evolcore 0.0.11 → 0.0.12

package/dist/core/command/connect-menu.js

@@ -331,6 +331,21 @@ async function actionReviewRequest(req, self, context, decision) {
         decision,
     });
     if (reviewed.code === 'approved' || reviewed.code === 'rejected' || reviewed.code === 'blocked') {
+        if (reviewed.requestId && reviewed.expiresAt) {
+            try {
+                await context.notifyContactRequestReviewed?.({
+                    applicantAid: primaryId,
+                    requestId: reviewed.requestId,
+                    expiresAt: reviewed.expiresAt,
+                    status: reviewed.code === 'approved'
+                        ? 'APPROVED'
+                        : reviewed.code === 'rejected' ? 'REJECTED' : 'NOT_ALLOWED',
+                });
+            }
+            catch {
+                // Review state is authoritative; notification delivery is best-effort.
+            }
+        }
         return ok({
             self,
             action: `${decision}-request`,

package/dist/core/command/group-menu.js

@@ -1,6 +1,6 @@
 import crypto from 'crypto';
 import { ConfigTarget, mutateConfig, read as readConfig, resolveEffectiveFieldWithSource, } from '../../config/config-manager.js';
-import { dispatchToMentionMode } from '../../config/mention-mode.js';
+import { normalizeMentionMode } from '../../config/mention-mode.js';
 import { readRolesConfig } from '../../config/roles.js';
 import { groupInfo, groupList } from '../../aun/msg/group.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
@@ -156,9 +156,9 @@ async function resolveTarget(args, context) {
         scope,
         selector: { self: context.self, peerKey: formatPeerKey('aun', canonicalGroupId) },
         groupId: canonicalGroupId,
-        aunMentionMode: dispatchToMentionMode(group.dispatch_mode
-            ?? group.settings?.dispatch_mode
-            ?? group.metadata?.dispatch_mode),
+        aunMentionMode: normalizeMentionMode(group.mention_mode)
+            ?? normalizeMentionMode(group.settings?.mention_mode)
+            ?? normalizeMentionMode(group.metadata?.mention_mode),
     };
 }
 function groupIdFromArgs(args, currentGroupId) {

package/dist/core/command/menu-catalog.js

@@ -0,0 +1,366 @@
+import { createHash } from 'node:crypto';
+import { groupInfo, groupMembers } from '../../aun/msg/group.js';
+import { formatPeerKey } from '../relation/peer-identity.js';
+import { authorizeAccess, authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
+import { ConfigTarget, read as readConfig } from '../../config/config-manager.js';
+import { readRolesConfig } from '../../config/roles.js';
+import { normalizeMenuError } from './menu-protocol.js';
+import { isValidAid } from '../../aun/aid/validation.js';
+const DEFAULT_DIRECTORY = { getGroup: groupInfo, getMembers: groupMembers };
+export function validateMenuValueBatchArgs(args) {
+    if (!args || typeof args !== 'object' || Array.isArray(args))
+        throw { code: 'INVALID_ARGUMENT', message: 'batch args must be an object' };
+    const allowed = new Set(['view', 'schemaVersion', 'consistency', 'context', 'items']);
+    const unknown = Object.keys(args).find(key => !allowed.has(key));
+    if (unknown)
+        throw { code: 'INVALID_ARGUMENT', message: `unsupported batch argument: ${unknown}` };
+    if (args.view !== 'values')
+        throw { code: 'NOT_SUPPORTED', message: 'batch requires args.view=values' };
+}
+export function validateMenuCatalogArgs(args) {
+    if (!args || typeof args !== 'object' || Array.isArray(args))
+        throw { code: 'INVALID_ARGUMENT', message: 'catalog args must be an object' };
+    const allowed = new Set(['view', 'acceptSchemaVersions', 'context']);
+    const unknown = Object.keys(args).find(key => !allowed.has(key));
+    if (unknown)
+        throw { code: 'INVALID_ARGUMENT', message: `unsupported catalog argument: ${unknown}` };
+    if (args.view !== 'catalog')
+        throw { code: 'NOT_SUPPORTED', message: 'catalog requires args.view=catalog' };
+    assertMenuSchemaVersion(args.acceptSchemaVersions);
+}
+function normalizeContextRequest(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw { code: 'INVALID_CONTEXT', message: 'context must be an object' };
+    }
+    const raw = value;
+    const unknown = Object.keys(raw).find(key => key !== 'kind' && key !== 'groupId');
+    if (unknown)
+        throw { code: 'INVALID_CONTEXT', message: `context field is unsupported: ${unknown}` };
+    if (raw.kind !== undefined && (typeof raw.kind !== 'string' || !['private_relation', 'group_relation', 'agent', 'process'].includes(raw.kind))) {
+        throw { code: 'INVALID_CONTEXT', message: 'context.kind is unsupported' };
+    }
+    if (raw.groupId !== undefined && (typeof raw.groupId !== 'string' || !raw.groupId.trim())) {
+        throw { code: 'INVALID_CONTEXT', message: 'context.groupId must be a non-empty string' };
+    }
+    return {
+        ...(raw.kind !== undefined ? { kind: raw.kind } : {}),
+        ...(raw.groupId !== undefined ? { groupId: raw.groupId.trim() } : {}),
+    };
+}
+export function assertMenuSchemaVersion(value) {
+    if (value === undefined || value === null)
+        return;
+    const versions = Array.isArray(value) ? value : [value];
+    if (!versions.some(version => version === 1)) {
+        throw { code: 'SCHEMA_VERSION_UNSUPPORTED', message: 'Only Menu schema version 1 is supported' };
+    }
+}
+const relation = (id, name, label, order, cmd, operation, extra) => ({
+    id, type: 'setting', contexts: ['private_relation', 'group_relation'], name, label, section: 'relation_behavior', order,
+    query: { cmd, operation, scope: 'relation' }, options: { cmd, operation: operation === 'model.current' ? 'model.list' : operation, scope: 'relation' },
+    ...extra,
+});
+const ENTRIES = [
+    relation('model.relation', 'model', '模型', 10, '/model', 'model.current', { options: { cmd: '/model', operation: 'model.list', scope: 'relation', mode: 'dynamic' }, update: { cmd: '/model', operation: 'model.use', scope: 'relation' }, control: 'select' }),
+    relation('effort.relation', 'effort', '推理强度', 20, '/effort', 'model.effort.current', { options: { cmd: '/effort', operation: 'model.effort.current', scope: 'relation', mode: 'dynamic', dependsOn: ['model.relation'] }, update: { cmd: '/effort', operation: 'model.effort', scope: 'relation' }, control: 'select' }),
+    relation('chatmode.relation', 'chatmode', '对话模式', 30, '/chatmode', 'chatmode.current', { options: { cmd: '/chatmode', operation: 'chatmode.current', scope: 'relation', mode: 'static', items: [{ value: 'interactive', label: '交互模式' }, { value: 'proactive', label: '主动模式' }] }, update: { cmd: '/chatmode', operation: 'chatmode.update', scope: 'relation' }, control: 'select' }),
+    relation('activity.relation', 'activity', '中间输出', 40, '/activity', 'activity.current', { options: { cmd: '/activity', operation: 'activity.current', scope: 'relation', mode: 'static', items: [{ value: 'all', label: '私聊显示' }, { value: 'text', label: '仅文字进展' }, { value: 'none', label: '全部静默' }] }, update: { cmd: '/activity', operation: 'activity.update', scope: 'relation' }, control: 'select' }),
+    relation('permissionMode.relation', 'permission', '权限模式', 50, '/perm', 'permission.current', { query: { cmd: '/perm', args: { scope: 'role' }, operation: 'permission.current', scope: 'relation' }, options: undefined, update: { cmd: '/perm', operation: 'permission.current', scope: 'relation', supported: false }, control: 'select' }),
+    relation('mentionMode.relation', 'group', '群消息响应', 60, '/group', 'group.mentionmode.current', { contexts: ['group_relation'], query: { cmd: '/group', args: { view: 'mentionMode', scope: 'relation' }, operation: 'group.mentionmode.current', scope: 'relation' }, options: { cmd: '/group', args: { option: 'mentionMode', scope: 'relation' }, operation: 'group.mentionmode.current', scope: 'relation' }, update: { cmd: '/group', args: { resource: 'mentionMode', scope: 'relation' }, operation: 'group.mentionmode.update', scope: 'relation' }, control: 'select' }),
+    relation('rulesPolicy.relation', 'group', '群规则策略', 70, '/group', 'group.rulespolicy.current', { contexts: ['group_relation'], query: { cmd: '/group', args: { view: 'rulesPolicy', scope: 'relation' }, operation: 'group.rulespolicy.current', scope: 'relation' }, options: { cmd: '/group', args: { option: 'rulesPolicy', scope: 'relation' }, operation: 'group.rulespolicy.current', scope: 'relation' }, update: { cmd: '/group', args: { resource: 'rulesPolicy', scope: 'relation' }, operation: 'group.rulespolicy.update', scope: 'relation' }, control: 'select' }),
+    { id: 'baseagent.agent', type: 'setting', contexts: ['agent'], name: 'baseagent', label: '运行后端', section: 'agent', order: 10, query: { cmd: '/baseagent', args: { scope: 'agent' }, operation: 'agent.baseagent.current', scope: 'agent' }, options: { cmd: '/baseagent', args: { scope: 'agent' }, operation: 'agent.baseagent.list', scope: 'agent', mode: 'dynamic' }, update: { cmd: '/baseagent', args: { scope: 'agent' }, operation: 'agent.baseagent.update', scope: 'agent' }, valueSchema: { type: 'string', nullable: true }, control: 'select' },
+    { id: 'model.agent', type: 'setting', contexts: ['agent'], name: 'model', label: 'Agent 默认模型', section: 'agent', order: 20, query: { cmd: '/model', args: { scope: 'agent' }, operation: 'model.current', scope: 'agent' }, options: { cmd: '/model', args: { scope: 'agent' }, operation: 'model.list', scope: 'agent' }, update: { cmd: '/model', args: { scope: 'agent' }, operation: 'model.use', scope: 'agent' }, control: 'select' },
+    { id: 'effort.agent', type: 'setting', contexts: ['agent'], name: 'effort', label: 'Agent 默认强度', section: 'agent', order: 30, query: { cmd: '/effort', args: { scope: 'agent' }, operation: 'model.effort.current', scope: 'agent' }, options: { cmd: '/effort', args: { scope: 'agent' }, operation: 'model.effort.current', scope: 'agent', mode: 'dynamic', dependsOn: ['baseagent.agent', 'model.agent'] }, update: { cmd: '/effort', args: { scope: 'agent' }, operation: 'model.effort', scope: 'agent' }, control: 'select' },
+    { id: 'chatmode.agent.private', type: 'setting', contexts: ['agent'], name: 'chatmode', label: 'Agent 私聊模式', section: 'agent', order: 41, query: { cmd: '/chatmode', args: { scope: 'agent', field: 'private' }, operation: 'chatmode.current', scope: 'agent' }, options: { cmd: '/chatmode', args: { scope: 'agent', field: 'private' }, operation: 'chatmode.current', scope: 'agent' }, update: { cmd: '/chatmode', args: { scope: 'agent', field: 'private' }, operation: 'chatmode.update', scope: 'agent' }, control: 'select' },
+    { id: 'chatmode.agent.group', type: 'setting', contexts: ['agent'], name: 'chatmode', label: 'Agent 群聊模式', section: 'agent', order: 42, query: { cmd: '/chatmode', args: { scope: 'agent', field: 'group' }, operation: 'chatmode.current', scope: 'agent' }, options: { cmd: '/chatmode', args: { scope: 'agent', field: 'group' }, operation: 'chatmode.current', scope: 'agent' }, update: { cmd: '/chatmode', args: { scope: 'agent', field: 'group' }, operation: 'chatmode.update', scope: 'agent' }, control: 'select' },
+    { id: 'chatmode.agent.nothuman', type: 'setting', contexts: ['agent'], name: 'chatmode', label: 'Agent 非人类对话模式', section: 'agent', order: 43, query: { cmd: '/chatmode', args: { scope: 'agent', field: 'nothuman' }, operation: 'chatmode.current', scope: 'agent' }, options: { cmd: '/chatmode', args: { scope: 'agent', field: 'nothuman' }, operation: 'chatmode.current', scope: 'agent' }, update: { cmd: '/chatmode', args: { scope: 'agent', field: 'nothuman' }, operation: 'chatmode.update', scope: 'agent' }, control: 'select' },
+    { id: 'activity.agent', type: 'setting', contexts: ['agent'], name: 'activity', label: 'Agent 中间输出', section: 'agent', order: 50, query: { cmd: '/activity', args: { scope: 'agent' }, operation: 'activity.current', scope: 'agent' }, options: { cmd: '/activity', args: { scope: 'agent' }, operation: 'activity.current', scope: 'agent' }, update: { cmd: '/activity', args: { scope: 'agent' }, operation: 'activity.update', scope: 'agent' }, control: 'select' },
+    { id: 'observable.agent', type: 'setting', contexts: ['agent'], name: 'observable', label: '观察模式', section: 'agent', order: 60, query: { cmd: '/observable', operation: 'observable.current', scope: 'agent' }, update: { cmd: '/observable', operation: 'observable.update', scope: 'agent' }, valueSchema: { type: 'boolean' }, control: 'toggle' },
+    { id: 'system.status', type: 'list', contexts: ['process'], name: 'system', label: '系统状态', section: 'process', order: 10, query: { cmd: '/system', operation: 'system.status', scope: 'process' }, control: 'list' },
+    { id: 'system.restart', type: 'action', contexts: ['process'], name: 'system', label: '重启服务', section: 'process', order: 20, action: { cmd: '/system', action: 'restart', operation: 'system.restart', scope: 'process' } },
+    { id: 'system.upgrade', type: 'action', contexts: ['process'], name: 'system', label: '升级服务', section: 'process', order: 30, action: { cmd: '/system', action: 'upgrade', operation: 'system.upgrade', scope: 'process' } },
+    { id: 'agent.list', type: 'list', contexts: ['process'], name: 'agent', label: 'Agent 列表', section: 'process', order: 40, options: { cmd: '/agent', args: { options: 'all' }, operation: 'agent.list', scope: 'control', mode: 'dynamic' }, control: 'list' },
+    { id: 'agent.create', type: 'action', contexts: ['process'], name: 'agent', label: '创建 Agent', section: 'process', order: 50, action: { cmd: '/agent', action: 'create', operation: 'agent.create', scope: 'control' } },
+    { id: 'agent.reload', type: 'action', contexts: ['process'], name: 'agent', label: '重载 Agent', section: 'process', order: 60, action: { cmd: '/agent', action: 'reload', operation: 'agent.reload', scope: 'control' } },
+    { id: 'agent.delete', type: 'action', contexts: ['process'], name: 'agent', label: '删除 Agent', section: 'process', order: 70, action: { cmd: '/agent', action: 'delete', operation: 'agent.delete', scope: 'control' } },
+];
+function stable(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stable).join(',')}]`;
+    if (!value || typeof value !== 'object')
+        return JSON.stringify(value);
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${JSON.stringify(k)}:${stable(v)}`).join(',')}}`;
+}
+function hash(value) { return `sha256:${createHash('sha256').update(stable(value)).digest('hex')}`; }
+export async function resolveMenuCatalogContext(input) {
+    const { subject } = input;
+    const request = normalizeContextRequest(input.request);
+    const requested = request?.kind ?? (subject.chatType === 'group' ? 'group_relation' : 'private_relation');
+    const transport = String(input.channelType || subject.channelType || 'unknown');
+    if (request?.groupId && requested !== 'group_relation') {
+        throw { code: 'INVALID_CONTEXT', message: 'groupId is only valid for group_relation context' };
+    }
+    if (input.channelScope === 'control' && !subject.fromControlChannel) {
+        throw { code: 'FORBIDDEN', message: 'control catalog context requires a control subject' };
+    }
+    if (requested === 'process') {
+        if (input.channelScope !== 'control' || !subject.fromControlChannel || !subject.isDaemonOwner)
+            throw { code: 'FORBIDDEN', message: 'process context requires a daemon owner control subject' };
+        return makeContext(input, requested, subject, input.channelId);
+    }
+    if (requested === 'agent') {
+        if (!subject.selfAid) {
+            throw { code: 'NOT_FOUND', message: 'agent context requires a receiving Agent' };
+        }
+        const bound = {
+            ...subject,
+            chatType: 'private',
+            conversationId: subject.selfAid,
+            channelId: subject.selfAid,
+            peerKey: undefined,
+        };
+        return makeContext({ ...input, channelId: bound.channelId }, requested, bound, bound.channelId);
+    }
+    if (requested === 'private_relation') {
+        if (subject.chatType === 'group')
+            throw { code: 'INVALID_CONTEXT', message: 'group transport cannot request private_relation' };
+        if (transport !== 'aun' || !subject.selfAid || !subject.actorId || !isValidAid(subject.actorId))
+            throw { code: 'INVALID_CONTEXT', message: 'private_relation requires an authenticated AUN actor and Agent' };
+        const rebuilt = buildAuthSubject({
+            selfAid: subject.selfAid,
+            actorId: subject.actorId,
+            channel: subject.channel,
+            channelType: transport,
+            channelId: subject.actorId,
+            chatType: 'private',
+            conversationId: subject.actorId,
+            fromControlChannel: subject.fromControlChannel,
+            identity: subject.isDaemonOwner ? subject.identity : undefined,
+        });
+        const bound = { ...rebuilt, channel: subject.channel, channelId: subject.actorId, peerKey: formatPeerKey('aun', subject.actorId), isDaemonOwner: subject.isDaemonOwner || rebuilt.isDaemonOwner, fromControlChannel: subject.fromControlChannel };
+        const access = authorizeAccess(bound);
+        if (!access.allow)
+            throw { code: access.code, message: access.reason };
+        return makeContext({ ...input, channelId: subject.actorId }, requested, bound, subject.actorId);
+    }
+    if (transport !== 'aun' || !subject.selfAid || !subject.actorId || !isValidAid(subject.actorId))
+        throw { code: 'INVALID_CONTEXT', message: 'group_relation requires an authenticated AUN actor and Agent' };
+    const groupId = String(request?.groupId || subject.conversationId || '').trim();
+    if (!groupId)
+        throw { code: 'INVALID_CONTEXT', message: 'group_relation requires groupId' };
+    const directory = input.directory ?? DEFAULT_DIRECTORY;
+    let info;
+    try {
+        info = await directory.getGroup({ from: subject.selfAid, groupId, required: ['member', 'state'] });
+    }
+    catch {
+        throw { code: 'TEMPORARILY_UNAVAILABLE', message: 'unable to verify target group' };
+    }
+    if (!info.ok || !info.found || !info.group || !info.group.my_role || info.group.status === 'dissolved')
+        throw { code: info.ok ? 'NOT_FOUND' : 'TEMPORARILY_UNAVAILABLE', message: 'target group is not joined by this Agent' };
+    const canonicalGroupId = String(info.group.group_aid || info.group.group_id || groupId);
+    const pageSize = 200;
+    let page = 1;
+    let total = 0;
+    let actor;
+    do {
+        let members;
+        try {
+            members = await directory.getMembers({ from: subject.selfAid, groupId: canonicalGroupId, page, size: pageSize });
+        }
+        catch {
+            throw { code: 'TEMPORARILY_UNAVAILABLE', message: 'unable to verify group membership' };
+        }
+        if (!members.ok)
+            throw { code: 'TEMPORARILY_UNAVAILABLE', message: 'unable to verify group membership' };
+        total = Number(members.total || 0);
+        actor = members.members.find(member => member.aid === subject.actorId);
+        if (actor || members.members.length === 0 || page * pageSize >= total)
+            break;
+        page += 1;
+    } while (page <= 50);
+    if (!actor)
+        throw { code: 'INVALID_CONTEXT', message: 'authenticated actor is not a member of target group' };
+    const peerKey = formatPeerKey('aun', canonicalGroupId);
+    const relationConfig = readConfig(ConfigTarget.Relation, { self: subject.selfAid, peerKey }, { cache: false });
+    const baselineRole = typeof relationConfig?.role === 'string'
+        ? relationConfig.role
+        : (readRolesConfig(subject.selfAid).defaultRoles?.group ?? null);
+    const rebuilt = buildAuthSubject({
+        selfAid: subject.selfAid,
+        actorId: subject.actorId,
+        channel: subject.channel,
+        channelType: transport,
+        channelId: canonicalGroupId,
+        chatType: 'group',
+        conversationId: canonicalGroupId,
+        fromControlChannel: subject.fromControlChannel,
+        identity: subject.isDaemonOwner ? subject.identity : undefined,
+    });
+    const bound = { ...rebuilt, channel: subject.channel, channelId: canonicalGroupId, conversationId: canonicalGroupId, peerKey, isDaemonOwner: subject.isDaemonOwner || rebuilt.isDaemonOwner, fromControlChannel: subject.fromControlChannel };
+    const access = authorizeAccess(bound);
+    if (!access.allow)
+        throw { code: access.code, message: access.reason };
+    return makeContext({ ...input, channelId: canonicalGroupId }, requested, bound, canonicalGroupId, actor.role, baselineRole);
+}
+function makeContext(input, kind, subject, channelId, groupMembershipRole, baselineRole) {
+    const descriptor = { kind, channelScope: input.channelScope, transport: input.channelType || subject.channelType, chatType: subject.chatType, self: subject.selfAid, actor: subject.actorId, groupId: kind === 'group_relation' ? subject.conversationId : undefined, peerKey: subject.peerKey };
+    return { ...descriptor, channelScope: input.channelScope, requesterRole: subject.role, ...(groupMembershipRole ? { groupMembershipRole } : {}), ...(baselineRole !== undefined ? { baselineRole } : {}), contextKey: hash(descriptor), subject, channelId };
+}
+function bindingArgs(binding, context) {
+    const args = { ...(binding.args ?? {}) };
+    if (context.kind === 'private_relation' || context.kind === 'group_relation') {
+        if (args.scope !== 'role')
+            args.scope = 'relation';
+        args.self = context.self;
+        args.peer = context.peerKey;
+        args.peerKey = context.peerKey;
+        if (binding.cmd === '/chatmode' && args.field === undefined) {
+            args.field = context.kind === 'group_relation' ? 'group' : 'private';
+        }
+    }
+    if (context.kind === 'group_relation') {
+        args.groupId = context.groupId;
+    }
+    if (context.kind === 'agent') {
+        args.scope = 'agent';
+        args.self = context.self;
+    }
+    return args;
+}
+export function bindMenuExecutionContextArgs(args, context) {
+    if (!args && context.kind !== 'group_relation')
+        return args;
+    const { context: _context, ...bound } = args ?? {};
+    if (context.kind === 'private_relation' || context.kind === 'group_relation') {
+        if (bound.scope !== 'role')
+            bound.scope = 'relation';
+        bound.self = context.self;
+        bound.peer = context.peerKey;
+        bound.peerKey = context.peerKey;
+    }
+    if (context.kind === 'group_relation')
+        bound.groupId = context.groupId;
+    if (context.kind === 'agent') {
+        bound.scope = 'agent';
+        bound.self = context.self;
+    }
+    return bound;
+}
+export async function resolveExplicitMenuExecutionContext(input) {
+    if (!input.args || !Object.prototype.hasOwnProperty.call(input.args, 'context')) {
+        return { subject: input.subject, channelId: input.channelId, args: input.args };
+    }
+    const context = await resolveMenuCatalogContext({
+        subject: input.subject,
+        channelType: input.channelType,
+        channelScope: input.channelScope,
+        channelId: input.channelId,
+        request: input.args.context,
+        directory: input.directory,
+    });
+    return {
+        subject: context.subject,
+        channelId: context.channelId,
+        args: bindMenuExecutionContextArgs(input.args, context),
+    };
+}
+function entryVisible(entry, context) { return entry.contexts.includes(context.kind); }
+function intentFor(binding, context) { return { operation: binding.operation, scope: binding.scope, source: 'menu', args: { ...bindingArgs(binding, context) } }; }
+async function operationView(binding, context) {
+    if (!binding)
+        return undefined;
+    if (binding.supported === false)
+        return { supported: false, allowed: false, reason: { code: 'NOT_SUPPORTED', message: 'operation is not supported' } };
+    if (binding.operation === 'group.rulespolicy.update' && context.subject.role !== 'owner' && !context.subject.isDaemonOwner) {
+        return { supported: true, allowed: false, reason: { code: 'PERMISSION_DENIED', message: 'rulesPolicy can only be changed by an Agent owner' } };
+    }
+    const decision = authorizeOperation({ source: 'menu', intent: intentFor(binding, context), subject: context.subject, audit: false });
+    return { supported: true, allowed: decision.allow, ...(binding.mode ? { mode: binding.mode } : {}), ...(binding.items ? { items: binding.items } : {}), ...(binding.dependsOn ? { dependsOn: binding.dependsOn } : {}), ...(decision.allow ? {} : { reason: { code: decision.code, message: decision.reason } }) };
+}
+function wireBinding(binding, context) {
+    if (!binding || binding.supported === false)
+        return undefined;
+    return {
+        args: context.kind === 'group_relation'
+            ? {
+                ...bindingArgs(binding, context),
+                context: { kind: context.kind, ...(context.groupId ? { groupId: context.groupId } : {}) },
+            }
+            : bindingArgs(binding, context),
+        ...(binding.action ? { action: binding.action } : {}),
+    };
+}
+export async function getMenuCatalog(input) {
+    const context = await resolveMenuCatalogContext(input);
+    const entries = [];
+    for (const entry of ENTRIES.filter(candidate => entryVisible(candidate, context)).sort((a, b) => a.order - b.order)) {
+        const operations = {};
+        for (const [key, binding] of [['query', entry.query], ['options', entry.options], ['update', entry.update], ['action', entry.action]]) {
+            const view = await operationView(binding, context);
+            if (view)
+                operations[key] = view;
+        }
+        entries.push({ id: entry.id, type: entry.type, name: entry.name, label: entry.label, section: entry.section, order: entry.order, target: { scope: context.kind === 'agent' ? 'agent' : context.kind === 'process' ? 'process' : 'relation', ...(context.self ? { self: context.self } : {}), ...(context.peerKey ? { peerKey: context.peerKey } : {}) }, valueSchema: entry.valueSchema ?? { type: 'object' }, operations, wire: { name: entry.name, operations: { ...(wireBinding(entry.query, context) ? { query: wireBinding(entry.query, context) } : {}), ...(wireBinding(entry.options, context) ? { options: wireBinding(entry.options, context) } : {}), ...(wireBinding(entry.update, context) ? { update: wireBinding(entry.update, context) } : {}), ...(wireBinding(entry.action, context) ? { action: wireBinding(entry.action, context) } : {}) } }, ui: { control: entry.control ?? 'action' } });
+    }
+    const policyRevision = hash({ role: context.subject.role, self: context.subject.selfAid, peerKey: context.subject.peerKey, groupMembershipRole: context.groupMembershipRole, baselineRole: context.baselineRole, roles: readRolesConfig(context.subject.selfAid) });
+    const data = { $schema_version: 1, kind: 'menu.catalog', complete: true, catalogRevision: hash({ entries, context: context.contextKey, policyRevision }), policyRevision, generatedAt: Date.now(), context: { contextKey: context.contextKey, kind: context.kind, channelScope: context.channelScope, transport: context.transport, chatType: context.chatType, ...(context.self ? { self: context.self } : {}), ...(context.actor ? { actor: context.actor } : {}), ...(context.groupId ? { groupId: context.groupId } : {}), ...(context.peerKey ? { peerKey: context.peerKey } : {}), requesterRole: context.requesterRole, ...(context.groupMembershipRole ? { groupMembershipRole: context.groupMembershipRole } : {}), ...(context.baselineRole !== undefined ? { baselineRole: context.baselineRole } : {}) }, features: { batchValuesV1: true, verifiedExplicitGroupContext: context.kind === 'group_relation' }, entries };
+    return data;
+}
+export async function execMenuValueBatch(input) {
+    assertMenuSchemaVersion(input.schemaVersion);
+    if (input.consistency !== undefined && input.consistency !== 'best-effort') {
+        throw { code: 'NOT_SUPPORTED', message: 'Only best-effort batch consistency is supported' };
+    }
+    const context = await resolveMenuCatalogContext(input);
+    if (!Array.isArray(input.items) || input.items.length < 1 || input.items.length > 32)
+        throw { code: 'INVALID_ARGUMENT', message: 'items must contain 1 to 32 entries' };
+    const seen = new Set();
+    const normalizedItems = [];
+    for (const raw of input.items) {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            throw { code: 'INVALID_ARGUMENT', message: 'each batch item must be an object' };
+        const item = raw;
+        const keys = Object.keys(item);
+        if (keys.some(key => key !== 'itemId' && key !== 'entryId'))
+            throw { code: 'INVALID_ARGUMENT', message: 'batch items may only contain itemId and entryId' };
+        const itemId = typeof item.itemId === 'string' ? item.itemId.trim() : '';
+        const entryId = typeof item.entryId === 'string' ? item.entryId.trim() : '';
+        if (!itemId || !entryId || seen.has(itemId))
+            throw { code: 'INVALID_ARGUMENT', message: 'itemId and entryId must be non-empty and itemId must be unique' };
+        seen.add(itemId);
+        normalizedItems.push({ itemId, entryId });
+    }
+    const results = new Array(normalizedItems.length);
+    const byId = new Map(ENTRIES.map(entry => [entry.id, entry]));
+    let cursor = 0;
+    const resolveItem = async (item) => {
+        const { itemId, entryId } = item;
+        const entry = byId.get(entryId);
+        if (!entry || !entryVisible(entry, context) || !entry.query)
+            return { itemId, entryId, ok: false, error: { code: 'NOT_SUPPORTED', message: 'entry is not queryable in this context' } };
+        const allowed = await operationView(entry.query, context);
+        if (allowed?.supported === false || !(allowed?.allowed))
+            return { itemId, entryId, ok: false, error: allowed?.reason ?? { code: 'NOT_SUPPORTED', message: 'operation is not supported or denied' } };
+        try {
+            const result = await input.execQuery(entry.query.cmd, context.channelId, bindingArgs(entry.query, context), context);
+            return !('error' in result) ? { itemId, entryId, ok: true, data: result.data } : { itemId, entryId, ok: false, error: { code: normalizeMenuError({ code: result.code, message: result.error, data: result.data }).code, message: result.error, ...(result.data !== undefined ? { data: result.data } : {}) } };
+        }
+        catch (error) {
+            const normalized = normalizeMenuError(error);
+            return { itemId, entryId, ok: false, error: normalized };
+        }
+    };
+    const worker = async () => {
+        while (true) {
+            const index = cursor++;
+            if (index >= normalizedItems.length)
+                return;
+            results[index] = await resolveItem(normalizedItems[index]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(6, normalizedItems.length) }, () => worker()));
+    return { $schema_version: 1, kind: 'menu.value_batch', consistency: 'best-effort', observedAt: Date.now(), context: { contextKey: context.contextKey, kind: context.kind, ...(context.self ? { self: context.self } : {}), ...(context.peerKey ? { peerKey: context.peerKey } : {}) }, items: results };
+}