
     const target = scopedAssignmentArgs(body, fallbackTargetId);
     const config = readRelationConfig(configMod, aid, target.peerKey);
+    const role = config.role;
     if (target.scope === 'group-member') {
-        const role = config.roles?.members?.[target.peerId];
         return explicitAssignment('group-member', target.peerKey, role, { groupId: target.groupId, peerId: target.peerId });
     }
-    const role = config.roles?.assigned;
     if (target.scope === 'private')
         return explicitAssignment('private', target.peerKey, role, { peerId: target.peerId });
     return explicitAssignment('group', target.peerKey, role, { groupId: target.groupId });
@@ -802,34 +793,32 @@ function getScopedAssignment(configMod, aid, body, fallbackTargetId) {
 function deleteScopedAssignment(configMod, aid, body, fallbackTargetId) {
     const target = scopedAssignmentArgs(body, fallbackTargetId);
     const config = readRelationConfig(configMod, aid, target.peerKey);
-    if (!config.roles || typeof config.roles !== 'object')
+    const deleted = typeof config.role === 'string';
+    if (!deleted)
         return false;
-    const roles = { ...config.roles };
-    let deleted = false;
-    if (target.scope === 'group-member') {
-        const members = roles.members && typeof roles.members === 'object' ? { ...roles.members } : {};
-        deleted = Object.prototype.hasOwnProperty.call(members, target.peerId);
-        delete members[target.peerId];
-        roles.members = members;
-    }
-    else {
-        deleted = Object.prototype.hasOwnProperty.call(roles, 'assigned');
-        delete roles.assigned;
-    }
-    writeRelationConfig(configMod, aid, target.peerKey, pruneEmptyRoles({ ...config, roles }));
+    const next = { ...config };
+    delete next.role;
+    delete next.roles;
+    writeRelationConfig(configMod, aid, target.peerKey, next);
     return deleted;
 }
 export async function handleRelationRolesApi(req, res, auth = {}) {
     try {
         const urlPath = (req.url || '').split('?')[0];
+        auth = {
+            ...auth,
+            ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+            endpoint: auth.endpoint ?? `${req.method ?? 'UNKNOWN'} ${urlPath}`,
+        };
+        const modules = await getParentModules();
         if (req.method === 'GET' && urlPath.startsWith('/api/roles/agent/')) {
             const aid = decodeURIComponent(urlPath.split('/').filter(Boolean).pop() || '');
             if (!aid)
                 return sendJson(res, 400, { error: 'missing aid' });
-            const result = await listAssignmentsThroughMenu(aid, auth);
-            if (result.error)
-                return sendRoleMenuError(res, result);
-            return sendJson(res, 200, result.data);
+            const decision = await authorizeRoleAssignmentRead(modules, aid, auth);
+            if (!decision.allow)
+                return sendAuthorizationDenied(res, decision);
+            return sendJson(res, 200, { $schema_version: 1, assignments: listRelationRoleAssignments(modules.config, aid) });
         }
         if ((req.method === 'POST' || req.method === 'PUT') && urlPath.startsWith('/api/roles/agent/')) {
             const aid = decodeURIComponent(urlPath.split('/').filter(Boolean).pop() || '');
@@ -839,10 +828,15 @@ export async function handleRelationRolesApi(req, res, auth = {}) {
             if (typeof body.role !== 'string' || !body.role) {
                 return sendJson(res, 400, { error: 'role is required' });
             }
-            const result = await updateAssignmentThroughMenu(aid, body, undefined, body.role, auth);
-            if (result.response.error)
-                return sendRoleMenuError(res, result.response);
-            return sendJson(res, 200, { ok: true, assignment: toLegacyAssignment(result.target, body.role) });
+            if (!roleExists(modules.roles, aid, body.role))
+                return sendJson(res, 404, { error: 'role not found' });
+            const target = scopedAssignmentArgs(body);
+            const decision = await authorizeRoleAssignmentWrite(modules, aid, auth, 'role.assign', body.role, {
+                scope: body.scope, peerId: target.peerId, groupId: target.groupId, peerKey: target.peerKey,
+            });
+            if (!decision.allow)
+                return sendAuthorizationDenied(res, decision);
+            return sendJson(res, 200, { ok: true, assignment: setScopedAssignment(modules.config, aid, body) });
         }
         return sendJson(res, 404, { error: 'not found' });
     }
@@ -853,25 +847,40 @@ export async function handleRelationRolesApi(req, res, auth = {}) {
 export async function handlePeerRoleApi(req, res, auth = {}) {
     try {
         const urlPath = (req.url || '').split('?')[0];
+        auth = {
+            ...auth,
+            ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+            endpoint: auth.endpoint ?? `${req.method ?? 'UNKNOWN'} ${urlPath}`,
+        };
         const target = assignmentFromPath(urlPath);
         if (!target)
             return sendJson(res, 400, { error: 'missing aid or target id' });
+        const modules = await getParentModules();
         if (req.method === 'DELETE') {
             const body = await parseBody(req);
-            const result = await updateAssignmentThroughMenu(target.aid, body, target.targetId, null, auth);
-            if (result.response.error)
-                return sendRoleMenuError(res, result.response);
-            return sendJson(res, 200, { ok: true, deleted: result.response.data.changed });
+            const scoped = scopedAssignmentArgs(body, target.targetId);
+            const current = getScopedAssignment(modules.config, target.aid, body, target.targetId);
+            const decision = await authorizeRoleAssignmentWrite(modules, target.aid, auth, 'role.revoke', current?.role, {
+                scope: body.scope, peerId: scoped.peerId, groupId: scoped.groupId, peerKey: scoped.peerKey,
+            });
+            if (!decision.allow)
+                return sendAuthorizationDenied(res, decision);
+            return sendJson(res, 200, { ok: true, deleted: deleteScopedAssignment(modules.config, target.aid, body, target.targetId) });
         }
         if (req.method === 'PUT') {
             const body = await parseBody(req);
             if (typeof body.role !== 'string' || !body.role) {
                 return sendJson(res, 400, { error: 'role is required' });
             }
-            const result = await updateAssignmentThroughMenu(target.aid, body, target.targetId, body.role, auth);
-            if (result.response.error)
-                return sendRoleMenuError(res, result.response);
-            return sendJson(res, 200, { ok: true, assignment: toLegacyAssignment(result.target, body.role) });
+            if (!roleExists(modules.roles, target.aid, body.role))
+                return sendJson(res, 404, { error: 'role not found' });
+            const scoped = scopedAssignmentArgs(body, target.targetId);
+            const decision = await authorizeRoleAssignmentWrite(modules, target.aid, auth, 'role.assign', body.role, {
+                scope: body.scope, peerId: scoped.peerId, groupId: scoped.groupId, peerKey: scoped.peerKey,
+            });
+            if (!decision.allow)
+                return sendAuthorizationDenied(res, decision);
+            return sendJson(res, 200, { ok: true, assignment: setScopedAssignment(modules.config, target.aid, body, target.targetId) });
         }
         return sendJson(res, 404, { error: 'not found' });
     }