package core

// The tokens.sr.ht grant vocabulary of dolt.sr.ht.
//
// tokens.sr.ht deliberately knows no service's vocabulary (tokens SPEC ch. 3):
// it seals whatever grant string it is asked for and passes it through, and the
// service that accepts the token is the one that decides what a member means.
// So the vocabulary is declared here, in the pure domain package, next to the
// access matrix it complements — and not in authn/, which validates a
// credential, nor in the surface, which would then be the only place that knows
// what it is asking for.

// GrantRead is the tokens.sr.ht grant an instance working token must carry to
// read anything through /mcp.
//
// There is deliberately no dolt:write. Nothing on that surface writes — it has
// no SQL tool and no mutation by design (docs/DESIGN.mcp.md §2) — and a grant
// nobody checks is a promise to an operator that no code keeps: a token minted
// with a narrow "dolt:read" would be indistinguishable in effect from one minted
// with "dolt:write", and the operator who chose the first would believe in a
// boundary that does not exist. When something on this service does write
// through a bearer credential, the constant is added together with the check.
const GrantRead = "dolt:read"