evolcore 0.0.2 → 0.0.4

package/dist/config/builtin-roles.js

@@ -1,4 +1,6 @@
 import { readBuiltinRoleTemplate } from './builtin-role-templates.js';
+import { expectedRoleRank } from './role-ranks.js';
+export { expectedRoleRank, ROLE_RANKS } from './role-ranks.js';
 export const BUILTIN_USER_ROLES = ['member', 'visitor'];
 export const MANAGEMENT_ROLES = ['owner', 'admin'];
 export function isManagementRole(role) {
@@ -19,15 +21,23 @@ export function getBuiltinRolesConfig() {
     };
 }
 /**
- * Management grants are a code-level ceiling, not configurable role policy.
- * A role file may narrow these rules but can never add a management grant.
+ * Management grants are a code-level ceiling. The built-in admin template
+ * declares the default grants; local role files may narrow them but can never
+ * add a grant outside this ceiling.
  */
-export function getManagementCommandPermissions(_role) {
+export function getManagementCommandPermissions(role) {
     return {
+        'contact.read': { allow: true, scopes: ['agent'] },
+        'contact.block': { allow: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
+        'connect.write': { allow: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
+        'connect.access.write': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },
         'role.assign': { allow: true, scopes: ['agent'] },
         'role.revoke': { allow: true, scopes: ['agent'] },
         'role.policy.read': { allow: true, scopes: ['agent'] },
         'role.relation.read': { allow: true, scopes: ['agent'] },
+        'config.get': { allow: true, scopes: ['agent', 'relation'] },
+        'config.set': { allow: true, scopes: ['agent', 'relation'] },
+        'config.unset': { allow: true, scopes: ['agent', 'relation'] },
         'role.policy.write': { allow: true, dangerous: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
         '*': { allow: true },
         'agent.reload': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
@@ -35,19 +45,26 @@ export function getManagementCommandPermissions(_role) {
     };
 }
 export function applyManagementRoleCeiling(role, configured) {
+    const builtin = readBuiltinRoleTemplate(role).definition;
     const fallback = {
         description: role === 'owner' ? 'Agent owner' : 'Agent administrator',
+        rank: expectedRoleRank(role),
         allowAccess: true,
         permissions: {
             permissionMode: { default: 'request', allowOverride: false },
         },
         commandPermissions: getManagementCommandPermissions(role),
     };
-    const policy = configured ?? readBuiltinRoleTemplate(role).definition ?? fallback;
+    const policy = configured ?? builtin ?? fallback;
+    const configuredCommandPermissions = policy.commandPermissions;
+    const defaultCommandPermissions = configuredCommandPermissions
+        ?? (role === 'admin' && builtin ? builtin.commandPermissions : undefined)
+        ?? getManagementCommandPermissions(role);
     return {
         ...policy,
-        allowAccess: true,
-        commandPermissions: narrowManagementCommandPermissions(getManagementCommandPermissions(role), policy.commandPermissions || {}),
+        rank: expectedRoleRank(role),
+        allowAccess: role === 'owner' ? true : policy.allowAccess !== false,
+        commandPermissions: narrowManagementCommandPermissions(getManagementCommandPermissions(role), defaultCommandPermissions),
     };
 }
 export function getManagementRoleDefinition(role) {
@@ -72,6 +89,14 @@ function narrowManagementCommandPermissions(ceiling, configured) {
         else if (!Array.isArray(permission.scopes) && Array.isArray(override.scopes)) {
             next.scopes = [...override.scopes];
         }
+        if (permission.constraints || override.constraints) {
+            // Configured constraints may add restrictions, but a role file cannot
+            // weaken a code-level constraint (the ceiling wins on collisions).
+            next.constraints = {
+                ...(override.constraints ?? {}),
+                ...(permission.constraints ?? {}),
+            };
+        }
         merged[operation] = next;
     }
     // Exact or namespace denies may narrow grants inherited through the ceiling's

package/dist/config/config-field-policy.js

@@ -8,6 +8,7 @@ const BEHAVIOR_TOP_FIELDS = new Set([
     'debounce',
     'show_activities',
     'session_renew',
+    'groupRules',
     'group_venue_sync',
     'render',
     'sessionManifests',
@@ -32,6 +33,7 @@ const SENSITIVE_TOP_FIELDS = new Set([
     'lifecycle',
     'initialized',
     'owners',
+    'access',
     'admins',
     'channels',
     'aun',
@@ -44,10 +46,10 @@ const SENSITIVE_TOP_FIELDS = new Set([
     'role',
     'extra_backup',
 ]);
-const CRITICAL_AGENT_FIELDS = new Set(['owners', 'admins', 'roles']);
+const CRITICAL_AGENT_FIELDS = new Set(['owners', 'admins', 'roles', 'access']);
 const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
-function scalar(rolePermissionKey, valueKind) {
-    return { class: 'safe-scalar', rolePermissionKey, valueKind };
+function scalar(rolePermissionKey, valueKind, access = 'role-overridable') {
+    return { class: 'safe-scalar', access, rolePermissionKey, valueKind };
 }
 function readonlyObject(rolePermissionKey) {
     return { class: 'safe-readonly-object', rolePermissionKey };
@@ -133,8 +135,6 @@ export function resolveConfigFieldRule(fieldPath) {
             return scalar('session_renew', 'boolean');
         if (parts[1] === 'after_hours')
             return scalar('session_renew', 'positive-number');
-        if (parts[1] === 'effort')
-            return scalar('session_renew', 'effort');
         if (parts[1] === 'fallback_action')
             return scalar('session_renew', 'session-renew-action');
         return { class: 'unknown' };
@@ -153,6 +153,14 @@ export function resolveConfigFieldRule(fieldPath) {
             return scalar('sessionManifests', 'manifest-file');
         return { class: 'unknown' };
     }
+    if (top === 'groupRules') {
+        if (parts.length === 1)
+            return readonlyObject('groupRules');
+        if (field === 'groupRules.mode') {
+            return scalar(field, 'group-rules-mode', 'owner-only');
+        }
+        return { class: 'unknown' };
+    }
     if (top === 'group_venue_sync')
         return parts.length === 1
             ? readonlyObject('group_venue_sync')
@@ -257,5 +265,9 @@ export function parseConfigFieldValue(fieldPath, rawValue) {
             return raw === 'continue' || raw === 'new'
                 ? { ok: true, value: raw }
                 : { ok: false, reason: `Config field ${fieldPath} must be continue or new` };
+        case 'group-rules-mode':
+            return raw === 'load' || raw === 'ignore'
+                ? { ok: true, value: raw }
+                : { ok: false, reason: `Config field ${fieldPath} must be load or ignore` };
     }
 }