@consciousclouds/admin-sdk 0.1.1 → 0.1.3

package/dist/generated/contract-types.d.ts

@@ -0,0 +1,648 @@
+/**
+ * The body of GET /personality-envelope/{productId}/{personalityId} — a Personality's EFFECTIVE AUTHORITY, re-derived live and uncached at read time: the cutover state and the owning product's enrollment grants are read fresh on every call, while the personality DECLARATION baseline is the one loaded at boot and is not re-read until the service restarts. It is a snapshot of a computation, never stored state. It carries only the Personality/consent HALF of the authority envelope: the re-proven initiating actor and the immutable Operation bounds are deliberately elsewhere. A lawful refusal (post-cutover, or no file authority) is DATA, not an error — it arrives as a 200 carrying the reason, with every dimension empty.
+ */
+export interface AuthorityEnvelope {
+    /** The product that OWNS this Personality — echoed back from the request path, and the product whose enrollment grants were intersected in. A personality id alone is ambiguous across products, so authority is only ever answered for the owning product named here. */
+    product_id: string;
+    /** The Personality whose authority was computed — echoed back from the request path. */
+    personality_id: string;
+    /** The moment this computation ran (UTC). A COMPUTATION timestamp, not a state as-of: nothing in this body was stored at this time, and re-reading a second later may legitimately return different dimensions if a grant was revoked in between. */
+    evaluated_at: string;
+    /** How this answer was produced. The COMPUTATION is uncached — an operator is reading what would be decided now, not what was decided once. Note the boundary precisely: the cutover state and enrollment grants are re-read per call; the personality declaration baseline is boot-loaded and changes only on restart. */
+    evaluation: "live_uncached_at_read";
+    /** Which part of the authority envelope this body actually answers. Always the Personality/consent half — never the complete authority a commissioned Operation runs under. Stated explicitly so a reader does not mistake this for the whole. */
+    scope: "personality_consent_half";
+    /** The authority terms this read deliberately does NOT include, named so their absence is visible rather than assumed. To see the whole authority of a commissioned Operation, an operator must also consult the re-proven initiating actor and the Operation's own immutable bounds (breadth, authored cap, time ceiling). */
+    excluded_terms: ("reproven_initiating_actor_authority" | "immutable_operation_bounds")[];
+    /** Which authority actually served this computation. Pre-cutover, the authored file declaration IS runtime authority. An EMPTY string means no authority was computed at all — read `refusal` for why; the dimensions below will all be empty and must not be read as 'this Personality may do nothing by design'. */
+    mode: "pre_cutover_file_authority" | "";
+    /** Why no authority could be computed, or EMPTY when the computation succeeded. A refusal is a lawful answer to the operator's question, not a failure: the Personality's record has cut over to a mode this wave will not serve, or the Personality has no file declaration to draw authority from at all. Both leave every dimension empty. */
+    refusal: "" | "envelope_post_cutover_unsupported" | "envelope_no_file_authority";
+    /** The seven authority dimensions, kept separate rather than flattened because they carry DIFFERENT guarantees — see `intersected_with_enrollment`. Every dimension is always present as a list; an empty list means the Personality holds nothing in that dimension (or that the whole computation refused). */
+    dimensions: {
+        /** The entitlements this Personality may exercise. This is the Personality's own authority alone — a DIFFERENT namespace from enrollment capability grants, and never narrowed by them. */
+        capabilities: string[];
+        /** The tools this Personality may invoke. The Personality's authority alone — no enrollment grant array exists for tools, so nothing narrows it. */
+        allowed_tools: string[];
+        /** The canvas types this Personality may emit. The Personality's authority alone. */
+        allowed_canvases: string[];
+        /** The adapters this Personality may read context from. The Personality's authority alone. */
+        allowed_adapters: string[];
+        /** The knowledge namespaces this Personality may actually query — its declared namespaces INTERSECTED with the owning product's live enrollment grants. An entry the Personality declares but the product is not granted will be missing here, and revoking that grant removes it from the very next read. */
+        knowledge_namespaces: string[];
+        /** The graph scopes this Personality may actually read — declared scopes INTERSECTED with the owning product's live enrollment grants. */
+        graph_scopes: string[];
+        /** The memory scopes this Personality may actually reach — declared scopes INTERSECTED with the owning product's live enrollment grants. */
+        memory_scopes: string[];
+    };
+    /** Which of the seven dimensions above were narrowed by the owning product's enrollment grants, and which were not. The dimensions named here answer 'the Personality declares this AND the product is granted it'; every dimension NOT named here is the Personality's effective authority standing alone. They are different guarantees, so an operator must never read the seven as one flat list. */
+    intersected_with_enrollment: ("knowledge_namespaces" | "graph_scopes" | "memory_scopes")[];
+}
+/**
+ * The response body of GET /admin/enrollments/{productId} on the conductor — ONE enrolled product's full manifest surface, rendered safe-by-construction from the boot-loaded enrollment Record. Federation trust is public by design (issuer name, JWKS location, accepted audiences — never a key); endpoints appear as KEYS and a reachable flag, never URLs; storage bindings appear as declared+lifecycle only, never the Doppler secret name / index / bucket / database. An unknown product is a 404 (`{"error":"no such enrollment"}`), not this shape. Read-only: nothing here is computed or stored, every field is already on the loaded Record. NOTE ON CLOSED VOCABULARIES: the Go loader closes NO vocabulary on the record itself — every closed-set rule (operative role, sandbox_requirement, escalation, observe family, storage-binding status) lives in a boot validator that SKIPS every record whose status is not `active`, and this endpoint renders non-active records verbatim. Those fields are therefore described in prose, never locked as an enum, exactly like `status` and `s2s_trust_mode`.
+ */
+export interface EnrollmentDetail {
+    /** The enrolled product this detail page is about — the platform's durable name for the product AND for its project (an enrolled product IS a project under the Project Isolation Doctrine). The path parameter must match this exactly; there is no fuzzy lookup. */
+    product_id: string;
+    /** The enrollment gate as recorded, verbatim. Only `active` is trusted anywhere: a `suspended` or `revoked` product still renders here (so an operator can see what was revoked) but resolves no capability, grants no personality, and is skipped by every boot-time validation. Rendered as loaded — the conductor never rewrites it. Not enumerated: the Go loader defines no closed constant set and only ever compares this to "active". */
+    status: string;
+    /** How the factory's OUTBOUND capability projection into this product is proven — the re-proof scheme the product expects, never the principal and never the HMAC secret behind it. The conductor only projects `signed-envelope`, and refuses at boot to run with an ACTIVE product declaring anything else; a non-active product may still show a mode it declared. */
+    s2s_trust_mode: string;
+    /** The identity issuer this product signs its own users with — the federation declaration that lets Universal trust a forwarded actor without ever minting one (products own people). Absent when the product has not declared federated identity. */
+    issuer?: string;
+    /** Where this product publishes the public keys that verify its actor tokens. Public by design — it is a location, never a key. Absent when the product has not declared federated identity. */
+    jwks_uri?: string;
+    /** The token audiences accepted for this product's actors — an incoming token must name one of these to be honoured. Empty means no audience was declared, which fails actor verification closed. */
+    audiences: string[];
+    /** The personality ids this product is allowed to resolve at the Conductor. A personality is resolved locally from its declaration, so this grant alone decides whether that declaration may register — there is nothing to route. This is also the one-owner-each pin: a personality id granted here belongs to this product. */
+    personality_grants: string[];
+    /** Every capability this product is granted, each shown with whether it is actually reachable by configuration. A grant with no route, or a route to a missing endpoint, is a grant that cannot be invoked — this is where that shows up. */
+    capability_grants: Array<{
+        /** The granted capability's id (<primitive>.<verb>) — what a personality names to invoke it. */
+        capability_id: string;
+        /** The service_endpoints KEY this capability is routed to — the name of the product backend that hosts it, never the URL. Absent when the capability is granted but unrouted, which means it can never be invoked. */
+        route_key?: string;
+        /** Whether the routed endpoint key is declared with a non-empty base URL — 'reachable by configuration', not a live health check. False means the grant is dead: either unrouted, or routed to an endpoint this record does not declare. */
+        endpoint_present: boolean;
+    }>;
+    /** The document/vector namespaces this product may read. A personality's own knowledge_namespaces may only narrow this set, so an empty grant means no personality of this product can search anything — breadth is granted, never assumed. */
+    knowledge_namespace_grants: string[];
+    /** The OTHER projects this product's actors may address for data access — the operator-breadth grant that makes a cross-product read (Chief reading eno) authorized at all. Empty is the default and means self-access only. Ownership never moves: the data stays owned by the addressed project. */
+    cross_project_grants: string[];
+    /** The names of the product backends this record declares, sorted. Keys only — the base URLs behind them are private and never serialized. This is the set a capability route may point at. */
+    service_endpoint_keys: string[];
+    /** This project's storage manifest as the six binding slots across the four data planes (structured = graph + memory + learning; plus vector, object, analytics). Always the full grid — an undeclared plane is an explicit declared:false row, so a missing plane is visible rather than silently absent. Presence and lifecycle only; the Doppler secret name, index, bucket and database behind each binding are never serialized. */
+    storage_bindings: {
+        /** This project's own graph store (Neon) — where its Reference and Overlay rings physically live. */
+        graph: {
+            /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+            declared: boolean;
+            /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+            status?: string;
+        };
+        /** This project's own memory store (Neon) — where its Memory Tier 0 / Tier 1 records physically live. */
+        memory: {
+            /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+            declared: boolean;
+            /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+            status?: string;
+        };
+        /** This project's own learning store (Neon) — where its edge inference and epoch state physically live. */
+        learning: {
+            /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+            declared: boolean;
+            /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+            status?: string;
+        };
+        /** This project's own vector collection — the retrieval plane; per-source namespaces nest inside it. */
+        vector: {
+            /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+            declared: boolean;
+            /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+            status?: string;
+        };
+        /** This project's own object-storage partition — the bucket/prefix its Artifact bytes live in. */
+        object: {
+            /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+            declared: boolean;
+            /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+            status?: string;
+        };
+        /** This project's own analytics database — the fourth plane, where its traces, usage and cost land. */
+        analytics: {
+            /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+            declared: boolean;
+            /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+            status?: string;
+        };
+    };
+    /** The org/team that owns this product — the party whose consent a cross-product delegation must record as its approver. Absent when the record declares no owner, which makes any cross-product delegation TARGETING this product unverifiable and therefore refused. */
+    owner?: string;
+    /** The browser origins this product's surfaces may call from. Carried on the record and enforced at the gateway layer, not by the conductor. Empty means none declared. */
+    allowed_origins: string[];
+    /** The graph Reference namespaces this product may read. A personality's allowed_graph_scopes may only narrow this, so an empty grant is a refusal for any personality that declares one — never a permissive default. */
+    graph_scope_grants: string[];
+    /** The memory scopes this product is granted. Same narrowing-only, fail-closed rule as the graph grant: empty means any personality declaring a memory scope is refused. */
+    memory_scope_grants: string[];
+    /** The cognitive-topic families this product's Watcher is granted to subscribe to. v1 is SELF-OBSERVE ONLY — every ACTIVE record's grant has a project equal to its own product_id, and cross-project or universal observation is refused at boot — so this must never be read as general observation breadth. It is co-declared intent; the broker's per-project literal ACL is the real subscription gate. Empty means this product runs no Watcher subscription. */
+    observe_topic_grants: Array<{
+        /** The project whose topic may be subscribed to. On an ACTIVE record this always equals the record's own product_id (ValidateObserveGrants refuses anything else at boot); a non-active record is never validated and renders whatever it declared. */
+        project: string;
+        /** Which cognitive-topic family may be observed. The lawful families are `episodes` (owner-scoped episode records) and `cognition` (cognitive run/relay events). NOT enumerated: the handler copies grant.Family through verbatim with no normalization or filtering, and the closed set is enforced only by ValidateObserveGrants, which skips every record whose status is not `active` — so this endpoint can and does emit other strings (the endpoint's own test pins a response carrying family "governance"). */
+        family: string;
+    }>;
+    /** The depth-1 delegate authorities this product's composer personalities hold — which of its composers may ASK which target personality for help inside one synchronous turn. The grant carries a task, never authority: the child runs under the target's OWN envelope. This is the mechanism half only; an operator-audience composer also needs a live Control-Plane Access row, and divergence fails closed. Empty means this product delegates to no one. */
+    delegation_grants: Array<{
+        /** The personality THIS product grants that is allowed to delegate. A product may only authorize its own composer, never another product's. */
+        composer_personality: string;
+        /** The personality the composer may ask for help. It must resolve to an enrolled, active product that grants it. */
+        target_personality: string;
+        /** Recorded delegate-side consent — the TARGET product's owner, required when the target belongs to another product. Absent on a same-product grant, where the product consents by declaring it; absent on a cross-product grant is a refusal at boot. */
+        approver?: string;
+        /** Whether this grant dispatches real bounded EXECUTION rather than an ordinary read-only delegated turn. True exactly when an execution_envelope is present — the two can never disagree. */
+        is_execution_grant: boolean;
+        /** The human-authored execution-provider selector this grant forwards to the Execution Runtime (policy metadata, never a credential and never AI-set). Absent means the runtime uses its own default. */
+        execution_provider?: string;
+        /** The bounded execution envelope this grant executes under, or null for the ordinary read-only delegated turn. Null is meaningful ABSENCE — it is never rendered as a row of zeros, which would read as 'bounded at nothing'. */
+        execution_envelope: {
+            /** CPU allotment the execution may consume. */
+            cpu: number;
+            /** Memory ceiling in MiB for the execution. */
+            memory_mib: number;
+            /** Writable filesystem ceiling in MiB for the execution. */
+            filesystem_mib: number;
+            /** Maximum bytes of output the execution may return — the bound that stops a runaway from flooding the caller. */
+            output_bytes_max: number;
+            /** The hosts this execution may reach. Authored governance, not a secret: an operator must be able to read it to judge the bound. Empty means no egress is allowed. */
+            network_egress_allow: string[];
+            /** Wall-clock ceiling for the execution before it is terminated. */
+            timeout_ms: number;
+            /** How long the execution's lease stays valid — the window in which it must renew or be reclaimed. */
+            lease_ttl_ms: number;
+            /** Grace period allowed for the execution to shut down cleanly after its bound is reached. */
+            teardown_slack_ms: number;
+        };
+    }>;
+    /** This product's declared Operative Types — the commissionable execution intelligences it authors. This is the AUTHORING half only: what the product declared, which is NOT what a governed Operation record resolves or what any gate enforces. An Operative is config, never an actor: it holds no grants and no identity outside an Operation. Empty means this product declares none. The product-authored `preferences` blob is deliberately never serialized here — it is opaque, schema-free, and could carry a credential on a platform-scoped read. */
+    operatives: Array<{
+        /** The executor identifier the existing grants and wire already speak. A COMPATIBILITY identifier only — never public vocabulary and never UI language. Unique within this record; across products the identity is the (product_id, id) pair. */
+        id: string;
+        /** The public face of this Operative Type — what an operator should actually read. On an ACTIVE record it is required and never equal to the raw id. */
+        display_name: string;
+        /** The Operative's registered role. The CLOSED seven-role vocabulary is `builder`, `research`, `scout`, `review`, `testing`, `migration`, `documentation`, plus the one legacy exception `general` — lawful only on ccu-admin's pre-ruling chief-worker declaration and excluded from typed commissioning. NOT enumerated: the handler copies the declared role through verbatim, and the closed set is enforced only by ValidateOperatives, which skips every record whose status is not `active`. */
+        role: string;
+        /** The human-authored execution-provider selector for this Type (policy metadata, never a credential, never AI-set). Absent means the runtime's own default applies. */
+        execution_provider?: string;
+        /** The bounded envelope this Operative always executes within — an Operative is never unbounded, and this is the operative-first source of truth that overrides the delegation grant's copy. Null only on a record boot validation never inspected (an unbounded declaration is a defect, refused for any active product). */
+        execution_envelope: {
+            /** CPU allotment this Operative may consume. */
+            cpu: number;
+            /** Memory ceiling in MiB for this Operative. */
+            memory_mib: number;
+            /** Writable filesystem ceiling in MiB for this Operative. */
+            filesystem_mib: number;
+            /** Maximum bytes of output this Operative may return. */
+            output_bytes_max: number;
+            /** The hosts this Operative may reach. Authored governance an operator must be able to read to judge the bound, not a secret. Empty means no egress is allowed. */
+            network_egress_allow: string[];
+            /** Wall-clock ceiling before this Operative's execution is terminated. */
+            timeout_ms: number;
+            /** How long this Operative's execution lease stays valid before it must renew or be reclaimed. */
+            lease_ttl_ms: number;
+            /** Grace period allowed for a clean shutdown after the bound is reached. */
+            teardown_slack_ms: number;
+        };
+        /** Capabilities this Type NEEDS in order to run — a binding requirement, never a grant. Nothing is authorized by appearing here; the evaluation is the commission-time intersection of the Operation's envelope with this list. Empty means none declared. */
+        required_capabilities: string[];
+        /** The named personalities permitted to commission this Type. Empty means any personality of the owning product that passes the ordinary intersection may commission it — enforced at commission, not here. */
+        allowed_commissioners: string[];
+        /** The execution FORM this Type requires. The lawful values are `none` (may run in the shared runtime; also what the handler normalizes an unauthored empty value to) and `isolated` (requires an isolated form; provider-blind, and an unsatisfiable requirement REFUSES the commission rather than silently downgrading). Shape, deliberately not an authority grant. NOT enumerated: the handler normalizes only the empty string and passes every other declared value through verbatim, and the closed set is enforced only by ValidateOperatives, which skips every record whose status is not `active`. */
+        sandbox_requirement: string;
+        /** Whether this Type CAN be one member of a grouped multiplicity. Defaults false, fail-closed: a Type that has not declared clustering can never be swept into one. The Operation's commission shape decides what is PERMITTED — both must agree and either may refuse. */
+        supports_clustering: boolean;
+        /** How an instance of this Type ENDS when it cannot proceed. The lawful values are `fail` (terminates abnormally; also what the handler normalizes an unauthored empty value to) and `report` (terminates AND records a structured reason for the commissioning personality). Deliberately narrow: it can NEVER mean acquiring authority, budget, time, or a human's attention. NOT enumerated: the handler normalizes only the empty string and passes every other declared value through verbatim, and the closed set is enforced only by ValidateOperatives, which skips every record whose status is not `active`. */
+        escalation: string;
+        /** Advisory operator-facing prose about this Type. Never binding and never part of the binding digest. Absent when the product authored none. */
+        description?: string;
+        /** This Type's default model-selection policy, resolved at commission time. Absent means the Operation's own policy governs. */
+        default_model_policy_ref?: string;
+        /** Type-level wall-clock bound an Operation may narrow but never widen. 0 means undeclared, not zero time. */
+        max_wall_clock_ms: number;
+        /** Type-level iteration bound an Operation may narrow but never widen. 0 means undeclared, not zero iterations. */
+        max_iterations: number;
+        /** The kinds of Artifact this Type may admit — enforced at Artifact admission, not here. Empty means none declared. */
+        artifact_contract: string[];
+    }>;
+    /** RETIRED by owner ruling (2026-08-19) and empty on every ACTIVE record: the role vocabulary is closed, and product specialization belongs in Type identity and display_name. Still rendered so a stale record's entries are VISIBLE rather than silently dropped — a non-empty array here means an active record would refuse loudly at validation, or that the record is not active and was never validated. Never read this as a live role registry. */
+    operative_roles: string[];
+    /** The record's full routing table: capability id to the service_endpoints KEY that hosts it — never a URL. Explicit, never inferred. May contain routes for capabilities that are not granted; the granted subset with reachability is capability_grants. Empty object means nothing is routed. */
+    capability_routes: Record<string, string>;
+    /** This product's ceiling on concurrent Operatives within one Operation, shown honestly as declared vs effective because an undeclared ceiling stores as 0 and a bare 0 on screen would read as 'no Operatives permitted' — the opposite of the truth. */
+    operation_breadth: {
+        /** The human-authored ceiling exactly as recorded. 0 means nobody has authored one. */
+        declared: number;
+        /** The ceiling actually applied: the declared value, or the fail-closed default of 1 when undeclared. Raising it is an explicit human enrollment edit — a request may narrow within it, never raise it. */
+        effective: number;
+        /** That this ceiling is genuinely enforced (atomically, at the worker-run storage boundary) — unlike several declared Type fields that are recorded now and enforced at a later gate. Always true. */
+        enforced: boolean;
+    };
+}
+/**
+ * The body of GET /admin/enrollments — every enrolled product the conductor loaded at boot, as a SUMMARY. It is deliberately narrower than the enrollment detail: identity, gate, trust mode and the two grant arrays, and nothing else. Non-active records are listed too, so an operator can see what was suspended or revoked rather than watching it vanish. Nothing here is a secret: no endpoint URL, no storage coordinate, no key.
+ */
+export interface EnrollmentList {
+    /** One row per loaded record, in load order. Always an array — never null — so an empty registry reads as 'no products enrolled' rather than as a missing field. */
+    enrollments: Array<{
+        /** The platform's durable name for the product, and for its project — an enrolled product IS a project under the Project Isolation Doctrine. */
+        product_id: string;
+        /** The enrollment gate as recorded, verbatim. Only `active` is trusted anywhere; a suspended or revoked product still appears here but resolves no capability and grants no personality. Not enumerated: the loader defines no closed constant set and only ever compares this to "active". */
+        status: string;
+        /** How the factory's outbound capability projection into this product is proven — the scheme, never the principal and never the secret behind it. */
+        s2s_trust_mode: string;
+        /** The personality ids this product owns. One-owner-each is a boot-enforced law for active records, so an id appearing here for two active products would refuse the boot. Always an array. */
+        personality_grants: string[];
+        /** The capabilities this product is entitled to consume. A grant is an entitlement, not a route — the detail read pairs each with its route key and whether an endpoint is present. Always an array. */
+        capability_grants: string[];
+    }>;
+    /** The number of rows, emitted alongside the array so a truncated or mis-parsed response is detectable rather than silently short. */
+    count: number;
+}
+/**
+ * The body of GET /operative-type/{productId}/{operativeId} — one Operative Type as an operator reads it, re-proven at the owning product. It never collapses the three answers that look like one: what the product DECLARED, what the governed record currently RESOLVES to, and what a gate actually ENFORCES. It carries the full authored version history and, unlike the roster read, the Type's opaque product-authored preferences. Unknown, unowned and unauthorized all answer 404, so this surface is never an existence oracle.
+ */
+export interface OperativeTypeDetail {
+    /** The product that OWNS this Operative Type. Half of the Type's canonical identity — an operative id alone is ambiguous across products, so this is echoed back to prove which product's roster you are reading. */
+    product_id: string;
+    /** The Type's identifier within its owning product (a compatibility identifier, e.g. chief-worker — never operator-facing language; use declared.display_name for that). */
+    operative_id: string;
+    /** The governed record's own state row: what has been authored, which version stands, and the standing lifecycle verdict. */
+    record: {
+        /** Whether a state row exists for this Type. Always true on this read — an absent record answers 404 rather than a body — but stated so the row shape is identical to the roster's. */
+        exists: boolean;
+        /** The version number the runtime currently points at. 0 means no version is active, which makes the Type unresolvable rather than falling back to the newest. */
+        active_version: number;
+        /** Whether a version pointer is set at all. Read this before trusting active_version, so 'none active' is never mistaken for 'version zero'. */
+        has_active_version: boolean;
+        /** The standing verdict on the Type. Only 'active' resolves; 'retired' and 'revoked' refuse commissioning even while the pointer and the full version chain remain (a verdict never edits or deletes history). Genuinely closed: a database CHECK constraint has held this column to these three values since the table was created, and both store twins refuse anything else before the write. */
+        lifecycle: "active" | "retired" | "revoked";
+        /** The reason recorded with the last lifecycle or pointer change — why a Type was retired or revoked. Empty when none was recorded. */
+        state_reason: string;
+        /** Who last changed the state row (the attributed actor for the activation, retirement or revocation). Empty when the store recorded none. */
+        updated_by: string;
+        /** When the state row last changed, in UTC. Null when the record has never carried an update timestamp — 'never stamped', not 'changed at epoch'. */
+        updated_at: string | null;
+    };
+    /** What the record RESOLVES to right now — the shape a commission would actually be admitted against, or the reason it refuses. A refusal is data, not an error: 'this Type cannot currently be commissioned, for this reason' is a true answer to the operator's question. Every field here is produced through the record's resolution gate, which re-runs the CURRENT write-boundary law over the active version before answering — which is why the vocabularies below can be closed while their history counterparts cannot. */
+    governed: {
+        /** Whether this Type can be commissioned right now. False means every field below except refusal_reason is empty — read the reason, not the blanks. */
+        resolvable: boolean;
+        /** Why the Type refuses to resolve: no active version pointer, or one of three named corruptions (the pointer names a version that does not exist; the active version fails the current write-boundary law; its stored digest is not the digest of its content). A stable governance code, never infrastructure error text — a store outage is a 500 here, never a cheerful refusal. Empty when resolvable. */
+        refusal_reason: "" | "no active version" | "torn_record" | "active_version_fails_current_law" | "content_digest_mismatch";
+        /** The version number a commission would pin, so mid-flight re-authoring cannot change work already running. 0 when the Type does not resolve. */
+        version: number;
+        /** The operational kind the runtime treats this Type as, from the closed universal roster. 'general' is the one legacy role, lawful only on the pre-ruling ccu-admin/chief-worker identity and outside typed commissioning. Empty when the Type does not resolve — and an active version whose role predates the closed roster resolves to exactly that: empty, with refusal_reason 'active_version_fails_current_law'. That gate is why this enum is closed and history's is not. */
+        role: "" | "builder" | "research" | "scout" | "review" | "testing" | "migration" | "documentation" | "general";
+        /** Capabilities this Type NEEDS but is never granted — they narrow the commissioning envelope by intersection, they never widen it. Empty list, never null. */
+        required_capabilities: string[];
+        /** The named Personalities permitted to commission this Type. An empty list means any Personality of the owning product that passes the other gates — an empty fence is open, not closed. */
+        allowed_commissioners: string[];
+        /** The isolation form a run of this Type demands. An unsatisfiable requirement refuses the commission outright — never a silent downgrade. Empty when the Type does not resolve. */
+        sandbox_requirement: "" | "none" | "isolated";
+        /** Whether this Type may be one member of a grouped multiplicity. False by default and fail-closed: a Type that has not declared clustering cannot be swept into one. */
+        supports_clustering: boolean;
+        /** How an instance of this Type ENDS when it gets stuck — fail outright, or report and stop. Empty when the Type does not resolve. */
+        escalation: "" | "fail" | "report";
+        /** The provider-by-policy selector naming which execution backend runs this Type. Empty means defer to the runtime's environment default — meaningful emptiness, not an unresolved value. */
+        execution_provider: string;
+    };
+    /** The AUTHORED half of the active version — the values the record carries that no runtime gate consumes today, plus this read's one exclusive field, preferences. This is governance the record RECORDS, not governance in force; compare it against `enforcement` before treating any of it as a bound. Read straight from the stored active version WITHOUT re-validation, so it is populated even when `governed` refuses: a retired Type, or one whose active version fails the current law, still shows what it declares. */
+    declared: {
+        /** Whether an active version was found to read these values from. False means nothing is declared here — the sibling fields are blank because there is no declaration, not because it declares zeros. */
+        present: boolean;
+        /** The Type's operator-facing name, required at authoring and never the raw operative id. This is the language to show an operator. */
+        display_name: string;
+        /** Advisory prose describing what this Operative is for. Outside the binding digest — editing it does not invalidate what was approved. */
+        description: string;
+        /** The Type's default model-selection law. Empty means absent, and the commissioning Operation's own policy governs instead. */
+        default_model_policy_ref: string;
+        /** The Type-level wall-clock ceiling a run may not exceed; an Operation may narrow it, never widen it. 0 means undeclared. Non-negativity is a database CHECK, not a convention. */
+        max_wall_clock_ms: number;
+        /** The Type-level iteration ceiling for a run, narrowable by the Operation but never widenable. 0 means undeclared. Non-negativity is a database CHECK, not a convention. */
+        max_iterations: number;
+        /** The kinds of Artifact this Type is declared to admit, enforced at the Artifact admission boundary. Empty list, never null. */
+        artifact_contract: string[];
+        /** The bounded-executor envelope this Type DECLARES. Note it is not the execution envelope that bounds a real run — see enforcement.serving_envelope_source. Null when the active version records none; never an object of zeros, which would read as 'bounded at nothing'. */
+        execution_envelope: {
+            /** Compute allotted to one run, in CPU units. Must be greater than zero — an unbounded executor is a declaration defect. */
+            cpu: number;
+            /** Memory ceiling for one run, in MiB. */
+            memory_mib: number;
+            /** Writable filesystem ceiling for one run, in MiB. */
+            filesystem_mib: number;
+            /** The largest output a run may return, in bytes. */
+            output_bytes_max: number;
+            /** The hosts a run may reach outbound. Absent means no egress allowance was declared. */
+            network_egress_allow?: string[];
+            /** How long one run may take before it is cut off. */
+            timeout_ms: number;
+            /** How long the run's lease is held. Always strictly greater than timeout plus teardown slack, so a lease can never reap live in-budget work. */
+            lease_ttl_ms: number;
+            /** The grace period allowed for tearing a finished run down, on top of its timeout. May be zero. */
+            teardown_slack_ms?: number;
+        };
+        /** Opaque, schema-free, product-authored configuration recorded verbatim and enforced by nothing. THIS READ ONLY: it is deliberately absent from the roster and from the platform-scoped enrollment read, because a platform-breadth operator can sweep those across every product at once and the platform cannot know what a product put in here. Always a JSON object when present (null, scalars and arrays refuse at the write boundary); null when the version declares none. */
+        preferences: Record<string, unknown> | null;
+    };
+    /** The honesty control. Which of this record's fields actually reach a gate, which are recorded and consumed by nothing, and which authority supplies the execution envelope that really bounds a run. Computed by the platform, not remembered by a UI — a bound that does not bind is the silent failure this field exists to prevent. */
+    enforcement: {
+        /** The field names on this record that a gate actually consults — the census gate, typed commission admission, or provider-bound sandbox satisfiability. Everything named here is governance in force. */
+        enforced: string[];
+        /** The field names validated at the write boundary and carried in the content digest, but consulted by no gate today. Everything named here is recorded governance, not enforced governance. */
+        declared: string[];
+        /** Which authority supplies the execution envelope that actually bounds a run. It is the enrollment declaration's envelope, NOT the Type record's own declared.execution_envelope — two truths, and this surface reports both rather than choosing. */
+        serving_envelope_source: "enrollment_declaration";
+    };
+    /** Every authored version of this Type, newest first, each carrying its FULL authored content. A history that showed only a role and a name would report that something changed without ever showing what — which is not a history an operator can audit a governance decision against. Append-only: retiring or revoking a Type never edits or removes an entry, and entries are served exactly as stored, with no re-validation against the current write-boundary law. Read every field below as an authored historical fact, not as a value the present law would still admit. */
+    history: Array<{
+        /** This version's monotonic number — the identity a commission pins so later authoring cannot change running work. */
+        version: number;
+        /** The approval identity: a digest over this version's BINDING content only, so advisory copy edits do not invalidate what was approved. A scheme prefix marks which digest law computed it; a digest is only comparable under its own scheme, and an entry authored before the current scheme carries no prefix at all. */
+        content_digest: string;
+        /** Who authored this version. A governed record is attributed, never anonymous. */
+        authored_by: string;
+        /** When this version was appended, in UTC, stamped by the store rather than the caller — provenance can never be backdated. */
+        authored_at: string;
+        /** Whether this is the version the record currently points at. At most one entry is true, and none is when the Type has no active pointer. True does not imply resolvable — a retired Type still points at a version. */
+        is_active: boolean;
+        /** The operational kind declared by THIS version, as authored. NOT a closed set on this surface, deliberately. The current roster is builder · research · scout · review · testing · migration · documentation, plus the legacy 'general' on the one pre-ruling ccu-admin/chief-worker identity — but that roster became the record's own write-boundary law after the record shipped, the role column carries no database constraint, and versions are append-only and never re-validated on read. Entries authored under the earlier extensible vocabulary therefore survive here permanently and may carry a value the present law refuses (for example 'build', migrated to 'builder', or a retired product-declared role). Read a value outside the current roster as history, not as a live classification; governed.role is the field that answers what the runtime treats this Type as NOW, and it is closed because it is re-proven against the current law before it is served. */
+        role: string;
+        /** The operator-facing name as authored in this version. Advisory, and never the raw operative id under the current law; an entry authored before that requirement may carry an empty name. */
+        display_name: string;
+        /** The advisory prose as authored in this version. */
+        description: string;
+        /** The default model-selection law as authored in this version. Empty means absent — the Operation's own policy would govern. */
+        default_model_policy_ref: string;
+        /** The wall-clock ceiling as authored in this version. 0 means undeclared. Non-negativity is a database CHECK. */
+        max_wall_clock_ms: number;
+        /** The iteration ceiling as authored in this version. 0 means undeclared. Non-negativity is a database CHECK. */
+        max_iterations: number;
+        /** The Artifact kinds this version declared admissible. Empty list, never null. */
+        artifact_contract: string[];
+        /** The capabilities this version required, in authored order. Requirements that narrow a commission's envelope — never grants. Empty list, never null. */
+        required_capabilities: string[];
+        /** The Personalities this version restricted commissioning to. Empty means unrestricted within the owning product. Empty list, never null. */
+        allowed_commissioners: string[];
+        /** The isolation form this version demanded. Stored normalized, so an entry never shows a blank that a reader would have to resolve to a default. Genuinely closed even across history: a database CHECK constraint has held this column to these two values since the table was created. */
+        sandbox_requirement: "none" | "isolated";
+        /** Whether this version permitted the Type to be one member of a grouped multiplicity. */
+        supports_clustering: boolean;
+        /** How this version said a stuck instance should end. Stored normalized, never blank. Genuinely closed even across history: a database CHECK constraint has held this column to these two values since the table was created. */
+        escalation: "fail" | "report";
+        /** The execution backend selector this version authored. Empty means defer to the runtime's environment default. */
+        execution_provider: string;
+        /** The bounded-executor envelope this version authored, emitted as JSON rather than an encoded blob. Null when the stored version records none. */
+        execution_envelope: {
+            /** Compute allotted to one run, in CPU units. */
+            cpu: number;
+            /** Memory ceiling for one run, in MiB. */
+            memory_mib: number;
+            /** Writable filesystem ceiling for one run, in MiB. */
+            filesystem_mib: number;
+            /** The largest output a run may return, in bytes. */
+            output_bytes_max: number;
+            /** The hosts a run may reach outbound. Absent means no egress allowance was declared in this version. */
+            network_egress_allow?: string[];
+            /** How long one run may take before it is cut off. */
+            timeout_ms: number;
+            /** How long the run's lease is held — always strictly greater than timeout plus teardown slack. */
+            lease_ttl_ms: number;
+            /** The grace period allowed for tearing a finished run down. May be zero. */
+            teardown_slack_ms?: number;
+        };
+    }>;
+    /** When the service assembled this answer, in UTC. Everything above is a reading at this instant — a governance verdict can move underneath it, so an operator citing this body should cite this timestamp with it. */
+    as_of: string;
+}
+/**
+ * The body of GET /operative-types — the Operative Type ROSTER, bounded by the operator's resolved read scope (an optional product_id query only NARROWS that scope, never widens it). Every row is built by the shared row builder and therefore reports three answers the surface refuses to collapse: what the product DECLARED, what the governed record currently RESOLVES to, and which of its fields any gate actually ENFORCES. The roster deliberately omits the declared `preferences` value — opaque, schema-free, product-authored JSON that a platform-breadth operator could sweep across every product in a single call; it is added only by the single-Type detail read.
+ */
+export interface OperativeTypeList {
+    /** Every Operative Type the operator is authorized to see, ordered by owning product then operative id. An empty array means the operator's scope contains no Types — never that they were denied; a denial is a 403, so 'you may not look' and 'there is nothing here' stay distinguishable. */
+    operative_types: Array<{
+        /** The product that OWNS this Operative Type — the first half of its canonical identity. An operative id alone is ambiguous across products, so the owning product is always named. */
+        product_id: string;
+        /** The Type's id within its owning product — the second half of the canonical identity, and the id an operator quotes when commissioning. */
+        operative_id: string;
+        /** The governed record's own state row: what was authored, which version the runtime pointer names, and the standing lifecycle verdict. */
+        record: {
+            /** Whether a governed record was found for this identity. Always true on a roster row — the row is here because the record is. */
+            exists: boolean;
+            /** The ONE version the runtime pointer names. Zero means no version is active, which is a refusing state for anything that commissions this Type. */
+            active_version: number;
+            /** Whether the pointer actually names a version, stated explicitly so an operator never has to read zero as a sentinel. */
+            has_active_version: boolean;
+            /** The standing verdict on the Type. Anything but active refuses resolution even while a pointer is set; retiring or revoking never edits or deletes the version history. */
+            lifecycle: "active" | "retired" | "revoked";
+            /** The reason an operator recorded alongside the current lifecycle verdict (for example why a Type was revoked). Empty when no reason was recorded. */
+            state_reason: string;
+            /** The operator attributed with the last change to this record's state. Empty when the state was never attributed. */
+            updated_by: string;
+            /** When the record's state was last changed, in UTC. Null when the record carries no state timestamp at all — never a zero date that would read as a real edit in 1970. */
+            updated_at: string | null;
+        };
+        /** What the record RESOLVES to right now — the half of the Type that binds a commission — or, when it cannot resolve, why it refuses. A refusal is data, not an error: 'this Type cannot currently be commissioned, for this reason' is a true answer to the operator's question. */
+        governed: {
+            /** Whether this Type can be commissioned right now. When false, every field below is the empty answer and only refusal_reason is meaningful. */
+            resolvable: boolean;
+            /** Why the record refuses to resolve, as a stable governance code rather than an error message: no active version (the pointer names nothing, the lifecycle is not active, or the state row is absent), a torn record (the pointer names a version that is missing), an active version that fails the law in force today, or a content digest that no longer matches its version. Empty when the Type resolves. */
+            refusal_reason: "" | "no active version" | "torn_record" | "active_version_fails_current_law" | "content_digest_mismatch";
+            /** The version that actually resolved — the one a commission would run. Zero when nothing resolved. */
+            version: number;
+            /** The Type's declared operational kind, drawn from the closed universal roster. `general` is the single legacy role, lawful only on the one pre-ruling declaration and outside typed commissioning. Empty when the Type does not resolve. */
+            role: "" | "builder" | "research" | "scout" | "review" | "testing" | "migration" | "documentation" | "general";
+            /** The capabilities this Type NEEDS in order to run — requirements it states, never grants. Intersected against the commissioner's authority at commission time. An empty list means the Type requires nothing beyond the baseline. */
+            required_capabilities: string[];
+            /** The named Personalities permitted to commission this Type. An empty list means any Personality of the owning product that passes the ordinary commission checks. */
+            allowed_commissioners: string[];
+            /** The isolation this Type demands of its execution backend. A requirement no provider can satisfy makes the commission REFUSE — it is never silently downgraded. Empty when the Type does not resolve. */
+            sandbox_requirement: "" | "none" | "isolated";
+            /** Whether this Type may run as more than one concurrent instance under a single commission. */
+            supports_clustering: boolean;
+            /** How an instance of this Type ENDS when it gets stuck — fail (end in failure) or report (end reporting what it reached). Empty when the Type does not resolve. */
+            escalation: "" | "fail" | "report";
+            /** The provider-by-policy selector naming which execution backend runs this Type. Empty is meaningful here: it means defer to the runtime environment's default, not that nothing was declared. */
+            execution_provider: string;
+        };
+        /** The AUTHORED half — the values of the fields the runtime does NOT consume. They are governance the record RECORDS, not governance in force; naming the fields without their content would tell an operator that a field exists but never what it says. NOTE: the roster's declared block carries no `preferences` key at all. That value is opaque, schema-free, product-authored JSON and appears only on the single-Type detail read, which is re-proven at one owning product. */
+        declared: {
+            /** Whether there is an active version to read declared values from. False means nothing is declared here — distinct from a row of zeros, which would read as 'bounded at nothing'. Note this is the pointer's version, read WITHOUT re-validation: it can be true while the governed half refuses. */
+            present: boolean;
+            /** The operator-facing name for this Type. Advisory: it is shown to humans and binds nothing. */
+            display_name: string;
+            /** The authored prose describing what this Type is for. Advisory — recorded, consumed by no gate. */
+            description: string;
+            /** The model-selection policy this Type names as its default. Empty means the Type defers to the commissioning Operation's policy. */
+            default_model_policy_ref: string;
+            /** The Type-level wall-clock ceiling an instance may run for. Zero means undeclared; an Operation may narrow this bound but never widen it. */
+            max_wall_clock_ms: number;
+            /** The Type-level ceiling on execution iterations. Zero means undeclared; an Operation may narrow this bound but never widen it. */
+            max_iterations: number;
+            /** The kinds of Artifact this Type declares it may produce, checked when an Artifact is admitted. An empty list means no kinds were declared. */
+            artifact_contract: string[];
+            /** The resource envelope this Type's record declares for a bounded executor, emitted as the AUTHORED JSON EXACTLY AS STORED — the roster never re-validates or re-renders these bytes, so this object's shape is bounded by the record's own write boundary and by nothing else. Null when no envelope is on the record (no active version, or an unreadable one). IMPORTANT: this is NOT the execution envelope that bounds a real run — see enforcement.serving_envelope_source; the enrollment declaration's envelope is the one resolved at dispatch. */
+            execution_envelope: {
+                /** CPU allowance for one instance of this Type. Required: the write boundary demands a value > 0, and an absent key decodes to zero and is refused — so no stored envelope can omit it. May be fractional. */
+                cpu: number;
+                /** Memory allowance for one instance, in MiB. Required for the same reason as cpu; a fractional literal is refused at the write boundary, so this is always an integer. */
+                memory_mib: number;
+                /** Working filesystem allowance for one instance, in MiB. Required: must be > 0 at the write boundary. */
+                filesystem_mib: number;
+                /** The most output bytes one instance may emit before it is cut off. Required: must be > 0 at the write boundary. */
+                output_bytes_max: number;
+                /** The hosts an instance may reach outbound. OPTIONAL, and NULLABLE: the key may be absent, an empty array, or an explicit JSON null — a null decodes to an empty host list, passes the write boundary, and is then re-emitted verbatim, so a consumer must treat absent, [] and null alike as 'no egress allowed'. Every entry, when present, is a non-empty printable host string. */
+                network_egress_allow?: string[];
+                /** How long the WORK itself may take before it is stopped. Required: must be > 0 at the write boundary. */
+                timeout_ms: number;
+                /** How long the execution lease is held. Required: must be > 0 and strictly longer than the work plus its teardown slack, so a lease can never reap live in-budget work. */
+                lease_ttl_ms: number;
+                /** The grace allowed for shutting an instance down after its work ends. OPTIONAL, and NULLABLE — this is the one bound whose zero is lawful, so the key may be absent or an explicit JSON null (both decode to zero and pass the write boundary, and null is then re-emitted verbatim). Read absent and null as zero slack. */
+                teardown_slack_ms?: number | null;
+            };
+        };
+        /** The honesty control, carried on EVERY row: which of the record's fields reach a gate, which are recorded and consumed by nothing, and which authority actually supplies the execution envelope that bounds a run. It describes the mechanism, so it is identical on every row — a surface that left this to a renderer would eventually show an operator a bound that does not bind. */
+        enforcement: {
+            /** The record's fields that actually reach a gate — today: role, required_capabilities, allowed_commissioners, sandbox_requirement, supports_clustering, execution_provider. These are governance in force. */
+            enforced: string[];
+            /** The record's fields that are validated when written and carried in the content digest, but consulted by nothing at run time — today: default_model_policy_ref, max_wall_clock_ms, max_iterations, artifact_contract, escalation, execution_envelope, description, preferences. Naming `preferences` here reports that the field exists; its value is still withheld from the roster. */
+            declared: string[];
+            /** Which authority supplies the execution envelope that actually bounds a run. It is the enrollment declaration's envelope, NOT the Type record's own — the surface reports both truths rather than choosing one. */
+            serving_envelope_source: "enrollment_declaration";
+        };
+    }>;
+    /** The UTC instant this roster was assembled. The read is live and uncached, so this is the moment the scope was resolved and the rows were projected — not a cache stamp. */
+    as_of: string;
+}
+/**
+ * Response body of GET /personalities on the conductor-service read-only admin surface (mounted as /admin/personalities behind the verified-actor gate and the gateway S2S-trust gate). The full roster of personalities registered at the composition root, each joined to the product whose enrollment grants it. The registry is immutable after boot, so this read is a snapshot of the running configuration, never a query against stored state. A personality's route table is deliberately absent from this surface.
+ */
+export interface PersonalityList {
+    /** Every registered personality, ordered by id. Always an array — an unconfigured registry yields an empty list, never null and never an error. */
+    personalities: Array<{
+        /** The registry key the engine resolves this personality by. Opaque — the engine never branches on it. */
+        id: string;
+        /** Human display name, for operator screens only. */
+        name: string;
+        /** The enrolled product whose enrollment record grants this personality. An EMPTY STRING is a real, meaningful value: the personality is registered in the runtime but no active enrollment grants it, so it currently has no owning product. The key is always present — do not read absence as unowned; read the empty string as unowned. */
+        owning_product: string;
+        /** That this personality is live in the running registry. Always true on this surface — the registry holds only successfully registered personalities, so an inactive row cannot appear here. */
+        active: boolean;
+        /** The model-tier hint the Conductor resolves against a provider. Never a vendor or model id. Always present — registration fails closed without a valid tier. */
+        tier: "fast" | "deep" | "local";
+        /** Coarse operator archetype, used for discovery and defaults only — it changes no runtime behavior. OMITTED ENTIRELY when the personality declared none; absence means undeclared, not a default. */
+        classification?: "operator" | "consumer" | "developer" | "administrator" | "analyst" | "educator";
+        /** Presentation posture the AI Client arranges the surface for. OMITTED ENTIRELY when undeclared, in which case the client's own chat-first default applies — this surface does not fill it in. */
+        primary_surface?: "chat-first" | "canvas-first";
+        /** The consul-bound entitlement envelope this personality declares (<primitive>.<verb>). Every allowed tool's required capability sits inside it. Always present; an empty array means the personality declared no capabilities, which is a genuine zero-entitlement state. */
+        capabilities: string[];
+        /** The registered tool names this personality may invoke. Always present; an empty array means it may invoke none. */
+        allowed_tools: string[];
+        /** The canvas types this personality may emit. Always present; an empty array means it may emit none. */
+        allowed_canvases: string[];
+    }>;
+    /** How many personalities the list carries — always the length of the personalities array on this page, never a total across a larger unreturned set (this surface does not paginate). */
+    count: number;
+}
+/**
+ * The body of GET /personality-model-policy/:personalityId — the AOE-2 Model Policy surface's per-personality RESOLUTION EXPLANATION: which provider and model this personality would use right now, and why. Split into the AUTHORED half (what a human wrote on the personality) and the DERIVED half (what the resolver computed against the live world), which are never to be read as one thing. A refusal is a legitimate ANSWER here, not an error: the operator asked what happens, and 'it refuses, for this reason' is the truth. Emitted only after the operator is re-proven at the personality's owning product; unknown, unowned, and unauthorized targets are indistinguishable 404s.
+ */
+export interface PersonalityResolution {
+    /** The personality this explanation is about, echoed back from the request so a cached or logged answer can never be misattributed to a different personality. */
+    personality_id: string;
+    /** What a human actually wrote on the personality declaration. Nothing here was computed; if an operator wants to change the outcome, this is the half they edit. */
+    authored: {
+        /** The Model Policy this personality points at. Empty string means the personality is on the tier-compatibility path — where every unbound personality sits, and where no Model Policy governs the choice at all. */
+        policy_ref: string;
+        /** The authored model-tier hint (never a vendor or model id). On the tier-compat path this is what actually decides the model; on the policy path the policy overrides it. */
+        tier: "fast" | "deep" | "local";
+    };
+    /** What the resolver computed by walking the authored policy against the live world (provider records, compiled adapters, degraded/impaired posture). Nothing here is stored or editable — it is the answer as of this instant, and it will change when the world changes. */
+    derived: {
+        /** Whether the Model Policy path ran at all. False means the personality is untouched by Model Policy and is served by tier compatibility exactly as before. */
+        policy_path: boolean;
+        /** Which of the two mutually exclusive paths answered: 'policy' = a Model Policy governed this personality, 'tier_compat' = no policy reference, the legacy tier default applies. The word form of policy_path, for a screen that should not print a boolean. */
+        path: "tier_compat" | "policy";
+        /** The product that owns this personality, taken from enrollment and never from the declaration — it is the authority for the cross-product check, so a policy belonging to any other product can never govern here. Empty string when the owner could not be derived or when no policy path ran. */
+        owning_product: string;
+        /** The immutable policy version that actually governed this resolution — the number to cite in an incident, because policy content is versioned and the live pointer moves. 0 means no version governed (tier-compat, or the policy path refused before reaching a version). */
+        active_policy_version: number;
+        /** The content digest of the governing policy version — proof that the bytes an operator is reading in the policy detail view are the bytes that produced this answer. Empty string when no version governed. */
+        policy_content_digest: string;
+        /** Why the policy path refused to select anything. Empty string means it did not refuse (either a model was selected, or this personality is on the tier-compat path). A set reference that cannot resolve always REFUSES — it never quietly falls back to the tier default, because falling back would widen what the product admitted. */
+        refusal: "" | "policy_not_found" | "policy_has_no_active_version" | "policy_owned_by_another_product" | "personality_owner_unknown" | "no_lane_entry_qualified" | "active_version_missing";
+        /** WHICH AUTHORITY admitted the selection — never to be conflated with the fact that one was made. 'provider_record' = admitted by the governed active Provider Record. 'pre_cutover_compiled_equivalence' = admitted only because the entry names exactly the compiled binding already serving on a provider that has never cut over; that is compatibility, not governance, and an operator reading it should know less governance is in force than the screen implies. Empty string when the walk ran but exhausted every entry. Present only when the walk was reached (a policy path that got as far as an active version). */
+        admission?: "" | "pre_cutover_compiled_equivalence" | "provider_record";
+        /** Which authored lane the winning entry came from — 'primary' means the first choice held, 'fallback' means the primary chain was exhausted and this personality is running degraded from what was intended. Empty string when nothing qualified. Present only when the walk was reached. The walk itself only ever traverses primary then fallback; the remaining lane names exist in the policy vocabulary but cannot be selected today. */
+        selected_lane?: "" | "primary" | "fallback" | "reasoning" | "large_context" | "cheap_classification";
+        /** The provider this personality's turns will actually go to right now. Present only when an entry qualified — its absence is the operator's signal that no model is available and turns are refusing. */
+        resolved_provider?: string;
+        /** The exact model this personality's turns will actually use right now. Present only when an entry qualified. Always one of the models the policy explicitly named — the walk can never reach a model the policy did not list. */
+        resolved_model?: string;
+        /** Every entry the walk rejected before settling, in authored walk order, each with the reason it was passed over. This is what makes a fallback chain readable rather than a list of hopes: it shows which intended choices are unavailable and why, even when the final answer is a healthy selection. Present only when the walk was reached; an empty array means the very first entry qualified. */
+        skips?: Array<{
+            /** The authored lane this rejected entry sat in — a rejection in 'primary' is the operator's intended choice failing, a rejection in 'fallback' is the safety net failing. */
+            lane: "primary" | "fallback" | "reasoning" | "large_context" | "cheap_classification";
+            /** The provider named by the rejected entry. */
+            provider: string;
+            /** The model named by the rejected entry. */
+            model: string;
+            /** The one rule that rejected this entry — a closed vocabulary, so 'no model qualified' is always actionable. Fence and record codes are governance problems (the product never admitted it, or the record does not admit it); capability, context-window and token-cap codes are authoring problems (the policy asks for more than the model declares); degraded and impaired are live-posture problems that will clear on their own. */
+            reason: "outside_allowed_provider_fence" | "no_provider_record" | "provider_record_not_admitted" | "model_not_in_active_version" | "no_compiled_provider_adapter" | "missing_required_capability" | "context_window_below_minimum" | "max_output_tokens_over_platform_cap" | "max_output_tokens_over_vendor_cap" | "provider_degraded" | "provider_impaired" | "pre_cutover_entry_is_not_the_compiled_binding";
+        }>;
+        /** The instant this explanation was computed, in UTC. Derived posture is a photograph, not a stored fact: the same personality can resolve differently a second later if a provider degrades or a version is activated, so an answer without this stamp is not quotable. */
+        as_of: string;
+    };
+}
+/**
+ * The body of GET /admin/projects — every enrolled product seen as a PROJECT: its provisioning posture rather than its AI configuration. An enrolled product IS a project (Project Isolation Doctrine), so the rows are the same records the enrollment list returns, projected through a different question: is this project storage-bound, across which planes, and what may it read across project lines. Non-active records appear here too, so a suspended project is visible rather than absent.
+ */
+export interface ProjectList {
+    /** One row per loaded record, in load order. Always an array — never null. */
+    projects: Array<{
+        /** The project's durable name — identical to the enrolled product_id. */
+        project_id: string;
+        /** The recorded provisioning/enrollment lifecycle, verbatim: `active` (fully provisioned, verified, turn-capable) or `suspended` per the engine's flip rule. Not enumerated: the loader closes no vocabulary and only ever compares this to "active". */
+        status: string;
+        /** Whether ANY plane binding is declared. False is a valid, pre-provisioning state — enrolled but not yet storage-bound — and must not be read as a failure. */
+        storage_bound: boolean;
+        /** The four-plane binding grid (six slots; structured = graph + memory + learning), each with declared + lifecycle status — the SAME safe rendering as the enrollment detail, deliberately identical so the two surfaces cannot drift into describing storage differently. Presence and lifecycle only; no secret name, index, bucket or database is ever serialized. */
+        planes: {
+            /** This project's own graph store (Neon) — where its Reference and Overlay rings physically live. */
+            graph: {
+                /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+                declared: boolean;
+                /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+                status?: string;
+            };
+            /** This project's own memory store (Neon) — where its Memory Tier 0 / Tier 1 records physically live. */
+            memory: {
+                /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+                declared: boolean;
+                /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+                status?: string;
+            };
+            /** This project's own learning store (Neon) — where its edge inference and epoch state physically live. */
+            learning: {
+                /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+                declared: boolean;
+                /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+                status?: string;
+            };
+            /** This project's own vector collection — the retrieval plane; per-source namespaces nest inside it. */
+            vector: {
+                /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+                declared: boolean;
+                /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+                status?: string;
+            };
+            /** This project's own object-storage partition — the bucket/prefix its Artifact bytes live in. */
+            object: {
+                /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+                declared: boolean;
+                /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+                status?: string;
+            };
+            /** This project's own analytics database — the fourth plane, where its traces, usage and cost land. */
+            analytics: {
+                /** Whether the record declares this plane at all. False = enrolled but not yet bound here, a valid pre-provisioning state. */
+                declared: boolean;
+                /** The provisioning lifecycle of a declared binding. The handler normalizes an omitted status to `active` and otherwise passes the recorded value through verbatim; the lawful set (`active` — resolves; `pending` — declared but unprovisioned, boots fine and fails closed at resolve) is closed only by ValidateStorage, which skips every non-active record, so this is described rather than enumerated. Absent when the plane is not declared. */
+                status?: string;
+            };
+        };
+        /** The other projects this one may read across, by name. Cross-project reach is granted, never assumed, and needs BOTH this grant and a Control Plane decision — divergence fails closed. Always an array. */
+        cross_project_grants: string[];
+    }>;
+    /** The number of rows, emitted alongside the array so a truncated response is detectable. */
+    count: number;
+}
+//# sourceMappingURL=contract-types.d.ts.map

package/dist/generated/contract-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-types.d.ts","sourceRoot":"","sources":["../../src/generated/contract-types.ts"],"names":[],"mappings":"AAYA;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0QAA0Q;IAC1Q,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;IACvB,qPAAqP;IACrP,YAAY,EAAE,MAAM,CAAC;IACrB,2TAA2T;IAC3T,UAAU,EAAE,uBAAuB,CAAC;IACpC,kPAAkP;IAClP,KAAK,EAAE,0BAA0B,CAAC;IAClC,+TAA+T;IAC/T,cAAc,EAAE,CAAC,qCAAqC,GAAG,4BAA4B,CAAC,EAAE,CAAC;IACzF,sTAAsT;IACtT,IAAI,EAAE,4BAA4B,GAAG,EAAE,CAAC;IACxC,iVAAiV;IACjV,OAAO,EAAE,EAAE,GAAG,mCAAmC,GAAG,4BAA4B,CAAC;IACjF,iTAAiT;IACjT,UAAU,EAAE;QACV,2LAA2L;QAC3L,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,oJAAoJ;QACpJ,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,qFAAqF;QACrF,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,8FAA8F;QAC9F,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,8SAA8S;QAC9S,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,0IAA0I;QAC1I,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,4IAA4I;QAC5I,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,yYAAyY;IACzY,2BAA2B,EAAE,CAAC,sBAAsB,GAAG,cAAc,GAAG,eAAe,CAAC,EAAE,CAAC;CAC5F;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sQAAsQ;IACtQ,UAAU,EAAE,MAAM,CAAC;IACnB,ibAAib;IACjb,MAAM,EAAE,MAAM,CAAC;IACf,yWAAyW;IACzW,cAAc,EAAE,MAAM,CAAC;IACvB,sPAAsP;IACtP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gMAAgM;IAChM,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qMAAqM;IACrM,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kUAAkU;IAClU,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,6OAA6O;IAC7O,iBAAiB,EAAE,KAAK,CAAC;QACvB,gGAAgG;QAChG,aAAa,EAAE,MAAM,CAAC;QACtB,sNAAsN;QACtN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,4OAA4O;QAC5O,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC,CAAC;IACH,+OAA+O;IAC/O,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,sSAAsS;IACtS,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,+LAA+L;IAC/L,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,yaAAya;IACza,gBAAgB,EAAE;QAChB,qGAAqG;QACrG,KAAK,EAAE;YACL,8HAA8H;YAC9H,QAAQ,EAAE,OAAO,CAAC;YAClB,wbAAwb;YACxb,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,yGAAyG;QACzG,MAAM,EAAE;YACN,8HAA8H;YAC9H,QAAQ,EAAE,OAAO,CAAC;YAClB,wbAAwb;YACxb,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,2GAA2G;QAC3G,QAAQ,EAAE;YACR,8HAA8H;YAC9H,QAAQ,EAAE,OAAO,CAAC;YAClB,wbAAwb;YACxb,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,wGAAwG;QACxG,MAAM,EAAE;YACN,8HAA8H;YAC9H,QAAQ,EAAE,OAAO,CAAC;YAClB,wbAAwb;YACxb,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,kGAAkG;QAClG,MAAM,EAAE;YACN,8HAA8H;YAC9H,QAAQ,EAAE,OAAO,CAAC;YAClB,wbAAwb;YACxb,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,uGAAuG;QACvG,SAAS,EAAE;YACT,8HAA8H;YAC9H,QAAQ,EAAE,OAAO,CAAC;YAClB,wbAAwb;YACxb,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;KACH,CAAC;IACF,0QAA0Q;IAC1Q,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2KAA2K;IAC3K,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0NAA0N;IAC1N,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4KAA4K;IAC5K,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,ucAAuc;IACvc,oBAAoB,EAAE,KAAK,CAAC;QAC1B,uPAAuP;QACvP,OAAO,EAAE,MAAM,CAAC;QAChB,wfAAwf;QACxf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,mcAAmc;IACnc,iBAAiB,EAAE,KAAK,CAAC;QACvB,+IAA+I;QAC/I,oBAAoB,EAAE,MAAM,CAAC;QAC7B,oHAAoH;QACpH,kBAAkB,EAAE,MAAM,CAAC;QAC3B,0PAA0P;QAC1P,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,8LAA8L;QAC9L,kBAAkB,EAAE,OAAO,CAAC;QAC5B,yMAAyM;QACzM,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,kOAAkO;QAClO,kBAAkB,EAAE;YAClB,+CAA+C;YAC/C,GAAG,EAAE,MAAM,CAAC;YACZ,+CAA+C;YAC/C,UAAU,EAAE,MAAM,CAAC;YACnB,4DAA4D;YAC5D,cAAc,EAAE,MAAM,CAAC;YACvB,kHAAkH;YAClH,gBAAgB,EAAE,MAAM,CAAC;YACzB,uKAAuK;YACvK,oBAAoB,EAAE,MAAM,EAAE,CAAC;YAC/B,oEAAoE;YACpE,UAAU,EAAE,MAAM,CAAC;YACnB,sGAAsG;YACtG,YAAY,EAAE,MAAM,CAAC;YACrB,8FAA8F;YAC9F,iBAAiB,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH,CAAC,CAAC;IACH,iiBAAiiB;IACjiB,UAAU,EAAE,KAAK,CAAC;QAChB,iPAAiP;QACjP,EAAE,EAAE,MAAM,CAAC;QACX,wJAAwJ;QACxJ,YAAY,EAAE,MAAM,CAAC;QACrB,ueAAue;QACve,IAAI,EAAE,MAAM,CAAC;QACb,wKAAwK;QACxK,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,8TAA8T;QAC9T,kBAAkB,EAAE;YAClB,gDAAgD;YAChD,GAAG,EAAE,MAAM,CAAC;YACZ,gDAAgD;YAChD,UAAU,EAAE,MAAM,CAAC;YACnB,6DAA6D;YAC7D,cAAc,EAAE,MAAM,CAAC;YACvB,yDAAyD;YACzD,gBAAgB,EAAE,MAAM,CAAC;YACzB,mKAAmK;YACnK,oBAAoB,EAAE,MAAM,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,UAAU,EAAE,MAAM,CAAC;YACnB,kGAAkG;YAClG,YAAY,EAAE,MAAM,CAAC;YACrB,4EAA4E;YAC5E,iBAAiB,EAAE,MAAM,CAAC;SAC3B,CAAC;QACF,8PAA8P;QAC9P,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,+MAA+M;QAC/M,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,klBAAklB;QACllB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,2QAA2Q;QAC3Q,mBAAmB,EAAE,OAAO,CAAC;QAC7B,0lBAA0lB;QAC1lB,UAAU,EAAE,MAAM,CAAC;QACnB,iJAAiJ;QACjJ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gIAAgI;QAChI,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,8GAA8G;QAC9G,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mHAAmH;QACnH,cAAc,EAAE,MAAM,CAAC;QACvB,uHAAuH;QACvH,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC,CAAC;IACH,4bAA4b;IAC5b,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,oSAAoS;IACpS,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,0PAA0P;IAC1P,iBAAiB,EAAE;QACjB,uFAAuF;QACvF,QAAQ,EAAE,MAAM,CAAC;QACjB,2MAA2M;QAC3M,SAAS,EAAE,MAAM,CAAC;QAClB,sMAAsM;QACtM,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oKAAoK;IACpK,WAAW,EAAE,KAAK,CAAC;QACjB,gJAAgJ;QAChJ,UAAU,EAAE,MAAM,CAAC;QACnB,+RAA+R;QAC/R,MAAM,EAAE,MAAM,CAAC;QACf,qJAAqJ;QACrJ,cAAc,EAAE,MAAM,CAAC;QACvB,+LAA+L;QAC/L,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,wMAAwM;QACxM,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC,CAAC;IACH,sIAAsI;IACtI,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,qNAAqN;IACrN,UAAU,EAAE,MAAM,CAAC;IACnB,4KAA4K;IAC5K,YAAY,EAAE,MAAM,CAAC;IACrB,6HAA6H;IAC7H,MAAM,EAAE;QACN,uLAAuL;QACvL,MAAM,EAAE,OAAO,CAAC;QAChB,kKAAkK;QAClK,cAAc,EAAE,MAAM,CAAC;QACvB,gJAAgJ;QAChJ,kBAAkB,EAAE,OAAO,CAAC;QAC5B,oYAAoY;QACpY,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;QAC5C,uIAAuI;QACvI,YAAY,EAAE,MAAM,CAAC;QACrB,8IAA8I;QAC9I,UAAU,EAAE,MAAM,CAAC;QACnB,qJAAqJ;QACrJ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;IACF,qgBAAqgB;IACrgB,QAAQ,EAAE;QACR,uJAAuJ;QACvJ,UAAU,EAAE,OAAO,CAAC;QACpB,+YAA+Y;QAC/Y,cAAc,EAAE,EAAE,GAAG,mBAAmB,GAAG,aAAa,GAAG,kCAAkC,GAAG,yBAAyB,CAAC;QAC1H,kJAAkJ;QAClJ,OAAO,EAAE,MAAM,CAAC;QAChB,sdAAsd;QACtd,IAAI,EAAE,EAAE,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,CAAC;QAC/G,+JAA+J;QAC/J,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,6LAA6L;QAC7L,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,oLAAoL;QACpL,mBAAmB,EAAE,EAAE,GAAG,MAAM,GAAG,UAAU,CAAC;QAC9C,yKAAyK;QACzK,mBAAmB,EAAE,OAAO,CAAC;QAC7B,sIAAsI;QACtI,UAAU,EAAE,EAAE,GAAG,MAAM,GAAG,QAAQ,CAAC;QACnC,6LAA6L;QAC7L,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,mgBAAmgB;IACngB,QAAQ,EAAE;QACR,yMAAyM;QACzM,OAAO,EAAE,OAAO,CAAC;QACjB,uIAAuI;QACvI,YAAY,EAAE,MAAM,CAAC;QACrB,2IAA2I;QAC3I,WAAW,EAAE,MAAM,CAAC;QACpB,gIAAgI;QAChI,wBAAwB,EAAE,MAAM,CAAC;QACjC,oLAAoL;QACpL,iBAAiB,EAAE,MAAM,CAAC;QAC1B,6KAA6K;QAC7K,cAAc,EAAE,MAAM,CAAC;QACvB,iIAAiI;QACjI,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC5B,+QAA+Q;QAC/Q,kBAAkB,EAAE;YAClB,4HAA4H;YAC5H,GAAG,EAAE,MAAM,CAAC;YACZ,0CAA0C;YAC1C,UAAU,EAAE,MAAM,CAAC;YACnB,uDAAuD;YACvD,cAAc,EAAE,MAAM,CAAC;YACvB,qDAAqD;YACrD,gBAAgB,EAAE,MAAM,CAAC;YACzB,yFAAyF;YACzF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;YAChC,sDAAsD;YACtD,UAAU,EAAE,MAAM,CAAC;YACnB,iJAAiJ;YACjJ,YAAY,EAAE,MAAM,CAAC;YACrB,oGAAoG;YACpG,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;QACF,udAAud;QACvd,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC7C,CAAC;IACF,4UAA4U;IAC5U,WAAW,EAAE;QACX,0MAA0M;QAC1M,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,gMAAgM;QAChM,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,uPAAuP;QACvP,uBAAuB,EAAE,wBAAwB,CAAC;KACnD,CAAC;IACF,sjBAAsjB;IACtjB,OAAO,EAAE,KAAK,CAAC;QACb,sHAAsH;QACtH,OAAO,EAAE,MAAM,CAAC;QAChB,4TAA4T;QAC5T,cAAc,EAAE,MAAM,CAAC;QACvB,mFAAmF;QACnF,WAAW,EAAE,MAAM,CAAC;QACpB,+HAA+H;QAC/H,WAAW,EAAE,MAAM,CAAC;QACpB,yNAAyN;QACzN,SAAS,EAAE,OAAO,CAAC;QACnB,67BAA67B;QAC77B,IAAI,EAAE,MAAM,CAAC;QACb,+LAA+L;QAC/L,YAAY,EAAE,MAAM,CAAC;QACrB,sDAAsD;QACtD,WAAW,EAAE,MAAM,CAAC;QACpB,iIAAiI;QACjI,wBAAwB,EAAE,MAAM,CAAC;QACjC,kHAAkH;QAClH,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iHAAiH;QACjH,cAAc,EAAE,MAAM,CAAC;QACvB,mFAAmF;QACnF,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC5B,0JAA0J;QAC1J,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,8IAA8I;QAC9I,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,6RAA6R;QAC7R,mBAAmB,EAAE,MAAM,GAAG,UAAU,CAAC;QACzC,0FAA0F;QAC1F,mBAAmB,EAAE,OAAO,CAAC;QAC7B,iOAAiO;QACjO,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC;QAC9B,oHAAoH;QACpH,kBAAkB,EAAE,MAAM,CAAC;QAC3B,mJAAmJ;QACnJ,kBAAkB,EAAE;YAClB,iDAAiD;YACjD,GAAG,EAAE,MAAM,CAAC;YACZ,0CAA0C;YAC1C,UAAU,EAAE,MAAM,CAAC;YACnB,uDAAuD;YACvD,cAAc,EAAE,MAAM,CAAC;YACvB,qDAAqD;YACrD,gBAAgB,EAAE,MAAM,CAAC;YACzB,yGAAyG;YACzG,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;YAChC,sDAAsD;YACtD,UAAU,EAAE,MAAM,CAAC;YACnB,mGAAmG;YACnG,YAAY,EAAE,MAAM,CAAC;YACrB,6EAA6E;YAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,uNAAuN;IACvN,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iSAAiS;IACjS,eAAe,EAAE,KAAK,CAAC;QACrB,uLAAuL;QACvL,UAAU,EAAE,MAAM,CAAC;QACnB,6IAA6I;QAC7I,YAAY,EAAE,MAAM,CAAC;QACrB,2IAA2I;QAC3I,MAAM,EAAE;YACN,kIAAkI;YAClI,MAAM,EAAE,OAAO,CAAC;YAChB,qJAAqJ;YACrJ,cAAc,EAAE,MAAM,CAAC;YACvB,2HAA2H;YAC3H,kBAAkB,EAAE,OAAO,CAAC;YAC5B,6KAA6K;YAC7K,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;YAC5C,uJAAuJ;YACvJ,YAAY,EAAE,MAAM,CAAC;YACrB,sHAAsH;YACtH,UAAU,EAAE,MAAM,CAAC;YACnB,2KAA2K;YAC3K,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;SAC3B,CAAC;QACF,qRAAqR;QACrR,QAAQ,EAAE;YACR,gJAAgJ;YAChJ,UAAU,EAAE,OAAO,CAAC;YACpB,mZAAmZ;YACnZ,cAAc,EAAE,EAAE,GAAG,mBAAmB,GAAG,aAAa,GAAG,kCAAkC,GAAG,yBAAyB,CAAC;YAC1H,uGAAuG;YACvG,OAAO,EAAE,MAAM,CAAC;YAChB,8OAA8O;YAC9O,IAAI,EAAE,EAAE,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,CAAC;YAC/G,uOAAuO;YACvO,qBAAqB,EAAE,MAAM,EAAE,CAAC;YAChC,uKAAuK;YACvK,qBAAqB,EAAE,MAAM,EAAE,CAAC;YAChC,2MAA2M;YAC3M,mBAAmB,EAAE,EAAE,GAAG,MAAM,GAAG,UAAU,CAAC;YAC9C,gGAAgG;YAChG,mBAAmB,EAAE,OAAO,CAAC;YAC7B,oKAAoK;YACpK,UAAU,EAAE,EAAE,GAAG,MAAM,GAAG,QAAQ,CAAC;YACnC,mMAAmM;YACnM,kBAAkB,EAAE,MAAM,CAAC;SAC5B,CAAC;QACF,wdAAwd;QACxd,QAAQ,EAAE;YACR,sSAAsS;YACtS,OAAO,EAAE,OAAO,CAAC;YACjB,iGAAiG;YACjG,YAAY,EAAE,MAAM,CAAC;YACrB,qGAAqG;YACrG,WAAW,EAAE,MAAM,CAAC;YACpB,sIAAsI;YACtI,wBAAwB,EAAE,MAAM,CAAC;YACjC,+IAA+I;YAC/I,iBAAiB,EAAE,MAAM,CAAC;YAC1B,oIAAoI;YACpI,cAAc,EAAE,MAAM,CAAC;YACvB,iJAAiJ;YACjJ,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC5B,6hBAA6hB;YAC7hB,kBAAkB,EAAE;gBAClB,8MAA8M;gBAC9M,GAAG,EAAE,MAAM,CAAC;gBACZ,2KAA2K;gBAC3K,UAAU,EAAE,MAAM,CAAC;gBACnB,0GAA0G;gBAC1G,cAAc,EAAE,MAAM,CAAC;gBACvB,qHAAqH;gBACrH,gBAAgB,EAAE,MAAM,CAAC;gBACzB,wXAAwX;gBACxX,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;gBAChC,2GAA2G;gBAC3G,UAAU,EAAE,MAAM,CAAC;gBACnB,4KAA4K;gBAC5K,YAAY,EAAE,MAAM,CAAC;gBACrB,+TAA+T;gBAC/T,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;aACnC,CAAC;SACH,CAAC;QACF,2XAA2X;QAC3X,WAAW,EAAE;YACX,+MAA+M;YAC/M,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnB,2XAA2X;YAC3X,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnB,qNAAqN;YACrN,uBAAuB,EAAE,wBAAwB,CAAC;SACnD,CAAC;KACH,CAAC,CAAC;IACH,8KAA8K;IAC9K,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mJAAmJ;IACnJ,aAAa,EAAE,KAAK,CAAC;QACnB,0GAA0G;QAC1G,EAAE,EAAE,MAAM,CAAC;QACX,qDAAqD;QACrD,IAAI,EAAE,MAAM,CAAC;QACb,+UAA+U;QAC/U,cAAc,EAAE,MAAM,CAAC;QACvB,iMAAiM;QACjM,MAAM,EAAE,OAAO,CAAC;QAChB,kKAAkK;QAClK,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAChC,sMAAsM;QACtM,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;QAClG,mMAAmM;QACnM,eAAe,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;QAChD,+QAA+Q;QAC/Q,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,sHAAsH;QACtH,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,yGAAyG;QACzG,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,0LAA0L;IAC1L,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kKAAkK;IAClK,cAAc,EAAE,MAAM,CAAC;IACvB,qKAAqK;IACrK,QAAQ,EAAE;QACR,qNAAqN;QACrN,UAAU,EAAE,MAAM,CAAC;QACnB,8KAA8K;QAC9K,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;KACjC,CAAC;IACF,8QAA8Q;IAC9Q,OAAO,EAAE;QACP,gKAAgK;QAChK,WAAW,EAAE,OAAO,CAAC;QACrB,iQAAiQ;QACjQ,IAAI,EAAE,aAAa,GAAG,QAAQ,CAAC;QAC/B,qSAAqS;QACrS,cAAc,EAAE,MAAM,CAAC;QACvB,gRAAgR;QAChR,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iNAAiN;QACjN,qBAAqB,EAAE,MAAM,CAAC;QAC9B,4UAA4U;QAC5U,OAAO,EAAE,EAAE,GAAG,kBAAkB,GAAG,8BAA8B,GAAG,iCAAiC,GAAG,2BAA2B,GAAG,yBAAyB,GAAG,wBAAwB,CAAC;QAC3L,omBAAomB;QACpmB,SAAS,CAAC,EAAE,EAAE,GAAG,kCAAkC,GAAG,iBAAiB,CAAC;QACxE,+aAA+a;QAC/a,aAAa,CAAC,EAAE,EAAE,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,eAAe,GAAG,sBAAsB,CAAC;QACrG,0MAA0M;QAC1M,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,mOAAmO;QACnO,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,yYAAyY;QACzY,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,8KAA8K;YAC9K,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,eAAe,GAAG,sBAAsB,CAAC;YACtF,gDAAgD;YAChD,QAAQ,EAAE,MAAM,CAAC;YACjB,6CAA6C;YAC7C,KAAK,EAAE,MAAM,CAAC;YACd,0aAA0a;YAC1a,MAAM,EAAE,gCAAgC,GAAG,oBAAoB,GAAG,8BAA8B,GAAG,6BAA6B,GAAG,8BAA8B,GAAG,6BAA6B,GAAG,8BAA8B,GAAG,qCAAqC,GAAG,mCAAmC,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,+CAA+C,CAAC;SAChZ,CAAC,CAAC;QACH,4QAA4Q;QAC5Q,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,EAAE,KAAK,CAAC;QACd,yEAAyE;QACzE,UAAU,EAAE,MAAM,CAAC;QACnB,yPAAyP;QACzP,MAAM,EAAE,MAAM,CAAC;QACf,gKAAgK;QAChK,aAAa,EAAE,OAAO,CAAC;QACvB,yWAAyW;QACzW,MAAM,EAAE;YACN,qGAAqG;YACrG,KAAK,EAAE;gBACL,8HAA8H;gBAC9H,QAAQ,EAAE,OAAO,CAAC;gBAClB,wbAAwb;gBACxb,MAAM,CAAC,EAAE,MAAM,CAAC;aACjB,CAAC;YACF,yGAAyG;YACzG,MAAM,EAAE;gBACN,8HAA8H;gBAC9H,QAAQ,EAAE,OAAO,CAAC;gBAClB,wbAAwb;gBACxb,MAAM,CAAC,EAAE,MAAM,CAAC;aACjB,CAAC;YACF,2GAA2G;YAC3G,QAAQ,EAAE;gBACR,8HAA8H;gBAC9H,QAAQ,EAAE,OAAO,CAAC;gBAClB,wbAAwb;gBACxb,MAAM,CAAC,EAAE,MAAM,CAAC;aACjB,CAAC;YACF,wGAAwG;YACxG,MAAM,EAAE;gBACN,8HAA8H;gBAC9H,QAAQ,EAAE,OAAO,CAAC;gBAClB,wbAAwb;gBACxb,MAAM,CAAC,EAAE,MAAM,CAAC;aACjB,CAAC;YACF,kGAAkG;YAClG,MAAM,EAAE;gBACN,8HAA8H;gBAC9H,QAAQ,EAAE,OAAO,CAAC;gBAClB,wbAAwb;gBACxb,MAAM,CAAC,EAAE,MAAM,CAAC;aACjB,CAAC;YACF,uGAAuG;YACvG,SAAS,EAAE;gBACT,8HAA8H;gBAC9H,QAAQ,EAAE,OAAO,CAAC;gBAClB,wbAAwb;gBACxb,MAAM,CAAC,EAAE,MAAM,CAAC;aACjB,CAAC;SACH,CAAC;QACF,8MAA8M;QAC9M,oBAAoB,EAAE,MAAM,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;CACf"}

package/dist/generated/contract-types.js

@@ -0,0 +1,12 @@
+// GENERATED FILE — DO NOT EDIT BY HAND.
+//
+// Source: platform/contracts/operator-admin/v1/*.schema.json
+// Generator: scripts/generate_operator_admin_types.py
+//
+// The published Admin SDK's response types were hand-written once, and nine of them disagreed with the wire —
+// phantom fields, missing fields, inverted optionality, and a response read at the wrong nesting level, all of
+// which type-checked and shipped. These types are now DERIVED from the operator-admin contract, and the same
+// contract is enforced against the real Go handlers by the conductor's contract_conformance_test.go. Editing
+// this file by hand fails the repository's generated-output drift gate; edit the schema instead.
+export {};
+//# sourceMappingURL=contract-types.js.map

package/dist/generated/contract-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-types.js","sourceRoot":"","sources":["../../src/generated/contract-types.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,6DAA6D;AAC7D,sDAAsD;AACtD,EAAE;AACF,8GAA8G;AAC9G,+GAA+G;AAC/G,6GAA6G;AAC7G,6GAA6G;AAC7G,iGAAiG"}

package/dist/index.d.ts

@@ -50,221 +50,8 @@ export declare class AdminError extends Error {
     readonly path: string;
     constructor(method: string, path: string, status: number);
 }
-export interface StorageBindingRead {
-    declared: boolean;
-    status?: string;
-}
-export interface ObserveTopicGrant {
-    project: string;
-    family: string;
-}
-export interface ExecutionEnvelope {
-    cpu: number;
-    memory_mib: number;
-    filesystem_mib: number;
-    output_bytes_max: number;
-    network_egress_allow: string[];
-    timeout_ms: number;
-    lease_ttl_ms: number;
-    teardown_slack_ms: number;
-}
-export interface DelegationGrant {
-    composer_personality: string;
-    target_personality: string;
-    approver?: string;
-    is_execution_grant: boolean;
-    execution_provider?: string;
-    execution_envelope: ExecutionEnvelope | null;
-}
-/**
- * An Operative declared in a product's enrollment — the AUTHORING half, which is not the same thing as the
- * governed record's resolution or as what any gate enforces.
- *
- * There is deliberately no `preferences` field: it is opaque, product-authored, schema-free JSON, and the
- * platform-scoped read that feeds this does not serialize it.
- */
-export interface OperativeDeclaration {
-    id: string;
-    display_name: string;
-    role: string;
-    execution_provider?: string;
-    execution_envelope: ExecutionEnvelope | null;
-    required_capabilities: string[];
-    allowed_commissioners: string[];
-    sandbox_requirement: string;
-    supports_clustering: boolean;
-    escalation: string;
-    description?: string;
-    default_model_policy_ref?: string;
-    max_wall_clock_ms: number;
-    max_iterations: number;
-    artifact_contract: string[];
-}
-/**
- * The breadth ceiling, told honestly. `declared` is what the product authored (0 = undeclared), `effective` is
- * what the runtime computes (undeclared fails closed to 1), and `enforced` records that this bound really is
- * applied — atomically, at the run store's admission boundary.
- */
-export interface OperationBreadth {
-    declared: number;
-    effective: number;
-    enforced: boolean;
-}
-export interface CapabilityRoute {
-    capability_id: string;
-    route_key: string;
-    endpoint_present: boolean;
-}
-/** A Project's enrollment record: its governed AI configuration, references only — never a secret. */
-export interface EnrollmentDetail {
-    product_id: string;
-    status: string;
-    s2s_trust_mode: string;
-    issuer?: string;
-    jwks_uri?: string;
-    audiences: string[];
-    personality_grants: string[];
-    capability_grants: CapabilityRoute[];
-    knowledge_namespace_grants: string[];
-    cross_project_grants: string[];
-    service_endpoint_keys: string[];
-    storage_bindings: Record<string, StorageBindingRead>;
-    owner?: string;
-    allowed_origins: string[];
-    graph_scope_grants: string[];
-    memory_scope_grants: string[];
-    observe_topic_grants: ObserveTopicGrant[];
-    delegation_grants: DelegationGrant[];
-    operatives: OperativeDeclaration[];
-    /** RETIRED by owner ruling and required to be empty; carried only so a stale record refuses loudly. */
-    operative_roles: string[];
-    /** Capability id → service_endpoints KEY. Never a URL. */
-    capability_routes: Record<string, string>;
-    operation_breadth: OperationBreadth;
-}
-export interface PersonalitySummary {
-    id: string;
-    name?: string;
-    classification?: string;
-    tier?: string;
-    business_package?: string;
-    capabilities?: string[];
-    allowed_tools?: string[];
-    allowed_canvases?: string[];
-}
-/**
- * A Personality's EFFECTIVE AUTHORITY, computed at read time.
- *
- * This is not stored state and the type refuses to imply otherwise. `evaluated_at` is a computation timestamp,
- * `evaluation` records that the computation is live and uncached, and `scope` + `excluded_terms` say plainly
- * that this is the Personality/consent half — the re-proven initiating actor and the immutable Operation bounds
- * are separate terms that a commission applies elsewhere.
- */
-export interface AuthorityEnvelope {
-    product_id: string;
-    personality_id: string;
-    evaluated_at: string;
-    evaluation: 'live_uncached_at_read';
-    scope: 'personality_consent_half';
-    excluded_terms: string[];
-    mode: string;
-    /** Empty when the authority envelope resolved; otherwise the reason it refuses, which is an answer, not an error. */
-    refusal: string;
-    dimensions: {
-        capabilities: string[];
-        allowed_tools: string[];
-        allowed_canvases: string[];
-        allowed_adapters: string[];
-        knowledge_namespaces: string[];
-        graph_scopes: string[];
-        memory_scopes: string[];
-    };
-    /** Which dimensions are effective authority ∩ the owning product's enrollment grants; the rest are authority alone. */
-    intersected_with_enrollment: string[];
-}
-/**
- * Which of a Type's fields actually bind.
- *
- * This is data rather than a rendering convention on purpose: a consumer asked to remember which fields are live
- * will eventually forget, and the failure is silent — an operator reads a bound that does not bind.
- */
-export interface OperativeTypeEnforcement {
-    /** Fields that reach a gate (census admission, typed commission admission, provider-bound sandbox). */
-    enforced: string[];
-    /** Fields validated at the write boundary, carried in the content digest, and consumed by nothing. */
-    declared: string[];
-    /** Which authority supplies the execution envelope that actually bounds a run. */
-    serving_envelope_source: string;
-}
-export interface OperativeTypeRecordState {
-    exists: boolean;
-    active_version: number;
-    has_active_version: boolean;
-    lifecycle: string;
-    state_reason?: string;
-    updated_by?: string;
-    updated_at?: string | null;
-}
-export interface OperativeTypeGoverned {
-    resolvable: boolean;
-    refusal_reason?: string;
-    version?: number;
-    role?: string;
-    required_capabilities: string[];
-    allowed_commissioners: string[];
-    sandbox_requirement?: string;
-    supports_clustering: boolean;
-    escalation?: string;
-    execution_provider?: string;
-}
-/**
- * The AUTHORED VALUES of the fields the runtime does not consume.
- *
- * Naming the fields without their content was half a contract: it told a consumer that
- * `default_model_policy_ref` exists, never what it says — and the whole point of the declared/enforced split
- * is to show what is configured next to what binds.
- *
- * `preferences` is opaque, product-authored JSON. It is present on this TARGET-BOUND read, where only an
- * operator already authorized at the owning product can see it, and deliberately absent from the
- * platform-scoped enrollment detail. Different breadth, different answer.
- */
-export interface OperativeTypeDeclared {
-    present: boolean;
-    display_name?: string;
-    description?: string;
-    default_model_policy_ref: string;
-    max_wall_clock_ms: number;
-    max_iterations: number;
-    artifact_contract: string[];
-    /** The record's OWN declared envelope — not the one resolved at dispatch. See `serving_envelope_source`. */
-    execution_envelope: unknown | null;
-    preferences: unknown | null;
-}
-export interface OperativeTypeView {
-    product_id: string;
-    operative_id: string;
-    record: OperativeTypeRecordState;
-    governed: OperativeTypeGoverned;
-    declared: OperativeTypeDeclared;
-    enforcement: OperativeTypeEnforcement;
-}
-export interface OperativeTypeVersion {
-    version: number;
-    content_digest: string;
-    authored_by: string;
-    authored_at: string;
-    is_active: boolean;
-    role: string;
-    display_name: string;
-}
-export interface OperativeTypeDetail extends OperativeTypeView {
-    history: OperativeTypeVersion[];
-    as_of: string;
-}
-export interface OperativeTypeList {
-    operative_types: OperativeTypeView[];
-    as_of: string;
-}
+export type { AuthorityEnvelope, EnrollmentDetail, EnrollmentList, OperativeTypeDetail, OperativeTypeList, PersonalityList, PersonalityResolution, ProjectList, } from './generated/contract-types.js';
+import type { AuthorityEnvelope, EnrollmentDetail, EnrollmentList, OperativeTypeDetail, OperativeTypeList, PersonalityList, PersonalityResolution, ProjectList } from './generated/contract-types.js';
 /**
  * AdminClient is a thin wrapper over the Operator Gateway's governance reads. Each method is one request; the
  * gateway authorizes before proxying, and a non-2xx response throws.
@@ -273,6 +60,20 @@ export interface OperativeTypeList {
  * is ambiguous across products, and resolving one by picking a match would show a caller another product's
  * governance — so the detail methods take (productId, id) and encode both.
  */
+/**
+ * A CONTRACT-COVERED METHOD TAKES NO TYPE PARAMETER.
+ *
+ * Six of these reads are described by platform/contracts/operator-admin/v1 and return the GENERATED type for
+ * their contract. They deliberately expose no `<T>` escape, because a caller-supplied replacement type is
+ * exactly the defect this package was rebuilt to remove: the consumer re-declares the shape by hand, the
+ * hand-written shape drifts from the wire, and nothing objects — which is how nine divergences shipped. An
+ * override would let a consumer opt back out of the contract one call site at a time, and the contract would
+ * quietly stop meaning anything.
+ *
+ * The remaining eight methods are still `<T = unknown>`. That is honest rather than lax: they declare NOTHING,
+ * so they cannot contradict the wire. They gain contracts, and lose their type parameter, when their response
+ * bodies are added to the contract home.
+ */
 export declare class AdminClient {
     private readonly baseUrl;
     private readonly headersFn;
@@ -280,15 +81,13 @@ export declare class AdminClient {
     constructor(options: AdminClientOptions);
     private request;
     /** Every enrolled Project the operator may see. */
-    listEnrollments<T = unknown>(): Promise<T>;
+    listEnrollments(): Promise<EnrollmentList>;
     /** One Project's enrollment record — its governed AI configuration. */
     getEnrollment(productId: string): Promise<EnrollmentDetail>;
     /** The Project portfolio read. */
-    listProjects<T = unknown>(): Promise<T>;
+    listProjects(): Promise<ProjectList>;
     /** The personalities the conductor is actually serving (the file registry). */
-    listPersonalities<T = {
-        personalities: PersonalitySummary[];
-    }>(): Promise<T>;
+    listPersonalities(): Promise<PersonalityList>;
     /** The governed Personality Records inside the operator's read scope, optionally narrowed to one product. */
     listPersonalityRecords<T = unknown>(productId?: string): Promise<T>;
     /** One governed Personality Record and its version history. */
@@ -316,7 +115,7 @@ export declare class AdminClient {
      * COMPATIBILITY, not governance — the Provider Record has not cut over, so nothing it declares is in force.
      * A consumer that renders this as "governed" states the opposite of the truth.
      */
-    getPersonalityModelPolicy<T = unknown>(personalityId: string): Promise<T>;
+    getPersonalityModelPolicy(personalityId: string): Promise<PersonalityResolution>;
     /** The Provider Records the platform declares. Platform-scoped: a provider is platform configuration. */
     listProviders<T = unknown>(): Promise<T>;
     /** One Provider Record with its authored and derived halves. */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAOzD;AAID,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC7C,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,EAAE,eAAe,EAAE,CAAC;IACrC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;IAC1C,iBAAiB,EAAE,eAAe,EAAE,CAAC;IACrC,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,uGAAuG;IACvG,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0DAA0D;IAC1D,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,iBAAiB,EAAE,gBAAgB,CAAC;CACrC;AAID,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,uBAAuB,CAAC;IACpC,KAAK,EAAE,0BAA0B,CAAC;IAClC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,qHAAqH;IACrH,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE;QACV,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,uHAAuH;IACvH,2BAA2B,EAAE,MAAM,EAAE,CAAC;CACvC;AAID;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,uGAAuG;IACvG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kFAAkF;IAClF,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,4GAA4G;IAC5G,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,WAAW,EAAE,wBAAwB,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiE;IAC3F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,kBAAkB;YAMzB,OAAO;IAerB,mDAAmD;IACnD,eAAe,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAI1C,uEAAuE;IACvE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI3D,kCAAkC;IAClC,YAAY,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAIvC,+EAA+E;IAC/E,iBAAiB,CAAC,CAAC,GAAG;QAAE,aAAa,EAAE,kBAAkB,EAAE,CAAA;KAAE,KAAK,OAAO,CAAC,CAAC,CAAC;IAI5E,6GAA6G;IAC7G,sBAAsB,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKnE,+DAA+D;IAC/D,oBAAoB,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAOvF;;;;;OAKG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAO1F;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAK9D,gHAAgH;IAChH,cAAc,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAO5E;;;;;;;OAOG;IACH,yBAAyB,CAAC,CAAC,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzE,yGAAyG;IACzG,aAAa,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAIxC,gEAAgE;IAChE,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxD;;;;;;OAMG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOjE,wDAAwD;IACxD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAMvF;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAOzD;AAmBD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,WAAW,GACZ,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,WAAW,EACZ,MAAM,+BAA+B,CAAC;AAIvC;;;;;;;GAOG;AACH;;;;;;;;;;;;;GAaG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiE;IAC3F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,kBAAkB;YAMzB,OAAO;IAerB,mDAAmD;IACnD,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC;IAI1C,uEAAuE;IACvE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI3D,kCAAkC;IAClC,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC;IAIpC,+EAA+E;IAC/E,iBAAiB,IAAI,OAAO,CAAC,eAAe,CAAC;IAI7C,6GAA6G;IAC7G,sBAAsB,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKnE,+DAA+D;IAC/D,oBAAoB,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAOvF;;;;;OAKG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAO1F;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAK9D,gHAAgH;IAChH,cAAc,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAO5E;;;;;;;OAOG;IACH,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIhF,yGAAyG;IACzG,aAAa,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAIxC,gEAAgE;IAChE,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxD;;;;;;OAMG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOjE,wDAAwD;IACxD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAMvF;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE1E"}

package/dist/index.js

@@ -56,6 +56,20 @@ export class AdminError extends Error {
  * is ambiguous across products, and resolving one by picking a match would show a caller another product's
  * governance — so the detail methods take (productId, id) and encode both.
  */
+/**
+ * A CONTRACT-COVERED METHOD TAKES NO TYPE PARAMETER.
+ *
+ * Six of these reads are described by platform/contracts/operator-admin/v1 and return the GENERATED type for
+ * their contract. They deliberately expose no `<T>` escape, because a caller-supplied replacement type is
+ * exactly the defect this package was rebuilt to remove: the consumer re-declares the shape by hand, the
+ * hand-written shape drifts from the wire, and nothing objects — which is how nine divergences shipped. An
+ * override would let a consumer opt back out of the contract one call site at a time, and the contract would
+ * quietly stop meaning anything.
+ *
+ * The remaining eight methods are still `<T = unknown>`. That is honest rather than lax: they declare NOTHING,
+ * so they cannot contradict the wire. They gain contracts, and lose their type parameter, when their response
+ * bodies are added to the contract home.
+ */
 export class AdminClient {
     constructor(options) {
         this.baseUrl = options.baseUrl.replace(/\/$/, '');

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,0GAA0G;AAC1G,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAWtC;;;;;;;GAOG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IAInC,YAAY,MAAc,EAAE,IAAY,EAAE,MAAc;QACtD,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAiPD,oGAAoG;AAEpG;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IAKtB,YAAY,OAA2B;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY;QACnD,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5G,kGAAkG;QAClG,kGAAkG;QAClG,wGAAwG;QACxG,mGAAmG;QACnG,kFAAkF;QAClF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,qDAAqD;YACrD,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,mDAAmD;IACnD,eAAe;QACb,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,kCAAkC;IAClC,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IACpD,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;QACf,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAED,6GAA6G;IAC7G,sBAAsB,CAAc,SAAkB;QACpD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,+DAA+D;IAC/D,oBAAoB,CAAc,SAAiB,EAAE,aAAqB;QACxE,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,SAAiB,EAAE,aAAqB;QAC3D,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAc,SAAkB;QAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,gHAAgH;IAChH,cAAc,CAAc,SAAiB,EAAE,QAAgB;QAC7D,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,yBAAyB,CAAc,aAAqB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,6BAA6B,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,yGAAyG;IACzG,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAChE,WAAW,CAAc,UAAkB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,cAAc,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,+BAA+B,kBAAkB,CAAC,SAAS,CAAC,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,gBAAgB,CAAC,SAAiB,EAAE,WAAmB;QACrD,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,0GAA0G;AAC1G,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAWtC;;;;;;;GAOG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IAInC,YAAY,MAAc,EAAE,IAAY,EAAE,MAAc;QACtD,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAyCD,oGAAoG;AAEpG;;;;;;;GAOG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,WAAW;IAKtB,YAAY,OAA2B;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY;QACnD,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5G,kGAAkG;QAClG,kGAAkG;QAClG,wGAAwG;QACxG,mGAAmG;QACnG,kFAAkF;QAClF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,qDAAqD;YACrD,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,mDAAmD;IACnD,eAAe;QACb,OAAO,IAAI,CAAC,OAAO,CAAiB,KAAK,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IACpE,CAAC;IAED,uEAAuE;IACvE,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,kCAAkC;IAClC,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAc,KAAK,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;QACf,OAAO,IAAI,CAAC,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED,6GAA6G;IAC7G,sBAAsB,CAAc,SAAkB;QACpD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,+DAA+D;IAC/D,oBAAoB,CAAc,SAAiB,EAAE,aAAqB;QACxE,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,SAAiB,EAAE,aAAqB;QAC3D,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAc,SAAkB;QAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,gHAAgH;IAChH,cAAc,CAAc,SAAiB,EAAE,QAAgB;QAC7D,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,yBAAyB,CAAC,aAAqB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAwB,KAAK,EAAE,GAAG,IAAI,6BAA6B,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IAED,yGAAyG;IACzG,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAChE,WAAW,CAAc,UAAkB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,IAAI,cAAc,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,+BAA+B,kBAAkB,CAAC,SAAS,CAAC,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,gBAAgB,CAAC,SAAiB,EAAE,WAAmB;QACrD,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,GAAG,IAAI,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consciousclouds/admin-sdk",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "ConsciousClouds Universal Admin SDK \u2014 the thin, policy-free client for the Operator Gateway's governance reads: Projects/enrollment, Personalities and their governed records, effective authority envelopes, and Operative Type rosters. Types + HTTP wrappers only; every authorization decision belongs to the Operator Gateway and the Control Plane.",
   "license": "Apache-2.0",
   "type": "module",