instar 1.3.439 → 1.3.441

package/dist/permissions/IntentClassifier.js

@@ -0,0 +1,88 @@
+/**
+ * IntentClassifier — turn a natural-language request into a {action, tier, floorAction, confidence}.
+ *
+ * Two implementations:
+ *   - HeuristicIntentClassifier (here): deterministic, keyword-based, conservative.
+ *     Used for the floor (the dangerous path must NOT depend on an LLM — fail-closed)
+ *     and for the deterministic CI scenario suite. When uncertain whether something is
+ *     a floor action, it leans floor + low-confidence so the gate routes to CLARIFY.
+ *   - LlmIntentClassifier (LlmIntentClassifier.ts): wraps an IntelligenceProvider for the
+ *     judgment band. Per the "no silent degradation to brittle fallback" standard, it is
+ *     only used ABOVE the floor; floor detection stays deterministic here.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.5–6.6.
+ */
+const DEPLOY_VERB = /\b(deploy|deploys|deploying|ship|shipping|push|pushing|release|releasing|roll\s?out|cut a release)\b/;
+const PROD_NOUN = /\b(prod|production|live|the prod|to prod)\b/;
+const MONEY = /\b(wire|wiring|transfer|remit|pay|payment|send money|payout)\b|\$\s?\d/;
+const CRED_NOUN = /\b(api key|apikey|token|password|secret|credential|credentials|private key)\b/;
+const CRED_VERB = /\b(give|share|send|show|reveal|access|rotate|get|fetch|export|print)\b/;
+const DESTRUCTIVE_VERB = /\b(delete|drop|wipe|nuke|truncate|purge|destroy)\b|\brm\s+-rf\b/;
+const DESTRUCTIVE_NOUN = /\b(db|database|table|tables|data|records|prod|production|staging|everything|the whole)\b/;
+const GRANT_VERB = /\b(make|give|grant|promote|elevate|add)\b/;
+const GRANT_NOUN = /\b(admin|owner|root|access|authority|permission|permissions|privileges)\b/;
+const EXTERNAL_VERB = /\b(email|e-mail|send|reply|forward|message)\b/;
+const EXTERNAL_NOUN = /\b(client|clients|customer|customers|vendor|vendors|external|outside|outsider|partner|press|public)\b/;
+const READ_VERB = /\b(summar\w*|what is|what's|look up|lookup|find out|explain|status|draft|tell me|show me|recap|describe|list)\b/;
+const WRITE_VERB = /\b(post|create|file a ticket|open a ticket|schedule|add a|write up|note)\b/;
+const OP_VERB = /\b(run|trigger|kick off|start|rerun|re-run)\b/;
+const OP_NOUN = /\b(job|task|script|pipeline|staging|test|tests|build)\b/;
+/** Does the text CLAIM an authorization from some named party ("X said it's fine")? */
+export function mentionsClaimedAuthority(text) {
+    const t = text.toLowerCase();
+    return /\b(\w+\s+)?(said|told me|says|approved|authorized|okayed|gave the ok|signed off)\b/.test(t)
+        && /\b(it'?s fine|approved|ok(ay)?|go ahead|do it|fine|allowed|permission)\b/.test(t);
+}
+function intent(action, tier, confidence, directed, floorAction) {
+    return { action, tier, floorAction, confidence, directed };
+}
+/**
+ * Deterministic, conservative classifier. Floor detection is ordered first and
+ * leans toward treating an ambiguous "ship/deploy" as a possible floor action at
+ * LOW confidence so the gate clarifies rather than guesses.
+ */
+export class HeuristicIntentClassifier {
+    // eslint-disable-next-line @typescript-eslint/require-await
+    async classify(text, ctx) {
+        const t = (text || '').toLowerCase();
+        const directed = ctx.directed;
+        // ── Layer 0 floor detection (deterministic, conservative) ──
+        if (DEPLOY_VERB.test(t) && PROD_NOUN.test(t)) {
+            return intent('prod-deploy', 4, 0.92, directed, 'prod-deploy');
+        }
+        if (MONEY.test(t)) {
+            return intent('money-movement', 4, 0.9, directed, 'money-movement');
+        }
+        if (CRED_NOUN.test(t) && CRED_VERB.test(t)) {
+            return intent('credential-access', 4, 0.88, directed, 'credential-access');
+        }
+        if (DESTRUCTIVE_VERB.test(t) && DESTRUCTIVE_NOUN.test(t)) {
+            return intent('destructive-data', 4, 0.88, directed, 'destructive-data');
+        }
+        if (GRANT_VERB.test(t) && GRANT_NOUN.test(t)) {
+            return intent('grant-authority', 4, 0.88, directed, 'grant-authority');
+        }
+        if (EXTERNAL_VERB.test(t) && EXTERNAL_NOUN.test(t)) {
+            return intent('external-send', 4, 0.82, directed, 'external-send');
+        }
+        // ── Ambiguous deploy/ship with no object ("ship it") — possibly floor, low confidence ──
+        if (DEPLOY_VERB.test(t)) {
+            // Looks like a deploy/ship but no prod/object marker → could be a floor deploy or a
+            // harmless "send the draft". Treat as possibly-floor at LOW confidence → CLARIFY.
+            return intent('ambiguous', 4, 0.4, directed);
+        }
+        // ── Non-floor tiers ──
+        if (OP_VERB.test(t) && OP_NOUN.test(t)) {
+            return intent('operational', 3, 0.78, directed);
+        }
+        if (WRITE_VERB.test(t)) {
+            return intent('low-write', 2, 0.78, directed);
+        }
+        if (READ_VERB.test(t)) {
+            return intent('read', 1, 0.8, directed);
+        }
+        // ── Default: ambient discussion ──
+        return intent('discussion', 0, 0.6, directed);
+    }
+}
+//# sourceMappingURL=IntentClassifier.js.map

package/dist/permissions/IntentClassifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IntentClassifier.js","sourceRoot":"","sources":["../../src/permissions/IntentClassifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,MAAM,WAAW,GAAG,sGAAsG,CAAC;AAC3H,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE,MAAM,KAAK,GAAG,wEAAwE,CAAC;AACvF,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAClG,MAAM,SAAS,GAAG,wEAAwE,CAAC;AAC3F,MAAM,gBAAgB,GAAG,iEAAiE,CAAC;AAC3F,MAAM,gBAAgB,GAAG,0FAA0F,CAAC;AACpH,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAC/D,MAAM,UAAU,GAAG,2EAA2E,CAAC;AAC/F,MAAM,aAAa,GAAG,+CAA+C,CAAC;AACtE,MAAM,aAAa,GAAG,uGAAuG,CAAC;AAE9H,MAAM,SAAS,GAAG,iHAAiH,CAAC;AACpI,MAAM,UAAU,GAAG,4EAA4E,CAAC;AAChG,MAAM,OAAO,GAAG,+CAA+C,CAAC;AAChE,MAAM,OAAO,GAAG,yDAAyD,CAAC;AAE1E,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,oFAAoF,CAAC,IAAI,CAAC,CAAC,CAAC;WAC9F,0EAA0E,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,MAAM,CACb,MAAc,EACd,IAAqB,EACrB,UAAkB,EAClB,QAAiB,EACjB,WAAyB;IAEzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IACpC,4DAA4D;IAC5D,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,GAA0B;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B,8DAA8D;QAC9D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED,0FAA0F;QAC1F,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,oFAAoF;YACpF,kFAAkF;YAClF,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED,wBAAwB;QACxB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,oCAAoC;QACpC,OAAO,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/permissions/PermissionDecisionLedger.d.ts

@@ -0,0 +1,42 @@
+/**
+ * PermissionDecisionLedger — observe-only, append-only record of every permission
+ * verdict (allow / clarify / refuse / step-up) with the verified principal + basis.
+ *
+ * Purpose: measure the gate's decisions (and false-positive rate) against real
+ * traffic BEFORE enforcement is ever switched on. Writing here never blocks or
+ * mutates the message path — a ledger failure is swallowed.
+ *
+ * State category: `slack-permission-decisions` (state-coherence-registry.json).
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.10, §11.
+ */
+import type { PermissionVerdict } from './types.js';
+export interface PermissionLedgerEntry {
+    ts: string;
+    decision: string;
+    basis: string;
+    action: string;
+    tier: number;
+    floorAction?: string;
+    slackUserId?: string;
+    userId: string | null;
+    role: string;
+    registered: boolean;
+    directed: boolean;
+    confidence: number;
+    anomalyScore?: number;
+    channel?: string;
+    /** Observe-only marker: would this verdict have been ENFORCED (vs just logged)? */
+    enforced: boolean;
+}
+export declare class PermissionDecisionLedger {
+    private readonly file;
+    constructor(stateDir: string);
+    get path(): string;
+    record(verdict: PermissionVerdict, ctx?: {
+        channel?: string;
+        enforced?: boolean;
+    }): void;
+    /** Most-recent entries (for the read route + FP-rate measurement). */
+    readRecent(limit?: number): PermissionLedgerEntry[];
+}
+//# sourceMappingURL=PermissionDecisionLedger.d.ts.map

package/dist/permissions/PermissionDecisionLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionDecisionLedger.d.ts","sourceRoot":"","sources":["../../src/permissions/PermissionDecisionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,QAAQ,EAAE,MAAM;IAK5B,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IA0BxF,sEAAsE;IACtE,UAAU,CAAC,KAAK,SAAM,GAAG,qBAAqB,EAAE;CASjD"}

package/dist/permissions/PermissionDecisionLedger.js

@@ -0,0 +1,61 @@
+/**
+ * PermissionDecisionLedger — observe-only, append-only record of every permission
+ * verdict (allow / clarify / refuse / step-up) with the verified principal + basis.
+ *
+ * Purpose: measure the gate's decisions (and false-positive rate) against real
+ * traffic BEFORE enforcement is ever switched on. Writing here never blocks or
+ * mutates the message path — a ledger failure is swallowed.
+ *
+ * State category: `slack-permission-decisions` (state-coherence-registry.json).
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.10, §11.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+export class PermissionDecisionLedger {
+    file;
+    constructor(stateDir) {
+        /* state-registry: slack-permission-decisions */
+        this.file = path.join(stateDir, 'slack-permission-decisions.jsonl');
+    }
+    get path() {
+        return this.file;
+    }
+    record(verdict, ctx) {
+        const entry = {
+            ts: verdict.evaluatedAt,
+            decision: verdict.decision,
+            basis: verdict.basis,
+            action: verdict.intent.action,
+            tier: verdict.intent.tier,
+            floorAction: verdict.intent.floorAction,
+            slackUserId: verdict.principal.slackUserId,
+            userId: verdict.principal.userId,
+            role: verdict.principal.role,
+            registered: verdict.principal.registered,
+            directed: verdict.intent.directed,
+            confidence: verdict.intent.confidence,
+            anomalyScore: verdict.anomaly?.score,
+            channel: ctx?.channel,
+            enforced: ctx?.enforced ?? false,
+        };
+        try {
+            fs.mkdirSync(path.dirname(this.file), { recursive: true });
+            fs.appendFileSync(this.file, JSON.stringify(entry) + '\n');
+        }
+        catch {
+            // Observe-only ledger must NEVER break the message path.
+        }
+    }
+    /** Most-recent entries (for the read route + FP-rate measurement). */
+    readRecent(limit = 100) {
+        try {
+            const raw = fs.readFileSync(this.file, 'utf8');
+            const lines = raw.split('\n').filter(Boolean);
+            return lines.slice(-limit).map((l) => JSON.parse(l));
+        }
+        catch {
+            return [];
+        }
+    }
+}
+//# sourceMappingURL=PermissionDecisionLedger.js.map

package/dist/permissions/PermissionDecisionLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionDecisionLedger.js","sourceRoot":"","sources":["../../src/permissions/PermissionDecisionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAsB7B,MAAM,OAAO,wBAAwB;IAClB,IAAI,CAAS;IAE9B,YAAY,QAAgB;QAC1B,gDAAgD;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,OAA0B,EAAE,GAA8C;QAC/E,MAAM,KAAK,GAA0B;YACnC,EAAE,EAAE,OAAO,CAAC,WAAW;YACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YAC7B,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YACzB,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;YACvC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW;YAC1C,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;YAChC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5B,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU;YACxC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;YACrC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK;YACpC,OAAO,EAAE,GAAG,EAAE,OAAO;YACrB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,KAAK;SACjC,CAAC;QACF,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,KAAK,GAAG,GAAG;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA0B,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/permissions/RolePolicy.d.ts

@@ -0,0 +1,34 @@
+/**
+ * RolePolicy — the deterministic role→authority model (Layer 0 + role ceilings).
+ *
+ * Pure, synchronous, fully unit-testable. No LLM, no I/O. This is the part of the
+ * permission system that is STRUCTURE, not judgment: the floor and the role
+ * ceilings are enumerated here and cannot be talked around.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.4–6.6.
+ */
+import type { OrgRole, SensitivityTier, FloorAction } from './types.js';
+/** The enumerated floor — actions that are NEVER discretionary (Layer 0). */
+export declare const FLOOR_ACTIONS: readonly FloorAction[];
+export declare function isFloorAction(x: string | undefined | null): x is FloorAction;
+export interface RolePolicyConfig {
+    /** Override one or more role ceilings (org-configurable). */
+    roleCeilings?: Partial<Record<OrgRole, SensitivityTier>>;
+    /** Override which roles may authorize floor actions without a grant. */
+    floorAuthorizedRoles?: OrgRole[];
+}
+export declare class RolePolicy {
+    private readonly ceilings;
+    private readonly floorRoles;
+    constructor(config?: RolePolicyConfig);
+    /** The highest tier this role may authorize on its own. */
+    ceilingForRole(role: OrgRole): SensitivityTier;
+    /** Does this role's ceiling cover the requested tier? */
+    roleCoversTier(role: OrgRole, tier: SensitivityTier): boolean;
+    /**
+     * May this role authorize a FLOOR action without a separate grant?
+     * Default: only `owner`. (An `admin` has a T4 ceiling but is NOT floor-authorized.)
+     */
+    roleCanAuthorizeFloor(role: OrgRole): boolean;
+}
+//# sourceMappingURL=RolePolicy.d.ts.map

package/dist/permissions/RolePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RolePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/RolePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAmBxE,6EAA6E;AAC7E,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAO/C,CAAC;AAEF,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,WAAW,CAE5E;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACzD,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC;CAClC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;gBAEtC,MAAM,GAAE,gBAAqB;IAKzC,2DAA2D;IAC3D,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe;IAI9C,yDAAyD;IACzD,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO;IAI7D;;;OAGG;IACH,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;CAG9C"}

package/dist/permissions/RolePolicy.js

@@ -0,0 +1,60 @@
+/**
+ * RolePolicy — the deterministic role→authority model (Layer 0 + role ceilings).
+ *
+ * Pure, synchronous, fully unit-testable. No LLM, no I/O. This is the part of the
+ * permission system that is STRUCTURE, not judgment: the floor and the role
+ * ceilings are enumerated here and cannot be talked around.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.4–6.6.
+ */
+/** Default ceiling tier per role — the highest tier a role may authorize on its own. */
+const DEFAULT_ROLE_CEILING = {
+    guest: 0, // can be heard; cannot direct actions
+    member: 1, // reads, summaries, drafts
+    contributor: 2, // low-risk writes
+    operator: 3, // operational actions (non-prod)
+    admin: 4, // everything EXCEPT the floor without a grant (see canAuthorizeFloor)
+    owner: 4, // everything, and may authorize floor actions + issue grants
+};
+/**
+ * Roles that may authorize a FLOOR action without a separate grant. By default
+ * ONLY the owner. An `admin` has a T4 ceiling but still cannot reach a floor
+ * action without a grant — the floor is a harder boundary than the tier ceiling.
+ */
+const DEFAULT_FLOOR_AUTHORIZED_ROLES = ['owner'];
+/** The enumerated floor — actions that are NEVER discretionary (Layer 0). */
+export const FLOOR_ACTIONS = [
+    'money-movement',
+    'prod-deploy',
+    'credential-access',
+    'destructive-data',
+    'external-send',
+    'grant-authority',
+];
+export function isFloorAction(x) {
+    return !!x && FLOOR_ACTIONS.includes(x);
+}
+export class RolePolicy {
+    ceilings;
+    floorRoles;
+    constructor(config = {}) {
+        this.ceilings = { ...DEFAULT_ROLE_CEILING, ...(config.roleCeilings ?? {}) };
+        this.floorRoles = new Set(config.floorAuthorizedRoles ?? DEFAULT_FLOOR_AUTHORIZED_ROLES);
+    }
+    /** The highest tier this role may authorize on its own. */
+    ceilingForRole(role) {
+        return this.ceilings[role] ?? 0;
+    }
+    /** Does this role's ceiling cover the requested tier? */
+    roleCoversTier(role, tier) {
+        return this.ceilingForRole(role) >= tier;
+    }
+    /**
+     * May this role authorize a FLOOR action without a separate grant?
+     * Default: only `owner`. (An `admin` has a T4 ceiling but is NOT floor-authorized.)
+     */
+    roleCanAuthorizeFloor(role) {
+        return this.floorRoles.has(role);
+    }
+}
+//# sourceMappingURL=RolePolicy.js.map

package/dist/permissions/RolePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RolePolicy.js","sourceRoot":"","sources":["../../src/permissions/RolePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,wFAAwF;AACxF,MAAM,oBAAoB,GAAqC;IAC7D,KAAK,EAAE,CAAC,EAAE,sCAAsC;IAChD,MAAM,EAAE,CAAC,EAAE,2BAA2B;IACtC,WAAW,EAAE,CAAC,EAAE,kBAAkB;IAClC,QAAQ,EAAE,CAAC,EAAE,iCAAiC;IAC9C,KAAK,EAAE,CAAC,EAAE,sEAAsE;IAChF,KAAK,EAAE,CAAC,EAAE,6DAA6D;CACxE,CAAC;AAEF;;;;GAIG;AACH,MAAM,8BAA8B,GAAuB,CAAC,OAAO,CAAC,CAAC;AAErE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,iBAAiB;CAClB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,CAA4B;IACxD,OAAO,CAAC,CAAC,CAAC,IAAK,aAAmC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AASD,MAAM,OAAO,UAAU;IACJ,QAAQ,CAAmC;IAC3C,UAAU,CAAuB;IAElD,YAAY,SAA2B,EAAE;QACvC,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,8BAA8B,CAAC,CAAC;IAC3F,CAAC;IAED,2DAA2D;IAC3D,cAAc,CAAC,IAAa;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,yDAAyD;IACzD,cAAc,CAAC,IAAa,EAAE,IAAqB;QACjD,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,IAAa;QACjC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/permissions/SlackPermissionGate.d.ts

@@ -0,0 +1,62 @@
+/**
+ * SlackPermissionGate — the conversational authority gate (Pillar 2, Slice 0).
+ *
+ * Given a VERIFIED principal and a natural-language request, returns a
+ * {allow | clarify | refuse | step-up} verdict with a conversational message.
+ * It composes, in order:
+ *
+ *   overheard?            → undirected actionable request is never actioned (§6.9)
+ *   tier 0 / chat?        → no authority needed
+ *   unregistered?         → refuse + route to registration
+ *   ambiguous + possibly-floor (low confidence)?  → clarify, never guess
+ *   FLOOR action?         → Layer 0: needs owner role OR an explicit grant; else refuse
+ *   tiered action?        → role ceiling must cover the tier
+ *   would-allow a FLOOR action + anomalous?  → step-up (anomaly raises the bar, §7.4)
+ *
+ * Layer 0 (floor) is deterministic and fail-closed. The judgment band may consult
+ * an LLM classifier, but the floor never depends on one.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.6–6.9, §7.4.
+ */
+import type { PermissionVerdict, Principal, AuthorityGrant } from './types.js';
+import { RolePolicy } from './RolePolicy.js';
+import type { IntentClassifier } from './IntentClassifier.js';
+import type { AnomalyScorer } from './AnomalyScorer.js';
+/** Lookup for active authority grants (a Coordination Mandate, in production). */
+export interface GrantStore {
+    activeGrant(slackUserId: string, scope: string, now: number): AuthorityGrant | undefined;
+}
+export interface SlackPermissionGateDeps {
+    rolePolicy?: RolePolicy;
+    classifier: IntentClassifier;
+    anomalyScorer?: AnomalyScorer;
+    grants?: GrantStore;
+    /** Anomaly score at/above which a would-be-allowed floor action requires step-up. Default 0.5. */
+    stepUpThreshold?: number;
+    /** Confidence below which a possibly-floor action routes to clarify. Default 0.6. */
+    clarifyThreshold?: number;
+    /** Out-of-band channels offered for step-up, in priority order. */
+    stepUpChannels?: string[];
+    /** Injectable clock for deterministic tests. */
+    now?: () => number;
+}
+export interface EvaluateInput {
+    principal: Principal;
+    text: string;
+    /** Was the request directed at the agent (mention / clear ask)? */
+    directed: boolean;
+    channel?: string;
+}
+export declare class SlackPermissionGate {
+    private readonly rolePolicy;
+    private readonly classifier;
+    private readonly anomaly;
+    private readonly grants?;
+    private readonly stepUpThreshold;
+    private readonly clarifyThreshold;
+    private readonly stepUpChannels;
+    private readonly now;
+    constructor(deps: SlackPermissionGateDeps);
+    evaluate(input: EvaluateInput): Promise<PermissionVerdict>;
+}
+//# sourceMappingURL=SlackPermissionGate.d.ts.map

package/dist/permissions/SlackPermissionGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlackPermissionGate.d.ts","sourceRoot":"","sources":["../../src/permissions/SlackPermissionGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAiB,SAAS,EAAe,cAAc,EAAE,MAAM,YAAY,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAiB,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;CAC1F;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,kGAAkG;IAClG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAeD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAW;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,uBAAuB;IAWnC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAsGjE"}

package/dist/permissions/SlackPermissionGate.js

@@ -0,0 +1,117 @@
+/**
+ * SlackPermissionGate — the conversational authority gate (Pillar 2, Slice 0).
+ *
+ * Given a VERIFIED principal and a natural-language request, returns a
+ * {allow | clarify | refuse | step-up} verdict with a conversational message.
+ * It composes, in order:
+ *
+ *   overheard?            → undirected actionable request is never actioned (§6.9)
+ *   tier 0 / chat?        → no authority needed
+ *   unregistered?         → refuse + route to registration
+ *   ambiguous + possibly-floor (low confidence)?  → clarify, never guess
+ *   FLOOR action?         → Layer 0: needs owner role OR an explicit grant; else refuse
+ *   tiered action?        → role ceiling must cover the tier
+ *   would-allow a FLOOR action + anomalous?  → step-up (anomaly raises the bar, §7.4)
+ *
+ * Layer 0 (floor) is deterministic and fail-closed. The judgment band may consult
+ * an LLM classifier, but the floor never depends on one.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.6–6.9, §7.4.
+ */
+import { RolePolicy, isFloorAction } from './RolePolicy.js';
+import { mentionsClaimedAuthority } from './IntentClassifier.js';
+import { NullAnomalyScorer } from './AnomalyScorer.js';
+const FLOOR_LABEL = {
+    'money-movement': 'money transfer',
+    'prod-deploy': 'production deploy',
+    'credential-access': 'credential access',
+    'destructive-data': 'destructive data operation',
+    'external-send': 'external send to an outside party',
+    'grant-authority': 'permission/role change',
+};
+function floorLabel(f, fallback) {
+    return f ? FLOOR_LABEL[f] : fallback;
+}
+export class SlackPermissionGate {
+    rolePolicy;
+    classifier;
+    anomaly;
+    grants;
+    stepUpThreshold;
+    clarifyThreshold;
+    stepUpChannels;
+    now;
+    constructor(deps) {
+        this.rolePolicy = deps.rolePolicy ?? new RolePolicy();
+        this.classifier = deps.classifier;
+        this.anomaly = deps.anomalyScorer ?? new NullAnomalyScorer();
+        this.grants = deps.grants;
+        this.stepUpThreshold = deps.stepUpThreshold ?? 0.5;
+        this.clarifyThreshold = deps.clarifyThreshold ?? 0.6;
+        this.stepUpChannels = deps.stepUpChannels ?? ['your known Telegram', 'a second admin'];
+        this.now = deps.now ?? (() => Date.now());
+    }
+    async evaluate(input) {
+        const now = this.now();
+        const evaluatedAt = new Date(now).toISOString();
+        const { principal, text } = input;
+        const intent = await this.classifier.classify(text, { directed: input.directed });
+        const base = { principal, intent, evaluatedAt };
+        const verdict = (decision, basis, message, extra) => ({ decision, basis, message, ...base, ...extra });
+        // ── overheard ≠ command (§6.9): an undirected actionable request is never actioned ──
+        if (!intent.directed) {
+            if (intent.tier >= 1) {
+                return verdict('refuse', 'overheard', '');
+            }
+            return verdict('allow', 'ambient-noop', '');
+        }
+        // ── tier 0: plain conversation needs no authority ──
+        if (intent.tier === 0) {
+            return verdict('allow', 'within-authority', '');
+        }
+        const claimsAuthority = mentionsClaimedAuthority(text);
+        // ── unregistered principal cannot direct actions ──
+        if (!principal.registered) {
+            return verdict('refuse', 'unregistered', `I don't have you registered yet, ${principal.name}, so I can't action requests for you. ` +
+                `I've flagged an admin to set you up — once that's done I'll be able to help.`);
+        }
+        // ── ambiguous + possibly-floor (low confidence) → clarify, never guess ──
+        if (intent.tier >= 3 && intent.confidence < this.clarifyThreshold) {
+            return verdict('clarify', 'ambiguous-intent', `Happy to — just to be sure I do the right thing, ${principal.name}: do you mean deploy/ship to ` +
+                `production, or something lighter like sending a draft? They're pretty different and one of them needs sign-off.`);
+        }
+        // ── FLOOR action (Layer 0, deterministic, fail-closed) ──
+        if (isFloorAction(intent.floorAction)) {
+            const label = floorLabel(intent.floorAction, intent.action);
+            const granted = principal.slackUserId
+                ? this.grants?.activeGrant(principal.slackUserId, intent.floorAction, now)
+                : undefined;
+            const authorizedByRole = this.rolePolicy.roleCanAuthorizeFloor(principal.role);
+            if (!granted && !authorizedByRole) {
+                if (claimsAuthority) {
+                    return verdict('refuse', 'content-name-not-authority', `I can't act on an instruction relayed in a message, ${principal.name} — authority has to come from a ` +
+                        `verified grant, not a mention of who said it's OK. If an owner wants to grant this, they can do it ` +
+                        `directly and I'll have it on record.`);
+                }
+                return verdict('refuse', 'floor-no-grant', `I can't run a ${label} on a ${principal.role}'s request, ${principal.name} — that's a protected action ` +
+                    `that needs an explicit grant. Want me to ask an owner to approve it, or to grant you a time-boxed ` +
+                    `authority for this one?`);
+            }
+            // Would-allow a floor action → relationship anomaly may RAISE the bar to step-up (§7.4).
+            const anomaly = await this.anomaly.assess(principal, intent, text);
+            if (anomaly.score >= this.stepUpThreshold) {
+                return verdict('step-up', 'anomaly-stepup', `This is a bit different from what you usually ask, ${principal.name}, and a ${label} is a protected ` +
+                    `action — so I want to confirm it's really you before I move on it. I've sent a confirmation to ` +
+                    `${this.stepUpChannels[0]}; once you confirm there, I'll proceed.`, { anomaly, stepUp: { channels: this.stepUpChannels, reason: anomaly.reasons.join('; ') || 'out-of-character request' } });
+            }
+            return verdict('allow', granted ? 'floor-granted' : 'within-authority', '', { anomaly });
+        }
+        // ── tiered (non-floor) action: role ceiling must cover the tier ──
+        if (this.rolePolicy.roleCoversTier(principal.role, intent.tier)) {
+            return verdict('allow', 'within-authority', '');
+        }
+        return verdict('refuse', 'role-ceiling', `That's above what a ${principal.role} can authorize on their own, ${principal.name}. ` +
+            `I can ask someone with the authority to sign off — want me to?`);
+    }
+}
+//# sourceMappingURL=SlackPermissionGate.js.map

package/dist/permissions/SlackPermissionGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlackPermissionGate.js","sourceRoot":"","sources":["../../src/permissions/SlackPermissionGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AA8BvD,MAAM,WAAW,GAAgC;IAC/C,gBAAgB,EAAE,gBAAgB;IAClC,aAAa,EAAE,mBAAmB;IAClC,mBAAmB,EAAE,mBAAmB;IACxC,kBAAkB,EAAE,4BAA4B;IAChD,eAAe,EAAE,mCAAmC;IACpD,iBAAiB,EAAE,wBAAwB;CAC5C,CAAC;AAEF,SAAS,UAAU,CAAC,CAA0B,EAAE,QAAgB;IAC9D,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,UAAU,CAAa;IACvB,UAAU,CAAmB;IAC7B,OAAO,CAAgB;IACvB,MAAM,CAAc;IACpB,eAAe,CAAS;IACxB,gBAAgB,CAAS;IACzB,cAAc,CAAW;IACzB,GAAG,CAAe;IAEnC,YAAY,IAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,UAAU,EAAE,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,iBAAiB,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC;QACnD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACrD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElF,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CACd,QAAuC,EACvC,KAAa,EACb,OAAe,EACf,KAAkC,EACf,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAE1E,uFAAuF;QACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBACrB,OAAO,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,sDAAsD;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAEvD,qDAAqD;QACrD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO,OAAO,CACZ,QAAQ,EACR,cAAc,EACd,oCAAoC,SAAS,CAAC,IAAI,wCAAwC;gBACxF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAClE,OAAO,OAAO,CACZ,SAAS,EACT,kBAAkB,EAClB,oDAAoD,SAAS,CAAC,IAAI,+BAA+B;gBAC/F,iHAAiH,CACpH,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW;gBACnC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;gBAC1E,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE/E,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAClC,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,OAAO,CACZ,QAAQ,EACR,4BAA4B,EAC5B,uDAAuD,SAAS,CAAC,IAAI,kCAAkC;wBACrG,qGAAqG;wBACrG,sCAAsC,CACzC,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CACZ,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,KAAK,SAAS,SAAS,CAAC,IAAI,eAAe,SAAS,CAAC,IAAI,+BAA+B;oBACvG,oGAAoG;oBACpG,yBAAyB,CAC5B,CAAC;YACJ,CAAC;YAED,yFAAyF;YACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC1C,OAAO,OAAO,CACZ,SAAS,EACT,gBAAgB,EAChB,sDAAsD,SAAS,CAAC,IAAI,WAAW,KAAK,kBAAkB;oBACpG,iGAAiG;oBACjG,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,yCAAyC,EACpE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,EAAE,EAAE,CACzH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,oEAAoE;QACpE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CACZ,QAAQ,EACR,cAAc,EACd,uBAAuB,SAAS,CAAC,IAAI,gCAAgC,SAAS,CAAC,IAAI,IAAI;YACrF,gEAAgE,CACnE,CAAC;IACJ,CAAC;CACF"}

package/dist/permissions/SlackPermissionObserver.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SlackPermissionObserver — the single object the SlackAdapter calls to evaluate a
+ * message against the permission gate. Composes resolver → gate → ledger.
+ *
+ * Slice 0 ships OBSERVE-ONLY: `observe()` evaluates and RECORDS the verdict but
+ * never blocks the message path (enforce=false). This lets us measure the gate's
+ * decisions (and false-positive rate) against real traffic before enforcement is
+ * ever switched on (§11). It must NEVER throw — a failure here cannot break delivery.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.6, §6.10, §11.
+ */
+import type { PermissionVerdict } from './types.js';
+import type { SlackPrincipalResolver } from './SlackPrincipalResolver.js';
+import type { SlackPermissionGate } from './SlackPermissionGate.js';
+import type { PermissionDecisionLedger } from './PermissionDecisionLedger.js';
+export interface ObserveInput {
+    slackUserId: string;
+    displayName?: string;
+    text: string;
+    directed: boolean;
+    channel?: string;
+}
+export interface SlackPermissionObserverDeps {
+    resolver: SlackPrincipalResolver;
+    gate: SlackPermissionGate;
+    ledger: PermissionDecisionLedger;
+    /** When true the observer would ENFORCE (block). Slice 0 ships observe-only (false). */
+    enforce?: boolean;
+}
+export declare class SlackPermissionObserver {
+    private readonly deps;
+    constructor(deps: SlackPermissionObserverDeps);
+    /** Resolve → evaluate → record (observe-only). Returns the verdict; never throws. */
+    observe(input: ObserveInput): Promise<PermissionVerdict | null>;
+    get enforcing(): boolean;
+}
+//# sourceMappingURL=SlackPermissionObserver.d.ts.map

package/dist/permissions/SlackPermissionObserver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlackPermissionObserver.d.ts","sourceRoot":"","sources":["../../src/permissions/SlackPermissionObserver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,sBAAsB,CAAC;IACjC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,wBAAwB,CAAC;IACjC,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,2BAA2B;IAE9D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAiBrE,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF"}

package/dist/permissions/SlackPermissionObserver.js

@@ -0,0 +1,39 @@
+/**
+ * SlackPermissionObserver — the single object the SlackAdapter calls to evaluate a
+ * message against the permission gate. Composes resolver → gate → ledger.
+ *
+ * Slice 0 ships OBSERVE-ONLY: `observe()` evaluates and RECORDS the verdict but
+ * never blocks the message path (enforce=false). This lets us measure the gate's
+ * decisions (and false-positive rate) against real traffic before enforcement is
+ * ever switched on (§11). It must NEVER throw — a failure here cannot break delivery.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.6, §6.10, §11.
+ */
+export class SlackPermissionObserver {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Resolve → evaluate → record (observe-only). Returns the verdict; never throws. */
+    async observe(input) {
+        try {
+            const principal = this.deps.resolver.resolve(input.slackUserId, input.displayName);
+            const verdict = await this.deps.gate.evaluate({
+                principal,
+                text: input.text,
+                directed: input.directed,
+                channel: input.channel,
+            });
+            this.deps.ledger.record(verdict, { channel: input.channel, enforced: this.enforcing });
+            return verdict;
+        }
+        catch {
+            // Observe-only: a gate/ledger failure must NEVER break the message path.
+            return null;
+        }
+    }
+    get enforcing() {
+        return this.deps.enforce ?? false;
+    }
+}
+//# sourceMappingURL=SlackPermissionObserver.js.map

package/dist/permissions/SlackPermissionObserver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlackPermissionObserver.js","sourceRoot":"","sources":["../../src/permissions/SlackPermissionObserver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuBH,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,IAAiC;QAAjC,SAAI,GAAJ,IAAI,CAA6B;IAAG,CAAC;IAElE,qFAAqF;IACrF,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC5C,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACpC,CAAC;CACF"}

package/dist/permissions/SlackPrincipalResolver.d.ts

@@ -0,0 +1,39 @@
+/**
+ * SlackPrincipalResolver — resolve a VERIFIED Slack user id into a Principal.
+ *
+ * Identity is bound from the authenticated Slack `U…` id (Know Your Principal),
+ * NEVER from a name in message content. An unknown id resolves to an unregistered
+ * guest (the gate then refuses any actionable request and routes to registration).
+ *
+ * Decoupled from core: it depends only on a minimal `UserLookup` interface, which
+ * `UserManager` satisfies structurally — so the permission system never imports core.
+ *
+ * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.2.
+ */
+import type { OrgRole, Principal } from './types.js';
+/** The minimal user-store shape the resolver needs (UserManager satisfies this). */
+export interface ResolvedUserRecord {
+    id: string;
+    name: string;
+    permissions: string[];
+    orgRole?: string;
+}
+export interface UserLookup {
+    resolveFromSlackUserId(slackUserId: string): ResolvedUserRecord | null;
+}
+/**
+ * Derive an OrgRole. An explicit, valid `orgRole` wins; otherwise the highest role
+ * named in `permissions` wins; otherwise default to `member` (a registered user is
+ * at least a member). Legacy `permissions: ['admin']` therefore maps to admin.
+ */
+export declare function deriveRole(permissions?: string[], orgRole?: string): OrgRole;
+export declare class SlackPrincipalResolver {
+    private readonly users;
+    constructor(users: UserLookup);
+    /**
+     * @param slackUserId the AUTHENTICATED Slack user id (U…) from the event envelope
+     * @param displayName display name (for messages only — never a basis for authority)
+     */
+    resolve(slackUserId: string, displayName?: string): Principal;
+}
+//# sourceMappingURL=SlackPrincipalResolver.d.ts.map

package/dist/permissions/SlackPrincipalResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlackPrincipalResolver.d.ts","sourceRoot":"","sources":["../../src/permissions/SlackPrincipalResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGrD,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAC;CACxE;AAKD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,WAAW,GAAE,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,UAAU;IAE9C;;;OAGG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,SAAS;CAmB1D"}