evolcore 0.0.2 → 0.0.3

package/dist/config/peer-role-resolver.js

@@ -1,47 +1,77 @@
 import crypto from 'crypto';
 import fs from 'fs';
-import { agentConfig, agentContactConfig } from '../paths.js';
-import { formatPeerKey } from '../core/relation/peer-identity.js';
+import path from 'path';
+import { agentConfig, agentContactConfig, agentRelationsDir } from '../paths.js';
+import { formatPeerKey, parsePeerKey } from '../core/relation/peer-identity.js';
 import { hasTrustedPrincipal } from '../core/auth/authenticated-actor.js';
 import { ConfigTarget, read, write } from './config-manager.js';
 import { isManagementRole } from './builtin-roles.js';
-import { normalizeDefaultRole, roleExists, getRoleDefinition } from './roles.js';
+import { getRoleDefinition, getRoleRank, normalizeDefaultRole, roleExists } from './roles.js';
 import { getStoredRoleRegistry, roleRegistryExists } from './role-store.js';
 import { resolvePrincipal } from './contact-book.js';
 import { isValidAid } from '../aun/aid/validation.js';
+import { isExplicitGroupId } from '../aun/group-identity.js';
 export function isAuthenticated(userId) {
     return isValidAid(String(userId || '').trim());
 }
 export function listStaticAgentOwners(aid, opts = {}) {
-    return listAgentAids(aid, 'owners', opts);
+    return listAgentOwners(aid, opts);
 }
+/** Direct AUN relations with role=admin are the addressable Agent admin set. */
 export function listStaticAgentAdmins(aid, opts = {}) {
-    return listAgentAids(aid, 'admins', opts);
+    if (!aid)
+        return [];
+    const relations = agentRelationsDir(aid);
+    if (!fs.existsSync(relations))
+        return [];
+    const admins = new Set();
+    for (const entry of fs.readdirSync(relations, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('_'))
+            continue;
+        let parsed;
+        try {
+            parsed = parsePeerKey(entry.name);
+        }
+        catch {
+            continue;
+        }
+        if (parsed.channelType !== 'aun'
+            || !isValidAid(parsed.channelId)
+            || isExplicitGroupId(parsed.channelId))
+            continue;
+        const config = read(ConfigTarget.Relation, { self: aid, peerKey: entry.name }, { cache: opts.fresh !== true });
+        if (config?.targetKind === 'group')
+            continue;
+        if (config?.role === 'admin')
+            admins.add(parsed.channelId);
+    }
+    return [...admins].sort();
 }
 export function getFirstStaticAgentOwner(aid) {
     return listStaticAgentOwners(aid)[0];
 }
-/** Revision for security-sensitive Agent/contact files, including transient rewrites. */
+/** Revision for security-sensitive owner/contact/relation authorization inputs. */
 export function authorizationConfigRevision(aid) {
-    const fileRevision = (file) => {
-        try {
-            const stat = fs.statSync(file);
-            return [stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs].join(':');
-        }
-        catch {
-            return 'missing';
+    const fingerprints = [fileRevision(agentConfig(aid)), fileRevision(agentContactConfig(aid))];
+    const relations = agentRelationsDir(aid);
+    try {
+        for (const entry of fs.readdirSync(relations, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!entry.isDirectory() || entry.name.startsWith('_'))
+                continue;
+            fingerprints.push(entry.name, fileRevision(path.join(relations, entry.name, 'config.json')));
         }
-    };
-    return crypto.createHash('sha256').update(JSON.stringify([
-        fileRevision(agentConfig(aid)),
-        fileRevision(agentContactConfig(aid)),
-    ])).digest('hex');
+    }
+    catch { }
+    return crypto.createHash('sha256').update(JSON.stringify(fingerprints)).digest('hex');
 }
 export function isStaticAgentOwner(aid, actorId) {
     return !!aid && !!actorId && listStaticAgentOwners(aid).includes(actorId);
 }
 export function isStaticAgentAdmin(aid, actorId) {
-    return !!aid && !!actorId && listStaticAgentAdmins(aid).includes(actorId);
+    if (!aid || !isValidAid(actorId) || isExplicitGroupId(actorId))
+        return false;
+    const config = read(ConfigTarget.Relation, { self: aid, peerKey: formatPeerKey('aun', actorId) }, { cache: true });
+    return config?.targetKind !== 'group' && config?.role === 'admin';
 }
 export function addStaticAgentOwner(aid, ownerAid) {
     if (!aid || !ownerAid)
@@ -56,32 +86,46 @@ export function hasStaticAgentOwner(aid) {
 }
 export function resolvePeerRoleDetail(ctx) {
     const operatorId = String(ctx.actorId || '').trim();
-    const operatorChannelType = String(ctx.channelType || '').trim().toLowerCase();
-    const operatorChannelKey = String(ctx.channelKey || '').trim();
-    const principal = resolvePrincipal(ctx.selfAid, operatorChannelType, operatorId, operatorChannelKey || undefined);
+    const channelType = String(ctx.channelType || '').trim().toLowerCase();
+    const channelKey = String(ctx.channelKey || '').trim();
+    const principal = resolvePrincipal(ctx.selfAid, channelType, operatorId, channelKey || undefined);
     const actor = {
         operatorId,
-        operatorChannelKey: operatorChannelKey || operatorChannelType,
-        operatorChannelType,
+        operatorChannelKey: channelKey || channelType,
+        operatorChannelType: channelType,
         ...principal,
     };
-    const checkId = actor.principalId ?? '';
-    if (isStaticAgentOwner(ctx.selfAid, checkId)) {
-        return resultFor('owner', 'agent-owner', actor, ctx.selfAid, true);
+    const candidates = [];
+    if (hasTrustedPrincipal(actor) && isStaticAgentOwner(ctx.selfAid, actor.principalId)) {
+        candidates.push({ role: 'owner', source: 'agent-owner', sourcePriority: 100 });
     }
-    if (isStaticAgentAdmin(ctx.selfAid, checkId)) {
-        return resultFor('admin', 'agent-admin', actor, ctx.selfAid, true);
+    const actorRole = resolveActorDirectRole(ctx.selfAid, actor, channelType, operatorId);
+    if (ctx.chatType === 'private') {
+        if (actorRole)
+            candidates.push({ role: actorRole, source: 'relation-actor', sourcePriority: 80 });
+        const defaultRole = normalizeDefaultRole(readAgentDefaultRole(ctx.selfAid, 'private'), ctx.selfAid);
+        if (defaultRole)
+            candidates.push({ role: defaultRole, source: 'agent-default', sourcePriority: 40 });
     }
-    const relationId = ctx.chatType === 'group' ? ctx.conversationId : ctx.actorId;
-    const assigned = normalizeUserRole(readRelationRole(ctx.selfAid, ctx.channelType, relationId), ctx.selfAid);
-    if (assigned)
-        return resultFor(assigned, 'relation', actor, ctx.selfAid);
-    const fallback = normalizeDefaultRole(readAgentDefaultRole(ctx.selfAid, ctx.chatType), ctx.selfAid);
-    return fallback
-        ? resultFor(fallback, 'agent-default', actor, ctx.selfAid)
-        : roleRegistryExists(ctx.selfAid) && roleExists('visitor', ctx.selfAid)
-            ? resultFor('visitor', 'builtin-fallback', actor, ctx.selfAid)
-            : resultFor(null, 'none', actor, ctx.selfAid);
+    else {
+        if (actorRole)
+            candidates.push({ role: actorRole, source: 'relation-actor', sourcePriority: 80 });
+        const groupRole = normalizeRelationRole(readDirectRelationRole(ctx.selfAid, channelType, String(ctx.conversationId || '').trim(), 'group'), ctx.selfAid);
+        if (groupRole) {
+            candidates.push({ role: groupRole, source: 'relation-peer', sourcePriority: 60 });
+        }
+        else {
+            const defaultRole = normalizeDefaultRole(readAgentDefaultRole(ctx.selfAid, 'group'), ctx.selfAid);
+            if (defaultRole)
+                candidates.push({ role: defaultRole, source: 'agent-default', sourcePriority: 40 });
+        }
+    }
+    const winner = selectHighestRank(candidates, ctx.selfAid);
+    if (winner)
+        return resultFor(winner.role, winner.source, actor, ctx.selfAid);
+    return roleRegistryExists(ctx.selfAid) && roleExists('visitor', ctx.selfAid)
+        ? resultFor('visitor', 'builtin-fallback', actor, ctx.selfAid)
+        : resultFor(null, 'none', actor, ctx.selfAid);
 }
 export function roleToSessionIdentity(role) {
     return { role: role ?? 'none', mode: 'interactive' };
@@ -91,32 +135,52 @@ export function checkRoleAccess(role, selfAid) {
         return false;
     if (isManagementRole(role))
         return true;
-    const roleDef = getRoleDefinition(role, selfAid);
-    if (!roleDef)
-        return false;
-    return roleDef.allowAccess ?? true;
+    const definition = getRoleDefinition(role, selfAid);
+    return !!definition && (definition.allowAccess ?? true);
+}
+function selectHighestRank(candidates, selfAid) {
+    let winner = null;
+    for (const candidate of candidates) {
+        if (!normalizeRelationRole(candidate.role, selfAid) && candidate.role !== 'owner')
+            continue;
+        if (!winner) {
+            winner = candidate;
+            continue;
+        }
+        const rank = getRoleRank(candidate.role, selfAid);
+        const winnerRank = getRoleRank(winner.role, selfAid);
+        if (rank > winnerRank || (rank === winnerRank && candidate.sourcePriority > winner.sourcePriority)) {
+            winner = candidate;
+        }
+    }
+    return winner;
+}
+function resolveActorDirectRole(selfAid, actor, channelType, actorId) {
+    const role = hasTrustedPrincipal(actor)
+        ? readDirectRelationRole(selfAid, 'aun', actor.principalId, 'private')
+        : actor.principalStatus === 'unmapped'
+            ? readDirectRelationRole(selfAid, channelType, actorId, 'private')
+            : null;
+    return normalizeRelationRole(role, selfAid);
 }
-function resultFor(role, source, actor, selfAid, forceAccess = false) {
+function resultFor(role, source, actor, selfAid) {
     const exists = role ? (isManagementRole(role) || roleExists(role, selfAid)) : false;
     const roleDef = role ? getRoleDefinition(role, selfAid) : null;
     return {
         effectiveRole: exists ? role : null,
         source: exists ? source : 'none',
         isAuthenticated: hasTrustedPrincipal(actor),
-        allowAccess: forceAccess || !!(roleDef && (roleDef.allowAccess ?? true)),
+        allowAccess: !!(roleDef && (roleDef.allowAccess ?? true)),
         roleExists: exists,
         actor,
     };
 }
-function listAgentAids(aid, field, opts = {}) {
+function listAgentOwners(aid, opts = {}) {
     if (!aid)
         return [];
     try {
         const config = read(ConfigTarget.Agent, { self: aid }, { cache: opts.fresh !== true });
-        const values = config?.[field];
-        if (!Array.isArray(values))
-            return [];
-        return Array.from(new Set(values.map(value => String(value || '').trim()).filter(Boolean)));
+        return Array.from(new Set((config?.owners ?? []).map(value => String(value || '').trim()).filter(Boolean)));
     }
     catch {
         return [];
@@ -125,15 +189,30 @@ function listAgentAids(aid, field, opts = {}) {
 function readAgentDefaultRole(aid, chatType) {
     return getStoredRoleRegistry(aid).defaultRoles[chatType] ?? null;
 }
-function readRelationRole(selfAid, channelType, channelId) {
+function readDirectRelationRole(selfAid, channelType, channelId, expectedTargetKind) {
     if (!selfAid || !channelType || !channelId)
         return undefined;
+    if (expectedTargetKind === 'private' && channelType === 'aun' && isExplicitGroupId(channelId))
+        return undefined;
     const peerKey = formatPeerKey(channelType, channelId);
     const config = read(ConfigTarget.Relation, { self: selfAid, peerKey }, { cache: true });
+    if (expectedTargetKind && config?.targetKind && config.targetKind !== expectedTargetKind)
+        return undefined;
     return config?.role;
 }
-function normalizeUserRole(value, selfAid) {
-    if (typeof value !== 'string' || !roleExists(value, selfAid))
+function normalizeRelationRole(value, selfAid) {
+    if (typeof value !== 'string' || !value || value === 'owner')
         return null;
-    return value;
+    if (value === 'admin')
+        return getRoleDefinition('admin', selfAid) ? 'admin' : null;
+    return roleExists(value, selfAid) ? value : null;
+}
+function fileRevision(file) {
+    try {
+        const stat = fs.statSync(file);
+        return [stat.size, stat.mtimeMs].join(':');
+    }
+    catch {
+        return 'missing';
+    }
 }

package/dist/config/role-ranks.js

@@ -0,0 +1,18 @@
+export const ROLE_RANKS = Object.freeze({
+    owner: 900,
+    admin: 700,
+    custom: 500,
+    member: 300,
+    visitor: 100,
+});
+export function expectedRoleRank(role) {
+    if (role === 'owner')
+        return ROLE_RANKS.owner;
+    if (role === 'admin')
+        return ROLE_RANKS.admin;
+    if (role === 'member')
+        return ROLE_RANKS.member;
+    if (role === 'visitor')
+        return ROLE_RANKS.visitor;
+    return ROLE_RANKS.custom;
+}

package/dist/config/role-service.js

@@ -1,10 +1,11 @@
 import fs from 'fs';
 import path from 'path';
 import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
-import { agentRoleConfig, agentRolesIndex, kitsRoleTemplatesDir, resolvePaths } from '../paths.js';
+import { agentRelationConfig, agentRelationsDir, agentRoleConfig, agentRolesIndex } from '../paths.js';
 import { loadSchema } from './schema-registry.js';
 import { clearRoleStoreCache, getStoredRoleRegistry, isRoleName, readRoleStore, roleRegistryExists, } from './role-store.js';
-import { isManagementRole } from './builtin-roles.js';
+import { expectedRoleRank, isManagementRole } from './builtin-roles.js';
+import { readBuiltinRoleTemplate } from './builtin-role-templates.js';
 import { validateRoleConfig } from './role-schema.js';
 export class RoleServiceError extends Error {
     code;
@@ -42,7 +43,7 @@ export function writeRoleRegistry(selfAid, value) {
 export function writeRoleDefinition(selfAid, roleId, value) {
     if (!isRoleName(roleId))
         throw new RoleServiceError('INVALID_ROLE_ID', `Invalid role id: ${roleId}`);
-    const normalized = { ...value, $schema_version: 1 };
+    const normalized = { ...value, rank: expectedRoleRank(roleId), $schema_version: 1 };
     validateRoleDefinition(normalized);
     const registry = readRoleRegistry(selfAid);
     if (!registry.roles.includes(roleId)) {
@@ -92,7 +93,7 @@ export function listRoleDiagnostics(selfAid) {
     return readRoleStore(selfAid).diagnostics;
 }
 function writeRoleDefinitionFile(selfAid, roleId, value) {
-    const normalized = { ...value, $schema_version: 1 };
+    const normalized = { ...value, rank: expectedRoleRank(roleId), $schema_version: 1 };
     validateRoleDefinition(normalized);
     const file = agentRoleConfig(selfAid, roleId);
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -108,7 +109,7 @@ function validateRegistry(selfAid, value) {
         throw new RoleServiceError('VISITOR_REQUIRED', 'visitor must remain registered');
     for (const role of ['private', 'group']) {
         const selected = registry.defaultRoles[role];
-        if (selected !== null && (isManagementRole(selected) || !registry.roles.includes(selected))) {
+        if (selected !== null && (selected === 'owner' || !registry.roles.includes(selected))) {
             throw new RoleServiceError('INVALID_DEFAULT_ROLE', `defaultRoles.${role} must reference an assignable registered role`);
         }
         if (selected !== null && !hasValidRoleDefinition(selfAid, selected)) {
@@ -117,18 +118,14 @@ function validateRegistry(selfAid, value) {
     }
 }
 function hasValidRoleDefinition(selfAid, roleId) {
-    for (const file of [
-        agentRoleConfig(selfAid, roleId),
-        path.join(kitsRoleTemplatesDir(), `${roleId}.json`),
-    ]) {
-        try {
-            const value = atomicReadJson(file);
-            if (value !== null && validateRoleConfig(value).length === 0)
-                return true;
-        }
-        catch { }
+    try {
+        const value = atomicReadJson(agentRoleConfig(selfAid, roleId));
+        if (value !== null && validateRoleConfig(value).length === 0
+            && (value.rank === undefined || value.rank === expectedRoleRank(roleId)))
+            return true;
     }
-    return false;
+    catch { }
+    return !!readBuiltinRoleTemplate(roleId).definition;
 }
 function validateRoleDefinition(value) {
     const issues = validateRoleConfig(value);
@@ -142,13 +139,13 @@ function findRoleReferences(selfAid, roleId, registry) {
         references.push('defaultRoles.private');
     if (registry.defaultRoles.group === roleId)
         references.push('defaultRoles.group');
-    const relations = path.join(resolvePaths().agentsDir, selfAid, 'relations');
+    const relations = agentRelationsDir(selfAid);
     if (!fs.existsSync(relations))
         return references;
     for (const entry of fs.readdirSync(relations, { withFileTypes: true })) {
-        if (!entry.isDirectory())
+        if (!entry.isDirectory() || entry.name.startsWith('_'))
             continue;
-        const config = atomicReadJson(path.join(relations, entry.name, 'config.json'));
+        const config = atomicReadJson(agentRelationConfig(selfAid, entry.name));
         if (config?.role === roleId)
             references.push(`relations/${entry.name}/role`);
     }

package/dist/config/role-store.js

@@ -2,12 +2,11 @@ import fs from 'fs';
 import path from 'path';
 import { atomicReadJson } from '../utils/atomic-write.js';
 import { agentRoleConfig, agentRolesDir, agentRolesIndex, kitsRoleTemplatesDir, resolvePaths, } from '../paths.js';
-import { applyManagementRoleCeiling, getManagementRoleDefinition } from './builtin-roles.js';
+import { applyManagementRoleCeiling, expectedRoleRank, getManagementRoleDefinition } from './builtin-roles.js';
 import { readBuiltinRoleTemplate } from './builtin-role-templates.js';
 import { loadSchema } from './schema-registry.js';
 import { validateRoleConfig } from './role-schema.js';
 const ROLE_NAME_RE = /^[a-z0-9_-]+$/;
-const RESERVED_ROLES = new Set(['owner', 'admin']);
 const BUILTIN_ROLES = ['owner', 'admin', 'member', 'visitor'];
 const cache = new Map();
 export function clearRoleStoreCache(selfAid) {
@@ -79,9 +78,11 @@ export function getStoredRoleRegistry(selfAid) {
     return readRoleStore(selfAid).registry;
 }
 export function roleIsAssignable(selfAid, roleId) {
-    if (!roleId || !isRoleName(roleId) || RESERVED_ROLES.has(roleId))
+    if (!roleId || !isRoleName(roleId) || roleId === 'owner')
         return false;
     const snapshot = readRoleStore(selfAid);
+    if (roleId === 'admin')
+        return snapshot.registry.roles.includes(roleId) && !!getStoredRoleDefinition(selfAid, roleId);
     return snapshot.registry.roles.includes(roleId) && !!snapshot.definitions[roleId];
 }
 function readRegistry(selfAid, diagnostics) {
@@ -106,7 +107,7 @@ function readRegistry(selfAid, diagnostics) {
             const defaultRoles = { ...value.defaultRoles };
             for (const scene of ['private', 'group']) {
                 const selected = defaultRoles[scene];
-                if (selected === null || (roles.includes(selected) && !RESERVED_ROLES.has(selected)))
+                if (selected === null || (roles.includes(selected) && selected !== 'owner'))
                     continue;
                 diagnostics.push({
                     code: 'INVALID_ROLE_ASSIGNMENT',
@@ -156,7 +157,17 @@ function readDefinition(selfAid, roleId, diagnostics) {
         const issues = validateRoleConfig(raw);
         if (issues.length === 0) {
             const { $schema_version: _schemaVersion, ...definition } = raw;
-            return definition;
+            const expectedRank = expectedRoleRank(roleId);
+            if (definition.rank !== undefined && definition.rank !== expectedRank) {
+                diagnostics.push({
+                    code: 'INVALID_ROLE_FILE',
+                    roleId,
+                    file: path.relative(resolvePaths().root, file),
+                    message: `Role definition ${roleId} rank must be ${expectedRank}`,
+                });
+                continue;
+            }
+            return { ...definition, rank: expectedRank };
         }
         diagnostics.push({
             code: file === local ? 'INVALID_ROLE_FILE' : 'INVALID_ROLE_FILE',

package/dist/config/roles.js

@@ -1,4 +1,4 @@
-import { getBuiltinRolesConfig, getManagementRoleDefinition, isManagementRole, isReservedRoleName, } from './builtin-roles.js';
+import { getBuiltinRolesConfig, getManagementRoleDefinition, expectedRoleRank, isManagementRole, isReservedRoleName, } from './builtin-roles.js';
 import { clearRoleStoreCache, getStoredRoleDefinition, readRoleStore, roleIsAssignable, } from './role-store.js';
 const ROLE_NAME_RE = /^[a-z0-9_-]+$/;
 export { getBuiltinRolesConfig };
@@ -51,5 +51,14 @@ export function normalizeDefaultRole(value, selfAid) {
         return null;
     if (typeof value !== 'string')
         return null;
+    if (value === 'owner')
+        return null;
+    if (value === 'admin')
+        return getRoleDefinition(value, selfAid) ? value : null;
     return roleExists(value, selfAid) ? value : null;
 }
+export function getRoleRank(role, selfAid) {
+    if (!role)
+        return 0;
+    return getRoleDefinition(role, selfAid)?.rank ?? expectedRoleRank(role);
+}

package/dist/config-store.js

@@ -478,7 +478,6 @@ export async function migrateProject(oldPath, newPath) {
                 const active = readJsonFile(activePath);
                 if (active && active.projectPath === oldAbs) {
                     active.projectPath = newAbs;
-                    active.updatedAt = Date.now();
                     atomicWriteJson(activePath, active);
                     updated++;
                 }
@@ -489,7 +488,6 @@ export async function migrateProject(oldPath, newPath) {
                     const meta = readLastJsonlLine(metaPath);
                     if (meta && meta.projectPath === oldAbs) {
                         meta.projectPath = newAbs;
-                        meta.updatedAt = Date.now();
                         appendJsonl(metaPath, meta);
                         updated++;
                     }

package/dist/core/auth/authorization-audit.js

@@ -47,7 +47,16 @@ function redactIdentifier(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
 function logAuditEvent(record) {
-    const level = record.decision === 'deny' ? 'warn' : 'info';
+    // A role-management snapshot fans out into several successful read checks.
+    // Keep those available for verbose ECWeb diagnostics without flooding INFO.
+    const routineEcwebRoleRead = record.source === 'ecweb'
+        && !record.dangerous
+        && (record.operation === 'role.policy.read' || record.operation === 'role.relation.read');
+    const level = record.decision === 'deny'
+        ? 'warn'
+        : routineEcwebRoleRead
+            ? 'debug'
+            : 'info';
     const marker = record.decision === 'deny' ? 'DENY' : record.dangerous ? 'DANGEROUS_ALLOW' : 'ALLOW';
     const message = [
         `[CommandAudit:${marker}]`,

package/dist/core/auth/operation-authorizer.js

@@ -55,6 +55,8 @@ export const USER_PLANE_CAPABILITY_CEILING = {
     ]),
     denyNamespaces: new Set([
         'role',
+        'connect',
+        'contact',
         'agent',
         'system',
         'storage',

package/dist/core/auth/operation-catalog.js

@@ -304,6 +304,62 @@ const OPERATIONS = [
         description: 'Modify role definitions, command permissions, default roles, or usage limits',
         sources: ['menu', 'ecweb', 'control'],
     },
+    {
+        id: 'contact.read',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Read the Agent contact block list',
+        sources: ['agent-tool'],
+    },
+    {
+        id: 'contact.block',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Block or unblock an AUN contact',
+        sources: ['agent-tool'],
+    },
+    {
+        id: 'connect.read',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Read contacts, groups, assignments, or contact details',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.assign',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Assign a role to a relation',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.revoke',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Revoke a role assignment from a relation',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.admin',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Grant or revoke admin status',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.write',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Add contacts or modify contact status (block/unblock)',
+        sources: ['menu', 'ecweb', 'control'],
+    },
     // Agent Operations
     {
         id: 'agent.list',