@authorbot/domain 0.1.33 → 0.1.35

package/CHANGELOG.md

@@ -9,6 +9,72 @@ Every published package shares this version. A tag builds, tests, and publishes
 all of them together, so `@authorbot/cli@0.1.15` and `@authorbot/api@0.1.15` are
 always the same commit.
 
+## 0.1.35
+
+- **Legacy agent-token requests now maintain the canonical projection.** The
+  compatibility `{scopes}` request remains legacy-authoritative, but every new
+  token also records the exact safe capability translation. Control-plane
+  scopes never enter that projection. This dual-write Worker must be deployed
+  and verified before the one-shot legacy-row backfill ships in v0.1.36.
+- **The upgrade helper now repairs a stale local toolchain before changing a
+  book.** Forward upgrades hand off to the exact target CLI in a throwaway
+  install when `node_modules` does not match the repository pin. That target
+  aligns the CLI and API packages, regenerates the lockfile, and preserves the
+  child exit code and JSON output. Interrupted same-version installs are
+  repaired through a normal reviewable pull request, with migration baselines
+  accepted only from coherent committed CLI lock evidence. Dry runs regenerate
+  and verify the lockfile in a throwaway copy. Windows launches npm, npx, and
+  Wrangler through validated JavaScript entry points under the current Node
+  executable, without enabling a command shell. Exact `--to` targets require
+  no registry metadata lookup; implicit discovery uses npm's configured
+  offline cache, registry, userconfig, and authentication. Existing helpers
+  from before 0.1.35 still need one explicit
+  `npx --yes @authorbot/cli@0.1.35 upgrade --to 0.1.35` launch; ordinary
+  `npx authorbot upgrade` self-bootstraps after that.
+- This is a focused capability-writer-gate and upgrade-safety release. It adds
+  no D1 or book-format migration. The Phase 3B backfill is reserved for
+  v0.1.36 after this Worker is verified; Phase 3C legacy retirement remains a
+  deliberately separate later release.
+
+## 0.1.34
+
+- **The full editorial workflow is now available from the site.** Editors can
+  revise chapters with Milkdown Crepe, edit Outline, Timeline, and Character
+  documents in place, submit immutable proposals, and review safe Diff2Html
+  diffs. Maintainers can apply their own edit in one action without bypassing
+  validation, attribution, Git history, or the deployment pipeline.
+- **Notes and discussion now work as complete chapter collaboration tools.**
+  Anchored notes stay in manuscript order, expand with their target, navigate
+  with Previous and Next controls, render inline on mobile, and share the
+  Milkdown reading surface. Chapter-wide discussion supports replies, comment
+  voting, withdrawal, moderation, and one-click promotion to Work.
+- **Work and revision progress remains visible.** Completed Work stays on the
+  Work page with attribution and result links. Submitted edits report review,
+  apply, repository, build, and deployment state while retaining recoverable
+  drafts until the matching commit is live.
+- **Agent permissions are exact and human-equivalent for editorial work.**
+  Tokens can independently read and write comments and suggestions, vote,
+  reply, work a lease, submit revisions, review proposals, read history, and
+  update summaries within their role ceiling. Control-plane authority remains
+  human-only. Token event feeds and operation polling now enforce those same
+  exact read capabilities instead of exposing unrelated project activity. The
+  collaborator skill documents these workflows and exposes a bounded
+  story-bible API so agents do not have to probe a deployed site.
+- **Editors load reliably on nested and mobile sites.** Books served from a
+  base path keep lazy editor styles under that path. Mobile note forms stay
+  reachable beside their manuscript target, and rich Notes rerenders replace
+  the existing composer instead of duplicating it.
+- **Chapter context is easier to understand and recover.** Chapter rows show
+  open feedback and Work counts, summaries flow into the authenticated and
+  published Outline views, contributors link to the accepted revisions that
+  credited them, and authorized collaborators can browse, compare, and propose
+  restoring earlier chapter versions.
+- This release includes D1 migrations `0010_phase11_capabilities_expand.sql`,
+  `0011_phase11_revision_proposals.sql`, and
+  `0012_chapter_summaries.sql`. The capability backfill deliberately remains a
+  separate later release after this dual-read Worker is deployed. No
+  book-format migration is required.
+
 ## 0.1.33
 
 - **Collaboration state now stays coherent across the whole site.** Account,

package/dist/commands.d.ts

@@ -126,4 +126,14 @@ export declare const withdrawAnnotationCommandSchema: z.ZodObject<{
     annotationId: z.ZodString;
 }, z.core.$strict>;
 export type WithdrawAnnotationCommand = z.infer<typeof withdrawAnnotationCommandSchema>;
+/**
+ * `POST .../annotations/{annotationId}/replies/{replyId}/withdraw`. The HTTP
+ * body is empty; both route parameters are part of the logical command so an
+ * id cannot be moved across annotation threads by changing only the URL.
+ */
+export declare const withdrawReplyCommandSchema: z.ZodObject<{
+    annotationId: z.ZodString;
+    replyId: z.ZodString;
+}, z.core.$strict>;
+export type WithdrawReplyCommand = z.infer<typeof withdrawReplyCommandSchema>;
 //# sourceMappingURL=commands.d.ts.map

package/dist/commands.js

@@ -101,4 +101,13 @@ export const mintAgentTokenCommandSchema = z.strictObject({
 export const withdrawAnnotationCommandSchema = z.strictObject({
     annotationId: uuidv7Schema,
 });
+/**
+ * `POST .../annotations/{annotationId}/replies/{replyId}/withdraw`. The HTTP
+ * body is empty; both route parameters are part of the logical command so an
+ * id cannot be moved across annotation threads by changing only the URL.
+ */
+export const withdrawReplyCommandSchema = z.strictObject({
+    annotationId: uuidv7Schema,
+    replyId: uuidv7Schema,
+});
 //# sourceMappingURL=commands.js.map

package/dist/editorial-capabilities.d.ts

@@ -0,0 +1,158 @@
+import { z } from "zod";
+import { type Decision } from "./decision.js";
+import type { Role } from "./scopes.js";
+/**
+ * Canonical Phase 11 editorial authority for agent tokens.
+ *
+ * This vocabulary is deliberately exact. A capability added by a later
+ * release is absent from this tuple and therefore fails parsing instead of
+ * inheriting authority from a broad read or write grant.
+ */
+export declare const EDITORIAL_CAPABILITIES: readonly ["chapters:read", "comments:read", "suggestions:read", "comments:write", "suggestions:write", "replies:write", "comments:vote", "suggestions:vote", "feedback:withdraw-own", "feedback:moderate", "work:read", "work:promote", "work:claim", "work:submit", "work:cancel", "summaries:write", "chapters:write", "chapters:publish", "revisions:read", "revisions:write", "revisions:review", "history:read"];
+export type EditorialCapability = (typeof EDITORIAL_CAPABILITIES)[number];
+export declare const editorialCapabilitySchema: z.ZodEnum<{
+    "chapters:read": "chapters:read";
+    "work:read": "work:read";
+    "work:claim": "work:claim";
+    "comments:read": "comments:read";
+    "suggestions:read": "suggestions:read";
+    "comments:write": "comments:write";
+    "suggestions:write": "suggestions:write";
+    "replies:write": "replies:write";
+    "comments:vote": "comments:vote";
+    "suggestions:vote": "suggestions:vote";
+    "feedback:withdraw-own": "feedback:withdraw-own";
+    "feedback:moderate": "feedback:moderate";
+    "work:promote": "work:promote";
+    "work:submit": "work:submit";
+    "work:cancel": "work:cancel";
+    "summaries:write": "summaries:write";
+    "chapters:write": "chapters:write";
+    "chapters:publish": "chapters:publish";
+    "revisions:read": "revisions:read";
+    "revisions:write": "revisions:write";
+    "revisions:review": "revisions:review";
+    "history:read": "history:read";
+}>;
+/**
+ * A complete canonical grant set as stored on a canonical-mode token.
+ *
+ * Empty is valid and means that the token has no editorial authority. Unknown
+ * and duplicate names invalidate the complete set rather than being partially
+ * accepted. The transform gives every valid result one deterministic order.
+ */
+export declare const editorialCapabilitiesSchema: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+    "chapters:read": "chapters:read";
+    "work:read": "work:read";
+    "work:claim": "work:claim";
+    "comments:read": "comments:read";
+    "suggestions:read": "suggestions:read";
+    "comments:write": "comments:write";
+    "suggestions:write": "suggestions:write";
+    "replies:write": "replies:write";
+    "comments:vote": "comments:vote";
+    "suggestions:vote": "suggestions:vote";
+    "feedback:withdraw-own": "feedback:withdraw-own";
+    "feedback:moderate": "feedback:moderate";
+    "work:promote": "work:promote";
+    "work:submit": "work:submit";
+    "work:cancel": "work:cancel";
+    "summaries:write": "summaries:write";
+    "chapters:write": "chapters:write";
+    "chapters:publish": "chapters:publish";
+    "revisions:read": "revisions:read";
+    "revisions:write": "revisions:write";
+    "revisions:review": "revisions:review";
+    "history:read": "history:read";
+}>>, z.ZodTransform<("chapters:read" | "work:read" | "work:claim" | "comments:read" | "suggestions:read" | "comments:write" | "suggestions:write" | "replies:write" | "comments:vote" | "suggestions:vote" | "feedback:withdraw-own" | "feedback:moderate" | "work:promote" | "work:submit" | "work:cancel" | "summaries:write" | "chapters:write" | "chapters:publish" | "revisions:read" | "revisions:write" | "revisions:review" | "history:read")[], ("chapters:read" | "work:read" | "work:claim" | "comments:read" | "suggestions:read" | "comments:write" | "suggestions:write" | "replies:write" | "comments:vote" | "suggestions:vote" | "feedback:withdraw-own" | "feedback:moderate" | "work:promote" | "work:submit" | "work:cancel" | "summaries:write" | "chapters:write" | "chapters:publish" | "revisions:read" | "revisions:write" | "revisions:review" | "history:read")[]>>;
+export type EditorialCapabilityParseFailureReason = "invalid-capability-set" | "invalid-json";
+export type EditorialCapabilityParseResult = {
+    readonly ok: true;
+    readonly capabilities: EditorialCapability[];
+} | {
+    readonly ok: false;
+    readonly capabilities: readonly [];
+    readonly reason: EditorialCapabilityParseFailureReason;
+};
+/** Parse a decoded canonical capability value, denying every grant on error. */
+export declare function parseEditorialCapabilities(input: unknown): EditorialCapabilityParseResult;
+/** Parse the JSON stored in `capabilities_v2`, denying every grant on error. */
+export declare function parseStoredEditorialCapabilities(input: string | null): EditorialCapabilityParseResult;
+/**
+ * Maximum canonical authority admitted by each current project role.
+ * Token grants and this ceiling are independent; effective authority is their
+ * intersection.
+ */
+export declare const ROLE_EDITORIAL_CAPABILITIES: Readonly<Record<Role, readonly EditorialCapability[]>>;
+export declare function roleEditorialCapabilities(role: Role): readonly EditorialCapability[];
+/** Token grants intersected with the actor's current role, in canonical order. */
+export declare function effectiveEditorialCapabilities(grantedCapabilities: readonly EditorialCapability[], role: Role): EditorialCapability[];
+export type EditorialCapabilityDenialReason = "missing-capability" | "role-ceiling";
+/** Enforce the independent exact-grant and current-role checks. */
+export declare function authorizeEditorialCapability(grantedCapabilities: readonly EditorialCapability[], role: Role, required: EditorialCapability): Decision<EditorialCapabilityDenialReason>;
+/** Legacy names that exercised editorial authority before canonical mode. */
+export declare const LEGACY_EDITORIAL_SCOPES: readonly ["chapters:read", "annotations:read", "annotations:write", "work:read", "work:claim", "submissions:write", "votes:write"];
+export type LegacyEditorialScope = (typeof LEGACY_EDITORIAL_SCOPES)[number];
+/** Known old control-plane names. They never translate to editorial authority. */
+export declare const LEGACY_CONTROL_SCOPES: readonly ["tokens:manage", "members:manage"];
+export type LegacyControlScope = (typeof LEGACY_CONTROL_SCOPES)[number];
+export declare const LEGACY_AGENT_SCOPES: readonly ["chapters:read", "annotations:read", "annotations:write", "work:read", "work:claim", "submissions:write", "tokens:manage", "members:manage", "votes:write"];
+export type LegacyAgentScope = (typeof LEGACY_AGENT_SCOPES)[number];
+export declare const legacyAgentScopeSchema: z.ZodEnum<{
+    "chapters:read": "chapters:read";
+    "annotations:read": "annotations:read";
+    "annotations:write": "annotations:write";
+    "work:read": "work:read";
+    "work:claim": "work:claim";
+    "submissions:write": "submissions:write";
+    "tokens:manage": "tokens:manage";
+    "members:manage": "members:manage";
+    "votes:write": "votes:write";
+}>;
+/**
+ * Translate safe, known legacy editorial names. Unknown and control-plane
+ * names never produce authority, and prerequisites are deliberately not
+ * synthesized.
+ */
+export declare function translateLegacyScopes(scopes: readonly string[]): EditorialCapability[];
+export type LegacyScopeParseResult = {
+    readonly ok: true;
+    readonly scopes: LegacyEditorialScope[];
+    readonly removedScopes: string[];
+    readonly capabilities: EditorialCapability[];
+} | {
+    readonly ok: false;
+    readonly scopes: readonly [];
+    readonly removedScopes: readonly [];
+    readonly capabilities: readonly [];
+    readonly reason: "invalid-legacy-scope-set";
+};
+/**
+ * Sanitize a decoded legacy scope set for dual-read mode.
+ *
+ * Known control-plane and unknown string names are returned for audit and
+ * removed. Structurally malformed input denies the complete set so a corrupt
+ * row cannot partially authorize a request.
+ */
+export declare function parseLegacyScopes(input: unknown): LegacyScopeParseResult;
+export declare const LEGACY_COMPATIBILITY_ACTIONS: readonly ["feedback:moderate", "work:promote", "work:cancel"];
+export type LegacyCompatibilityAction = (typeof LEGACY_COMPATIBILITY_ACTIONS)[number];
+export interface LegacyEffectiveAction {
+    readonly action: LegacyCompatibilityAction;
+    readonly source: "legacy-scope";
+    readonly sourceScope: "annotations:write" | "work:claim";
+}
+/**
+ * Old maintainer-only actions preserved only while a row remains in legacy
+ * mode. They are reported separately and are never canonical grants.
+ */
+export declare function legacyEffectiveActions(scopes: readonly string[], role: Role): LegacyEffectiveAction[];
+/**
+ * Conservative old-scope shadow for a canonical row.
+ *
+ * A prior Worker may deny a granular action after deploy or rollback, but
+ * every scope it does see is guaranteed not to exceed the canonical grant.
+ * Control-plane and unknown names can never be emitted.
+ */
+export declare function legacyScopeShadow(capabilities: readonly EditorialCapability[]): LegacyEditorialScope[];
+//# sourceMappingURL=editorial-capabilities.d.ts.map

package/dist/editorial-capabilities.js

@@ -0,0 +1,297 @@
+import { z } from "zod";
+import { ALLOWED, denied } from "./decision.js";
+/**
+ * Canonical Phase 11 editorial authority for agent tokens.
+ *
+ * This vocabulary is deliberately exact. A capability added by a later
+ * release is absent from this tuple and therefore fails parsing instead of
+ * inheriting authority from a broad read or write grant.
+ */
+export const EDITORIAL_CAPABILITIES = [
+    "chapters:read",
+    "comments:read",
+    "suggestions:read",
+    "comments:write",
+    "suggestions:write",
+    "replies:write",
+    "comments:vote",
+    "suggestions:vote",
+    "feedback:withdraw-own",
+    "feedback:moderate",
+    "work:read",
+    "work:promote",
+    "work:claim",
+    "work:submit",
+    "work:cancel",
+    "summaries:write",
+    "chapters:write",
+    "chapters:publish",
+    "revisions:read",
+    "revisions:write",
+    "revisions:review",
+    "history:read",
+];
+export const editorialCapabilitySchema = z.enum(EDITORIAL_CAPABILITIES);
+/**
+ * A complete canonical grant set as stored on a canonical-mode token.
+ *
+ * Empty is valid and means that the token has no editorial authority. Unknown
+ * and duplicate names invalidate the complete set rather than being partially
+ * accepted. The transform gives every valid result one deterministic order.
+ */
+export const editorialCapabilitiesSchema = z
+    .array(editorialCapabilitySchema)
+    .superRefine((capabilities, ctx) => {
+    const seen = new Set();
+    capabilities.forEach((capability, index) => {
+        if (seen.has(capability)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `duplicate capability "${capability}"`,
+                path: [index],
+            });
+        }
+        seen.add(capability);
+    });
+})
+    .transform((capabilities) => {
+    const granted = new Set(capabilities);
+    return EDITORIAL_CAPABILITIES.filter((capability) => granted.has(capability));
+});
+const invalidCapabilitySet = (reason) => ({
+    ok: false,
+    capabilities: [],
+    reason,
+});
+/** Parse a decoded canonical capability value, denying every grant on error. */
+export function parseEditorialCapabilities(input) {
+    const parsed = editorialCapabilitiesSchema.safeParse(input);
+    return parsed.success
+        ? { ok: true, capabilities: parsed.data }
+        : invalidCapabilitySet("invalid-capability-set");
+}
+/** Parse the JSON stored in `capabilities_v2`, denying every grant on error. */
+export function parseStoredEditorialCapabilities(input) {
+    if (input === null) {
+        return invalidCapabilitySet("invalid-capability-set");
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(input);
+    }
+    catch {
+        return invalidCapabilitySet("invalid-json");
+    }
+    return parseEditorialCapabilities(decoded);
+}
+const READER_CAPABILITIES = [
+    "chapters:read",
+    "comments:read",
+    "suggestions:read",
+];
+const CONTRIBUTOR_CAPABILITIES = [
+    ...READER_CAPABILITIES,
+    "comments:write",
+    "suggestions:write",
+    "replies:write",
+    "comments:vote",
+    "suggestions:vote",
+    "feedback:withdraw-own",
+    "summaries:write",
+];
+const EDITOR_CAPABILITIES = [
+    ...CONTRIBUTOR_CAPABILITIES,
+    "work:read",
+    "work:claim",
+    "work:submit",
+    "chapters:write",
+    "revisions:read",
+    "revisions:write",
+    "history:read",
+];
+const MAINTAINER_CAPABILITIES = EDITORIAL_CAPABILITIES;
+/**
+ * Maximum canonical authority admitted by each current project role.
+ * Token grants and this ceiling are independent; effective authority is their
+ * intersection.
+ */
+export const ROLE_EDITORIAL_CAPABILITIES = Object.freeze({
+    reader: READER_CAPABILITIES,
+    contributor: CONTRIBUTOR_CAPABILITIES,
+    editor: EDITOR_CAPABILITIES,
+    maintainer: MAINTAINER_CAPABILITIES,
+});
+export function roleEditorialCapabilities(role) {
+    return ROLE_EDITORIAL_CAPABILITIES[role];
+}
+/** Token grants intersected with the actor's current role, in canonical order. */
+export function effectiveEditorialCapabilities(grantedCapabilities, role) {
+    const granted = new Set(grantedCapabilities);
+    const ceiling = new Set(ROLE_EDITORIAL_CAPABILITIES[role]);
+    return EDITORIAL_CAPABILITIES.filter((capability) => granted.has(capability) && ceiling.has(capability));
+}
+/** Enforce the independent exact-grant and current-role checks. */
+export function authorizeEditorialCapability(grantedCapabilities, role, required) {
+    if (!grantedCapabilities.includes(required)) {
+        return denied("missing-capability", `token lacks required editorial capability "${required}"`);
+    }
+    if (!ROLE_EDITORIAL_CAPABILITIES[role].includes(required)) {
+        return denied("role-ceiling", `project role "${role}" does not admit editorial capability "${required}"`);
+    }
+    return ALLOWED;
+}
+/** Legacy names that exercised editorial authority before canonical mode. */
+export const LEGACY_EDITORIAL_SCOPES = [
+    "chapters:read",
+    "annotations:read",
+    "annotations:write",
+    "work:read",
+    "work:claim",
+    "submissions:write",
+    "votes:write",
+];
+/** Known old control-plane names. They never translate to editorial authority. */
+export const LEGACY_CONTROL_SCOPES = ["tokens:manage", "members:manage"];
+export const LEGACY_AGENT_SCOPES = [
+    "chapters:read",
+    "annotations:read",
+    "annotations:write",
+    "work:read",
+    "work:claim",
+    "submissions:write",
+    ...LEGACY_CONTROL_SCOPES,
+    "votes:write",
+];
+export const legacyAgentScopeSchema = z.enum(LEGACY_AGENT_SCOPES);
+const LEGACY_TRANSLATION = Object.freeze({
+    "chapters:read": ["chapters:read"],
+    "annotations:read": ["comments:read", "suggestions:read"],
+    "annotations:write": [
+        "comments:write",
+        "suggestions:write",
+        "replies:write",
+        "feedback:withdraw-own",
+    ],
+    "work:read": ["work:read"],
+    "work:claim": ["work:claim"],
+    "submissions:write": ["work:submit", "chapters:write", "chapters:publish"],
+    "votes:write": ["suggestions:vote"],
+});
+/**
+ * Translate safe, known legacy editorial names. Unknown and control-plane
+ * names never produce authority, and prerequisites are deliberately not
+ * synthesized.
+ */
+export function translateLegacyScopes(scopes) {
+    const present = new Set(scopes);
+    const translated = new Set();
+    for (const scope of LEGACY_EDITORIAL_SCOPES) {
+        if (!present.has(scope))
+            continue;
+        for (const capability of LEGACY_TRANSLATION[scope]) {
+            translated.add(capability);
+        }
+    }
+    return EDITORIAL_CAPABILITIES.filter((capability) => translated.has(capability));
+}
+/**
+ * Sanitize a decoded legacy scope set for dual-read mode.
+ *
+ * Known control-plane and unknown string names are returned for audit and
+ * removed. Structurally malformed input denies the complete set so a corrupt
+ * row cannot partially authorize a request.
+ */
+export function parseLegacyScopes(input) {
+    if (!Array.isArray(input) || !input.every((scope) => typeof scope === "string")) {
+        return {
+            ok: false,
+            scopes: [],
+            removedScopes: [],
+            capabilities: [],
+            reason: "invalid-legacy-scope-set",
+        };
+    }
+    const values = input;
+    const present = new Set(values);
+    const scopes = LEGACY_EDITORIAL_SCOPES.filter((scope) => present.has(scope));
+    const safe = new Set(LEGACY_EDITORIAL_SCOPES);
+    const removedScopes = [...new Set(values.filter((scope) => !safe.has(scope)))];
+    return {
+        ok: true,
+        scopes,
+        removedScopes,
+        capabilities: translateLegacyScopes(scopes),
+    };
+}
+export const LEGACY_COMPATIBILITY_ACTIONS = [
+    "feedback:moderate",
+    "work:promote",
+    "work:cancel",
+];
+/**
+ * Old maintainer-only actions preserved only while a row remains in legacy
+ * mode. They are reported separately and are never canonical grants.
+ */
+export function legacyEffectiveActions(scopes, role) {
+    if (role !== "maintainer")
+        return [];
+    const present = new Set(scopes);
+    const actions = [];
+    if (present.has("annotations:write")) {
+        actions.push({
+            action: "feedback:moderate",
+            source: "legacy-scope",
+            sourceScope: "annotations:write",
+        });
+    }
+    if (present.has("work:claim")) {
+        actions.push({
+            action: "work:promote",
+            source: "legacy-scope",
+            sourceScope: "work:claim",
+        }, {
+            action: "work:cancel",
+            source: "legacy-scope",
+            sourceScope: "work:claim",
+        });
+    }
+    return actions;
+}
+/**
+ * Requirements for writing an old scope alongside a canonical grant set.
+ *
+ * These are evaluated against granted capabilities, not today's role. A role
+ * may be raised later without rewriting the token, so the shadow must remain
+ * safe at the maintainer ceiling. Prerequisites used only by canonical routes
+ * are included where an old umbrella route did not enforce them.
+ */
+const LEGACY_SHADOW_REQUIREMENTS = Object.freeze({
+    "chapters:read": ["chapters:read"],
+    "annotations:read": ["comments:read", "suggestions:read"],
+    "annotations:write": [
+        "chapters:read",
+        "comments:read",
+        "suggestions:read",
+        "comments:write",
+        "suggestions:write",
+        "replies:write",
+        "feedback:withdraw-own",
+        "feedback:moderate",
+    ],
+    "work:read": ["work:read"],
+    "work:claim": ["work:promote", "work:claim", "work:cancel"],
+    "submissions:write": ["work:submit", "chapters:write", "chapters:publish"],
+    "votes:write": ["suggestions:vote"],
+});
+/**
+ * Conservative old-scope shadow for a canonical row.
+ *
+ * A prior Worker may deny a granular action after deploy or rollback, but
+ * every scope it does see is guaranteed not to exceed the canonical grant.
+ * Control-plane and unknown names can never be emitted.
+ */
+export function legacyScopeShadow(capabilities) {
+    const granted = new Set(capabilities);
+    return LEGACY_EDITORIAL_SCOPES.filter((scope) => LEGACY_SHADOW_REQUIREMENTS[scope].every((capability) => granted.has(capability)));
+}
+//# sourceMappingURL=editorial-capabilities.js.map

package/dist/index.d.ts

@@ -4,12 +4,14 @@ export type { AnnotationPolicy, AnnotationPolicyDenialReason, AnnotationPolicyRe
 export type { Allowed, Decision, Denied } from "./decision.js";
 export { ROLES, ROLE_SCOPES, SCOPES, effectiveScopes, requireScope, requireScopes, roleSchema, roleScopes, scopeSchema, } from "./scopes.js";
 export type { Role, Scope, ScopeDenialReason } from "./scopes.js";
+export { EDITORIAL_CAPABILITIES, LEGACY_AGENT_SCOPES, LEGACY_COMPATIBILITY_ACTIONS, LEGACY_CONTROL_SCOPES, LEGACY_EDITORIAL_SCOPES, ROLE_EDITORIAL_CAPABILITIES, authorizeEditorialCapability, editorialCapabilitiesSchema, editorialCapabilitySchema, effectiveEditorialCapabilities, legacyAgentScopeSchema, legacyEffectiveActions, legacyScopeShadow, parseEditorialCapabilities, parseLegacyScopes, parseStoredEditorialCapabilities, roleEditorialCapabilities, translateLegacyScopes, } from "./editorial-capabilities.js";
+export type { EditorialCapability, EditorialCapabilityDenialReason, EditorialCapabilityParseFailureReason, EditorialCapabilityParseResult, LegacyAgentScope, LegacyCompatibilityAction, LegacyControlScope, LegacyEditorialScope, LegacyEffectiveAction, LegacyScopeParseResult, } from "./editorial-capabilities.js";
 export { ANNOTATION_STATUSES, ANNOTATION_TRANSITIONS, authorizeAnnotationWithdraw, canTransitionAnnotation, transitionAnnotation, } from "./annotation-state.js";
 export type { AnnotationStatus, AnnotationTransitionDenialReason, WithdrawDenialReason, } from "./annotation-state.js";
 export { GIT_OPERATION_STATES, GIT_OPERATION_TRANSITIONS, INITIAL_GIT_OPERATION, MAX_GIT_ATTEMPTS, canRetryGitOperation, canTransitionGitOperation, isGitOperationTerminal, transitionGitOperation, } from "./git-operation-state.js";
 export type { GitOperationDenialReason, GitOperationProgress, GitOperationState, GitOperationTransitionResult, } from "./git-operation-state.js";
-export { MAX_BODY_BYTES, MAX_TOKEN_NAME_LENGTH, bodySchema, normalizeBody, createAnnotationCommandSchema, createReplyCommandSchema, mintAgentTokenCommandSchema, orderedRangeTargetSchema, utf8ByteLength, withdrawAnnotationCommandSchema, } from "./commands.js";
-export type { CreateAnnotationCommand, CreateReplyCommand, MintAgentTokenCommand, MintAgentTokenCommandInput, WithdrawAnnotationCommand, } from "./commands.js";
+export { MAX_BODY_BYTES, MAX_TOKEN_NAME_LENGTH, bodySchema, normalizeBody, createAnnotationCommandSchema, createReplyCommandSchema, mintAgentTokenCommandSchema, orderedRangeTargetSchema, utf8ByteLength, withdrawAnnotationCommandSchema, withdrawReplyCommandSchema, } from "./commands.js";
+export type { CreateAnnotationCommand, CreateReplyCommand, MintAgentTokenCommand, MintAgentTokenCommandInput, WithdrawAnnotationCommand, WithdrawReplyCommand, } from "./commands.js";
 export { VOTE_VALUES, authorizeVote, castVoteCommandSchema, clearVoteCommandSchema, voteValueSchema, } from "./vote.js";
 export type { CastVoteCommand, ClearVoteCommand, VoteDenialReason, VoteValue } from "./vote.js";
 export { DECISION_RESULTS, DECISION_SUPPORT_CHANGED_EVENT, decisionResultSchema, resolveSupportChange, } from "./decision-support.js";

package/dist/index.js

@@ -1,9 +1,10 @@
 export { ALLOWED, denied } from "./decision.js";
 export { ANNOTATION_POLICIES, DEFAULT_ANNOTATION_POLICY, checkAnnotationPolicy, isAnnotationPolicy, policyRequiresApproval, } from "./annotation-policy.js";
 export { ROLES, ROLE_SCOPES, SCOPES, effectiveScopes, requireScope, requireScopes, roleSchema, roleScopes, scopeSchema, } from "./scopes.js";
+export { EDITORIAL_CAPABILITIES, LEGACY_AGENT_SCOPES, LEGACY_COMPATIBILITY_ACTIONS, LEGACY_CONTROL_SCOPES, LEGACY_EDITORIAL_SCOPES, ROLE_EDITORIAL_CAPABILITIES, authorizeEditorialCapability, editorialCapabilitiesSchema, editorialCapabilitySchema, effectiveEditorialCapabilities, legacyAgentScopeSchema, legacyEffectiveActions, legacyScopeShadow, parseEditorialCapabilities, parseLegacyScopes, parseStoredEditorialCapabilities, roleEditorialCapabilities, translateLegacyScopes, } from "./editorial-capabilities.js";
 export { ANNOTATION_STATUSES, ANNOTATION_TRANSITIONS, authorizeAnnotationWithdraw, canTransitionAnnotation, transitionAnnotation, } from "./annotation-state.js";
 export { GIT_OPERATION_STATES, GIT_OPERATION_TRANSITIONS, INITIAL_GIT_OPERATION, MAX_GIT_ATTEMPTS, canRetryGitOperation, canTransitionGitOperation, isGitOperationTerminal, transitionGitOperation, } from "./git-operation-state.js";
-export { MAX_BODY_BYTES, MAX_TOKEN_NAME_LENGTH, bodySchema, normalizeBody, createAnnotationCommandSchema, createReplyCommandSchema, mintAgentTokenCommandSchema, orderedRangeTargetSchema, utf8ByteLength, withdrawAnnotationCommandSchema, } from "./commands.js";
+export { MAX_BODY_BYTES, MAX_TOKEN_NAME_LENGTH, bodySchema, normalizeBody, createAnnotationCommandSchema, createReplyCommandSchema, mintAgentTokenCommandSchema, orderedRangeTargetSchema, utf8ByteLength, withdrawAnnotationCommandSchema, withdrawReplyCommandSchema, } from "./commands.js";
 export { VOTE_VALUES, authorizeVote, castVoteCommandSchema, clearVoteCommandSchema, voteValueSchema, } from "./vote.js";
 export { DECISION_RESULTS, DECISION_SUPPORT_CHANGED_EVENT, decisionResultSchema, resolveSupportChange, } from "./decision-support.js";
 export { PHASE3_WORK_ITEM_STATUSES, WORK_ITEM_STATUSES, WORK_ITEM_TRANSITIONS, canTransitionWorkItem, isPhase3WorkItemStatus, transitionWorkItem, } from "./work-item-state.js";

package/dist/vote.d.ts

@@ -5,7 +5,7 @@ import { type Decision } from "./decision.js";
  * Vote commands (Phase 3 contract section 2):
  * `PUT /v1/projects/{p}/annotations/{id}/vote` with `{ value }`, `DELETE`
  * clears. One current vote per actor is a DB uniqueness concern (upsert);
- * this module pins the command shapes and the suggestion-only rule.
+ * this module pins the command shapes and kind support.
  */
 /** Vote values (contract section 2; mirrors `authorbot.instance/v1` `votes.values`). */
 export declare const VOTE_VALUES: readonly ["approve", "reject", "abstain"];
@@ -30,13 +30,12 @@ export declare const clearVoteCommandSchema: z.ZodObject<{
     annotationId: z.ZodString;
 }, z.core.$strict>;
 export type ClearVoteCommand = z.infer<typeof clearVoteCommandSchema>;
-export type VoteDenialReason = "not-a-suggestion";
+export type VoteDenialReason = never;
 /**
- * Suggestion-only guard (contract section 2: votes on comments → 422). Votes
- * stay legal after `open` - sticky decisions require tracking vote changes on
- * `work_item_created` annotations (contract section 4) - so annotation status
- * is deliberately not checked here; `votes:write` scope enforcement is the
- * API layer's (`requireScope`).
+ * Both comments and suggestions use the same one-current-vote resource. The
+ * API applies the exact kind capability and keeps comment tallies out of the
+ * suggestion-to-Work rule. Status is deliberately checked by that serialized
+ * API command because suggestion votes remain legal after a sticky crossing.
  */
 export declare function authorizeVote(input: {
     annotationKind: AnnotationKind;

package/dist/vote.js

@@ -1,11 +1,11 @@
 import { z } from "zod";
 import { uuidv7Schema } from "@authorbot/schemas";
-import { ALLOWED, denied } from "./decision.js";
+import { ALLOWED } from "./decision.js";
 /**
  * Vote commands (Phase 3 contract section 2):
  * `PUT /v1/projects/{p}/annotations/{id}/vote` with `{ value }`, `DELETE`
  * clears. One current vote per actor is a DB uniqueness concern (upsert);
- * this module pins the command shapes and the suggestion-only rule.
+ * this module pins the command shapes and kind support.
  */
 /** Vote values (contract section 2; mirrors `authorbot.instance/v1` `votes.values`). */
 export const VOTE_VALUES = ["approve", "reject", "abstain"];
@@ -20,16 +20,13 @@ export const clearVoteCommandSchema = z.strictObject({
     annotationId: uuidv7Schema,
 });
 /**
- * Suggestion-only guard (contract section 2: votes on comments → 422). Votes
- * stay legal after `open` - sticky decisions require tracking vote changes on
- * `work_item_created` annotations (contract section 4) - so annotation status
- * is deliberately not checked here; `votes:write` scope enforcement is the
- * API layer's (`requireScope`).
+ * Both comments and suggestions use the same one-current-vote resource. The
+ * API applies the exact kind capability and keeps comment tallies out of the
+ * suggestion-to-Work rule. Status is deliberately checked by that serialized
+ * API command because suggestion votes remain legal after a sticky crossing.
  */
 export function authorizeVote(input) {
-    if (input.annotationKind !== "suggestion") {
-        return denied("not-a-suggestion", "votes apply to suggestions only; comments cannot be voted on");
-    }
+    void input;
     return ALLOWED;
 }
 //# sourceMappingURL=vote.js.map

package/dist/work-item-lifecycle.d.ts

@@ -13,7 +13,7 @@ import { type Decision, type Denied } from "./decision.js";
  * `expire` and `release` are the two expiry/release back-edges sharing
  * `leased -> ready`, and `cancel` covers both maintainer-action arrows.
  */
-export declare const WORK_ITEM_TRIGGERS: readonly ["claim", "expire", "release", "submit", "validation_passed", "validation_failed", "apply_succeeded", "apply_conflicted", "conflict_resolution_prepared", "cancel"];
+export declare const WORK_ITEM_TRIGGERS: readonly ["claim", "expire", "release", "submit", "review_rejected", "validation_passed", "validation_failed", "apply_succeeded", "apply_conflicted", "conflict_resolution_prepared", "cancel"];
 export type WorkItemTrigger = (typeof WORK_ITEM_TRIGGERS)[number];
 /** Trigger -> the design edges it may traverse (exactly section 9.5). */
 export declare const WORK_ITEM_TRIGGER_EDGES: Readonly<Record<WorkItemTrigger, ReadonlyArray<readonly [WorkItemStatus, WorkItemStatus]>>>;

package/dist/work-item-lifecycle.js

@@ -19,6 +19,7 @@ export const WORK_ITEM_TRIGGERS = [
     "expire",
     "release",
     "submit",
+    "review_rejected",
     "validation_passed",
     "validation_failed",
     "apply_succeeded",
@@ -32,6 +33,7 @@ export const WORK_ITEM_TRIGGER_EDGES = Object.freeze({
     expire: [["leased", "ready"]],
     release: [["leased", "ready"]],
     submit: [["leased", "submitted"]],
+    review_rejected: [["submitted", "ready"]],
     validation_passed: [["submitted", "applying"]],
     validation_failed: [["submitted", "failed"]],
     apply_succeeded: [["applying", "completed"]],

package/dist/work-item-state.js

@@ -12,7 +12,9 @@ export { WORK_ITEM_STATUSES };
 export const WORK_ITEM_TRANSITIONS = Object.freeze({
     ready: ["leased", "cancelled"],
     leased: ["ready", "submitted", "cancelled"],
-    submitted: ["applying", "failed"],
+    // Phase 11 review-gated chapter revisions can be declined without burning
+    // the Work item. The lease is already consumed, so it returns claimable.
+    submitted: ["ready", "applying", "failed"],
     applying: ["completed", "conflict"],
     conflict: ["ready"],
     completed: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authorbot/domain",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "Pure domain logic for Authorbot: role/scope authorization, annotation and Git-operation state machines, command validators, and token/session value rules (Phase 2 contract section 3)",
   "keywords": [
     "authorbot",
@@ -40,7 +40,7 @@
   ],
   "dependencies": {
     "zod": "^4.0.0",
-    "@authorbot/schemas": "0.1.33"
+    "@authorbot/schemas": "0.1.35"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",