@immediately-run/preauth-core 0.1.6 → 0.1.8

package/dist/bootConsent.d.ts

@@ -20,6 +20,11 @@ export interface MintResult {
      *  requested) — the post-boot caller lifts the frame cap on this alone, even
      *  if a mount selection failed (matching its historical behavior). */
     netFetchOk: boolean;
+    /** Whether the plain app-scoped capability grant succeeded (vacuously true when
+     *  none was requested), R3-233. False when caps were requested but the store has
+     *  no `grantAppCapabilities` (fail-loud, never validate-then-drop) or the write
+     *  threw — the caller lifts those frame caps only on `true`. */
+    capabilitiesOk: boolean;
     /** Successfully minted per-selection space ids (for post-boot provisioning). */
     minted: {
         selection: ConsentSelection;
@@ -39,4 +44,10 @@ export type MintErrorSink = (ctx: string, err: unknown) => void;
  * records which §11.4 declared mount it satisfies, so a later boot re-provisions
  * it without re-consent.
  */
-export declare function mintConsentedGrants(store: MintStore, uid: string, appKey: string, selections: readonly ConsentSelection[], netFetchHosts: readonly NetFetchHost[], mintPath?: MintPath, onError?: MintErrorSink): Promise<MintResult>;
+export declare function mintConsentedGrants(store: MintStore, uid: string, appKey: string, selections: readonly ConsentSelection[], netFetchHosts: readonly NetFetchHost[], mintPath?: MintPath, onError?: MintErrorSink, 
+/** PLAIN app-scoped on/off capabilities to grant (R3-233) — `task:invoke`,
+ *  `llm:chat`, `contribute:self`, `diagnostics:read`. NOT `net:fetch` (host-
+ *  parameterized — granted via `netFetchHosts` above); the caller (`applyPreAuth`)
+ *  filters host-parameterized caps out. Defaults to none, so existing callers that
+ *  only mint mounts + hosts are unaffected. */
+capabilities?: readonly string[]): Promise<MintResult>;

package/dist/bootConsent.js

@@ -28,7 +28,13 @@ exports.mintConsentedGrants = mintConsentedGrants;
  * records which §11.4 declared mount it satisfies, so a later boot re-provisions
  * it without re-consent.
  */
-async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts, mintPath = 'interactive', onError) {
+async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts, mintPath = 'interactive', onError, 
+/** PLAIN app-scoped on/off capabilities to grant (R3-233) — `task:invoke`,
+ *  `llm:chat`, `contribute:self`, `diagnostics:read`. NOT `net:fetch` (host-
+ *  parameterized — granted via `netFetchHosts` above); the caller (`applyPreAuth`)
+ *  filters host-parameterized caps out. Defaults to none, so existing callers that
+ *  only mint mounts + hosts are unaffected. */
+capabilities = []) {
     let ok = true;
     let netFetchOk = true;
     if (netFetchHosts.length > 0) {
@@ -41,6 +47,27 @@ async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts
             netFetchOk = false;
         }
     }
+    // Plain app-scoped capability grants (R3-233). Fail LOUD if asked to mint caps but
+    // the adapter has no `grantAppCapabilities` — a silent skip would resurrect the
+    // exact validate-then-drop bug this fixes.
+    let capabilitiesOk = true;
+    if (capabilities.length > 0) {
+        if (!store.grantAppCapabilities) {
+            onError?.('capability grant unsupported by this store', new Error('grantAppCapabilities not implemented'));
+            ok = false;
+            capabilitiesOk = false;
+        }
+        else {
+            try {
+                await store.grantAppCapabilities({ uid, appKey, capabilities, mintPath });
+            }
+            catch (err) {
+                onError?.('capability grant failed', err);
+                ok = false;
+                capabilitiesOk = false;
+            }
+        }
+    }
     const minted = [];
     for (const sel of selections) {
         try {
@@ -63,5 +90,5 @@ async function mintConsentedGrants(store, uid, appKey, selections, netFetchHosts
             ok = false;
         }
     }
-    return { ok, netFetchOk, minted };
+    return { ok, netFetchOk, capabilitiesOk, minted };
 }

package/dist/capabilities.d.ts

@@ -49,6 +49,14 @@ export declare function isBaseline(cap: Capability): boolean;
  *  per decision #1.) */
 export declare const APP_SCOPED_CAPABILITIES: readonly Capability[];
 export declare function isAppScoped(cap: Capability): boolean;
+/** App-scoped caps whose durable authority is a PARAMETER SET minted on its own
+ *  path — today only `net:fetch` (its granted host set, §5.11). These are granted
+ *  by that path, never as a bare on/off capability: a bare `net:fetch` grant would
+ *  be UNBOUNDED (every origin), so the plain-capability mint (R3-233) MUST exclude
+ *  them. `task:invoke` is `parameterized` too but its bound is the app's manifest
+ *  `invokes` (§5.8), not a durable grant param, so it IS a plain on/off grant. */
+export declare const HOST_PARAMETERIZED_CAPABILITIES: readonly Capability[];
+export declare function isHostParameterized(cap: Capability): boolean;
 /** Compare dotted numeric versions: <0 if a<b, 0 if equal, >0 if a>b. Missing
  *  segments are treated as 0 ("1.2" === "1.2.0"); non-numeric segments as 0. */
 export declare function compareVersions(a: string, b: string): number;

package/dist/capabilities.js

@@ -9,11 +9,12 @@
 // with a view() projection on a channel (§8.3); actions are gated before the
 // handler (§8.4). Parameterized capabilities additionally bound an argument set.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_SCOPED_CAPABILITIES = exports.BASELINE_CAPABILITIES = exports.REGISTRY_VERSION = exports.CAPABILITIES = void 0;
+exports.HOST_PARAMETERIZED_CAPABILITIES = exports.APP_SCOPED_CAPABILITIES = exports.BASELINE_CAPABILITIES = exports.REGISTRY_VERSION = exports.CAPABILITIES = void 0;
 exports.isKnownCapability = isKnownCapability;
 exports.tierOf = tierOf;
 exports.isBaseline = isBaseline;
 exports.isAppScoped = isAppScoped;
+exports.isHostParameterized = isHostParameterized;
 exports.compareVersions = compareVersions;
 exports.isSupportedCapability = isSupportedCapability;
 exports.unsupportedCapabilities = unsupportedCapabilities;
@@ -234,6 +235,16 @@ exports.APP_SCOPED_CAPABILITIES = Object.keys(exports.CAPABILITIES).filter((c) =
 function isAppScoped(cap) {
     return exports.CAPABILITIES[cap].appScoped === true;
 }
+/** App-scoped caps whose durable authority is a PARAMETER SET minted on its own
+ *  path — today only `net:fetch` (its granted host set, §5.11). These are granted
+ *  by that path, never as a bare on/off capability: a bare `net:fetch` grant would
+ *  be UNBOUNDED (every origin), so the plain-capability mint (R3-233) MUST exclude
+ *  them. `task:invoke` is `parameterized` too but its bound is the app's manifest
+ *  `invokes` (§5.8), not a durable grant param, so it IS a plain on/off grant. */
+exports.HOST_PARAMETERIZED_CAPABILITIES = ['net:fetch'];
+function isHostParameterized(cap) {
+    return exports.HOST_PARAMETERIZED_CAPABILITIES.includes(cap);
+}
 // ── §5.11 capability version gate (threat T26) ──────────────────────────────
 //
 // Each capability declares the lowest registry version that knows it (`since`).

package/dist/docLayout.d.ts

@@ -13,6 +13,30 @@ export interface MintSentinels {
  *  of a delegated grant's `parentGrantId`. `::` is delimiter-safe: `appKey` uses
  *  `__` separators and a Firestore `spaceId` is alphanumeric. */
 export declare const grantKey: (appKey: string, spaceId: string) => string;
+/** R3-98 S4 — the principal-aware grant key `(appKey, principal, spaceId)` (design
+ *  05a §3.1/§3.2). Additive: {@link grantKey} is retained for the legacy 2-field
+ *  form. `::` stays delimiter-safe — `appKey` uses `__`, a `spaceId` is alphanumeric,
+ *  and a named principal is lowercase-dotted/hyphenated (CA-3), none containing `::`. */
+export declare const grantKeyWithPrincipal: (appKey: string, principal: string, spaceId: string) => string;
+/** A parsed `parentGrantId` — the pieces the §8.15 revoke cascade reconstructs a
+ *  grant doc path from. `principal` is present only for a 3-field (S4+) key. */
+export interface ParsedGrantKey {
+    appKey: string;
+    spaceId: string;
+    /** The named principal for a 3-field {@link grantKeyWithPrincipal} key; undefined
+     *  for a legacy 2-field {@link grantKey} (the caller defaults to its grandfather
+     *  sentinel). */
+    principal?: string;
+}
+/** R3-98 S4 — ARITY-DETECTING parse of a grant key (design 05a §3.1 step 3 /
+ *  MEDIUM-6). A 3-field key is `appKey::principal::spaceId`; a legacy 2-field key is
+ *  `appKey::spaceId` (principal undefined). This lets the revoke cascade keep
+ *  resolving BOTH legacy and keyed `parentGrantId`s after the re-key — a positional
+ *  `split('::')` would mis-assign a legacy key's `spaceId` to `principal`. A
+ *  malformed key (≠2/≠3 segments) degrades to best-effort `appKey::…::spaceId`
+ *  (first + last), so the cascade fails safe (child self-revokes) rather than
+ *  crashing. */
+export declare const parseGrantKey: (key: string) => ParsedGrantKey;
 /** Durable elevated/app-scoped grants expire after 90 days WITHOUT USE; first
  *  use after expiry re-prompts. Baseline needs no grant record, so this never
  *  touches it. */
@@ -50,7 +74,7 @@ export declare const appKeyTouchFields: (s: MintSentinels) => Record<string, unk
 /** `user-app-spaces/{uid}/apps/{appKey}/spaces/{spaceId}` — the durable §8.7
  *  grant doc (merge). `mintPath` defaults to `interactive`; `grantedAt`/`lastUsedAt`
  *  drive the §8.15 90-day-unused expiry. */
-export declare const appSpaceGrantFields: (params: Pick<GrantSpaceParams, "name" | "subtree" | "mode" | "rules" | "declaredUri" | "mintPath" | "parentGrantId">, s: MintSentinels) => Record<string, unknown>;
+export declare const appSpaceGrantFields: (params: Pick<GrantSpaceParams, "name" | "subtree" | "mode" | "rules" | "declaredUri" | "mintPath" | "parentGrantId" | "principal">, s: MintSentinels) => Record<string, unknown>;
 /** Union net:fetch host rules by origin (incoming wins) — the "consent
  *  accumulates" merge both adapters apply before writing the host set. */
 export declare const mergeNetFetchHosts: (existing: readonly NetFetchHost[], incoming: readonly NetFetchHost[]) => NetFetchHost[];
@@ -59,3 +83,13 @@ export declare const mergeNetFetchHosts: (existing: readonly NetFetchHost[], inc
  *  grant time is stamped ONCE, on first mint, and `netFetchLastUsedAt` refreshes
  *  on every (re-)consent). */
 export declare const netFetchGrantFields: (mergedHosts: readonly NetFetchHost[], hadGrantedAt: boolean, s: MintSentinels) => Record<string, unknown>;
+/** Union granted PLAIN app-scoped capability names (set semantics; sorted for a
+ *  stable, byte-faithful document) — the "consent accumulates" merge for the
+ *  R3-233 capability grant, mirroring {@link mergeNetFetchHosts}. */
+export declare const mergeCapabilities: (existing: readonly string[], incoming: readonly string[]) => string[];
+/** `user-app-spaces/{uid}/apps/{appKey}` — the durable granted PLAIN app-scoped
+ *  capability set (merge), R3-233. Lives on the SAME appKey doc as the net:fetch
+ *  grant so one read (`getAppGrantDoc`) yields both. `capabilitiesGrantedAt` is
+ *  stamped ONCE (first mint); `capabilitiesLastUsedAt` refreshes on every
+ *  (re-)consent — the §8.15 90-day-unused expiry clock, identical to net:fetch. */
+export declare const appCapabilitiesGrantFields: (mergedCaps: readonly string[], hadGrantedAt: boolean, s: MintSentinels) => Record<string, unknown>;

package/dist/docLayout.js

@@ -16,12 +16,35 @@
 // `.set()`/`.update()` is the only thing each adapter does itself. Drift is then
 // impossible without editing a helper both consume.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.netFetchGrantFields = exports.mergeNetFetchHosts = exports.appSpaceGrantFields = exports.appKeyTouchFields = exports.appCountFields = exports.userCountFields = exports.ownerUserSpaceFields = exports.ownerMemberFields = exports.spaceDocFields = exports.appCountPath = exports.userCountPath = exports.appSpacePath = exports.appKeyPath = exports.userSpacePath = exports.memberPath = exports.spacePath = exports.defined = exports.granteeId = exports.GRANT_EXPIRY_MS = exports.grantKey = void 0;
+exports.appCapabilitiesGrantFields = exports.mergeCapabilities = exports.netFetchGrantFields = exports.mergeNetFetchHosts = exports.appSpaceGrantFields = exports.appKeyTouchFields = exports.appCountFields = exports.userCountFields = exports.ownerUserSpaceFields = exports.ownerMemberFields = exports.spaceDocFields = exports.appCountPath = exports.userCountPath = exports.appSpacePath = exports.appKeyPath = exports.userSpacePath = exports.memberPath = exports.spacePath = exports.defined = exports.granteeId = exports.GRANT_EXPIRY_MS = exports.parseGrantKey = exports.grantKeyWithPrincipal = exports.grantKey = void 0;
 /** Stable per-user identifier for a grant `(appKey, spaceId)`, used as the value
  *  of a delegated grant's `parentGrantId`. `::` is delimiter-safe: `appKey` uses
  *  `__` separators and a Firestore `spaceId` is alphanumeric. */
 const grantKey = (appKey, spaceId) => `${appKey}::${spaceId}`;
 exports.grantKey = grantKey;
+/** R3-98 S4 — the principal-aware grant key `(appKey, principal, spaceId)` (design
+ *  05a §3.1/§3.2). Additive: {@link grantKey} is retained for the legacy 2-field
+ *  form. `::` stays delimiter-safe — `appKey` uses `__`, a `spaceId` is alphanumeric,
+ *  and a named principal is lowercase-dotted/hyphenated (CA-3), none containing `::`. */
+const grantKeyWithPrincipal = (appKey, principal, spaceId) => `${appKey}::${principal}::${spaceId}`;
+exports.grantKeyWithPrincipal = grantKeyWithPrincipal;
+/** R3-98 S4 — ARITY-DETECTING parse of a grant key (design 05a §3.1 step 3 /
+ *  MEDIUM-6). A 3-field key is `appKey::principal::spaceId`; a legacy 2-field key is
+ *  `appKey::spaceId` (principal undefined). This lets the revoke cascade keep
+ *  resolving BOTH legacy and keyed `parentGrantId`s after the re-key — a positional
+ *  `split('::')` would mis-assign a legacy key's `spaceId` to `principal`. A
+ *  malformed key (≠2/≠3 segments) degrades to best-effort `appKey::…::spaceId`
+ *  (first + last), so the cascade fails safe (child self-revokes) rather than
+ *  crashing. */
+const parseGrantKey = (key) => {
+    const parts = key.split('::');
+    if (parts.length === 3) {
+        return { appKey: parts[0], principal: parts[1], spaceId: parts[2] };
+    }
+    // Legacy 2-field, or malformed → first segment is the appKey, last the spaceId.
+    return { appKey: parts[0], spaceId: parts[parts.length - 1] };
+};
+exports.parseGrantKey = parseGrantKey;
 /** Durable elevated/app-scoped grants expire after 90 days WITHOUT USE; first
  *  use after expiry re-prompts. Baseline needs no grant record, so this never
  *  touches it. */
@@ -123,6 +146,11 @@ const appSpaceGrantFields = (params, s) => (0, exports.defined)({
     grantedAt: s.serverTimestamp(),
     lastUsedAt: s.serverTimestamp(),
     name: params.name,
+    // R3-98 S3/S4 — the named principal this grant was minted under (design 05a
+    // §3.1). `defined()` omits it when absent, so a legacy/unkeyed mint writes no
+    // `principal` field and is grandfathered at the gate (both adapters stamp it
+    // identically, keeping the byte-identical-doc guarantee).
+    principal: params.principal,
     // UI_AS_APPS_SPEC §8.7: `rules` is authoritative; `subtree`/`mode` are kept as the
     // deprecated `rules[0]` mirror for not-yet-migrated readers. When no rule-set
     // is given, derive a single-rule set from the legacy scope so the backend
@@ -158,3 +186,19 @@ const netFetchGrantFields = (mergedHosts, hadGrantedAt, s) => (0, exports.define
     netFetchLastUsedAt: s.serverTimestamp(),
 });
 exports.netFetchGrantFields = netFetchGrantFields;
+/** Union granted PLAIN app-scoped capability names (set semantics; sorted for a
+ *  stable, byte-faithful document) — the "consent accumulates" merge for the
+ *  R3-233 capability grant, mirroring {@link mergeNetFetchHosts}. */
+const mergeCapabilities = (existing, incoming) => [...new Set([...existing, ...incoming])].sort();
+exports.mergeCapabilities = mergeCapabilities;
+/** `user-app-spaces/{uid}/apps/{appKey}` — the durable granted PLAIN app-scoped
+ *  capability set (merge), R3-233. Lives on the SAME appKey doc as the net:fetch
+ *  grant so one read (`getAppGrantDoc`) yields both. `capabilitiesGrantedAt` is
+ *  stamped ONCE (first mint); `capabilitiesLastUsedAt` refreshes on every
+ *  (re-)consent — the §8.15 90-day-unused expiry clock, identical to net:fetch. */
+const appCapabilitiesGrantFields = (mergedCaps, hadGrantedAt, s) => (0, exports.defined)({
+    grantedCapabilities: [...mergedCaps],
+    capabilitiesGrantedAt: hadGrantedAt ? undefined : s.serverTimestamp(),
+    capabilitiesLastUsedAt: s.serverTimestamp(),
+});
+exports.appCapabilitiesGrantFields = appCapabilitiesGrantFields;

package/dist/m1PreAuth.d.ts

@@ -46,8 +46,17 @@ export interface PreAuthResult {
 }
 /**
  * The M1 write path: validate the requested capabilities against the §8.9 target
- * check, then — only if clean — mint the mounts + net:fetch hosts as durable
- * grants with `policy` provenance, through the same `mintConsentedGrants` M3 uses.
+ * check, then — only if clean — mint the mounts, net:fetch hosts, AND the plain
+ * app-scoped on/off capabilities (`task:invoke`, `llm:chat`, `contribute:self`,
+ * `diagnostics:read`) as durable grants with `policy` provenance, through the same
+ * `mintConsentedGrants` M3 uses.
+ *
+ * R3-233: the `grantable` app-scoped caps used to be VALIDATED and then silently
+ * DROPPED (only mounts + hosts were minted), so pre-authorizing `task:invoke` /
+ * `llm:chat` reported success but granted nothing and the gate kept refusing. They
+ * are now actually minted. `net:fetch` is excluded from the plain-cap mint — it is
+ * host-parameterized and granted via `netFetchHosts` (a bare grant would be
+ * unbounded).
  *
  * Refusal is terminal and silent of side effects: when any requested capability
  * is broad-elevated or unknown, the function mints NOTHING and returns the

package/dist/m1PreAuth.js

@@ -69,8 +69,17 @@ const isPreAuthClean = (plan) => plan.refused.length === 0;
 exports.isPreAuthClean = isPreAuthClean;
 /**
  * The M1 write path: validate the requested capabilities against the §8.9 target
- * check, then — only if clean — mint the mounts + net:fetch hosts as durable
- * grants with `policy` provenance, through the same `mintConsentedGrants` M3 uses.
+ * check, then — only if clean — mint the mounts, net:fetch hosts, AND the plain
+ * app-scoped on/off capabilities (`task:invoke`, `llm:chat`, `contribute:self`,
+ * `diagnostics:read`) as durable grants with `policy` provenance, through the same
+ * `mintConsentedGrants` M3 uses.
+ *
+ * R3-233: the `grantable` app-scoped caps used to be VALIDATED and then silently
+ * DROPPED (only mounts + hosts were minted), so pre-authorizing `task:invoke` /
+ * `llm:chat` reported success but granted nothing and the gate kept refusing. They
+ * are now actually minted. `net:fetch` is excluded from the plain-cap mint — it is
+ * host-parameterized and granted via `netFetchHosts` (a bare grant would be
+ * unbounded).
  *
  * Refusal is terminal and silent of side effects: when any requested capability
  * is broad-elevated or unknown, the function mints NOTHING and returns the
@@ -81,6 +90,9 @@ async function applyPreAuth(store, uid, appKey, request, onError) {
     if (!(0, exports.isPreAuthClean)(plan)) {
         return { ok: false, refused: plan.refused };
     }
-    const mint = await (0, bootConsent_1.mintConsentedGrants)(store, uid, appKey, request.mounts, request.netFetchHosts, 'policy', onError);
+    // The plain on/off caps to mint: every grantable cap EXCEPT the host-parameterized
+    // ones (net:fetch), which are minted as their host set via `netFetchHosts`.
+    const plainCaps = plan.grantable.filter((c) => !(0, capabilities_1.isHostParameterized)(c));
+    const mint = await (0, bootConsent_1.mintConsentedGrants)(store, uid, appKey, request.mounts, request.netFetchHosts, 'policy', onError, plainCaps);
     return { ok: mint.ok, refused: [], mint };
 }

package/dist/port.d.ts

@@ -60,6 +60,11 @@ export interface GrantSpaceParams {
     mintPath?: MintPath;
     /** §8.15 — parent `grantKey` for an M2 `delegated` grant. */
     parentGrantId?: string;
+    /** R3-98 S3/S4 — the **named principal** this grant is minted under (design 05a
+     *  §3.1). Written as the `principal` field so the mount-admission gate re-checks
+     *  it (a grant fires only under the principal it was minted with). Optional +
+     *  additive: omitted ⇒ no field ⇒ a legacy/grandfathered grant. */
+    principal?: string;
 }
 /** Parameters for `MintStore.grantNetFetchHosts` — the per-(user, app) granted
  *  host set, the grant half of the `manifest ∩ grant` net:fetch allowlist. */
@@ -68,6 +73,19 @@ export interface GrantNetFetchParams {
     appKey: string;
     hosts: readonly NetFetchHost[];
 }
+/** Parameters for `MintStore.grantAppCapabilities` — the durable §8.7 grant of a
+ *  set of PLAIN (on/off) app-scoped elevated capabilities for one (user, app):
+ *  `task:invoke`, `llm:chat`, `contribute:self`, `diagnostics:read` (R3-233). NOT
+ *  `net:fetch` — that is host-parameterized and granted via {@link GrantNetFetchParams};
+ *  a bare `net:fetch` grant would be unbounded. The set unions into the app's
+ *  granted-capability set (consent accumulates), mirroring net:fetch hosts. */
+export interface GrantAppCapabilitiesParams {
+    uid: string;
+    appKey: string;
+    capabilities: readonly string[];
+    /** §8.15 provenance; defaults to `interactive` when omitted. */
+    mintPath?: MintPath;
+}
 /**
  * The mint port: exactly the methods `mintConsentedGrants` calls. Every backend
  * (browser Firestore, admin Firestore, the in-memory test double) implements
@@ -81,4 +99,11 @@ export interface MintStore {
     grantSpaceToApp(params: GrantSpaceParams): Promise<void>;
     /** Union the given net:fetch hosts into the app's consented host set. */
     grantNetFetchHosts(params: GrantNetFetchParams): Promise<void>;
+    /** Union the given PLAIN app-scoped capabilities into the app's granted set
+     *  (R3-233). **Optional** so existing {@link MintStore} implementers (the backend
+     *  `AdminMintStore`) keep compiling; when a caller asks to mint plain caps and an
+     *  adapter does not implement this, `mintConsentedGrants` fails LOUD (reports
+     *  `capabilitiesOk:false`) rather than silently dropping them — the exact
+     *  validate-then-drop bug R3-233 fixes. */
+    grantAppCapabilities?(params: GrantAppCapabilitiesParams): Promise<void>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immediately-run/preauth-core",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "The shared §8.9 pre-auth target check + the single grant-mint path (mintConsentedGrants) + the capability vocabulary + the byte-faithful grant/space/net-fetch document layout. Consumed by site-main (browser Firestore) and the backend (admin Firestore) so there is ONE gate, ONE mint path, ONE wire layout.",
   "license": "UNLICENSED",
   "repository": {