@cosmicdrift/kumiko-framework 0.365.0 → 0.366.0

package/agents/examples/idempotency.md

@@ -147,33 +147,31 @@ export const orderEntity = createEntity({
 
 const orderTable = buildEntityTable("order", orderEntity);
 export const orderFeature = defineFeature("orders", (r) => {
-  r.entity("order", orderEntity);
+  r.entity({ name: "order", ...orderEntity });
 
   const orderExecutor = createEventStoreExecutor(orderTable, orderEntity, { entityName: "order" });
 
-  r.writeHandler(
-    "order:place",
-    z.object({
+  r.writeHandler({
+    name: "order:place",
+    schema: z.object({
       customerName: z.string().min(1),
       product: z.string().min(1),
     }),
-    async (event, ctx) =>
+    handler: async (event, ctx) =>
       orderExecutor.create({ ...event.payload, status: "pending" }, event.user, ctx.db),
-    { access: { roles: ["Admin", "Customer"] } },
-  );
-
-  r.queryHandler(
-    "order:list",
-    z.object({ limit: z.number().optional() }),
-    async (query, ctx) => orderExecutor.list(query.payload, query.user, ctx.db),
-    {
-      access: {
-        openToAll: {
-          reason:
-            "any signed-in user may list orders in this recipe; placing an order still requires a role above",
-        },
+    access: { roles: ["Admin", "Customer"] },
+  });
+
+  r.queryHandler({
+    name: "order:list",
+    schema: z.object({ limit: z.number().optional() }),
+    handler: async (query, ctx) => orderExecutor.list(query.payload, query.user, ctx.db),
+    access: {
+      openToAll: {
+        reason:
+          "any signed-in user may list orders in this recipe; placing an order still requires a role above",
       },
     },
-  );
+  });
 });
 ```

package/agents/examples/inbound-mail-triage.md

@@ -286,7 +286,7 @@ export function createMailTriageFeature(): FeatureDefinition {
     r.describe(
       "Sample consumer for inbound-mail-foundation: a worker-lane job triggered by the ingest-message write-handler turns every inbound mail into a triage item.",
     );
-    r.requires("inbound-mail-foundation");
+    r.requires({ features: ["inbound-mail-foundation"] });
 
     // The job receives the dispatcher-validated ingest payload — i.e.
     // the PLAINTEXT normalized mail (PII encryption happens inside the

package/agents/examples/lane-routing.md

@@ -178,18 +178,18 @@ const orderEntity = createEntity({
 
 export function createLaneRoutingFeature(): FeatureDefinition {
   return defineFeature("orders", (r) => {
-    r.entity("order", orderEntity);
+    r.entity({ name: "order", ...orderEntity });
 
     // Write handler — runs in the API process (or wherever the command
     // lands). Event "orders:write:order:create" is the auto-generated
     // write-event both jobs trigger on.
-    r.writeHandler(
-      "order:create",
-      z.object({
+    r.writeHandler({
+      name: "order:create",
+      schema: z.object({
         customerName: z.string().min(1),
         amount: z.number().positive(),
       }),
-      async (event) => ({
+      handler: async (event) => ({
         isSuccess: true as const,
         data: {
           id: 1,
@@ -197,15 +197,13 @@ export function createLaneRoutingFeature(): FeatureDefinition {
           amount: event.payload.amount,
         },
       }),
-      {
-        access: {
-          openToAll: {
-            reason:
-              "demo recipe: any signed-in user may place an order; the handler is a stub with no persistence",
-          },
+      access: {
+        openToAll: {
+          reason:
+            "demo recipe: any signed-in user may place an order; the handler is a stub with no persistence",
         },
       },
-    );
+    });
 
     // Receipt-rendering: heavy CPU work. Pinned to `worker` so the
     // BullMQ consumer on the API process never picks it up — even if the

package/agents/examples/legal-pages.md

@@ -383,7 +383,7 @@ import {
 import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 
 // Beide Features aktivieren — template-resolver ist Foundation, legal-pages
-// requires sie. r.requires("template-resolver") greift automatisch im
+// requires sie. r.requires({ features: ["template-resolver"] }) greift automatisch im
 // legal-pages-Feature.
 export const templateResolverFeature = createTemplateResolverFeature();
 export const legalPagesFeature = createLegalPagesFeature();

package/agents/examples/lifecycle-hooks.md

@@ -20,19 +20,19 @@ back.
 
 ## What it shows
 
-- **`r.hook("validation", handlerRef, fn)`** — runs before the
+- **`r.hook({ type: "validation", target: handlerRef, handler })`** — runs before the
   handler body executes. Returns either `null` (pass) or an array of
   `{ field, error }` objects (fail). Used here to reject titles
   containing the word "spam" and titles longer than 200 characters.
-- **`r.hook("postSave", { allOf: entityRef }, fn)`** — fires after every
+- **`r.hook({ type: "postSave", target: { allOf: entityRef }, handler })`** — fires after every
   successful save (create or update) in the same transaction.
   `result.isNew` distinguishes create from update; `result.changes`
   carries the changed fields only.
-- **`r.hook("preDelete", { allOf: entityRef }, fn)`** — fires inside the
+- **`r.hook({ type: "preDelete", target: { allOf: entityRef }, handler })`** — fires inside the
   delete transaction. Throws on invariant violations (here: "published
   articles cannot be deleted") to roll the delete back. The handler
   receives the full row snapshot — no extra load needed.
-- **`r.hook("postDelete", { allOf: entityRef }, fn)`** — fires after commit.
+- **`r.hook({ type: "postDelete", target: { allOf: entityRef }, handler })`** — fires after commit.
   External side effects (logs, notifications) belong here because
   failures cannot roll the delete back.
 
@@ -301,7 +301,7 @@ export const hookLog: { type: string; data: Record<string, unknown> }[] = [];
 const editorWrite = { access: { roles: ["Admin", "Editor"] } } as const;
 
 export const articlesFeature = defineFeature("blog", (r) => {
-  const article = r.entity("article", articleEntity);
+  const article = r.entity({ name: "article", ...articleEntity });
 
   const articleCreate = r.writeHandler(
     defineEntityCreateHandler("article", articleEntity, editorWrite),
@@ -312,33 +312,45 @@ export const articlesFeature = defineFeature("blog", (r) => {
   r.writeHandler(defineEntityDeleteHandler("article", articleEntity, editorWrite));
 
   // --- Validation hook on create: reject banned words + length ---
-  r.hook("validation", articleCreate, (data) => {
-    const title = data["title"] as string;
-    if (title.toLowerCase().includes("spam")) {
-      return [{ field: "title", error: "title_contains_banned_word" }];
-    }
-    if (title.length > 200) {
-      return [{ field: "title", error: "title_too_long" }];
-    }
-    return null;
+  r.hook({
+    type: "validation",
+    target: articleCreate,
+    handler: (data) => {
+      const title = data["title"] as string;
+      if (title.toLowerCase().includes("spam")) {
+        return [{ field: "title", error: "title_contains_banned_word" }];
+      }
+      if (title.length > 200) {
+        return [{ field: "title", error: "title_too_long" }];
+      }
+      return null;
+    },
   });
 
   // --- Validation hook on update: length check on title changes ---
-  r.hook("validation", articleUpdate, (data) => {
-    const changes = data["changes"] as Record<string, unknown> | undefined;
-    const title = changes?.["title"] as string | undefined;
-    if (title && title.length > 200) {
-      return [{ field: "title", error: "title_too_long" }];
-    }
-    return null;
+  r.hook({
+    type: "validation",
+    target: articleUpdate,
+    handler: (data) => {
+      const changes = data["changes"] as Record<string, unknown> | undefined;
+      const title = changes?.["title"] as string | undefined;
+      if (title && title.length > 200) {
+        return [{ field: "title", error: "title_too_long" }];
+      }
+      return null;
+    },
   });
 
   // --- postSave entity hook: log all saves ---
-  r.hook("postSave", { allOf: article }, async (result: SaveContext) => {
-    hookLog.push({
-      type: result.isNew ? "created" : "updated",
-      data: { id: result.id, changes: result.changes },
-    });
+  r.hook({
+    type: "postSave",
+    target: { allOf: article },
+    handler: async (result: SaveContext) => {
+      hookLog.push({
+        type: result.isNew ? "created" : "updated",
+        data: { id: result.id, changes: result.changes },
+      });
+    },
   });
 
   // --- preDelete entity hook: block delete when the article is still published.
@@ -346,23 +358,31 @@ export const articlesFeature = defineFeature("blog", (r) => {
   // the delete rolls back before any projection or event is written. The
   // payload.data carries the full row snapshot taken just before delete —
   // no extra load needed.
-  r.hook("preDelete", { allOf: article }, async (payload) => {
-    if (payload.data["isPublished"] === true) {
-      throw new ConflictError({
-        message: `article ${payload.id} is still published`,
-        i18nKey: "errors.publishedArticleCannotBeDeleted",
-        details: { reason: "published_article_cannot_be_deleted", entityId: payload.id },
-      });
-    }
+  r.hook({
+    type: "preDelete",
+    target: { allOf: article },
+    handler: async (payload) => {
+      if (payload.data["isPublished"] === true) {
+        throw new ConflictError({
+          message: `article ${payload.id} is still published`,
+          i18nKey: "errors.publishedArticleCannotBeDeleted",
+          details: { reason: "published_article_cannot_be_deleted", entityId: payload.id },
+        });
+      }
+    },
   });
 
   // --- postDelete entity hook: log deletions after the transaction commits.
   // Default phase is afterCommit so failures here can't roll back the delete.
-  r.hook("postDelete", { allOf: article }, async (payload) => {
-    hookLog.push({
-      type: "deleted",
-      data: { id: payload.id },
-    });
+  r.hook({
+    type: "postDelete",
+    target: { allOf: article },
+    handler: async (payload) => {
+      hookLog.push({
+        type: "deleted",
+        data: { id: payload.id },
+      });
+    },
   });
 });
 ```

package/agents/examples/managed-config.md

@@ -326,7 +326,7 @@ describe("managed config — tenant cascade override", () => {
 
 describe("feature contract — backing:secrets declares the secrets dependency", () => {
   test("registry build rejects integrationsFeature without the secrets feature", () => {
-    // r.requires("secrets") is what makes this throw: without the dependency a
+    // r.requires({ features: ["secrets"] }) is what makes this throw: without the dependency a
     // consumer would only discover the missing tenant_secrets table at runtime.
     // config is registered so the failure isolates the secrets requirement.
     expect(() => createRegistry([createConfigFeature(), integrationsFeature])).toThrow(/secrets/);
@@ -375,12 +375,12 @@ export const smtpHostHandle: ConfigKeyHandle<"text"> = {
 };
 
 export const integrationsFeature = defineFeature(FEATURE, (r) => {
-  r.requires("config");
+  r.requires({ features: ["config"] });
   // backing:"secrets" stores payment-api-key in the secrets envelope, which
   // the secrets feature provisions — declare the dependency so registry-build
   // enforces it instead of leaving a consumer to discover the missing
   // tenant_secrets table at runtime.
-  r.requires("secrets");
+  r.requires({ features: ["secrets"] });
 
   r.config({
     keys: {
@@ -407,15 +407,15 @@ export const integrationsFeature = defineFeature(FEATURE, (r) => {
 
   // Internal-read probe: the owning feature reads its own secrets-backed key
   // via ctx.config and receives the revealed plaintext, never the mask.
-  r.queryHandler(
-    "peek-payment-key",
-    z.object({}),
-    async (_query, ctx) => {
+  r.queryHandler({
+    name: "peek-payment-key",
+    schema: z.object({}),
+    handler: async (_query, ctx) => {
       if (!ctx.config) throw new Error("ctx.config not wired");
       return { value: await ctx.config(paymentApiKeyHandle) };
     },
-    { access: { roles: ["SystemAdmin"] } },
-  );
+    access: { roles: ["SystemAdmin"] },
+  });
 
   r.translations({
     keys: {

package/agents/examples/managed-pages.md

@@ -332,7 +332,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/managed-pages";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 
-// managed-pages declares `r.requires("config")` for its branding keys — the
+// managed-pages declares `r.requires({ features: ["config"] })` for its branding keys — the
 // config feature must be in the stack (runProdApp auto-mounts it; setupTestStack
 // does not, so the recipe lists it explicitly).
 export const configFeature = createConfigFeature();

package/agents/examples/notes-history-basic.md

@@ -76,7 +76,7 @@ The component itself is `notes-history/web/notes-section.tsx`
 ```
 notes-history    → core bundle: note-entry entity, add-note handler, list query
 task-management  → our feature: a plain `task` entity. Declares
-                   r.requires("notes-history") only so the bundle is
+                   r.requires({ features: ["notes-history"] }) only so the bundle is
                    mounted — the task itself is completely notes-agnostic.
 ```
 
@@ -274,9 +274,9 @@ export const taskFeature = defineFeature("task-management", (r) => {
   // notes-history is non-optional for this recipe: the demo notes tasks.
   // The task feature itself stays completely notes-agnostic — it only
   // declares the dependency so the bundle is mounted.
-  r.requires("notes-history");
+  r.requires({ features: ["notes-history"] });
 
-  r.entity("task", taskEntity);
+  r.entity({ name: "task", ...taskEntity });
 
   r.writeHandler({
     name: "task:create",

package/agents/examples/pdf-audit-export.md

@@ -227,20 +227,20 @@ const AUDIT_ROW_LIMIT = 100;
 const access = { access: { roles: ["Admin", "User"] } } as const;
 
 export const pdfAuditExportFeature = defineFeature("pdf-audit-export", (r) => {
-  r.entity("inspection", inspectionEntity);
+  r.entity({ name: "inspection", ...inspectionEntity });
   const { executor: inspectionExecutor } = createEntityExecutor("inspection", inspectionEntity);
 
-  r.writeHandler(
-    "inspection:create",
-    z.object({
+  r.writeHandler({
+    name: "inspection:create",
+    schema: z.object({
       assetName: z.string().min(1),
       inspectedOn: z.iso.date(),
       result: z.enum(INSPECTION_RESULTS),
       inspector: z.string().optional(),
     }),
-    async (event, ctx) => inspectionExecutor.create(event.payload, event.user, ctx.db),
-    access,
-  );
+    handler: async (event, ctx) => inspectionExecutor.create(event.payload, event.user, ctx.db),
+    ...access,
+  });
 
   r.writeHandler(
     defineWriteHandler({

package/agents/examples/pipeline-basics.md

@@ -47,7 +47,7 @@ and why the combination is the production-realistic shape (not just
 an API tour).
 
 If you've only ever seen the free-form handler signature
-(`r.writeHandler(name, schema, async fn, opts)`), compare:
+(`r.writeHandler({ name, schema, handler, access })`), compare:
 
 - `samples/recipes/custom-handlers/src/feature.ts` — a similar
   domain, written in the free-form style.
@@ -439,7 +439,7 @@ const productExecutor = createEventStoreExecutor(productTable, productEntity, {
 });
 
 export const inventoryFeature = defineFeature("inventory", (r) => {
-  r.entity("product", productEntity);
+  r.entity({ name: "product", ...productEntity });
   r.requires.projection("read_inventory_low_stock_alerts");
 
   // Domain-events on the product stream (alongside the auto-CRUD
@@ -779,14 +779,14 @@ export const inventoryFeature = defineFeature("inventory", (r) => {
   // only; queries get the existing handler signature. The list
   // below is what the integration test reads against.
   // -------------------------------------------------------------
-  r.queryHandler(
-    "low-stock-alerts:list",
-    z.object({}),
-    async (_query, ctx) => {
+  r.queryHandler({
+    name: "low-stock-alerts:list",
+    schema: z.object({}),
+    handler: async (_query, ctx) => {
       const rows = await selectMany(ctx.db, lowStockAlertsTable);
       return { rows };
     },
-    { access: { roles: ["Admin"] } },
-  );
+    access: { roles: ["Admin"] },
+  });
 });
 ```

package/agents/examples/public-share-token.md

@@ -343,7 +343,7 @@ export const shareByTokenQuery = defineQueryHandler({
 });
 
 export const publicShareTokenFeature = defineFeature("public-share", (r) => {
-  r.entity("share-link", shareLinkEntity);
+  r.entity({ name: "share-link", ...shareLinkEntity });
   r.writeHandler(shareLinkCreateWrite);
   r.writeHandler(shareLinkRevokeWrite);
   r.queryHandler(shareByTokenQuery);

package/agents/examples/rate-limiting.md

@@ -197,15 +197,13 @@ export function createRateLimitShowcaseFeature(): FeatureDefinition {
     // Per-user budget. Real apps tune `limit` to actual handler cost — a
     // search call against a sharded index might warrant 5/min, a full
     // export 1/min. The bucket is `user:<userId>` (see rate-limit/bucket.ts).
-    r.queryHandler(
-      "expensive-search",
-      z.object({ q: z.string().min(1) }),
-      async ({ payload }) => ({ q: payload.q, hits: 0 }),
-      {
-        access: { roles: ["Admin", "User"] },
-        rateLimit: { per: "user", limit: 3, windowSeconds: 60 },
-      },
-    );
+    r.queryHandler({
+      name: "expensive-search",
+      schema: z.object({ q: z.string().min(1) }),
+      handler: async ({ payload }) => ({ q: payload.q, hits: 0 }),
+      access: { roles: ["Admin", "User"] },
+      rateLimit: { per: "user", limit: 3, windowSeconds: 60 },
+    });
   });
 }
 ```

package/agents/examples/record-detail-layout.md

@@ -115,7 +115,10 @@ describe("record-detail-layout showcase — registration", () => {
 describe("record-detail-layout showcase — boot-validator catches author mistakes", () => {
   test("metric without a fieldLabels entry fails boot — no fallback to the raw column name", () => {
     const broken = defineFeature("broken-order-desk", (r) => {
-      r.queryHandler("order:detail", z.object({ id: z.string() }), async () => ({ id: "1" }), {
+      r.queryHandler({
+        name: "order:detail",
+        schema: z.object({ id: z.string() }),
+        handler: async () => ({ id: "1" }),
         access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
@@ -133,7 +136,10 @@ describe("record-detail-layout showcase — boot-validator catches author mistak
 
   test("tabs with only one section fails boot", () => {
     const broken = defineFeature("broken-order-desk-tabs", (r) => {
-      r.queryHandler("order:detail", z.object({ id: z.string() }), async () => ({ id: "1" }), {
+      r.queryHandler({
+        name: "order:detail",
+        schema: z.object({ id: z.string() }),
+        handler: async () => ({ id: "1" }),
         access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
@@ -183,10 +189,10 @@ export function createOrderDeskFeature(): FeatureDefinition {
   return defineFeature("order-desk", (r) => {
     r.systemScope();
 
-    r.queryHandler(
-      "order:detail",
-      rowIdSchema,
-      async (query) => ({
+    r.queryHandler({
+      name: "order:detail",
+      schema: rowIdSchema,
+      handler: async (query) => ({
         id: query.payload.id,
         customerName: "Aiko Tanaka",
         orderNumber: "SO-10482",
@@ -199,33 +205,33 @@ export function createOrderDeskFeature(): FeatureDefinition {
         billingAddress: "Karl-Marx-Straße 12, 12043 Berlin",
         salesRep: "Jonas Weber",
       }),
-      { access: { roles: ["Support", "Admin"] } },
-    );
+      access: { roles: ["Support", "Admin"] },
+    });
 
-    r.queryHandler(
-      "order:items",
-      rowIdSchema,
-      async () => ({
+    r.queryHandler({
+      name: "order:items",
+      schema: rowIdSchema,
+      handler: async () => ({
         rows: [
           { sku: "KB-100", description: "Mechanical keyboard", quantity: 1, unitPrice: 148 },
           { sku: "MS-220", description: "Wireless mouse", quantity: 2, unitPrice: 45 },
           { sku: "PAD-01", description: "Desk mat", quantity: 1, unitPrice: 22 },
         ],
       }),
-      { access: { roles: ["Support", "Admin"] } },
-    );
+      access: { roles: ["Support", "Admin"] },
+    });
 
-    r.queryHandler(
-      "order:payments",
-      rowIdSchema,
-      async () => ({
+    r.queryHandler({
+      name: "order:payments",
+      schema: rowIdSchema,
+      handler: async () => ({
         rows: [
           { paidAt: "2026-08-21", amount: 936, method: "card", status: "settled" },
           { paidAt: "2026-08-25", amount: 312, method: "invoice", status: "pending" },
         ],
       }),
-      { access: { roles: ["Support", "Admin"] } },
-    );
+      access: { roles: ["Support", "Admin"] },
+    });
 
     r.screen({
       id: "order-detail",

package/agents/examples/reference-data.md

@@ -134,7 +134,7 @@ export const categoryTable = table("read_sample_categories", {
 });
 
 export const categoryFeature = defineFeature("catalog", (r) => {
-  r.entity("category", categoryEntity);
+  r.entity({ name: "category", ...categoryEntity });
 
   // Static reference data — seeded on boot, upserted on changes
   r.referenceData(

package/agents/examples/relations.md

@@ -244,8 +244,8 @@ const createOnly = {
 } as const;
 
 export const relationsFeature = defineFeature("org", (r) => {
-  const team = r.entity("team", teamEntity);
-  const member = r.entity("member", memberEntity);
+  const team = r.entity({ name: "team", ...teamEntity });
+  const member = r.entity({ name: "member", ...memberEntity });
 
   r.relation(team, "members", {
     type: "hasMany",

package/agents/examples/screens-nav.md

@@ -172,7 +172,7 @@ describe("screens-nav showcase — boot-validator catches author mistakes", () =
     // Typo-protection: field refs must exist on the entity. Mis-spelled
     // column names would otherwise silently vanish from the form.
     const broken = defineFeature("broken-shop", (r) => {
-      r.entity("book", bookEntity);
+      r.entity({ name: "book", ...bookEntity });
       r.screen({
         id: "book-edit",
         type: "entityEdit",
@@ -256,7 +256,7 @@ export const bookEntity = createEntity({
 export function createBookshopFeature(): FeatureDefinition {
   return defineFeature("bookshop", (r) => {
     r.systemScope();
-    r.entity("book", bookEntity);
+    r.entity({ name: "book", ...bookEntity });
 
     // entityList — columns carry string shorthand and the object form
     // side by side; the framework normalizes both through

package/agents/examples/search.md

@@ -186,48 +186,46 @@ export const productEntity = createEntity({
 const productTable = buildEntityTable("product", productEntity);
 
 export const productFeature = defineFeature("shop", (r) => {
-  r.entity("product", productEntity);
+  r.entity({ name: "product", ...productEntity });
 
-  r.writeHandler(
-    "product:create",
-    z.object({
+  r.writeHandler({
+    name: "product:create",
+    schema: z.object({
       name: z.string().min(1),
       brand: z.string().optional(),
       sku: z.string().min(1),
       category: z.string().optional(),
     }),
-    async (event, ctx) => {
+    handler: async (event, ctx) => {
       const crud = createEventStoreExecutor(productTable, productEntity, {
         searchAdapter: ctx.searchAdapter,
         entityName: "product",
       });
       return crud.create(event.payload, event.user, ctx.db);
     },
-    { access: { roles: ["Admin"] } },
-  );
+    access: { roles: ["Admin"] },
+  });
 
-  r.queryHandler(
-    "product:list",
-    z.object({
+  r.queryHandler({
+    name: "product:list",
+    schema: z.object({
       search: z.string().optional(),
       limit: z.number().optional(),
     }),
-    async (query, ctx) => {
+    handler: async (query, ctx) => {
       const crud = createEventStoreExecutor(productTable, productEntity, {
         searchAdapter: ctx.searchAdapter,
         entityName: "product",
       });
       return crud.list(query.payload, query.user, ctx.db);
     },
-    {
-      access: {
-        openToAll: {
-          reason:
-            "any signed-in user may search and list products in this recipe; creating " +
-            "a product still requires the Admin role above",
-        },
+    access: {
+      openToAll: {
+        reason:
+          "any signed-in user may search and list products in this recipe; creating " +
+          "a product still requires the Admin role above",
       },
     },
-  );
+  });
 });
 ```

package/agents/examples/security-baseline.md

@@ -33,7 +33,7 @@ used to be silent; now the boot validator warns at `NODE_ENV=production`.
 ## Feature composition
 
 ```
-config            → tenant's r.requires("config") dependency
+config            → tenant's r.requires({ features: ["config"] }) dependency
 user              → cross-tenant identity (sessions' r.requires target)
 tenant            → memberships (audit's r.requires target)
 auth-foundation   → tokenVerifier extension point (sessions' r.requires target)