@indorania/contracts 0.1.0

package/dist/constitution/tables.js

@@ -0,0 +1,96 @@
+/**
+ * The constitution, checked against a database schema — described as plain data, so it works for
+ * any ORM. `@indorania/db` builds this model from its Drizzle tables; a member can build one from
+ * its own.
+ */
+import { RULES, summarise } from "./report.js";
+import { DECLINE_TOKENS, MEMBER_NAMES, MEMBERSHIP_TOKENS, METER_TOKENS, ORIGIN_TOKENS, PERSON_TOKENS, SCORE_TOKENS, SECRET_TOKENS, hasToken, } from "./words.js";
+/** A person-side column would be one of these; the platform has none (d41, ADR-0001). */
+const PERSON_COLUMN_TOKENS = new Set([...PERSON_TOKENS, "relationship", "relationships"]);
+export const EXPIRY_COLUMN = "expires_at";
+export function checkTables(model) {
+    const findings = [];
+    const add = (rule, where, why) => findings.push({ rule, where, why });
+    const classes = new Map(model.jsonColumns.map((c) => [c.column, c]));
+    for (const table of model.tables) {
+        const t = `${table.schema}.${table.name}`;
+        const structural = [
+            { name: table.schema, where: t, kind: "schema" },
+            { name: table.name, where: t, kind: "table" },
+            ...table.columns.map((c) => ({ name: c.name, where: `${t}.${c.name}`, kind: "column" })),
+            ...table.columns.flatMap((c) => (c.enumValues ?? []).map((v) => ({ name: v, where: `${t}.${c.name}`, kind: "enum value" }))),
+        ];
+        for (const s of structural) {
+            const origin = hasToken(s.name, ORIGIN_TOKENS);
+            if (origin)
+                add("no-origin-fields", s.where, `${s.kind} "${s.name}" names ${origin}`);
+            const decline = hasToken(s.name, DECLINE_TOKENS);
+            if (decline)
+                add("no-decline-trace", s.where, `${s.kind} "${s.name}" names ${decline}`);
+            const member = hasToken(s.name, MEMBER_NAMES);
+            if (member)
+                add("no-member-names", s.where, `${s.kind} "${s.name}" names a member (${member})`);
+        }
+        const tableMembership = hasToken(table.name, MEMBERSHIP_TOKENS);
+        if (tableMembership)
+            add("no-house-member-list", t, `table "${table.name}" names ${tableMembership}`);
+        for (const c of table.columns) {
+            const where = `${t}.${c.name}`;
+            const person = hasToken(c.name, PERSON_COLUMN_TOKENS);
+            if (person)
+                add("no-cross-relationship-joins", where, `column "${c.name}" would hold a person-side identifier (${person}); the platform stores none`);
+            const membership = hasToken(c.name, MEMBERSHIP_TOKENS);
+            if (membership)
+                add("no-house-member-list", where, `column "${c.name}" names ${membership}`);
+            const score = hasToken(c.name, SCORE_TOKENS);
+            if (score)
+                add("no-score-or-balance", where, `column "${c.name}" names ${score}`);
+            const secret = hasToken(c.name, SECRET_TOKENS);
+            if (secret)
+                add("no-secret-material", where, `column "${c.name}" names ${secret}`);
+            if (table.schema === "entitlements") {
+                const meter = hasToken(c.name, METER_TOKENS);
+                if (meter)
+                    add("no-volume-meter", where, `entitlement column "${c.name}" meters ${meter}`);
+            }
+            if (c.sqlType === "json" || c.sqlType === "jsonb") {
+                const cls = classes.get(where);
+                if (!cls) {
+                    add("no-cross-relationship-joins", where, `json column "${c.name}" does not say whether it holds party content`);
+                }
+                else if (cls.holds === "party-content") {
+                    const expiry = table.columns.find((x) => x.name === EXPIRY_COLUMN);
+                    if (!expiry?.notNull)
+                        add("no-cross-relationship-joins", where, `party content in ${t}, which has no non-null ${EXPIRY_COLUMN}: it would be kept`);
+                }
+            }
+        }
+        for (const fk of table.foreignKeys) {
+            if (fk.foreignSchema !== table.schema) {
+                add("no-cross-relationship-joins", `${t}(${fk.columns.join(", ")})`, `a foreign key into ${fk.foreignSchema}.${fk.foreignTable} crosses a schema (architecture §4.3 rules 5–6)`);
+            }
+        }
+    }
+    const known = new Set(model.tables.flatMap((t) => t.columns.map((c) => `${t.schema}.${t.name}.${c.name}`)));
+    for (const c of model.jsonColumns) {
+        if (!known.has(c.column))
+            add("no-cross-relationship-joins", c.column, "classified json column does not exist");
+    }
+    // Reviewed exceptions: matched by rule and column. One that matches nothing is itself a failure.
+    const accepted = model.accepted ?? [];
+    const used = new Set();
+    const kept = findings.filter((f) => {
+        const hit = accepted.find((a) => a.rule === f.rule && a.column === f.where);
+        if (hit)
+            used.add(hit);
+        return hit === undefined;
+    });
+    for (const a of accepted) {
+        if (!used.has(a))
+            kept.push({ rule: a.rule, where: a.column, why: "an accepted exception that no longer matches any finding — remove it" });
+    }
+    const acceptedFindings = [...used].map((a) => ({ rule: a.rule, where: a.column, why: "accepted", reason: a.reason }));
+    // Every rule applies to a schema except the list allowlist, which is about reads.
+    return summarise(kept, Object.keys(RULES).filter((id) => id !== "collections-allowlisted"), acceptedFindings);
+}
+//# sourceMappingURL=tables.js.map

package/dist/constitution/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../src/constitution/tables.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAoE,MAAM,aAAa,CAAC;AACjH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,aAAa,EACb,QAAQ,GACT,MAAM,YAAY,CAAC;AAoDpB,yFAAyF;AACzF,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAErE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG;YACjB,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChD,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YAC7C,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxF,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;SAC7H,CAAC;QAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC/C,IAAI,MAAM;gBAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;YACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACjD,IAAI,OAAO;gBAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,WAAW,OAAO,EAAE,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC9C,IAAI,MAAM;gBAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,qBAAqB,MAAM,GAAG,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAChE,IAAI,eAAe;YAAE,GAAG,CAAC,sBAAsB,EAAE,CAAC,EAAE,UAAU,KAAK,CAAC,IAAI,WAAW,eAAe,EAAE,CAAC,CAAC;QAEtG,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACtD,IAAI,MAAM;gBAAE,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,0CAA0C,MAAM,6BAA6B,CAAC,CAAC;YACtJ,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YACvD,IAAI,UAAU;gBAAE,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,WAAW,UAAU,EAAE,CAAC,CAAC;YAC7F,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC7C,IAAI,KAAK;gBAAE,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC/C,IAAI,MAAM;gBAAE,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC7C,IAAI,KAAK;oBAAE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC,IAAI,YAAY,KAAK,EAAE,CAAC,CAAC;YAC7F,CAAC;YAED,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,IAAI,+CAA+C,CAAC,CAAC;gBACnH,CAAC;qBAAM,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACzC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;oBACnE,IAAI,CAAC,MAAM,EAAE,OAAO;wBAAE,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,oBAAoB,CAAC,2BAA2B,aAAa,oBAAoB,CAAC,CAAC;gBACrJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,aAAa,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACtC,GAAG,CACD,6BAA6B,EAC7B,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAChC,sBAAsB,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,YAAY,iDAAiD,CAC3G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5G,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;IAClH,CAAC;IAED,iGAAiG;IACjG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,sEAAsE,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,gBAAgB,GAAsB,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzI,kFAAkF;IAClF,OAAO,SAAS,CAAC,IAAI,EAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC9H,CAAC"}

package/dist/constitution/words.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The words the constitution forbids in structure — the names of paths, operations, parameters,
+ * properties, enum values, schemas, tables and columns. Text (descriptions) is not checked here.
+ *
+ * Names are compared token by token, after splitting camelCase, snake_case, kebab-case, dots,
+ * slashes and braces — so "sectionId" is [section, id] and never matches "sect", and "trace" is
+ * never "race". Each list spells its forms out; nothing is matched by prefix.
+ */
+/** Split a name into lower-case tokens. */
+export declare function tokens(name: string): string[];
+export declare function hasToken(name: string, set: ReadonlySet<string>): string | null;
+/** ECOSYSTEM d36 and Indorania content rule 2: no origin, ethnicity, sect, caste or descent field anywhere. */
+export declare const ORIGIN_TOKENS: ReadonlySet<string>;
+/** A field named for a person must be a RelationshipId — never a free-standing identifier (d41, d47(g)). */
+export declare const PERSON_TOKENS: ReadonlySet<string>;
+/** d47(c): membership of a house is a credential in the person's wallet, never a list the platform holds. */
+export declare const MEMBERSHIP_TOKENS: ReadonlySet<string>;
+/** PL-4 edge 7: no client needs to know a member's name — members appear as capabilities. */
+export declare const MEMBER_NAMES: ReadonlySet<string>;
+/**
+ * d49(a): a decline leaves no trace — no endpoint, state or field for it. "declining" is absent on
+ * purpose: it is the ask's own statement that declining costs only what `goodFor` names (d42 §5).
+ */
+export declare const DECLINE_TOKENS: ReadonlySet<string>;
+/** d27, d43, d49: nothing scores, ranks or totals a person; thank-yous never add up. */
+export declare const SCORE_TOKENS: ReadonlySet<string>;
+/** d47(g): no person's private key on a server. No field carries secret key material. */
+export declare const SECRET_TOKENS: ReadonlySet<string>;
+/** d50(b)1: capacity is what costs work; volume is never capacity. Checked on entitlements only. */
+export declare const METER_TOKENS: ReadonlySet<string>;
+/**
+ * For values people write (a house's join rule): the door opens on place, craft or goal, never on
+ * birth or descent (d27, d36, d47(c)). A floor, not a filter — human review sits above it (PL-7).
+ * Word-bounded, so "original" and "insect" pass.
+ */
+export declare const BIRTH_OR_ORIGIN: RegExp;
+/** For labels an integration writes: a section is named by what it does, never by who powers it. */
+export declare const MEMBER_NAME_PATTERN: RegExp;
+//# sourceMappingURL=words.d.ts.map

package/dist/constitution/words.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"words.d.ts","sourceRoot":"","sources":["../../src/constitution/words.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,2CAA2C;AAC3C,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7C;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAG9E;AAED,+GAA+G;AAC/G,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAe5C,CAAC;AAEH,4GAA4G;AAC5G,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAiB5C,CAAC;AAEH,6GAA6G;AAC7G,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAOhD,CAAC;AAEH,6FAA6F;AAC7F,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,CAI3C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAI7C,CAAC;AAEH,wFAAwF;AACxF,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,CAS3C,CAAC;AAEH,yFAAyF;AACzF,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAE5C,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,CAiB3C,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,QACyM,CAAC;AAEtO,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,QAAmG,CAAC"}

package/dist/constitution/words.js

@@ -0,0 +1,126 @@
+/**
+ * The words the constitution forbids in structure — the names of paths, operations, parameters,
+ * properties, enum values, schemas, tables and columns. Text (descriptions) is not checked here.
+ *
+ * Names are compared token by token, after splitting camelCase, snake_case, kebab-case, dots,
+ * slashes and braces — so "sectionId" is [section, id] and never matches "sect", and "trace" is
+ * never "race". Each list spells its forms out; nothing is matched by prefix.
+ */
+/** Split a name into lower-case tokens. */
+export function tokens(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean)
+        .map((t) => t.toLowerCase());
+}
+export function hasToken(name, set) {
+    for (const t of tokens(name))
+        if (set.has(t))
+            return t;
+    return null;
+}
+/** ECOSYSTEM d36 and Indorania content rule 2: no origin, ethnicity, sect, caste or descent field anywhere. */
+export const ORIGIN_TOKENS = new Set([
+    "origin", "origins",
+    "ethnic", "ethnicity", "ethnicities",
+    "race", "races", "racial",
+    "sect", "sects", "sectarian",
+    "caste", "castes",
+    "tribe", "tribes", "tribal",
+    "clan", "clans",
+    "lineage", "lineages",
+    "ancestry", "ancestries", "ancestral", "ancestor", "ancestors",
+    "descent",
+    "nationality", "nationalities",
+    "religion", "religions", "religious",
+    "birth", "births", "birthplace",
+    "endonym", "endonyms",
+]);
+/** A field named for a person must be a RelationshipId — never a free-standing identifier (d41, d47(g)). */
+export const PERSON_TOKENS = new Set([
+    "person", "persons", "people",
+    "holder", "holders",
+    "wallet", "wallets",
+    "device", "devices",
+    "install", "installs", "installation",
+    "push",
+    "subject", "subjects",
+    "user", "users",
+    "individual", "individuals",
+    "citizen", "citizens",
+    "visitor", "visitors",
+    "customer", "customers",
+    "recipient", "recipients",
+    "beneficiary", "beneficiaries",
+    "worker", "workers",
+    "member", "members",
+]);
+/** d47(c): membership of a house is a credential in the person's wallet, never a list the platform holds. */
+export const MEMBERSHIP_TOKENS = new Set([
+    "member", "members", "membership", "memberships",
+    "people", "persons",
+    "roster", "rosters",
+    "follower", "followers",
+    "joiner", "joiners",
+    "subscriber", "subscribers",
+]);
+/** PL-4 edge 7: no client needs to know a member's name — members appear as capabilities. */
+export const MEMBER_NAMES = new Set([
+    "kashscript", "indusland", "duedale", "oreoasis",
+    "tehzeeb", "kumak", "industown",
+    "sabaat", "safeer", "suroor", "simt",
+]);
+/**
+ * d49(a): a decline leaves no trace — no endpoint, state or field for it. "declining" is absent on
+ * purpose: it is the ask's own statement that declining costs only what `goodFor` names (d42 §5).
+ */
+export const DECLINE_TOKENS = new Set([
+    "decline", "declines", "declined", "declination",
+    "refuse", "refuses", "refused", "refusal", "refusals", "refuser", "refusers",
+    "optout", "opted",
+]);
+/** d27, d43, d49: nothing scores, ranks or totals a person; thank-yous never add up. */
+export const SCORE_TOKENS = new Set([
+    "score", "scores", "scoring",
+    "rank", "ranks", "ranking", "rankings",
+    "percent", "percentage", "percentages", "percentile", "percentiles",
+    "balance", "balances",
+    "points",
+    "leaderboard", "leaderboards",
+    "rating", "ratings",
+    "tier", "tiers",
+]);
+/** d47(g): no person's private key on a server. No field carries secret key material. */
+export const SECRET_TOKENS = new Set([
+    "private", "secret", "secrets", "seed", "seeds", "mnemonic", "mnemonics", "passphrase", "password", "passwords",
+]);
+/** d50(b)1: capacity is what costs work; volume is never capacity. Checked on entitlements only. */
+export const METER_TOKENS = new Set([
+    "price", "prices", "pricing",
+    "amount", "amounts",
+    "cost", "costs",
+    "fee", "fees",
+    "charge", "charges",
+    "meter", "meters", "metered", "metering",
+    "usage",
+    "count", "counts",
+    "volume", "volumes",
+    "record", "records",
+    "confirmation", "confirmations",
+    "check", "checks",
+    "presentation", "presentations",
+    "session", "sessions",
+    "answer", "answers",
+    "thank",
+]);
+/**
+ * For values people write (a house's join rule): the door opens on place, craft or goal, never on
+ * birth or descent (d27, d36, d47(c)). A floor, not a filter — human review sits above it (PL-7).
+ * Word-bounded, so "original" and "insect" pass.
+ */
+export const BIRTH_OR_ORIGIN = /\b(born|births?|birthplace|descent|descend(?:s|ed|ants?)?|lineages?|ancestr(?:y|ies|al)|ancestors?|bloodlines?|ethnic(?:ity|ities)?|races?|racial|sects?|sectarian|castes?|tribes?|tribal|clans?|origins?|nationalit(?:y|ies))\b/i;
+/** For labels an integration writes: a section is named by what it does, never by who powers it. */
+export const MEMBER_NAME_PATTERN = /\b(kashscript|indusland|duedale|oreoasis|tehzeeb|kumak|industown|sabaat|safeer|suroor|simt)\b/i;
+//# sourceMappingURL=words.js.map

package/dist/constitution/words.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"words.js","sourceRoot":"","sources":["../../src/constitution/words.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,2CAA2C;AAC3C,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI;SACR,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAwB;IAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACxD,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,WAAW,EAAE,aAAa;IACpC,MAAM,EAAE,OAAO,EAAE,QAAQ;IACzB,MAAM,EAAE,OAAO,EAAE,WAAW;IAC5B,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ,EAAE,QAAQ;IAC3B,MAAM,EAAE,OAAO;IACf,SAAS,EAAE,UAAU;IACrB,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW;IAC9D,SAAS;IACT,aAAa,EAAE,eAAe;IAC9B,UAAU,EAAE,WAAW,EAAE,WAAW;IACpC,OAAO,EAAE,QAAQ,EAAE,YAAY;IAC/B,SAAS,EAAE,UAAU;CACtB,CAAC,CAAC;AAEH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACxD,QAAQ,EAAE,SAAS,EAAE,QAAQ;IAC7B,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,UAAU,EAAE,cAAc;IACrC,MAAM;IACN,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,OAAO;IACf,YAAY,EAAE,aAAa;IAC3B,SAAS,EAAE,UAAU;IACrB,SAAS,EAAE,UAAU;IACrB,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,YAAY;IACzB,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAC;AAEH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa;IAChD,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,SAAS;IACnB,YAAY,EAAE,aAAa;CAC5B,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IACvD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU;IAChD,SAAS,EAAE,OAAO,EAAE,WAAW;IAC/B,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;CACrC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa;IAChD,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU;IAC5E,QAAQ,EAAE,OAAO;CAClB,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS;IAC5B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU;IACtC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa;IACnE,SAAS,EAAE,UAAU;IACrB,QAAQ;IACR,aAAa,EAAE,cAAc;IAC7B,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,OAAO;CAChB,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACxD,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW;CAChH,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS;IAC5B,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU;IACxC,OAAO;IACP,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,cAAc,EAAE,eAAe;IAC/B,OAAO,EAAE,QAAQ;IACjB,cAAc,EAAE,eAAe;IAC/B,SAAS,EAAE,UAAU;IACrB,QAAQ,EAAE,SAAS;IACnB,OAAO;CACR,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,mOAAmO,CAAC;AAEtO,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,gGAAgG,CAAC"}

package/dist/document.d.ts

@@ -0,0 +1,12 @@
+/** Every operation and webhook of the contract, and the OpenAPI 3.1 document generated from them. */
+import { OpenApiGeneratorV31 } from "@asteasolutions/zod-to-openapi";
+import { type Operation } from "./op.ts";
+import { type ApiVersion } from "./versions.ts";
+/** Every operation this API serves. apps/api registers exactly these, and nothing else. */
+export declare const OPERATIONS: readonly Operation[];
+/** What the platform sends to integrations. */
+export declare const WEBHOOKS: readonly Operation[];
+/** An OpenAPI 3.1 document, as the generator types it. */
+export type GeneratedDocument = ReturnType<OpenApiGeneratorV31["generateDocument"]>;
+export declare function generateDocument(version?: ApiVersion): GeneratedDocument;
+//# sourceMappingURL=document.d.ts.map

package/dist/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../src/document.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,EAAmB,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAa/C,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/D,2FAA2F;AAC3F,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAa1C,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,QAAQ,EAAE,SAAS,SAAS,EAAwB,CAAC;AA2DlE,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEpF,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,UAA4B,GAAG,iBAAiB,CAgBzF"}

package/dist/document.js

@@ -0,0 +1,106 @@
+/** Every operation and webhook of the contract, and the OpenAPI 3.1 document generated from them. */
+import { OpenAPIRegistry, OpenApiGeneratorV31 } from "@asteasolutions/zod-to-openapi";
+import { TAGS } from "./op.js";
+import { askOperations } from "./routes/asks.js";
+import { backupOperations } from "./routes/backup.js";
+import { capabilityOperations } from "./routes/capabilities.js";
+import { entitlementOperations } from "./routes/entitlements.js";
+import { guestOperations } from "./routes/guest.js";
+import { integrationOperations, integrationWebhooks } from "./routes/integration.js";
+import { metaOperations } from "./routes/meta.js";
+import { organisationOperations } from "./routes/organisations.js";
+import { presentationOperations } from "./routes/presentations.js";
+import { sessionOperations } from "./routes/sessions.js";
+import { standingOperations } from "./routes/standing.js";
+import { thankYouOperations } from "./routes/thank-yous.js";
+import { latestVersion } from "./versions.js";
+/** Every operation this API serves. apps/api registers exactly these, and nothing else. */
+export const OPERATIONS = [
+    ...metaOperations,
+    ...backupOperations,
+    ...organisationOperations,
+    ...guestOperations,
+    ...capabilityOperations,
+    ...entitlementOperations,
+    ...askOperations,
+    ...presentationOperations,
+    ...standingOperations,
+    ...sessionOperations,
+    ...thankYouOperations,
+    ...integrationOperations,
+];
+/** What the platform sends to integrations. */
+export const WEBHOOKS = integrationWebhooks;
+const SECURITY_SCHEMES = {
+    seat: {
+        type: "http",
+        scheme: "bearer",
+        bearerFormat: "JWT",
+        description: "A staff login's access token, from the platform's OIDC boundary (PL-7). It acts through the seats its login holds.",
+    },
+    integration: {
+        type: "http",
+        scheme: "bearer",
+        bearerFormat: "JWT",
+        description: "An integration's access token: the client-credentials grant, authenticated with a private_key_jwt assertion (RFC 7523) signed by one of its registered Ed25519 keys (PL-7).",
+    },
+    personAccount: {
+        type: "http",
+        scheme: "bearer",
+        bearerFormat: "JWT",
+        description: "A person's optional account, signed in with a passkey. It reaches /v1/backup and nothing else (ADR-0001). People need no account for anything else.",
+    },
+    relationshipProof: {
+        type: "apiKey",
+        in: "header",
+        name: "DPoP",
+        description: "A DPoP proof JWT (RFC 9449) signed by the person's relationship key, over this method and URL. It proves which party is calling without any account; its key is the person's identifier in that relationship only.",
+    },
+    webhookSignature: {
+        type: "apiKey",
+        in: "header",
+        name: "webhook-signature",
+        description: "Standard Webhooks 1.0.0, v1a (Ed25519) over webhook-id.webhook-timestamp.body. The platform signs with the keys at /v1/webhook-keys; an integration signs with a key it registered.",
+    },
+    issuanceToken: {
+        type: "http",
+        scheme: "bearer",
+        description: "The access token /v1/issuance/token returned for a pre-authorized code (OpenID4VCI 1.0).",
+    },
+};
+const DESCRIPTION = `The platform contract that every member, and any outside issuer, builds against (ECOSYSTEM decision 47). A member integrates exactly as a stranger would.
+
+**Versions.** The URL carries the major version (\`/v1\`). Every request speaks a dated version: send \`Indorania-Version: YYYY-MM-DD\`, or your organisation's or integration's pinned version applies; with neither, the request is refused. Inside a released version, changes are additive only — new operations, new optional fields, new enum values, new problem codes — so treat anything unknown gracefully. Any other change is a new dated version, and the platform translates between the two. A version is a **preview** until its first release, and may still change in place.
+
+**Exempt from dated versions:** the OpenID4VCI and OpenID4VP endpoints, which their standards version, and documents that describe themselves: the trust list, the webhook keys, the version list, and these documents.
+
+**Errors** are RFC 9457 problem details (\`application/problem+json\`), each with a stable \`code\`.
+
+**Idempotency.** Every change made through this API carries an \`Idempotency-Key\` (IETF draft-07). Without one it is refused (400). The same key and body get the first answer again for 24 hours; the same key with another body is refused (422); a key still running is refused (409). Protocol endpoints rely on their own single-use code or nonce, and webhooks on \`webhook-id\`.
+
+**Webhooks,** in both directions: Standard Webhooks 1.0.0, v1a (Ed25519), with a 300-second tolerance.
+
+**What it never does.** No endpoint lists a house's members, answers "everything matching X", records a decline, meters records, scores a person, or joins a person across relationships: person-side identifiers are relationship identifiers, one at a time. Lints check this document for all of it.
+
+**Status.** Every operation marked \`x-indorania-pending\` is wired but not built, and answers 501 \`not_built\`. No host serves this API yet, and nothing it serves reaches real society before ECOSYSTEM decision 30's gate.`;
+export function generateDocument(version = latestVersion()) {
+    const registry = new OpenAPIRegistry();
+    for (const [name, scheme] of Object.entries(SECURITY_SCHEMES))
+        registry.registerComponent("securitySchemes", name, scheme);
+    for (const op of OPERATIONS)
+        registry.registerPath(op.route);
+    for (const op of WEBHOOKS)
+        registry.registerWebhook(op.route);
+    return new OpenApiGeneratorV31(registry.definitions).generateDocument({
+        openapi: "3.1.0",
+        info: {
+            title: "Indorania platform API",
+            version: version.id,
+            description: DESCRIPTION,
+            license: { name: "Apache-2.0", identifier: "Apache-2.0" },
+            "x-indorania-version-status": version.status,
+        },
+        tags: Object.entries(TAGS).map(([name, description]) => ({ name, description })),
+    });
+}
+//# sourceMappingURL=document.js.map

package/dist/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../src/document.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAmB,MAAM,eAAe,CAAC;AAE/D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C,GAAG,cAAc;IACjB,GAAG,gBAAgB;IACnB,GAAG,sBAAsB;IACzB,GAAG,eAAe;IAClB,GAAG,oBAAoB;IACvB,GAAG,qBAAqB;IACxB,GAAG,aAAa;IAChB,GAAG,sBAAsB;IACzB,GAAG,kBAAkB;IACrB,GAAG,iBAAiB;IACpB,GAAG,kBAAkB;IACrB,GAAG,qBAAqB;CACzB,CAAC;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAyB,mBAAmB,CAAC;AAElE,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,oHAAoH;KAClI;IACD,WAAW,EAAE;QACX,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;QACnB,WAAW,EACT,6KAA6K;KAChL;IACD,aAAa,EAAE;QACb,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,qJAAqJ;KACnK;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,oNAAoN;KACvN;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,qLAAqL;KACxL;IACD,aAAa,EAAE;QACb,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,0FAA0F;KACxG;CACO,CAAC;AAEX,MAAM,WAAW,GAAG;;;;;;;;;;;;;;+NAc2M,CAAC;AAKhO,MAAM,UAAU,gBAAgB,CAAC,UAAsB,aAAa,EAAE;IACpE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAAE,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3H,KAAK,MAAM,EAAE,IAAI,UAAU;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7D,KAAK,MAAM,EAAE,IAAI,QAAQ;QAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC;QACpE,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,WAAW,EAAE,WAAW;YACxB,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE;YACzD,4BAA4B,EAAE,OAAO,CAAC,MAAM;SAC7C;QACD,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;KACjF,CAAC,CAAC;AACL,CAAC"}

package/dist/domain-error.d.ts

@@ -0,0 +1,14 @@
+/**
+ * What a platform implementation throws when a request is refused for a reason the contract names.
+ * The API turns it into the one error envelope (RFC 9457 plus `code`); nothing else in the platform
+ * knows about HTTP. The codes are the contract's own, so a refusal can only be one the document lists.
+ */
+import { type ProblemCode, type ProblemDetail } from "./common.ts";
+export declare class DomainError extends Error {
+    readonly code: ProblemCode;
+    readonly errors: readonly ProblemDetail[];
+    constructor(code: ProblemCode, detail: string, errors?: readonly ProblemDetail[]);
+    get status(): number;
+}
+export declare const refuse: (code: ProblemCode, detail: string, errors?: readonly ProblemDetail[]) => never;
+//# sourceMappingURL=domain-error.d.ts.map

package/dist/domain-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-error.d.ts","sourceRoot":"","sources":["../src/domain-error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAY,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7E,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;gBAE9B,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,SAAS,aAAa,EAAO;IAOpF,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAED,eAAO,MAAM,MAAM,GAAI,MAAM,WAAW,EAAE,QAAQ,MAAM,EAAE,SAAQ,SAAS,aAAa,EAAO,KAAG,KAEjG,CAAC"}

package/dist/domain-error.js

@@ -0,0 +1,23 @@
+/**
+ * What a platform implementation throws when a request is refused for a reason the contract names.
+ * The API turns it into the one error envelope (RFC 9457 plus `code`); nothing else in the platform
+ * knows about HTTP. The codes are the contract's own, so a refusal can only be one the document lists.
+ */
+import { PROBLEMS } from "./common.js";
+export class DomainError extends Error {
+    code;
+    errors;
+    constructor(code, detail, errors = []) {
+        super(detail);
+        this.name = "DomainError";
+        this.code = code;
+        this.errors = errors;
+    }
+    get status() {
+        return PROBLEMS[this.code].status;
+    }
+}
+export const refuse = (code, detail, errors = []) => {
+    throw new DomainError(code, detail, errors);
+};
+//# sourceMappingURL=domain-error.js.map

package/dist/domain-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-error.js","sourceRoot":"","sources":["../src/domain-error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAwC,MAAM,aAAa,CAAC;AAE7E,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAc;IAClB,MAAM,CAA2B;IAE1C,YAAY,IAAiB,EAAE,MAAc,EAAE,SAAmC,EAAE;QAClF,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAiB,EAAE,MAAc,EAAE,SAAmC,EAAE,EAAS,EAAE;IACxG,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `@indorania/contracts` — the platform contract (ECOSYSTEM decision 47; PLATFORM-SESSIONS PL-4).
+ * Zod schemas are the source; the OpenAPI 3.1 document in `openapi/` is generated from them and
+ * committed. Also: `@indorania/contracts/constitution` (the lints) and `/webhooks` (signing).
+ */
+export * from "./common.ts";
+export * from "./domain-error.ts";
+export * from "./versions.ts";
+export { IdempotencyKeyHeader, TAGS, VersionHeader, WebhookHeaders, operation, type Idempotency, type Method, type Operation, type OperationMeta, type OperationSpec, type Pending, type Scheme, type Tag, } from "./op.ts";
+export { OPERATIONS, WEBHOOKS, generateDocument, type GeneratedDocument } from "./document.ts";
+export * from "./routes/meta.ts";
+export * from "./routes/backup.ts";
+export * from "./routes/organisations.ts";
+export * from "./routes/guest.ts";
+export * from "./routes/capabilities.ts";
+export * from "./routes/entitlements.ts";
+export * from "./routes/asks.ts";
+export * from "./routes/presentations.ts";
+export * from "./routes/standing.ts";
+export * from "./routes/sessions.ts";
+export * from "./routes/thank-yous.ts";
+export * from "./routes/integration.ts";
+export { BIRTH_OR_ORIGIN } from "./constitution/words.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,cAAc,EACd,SAAS,EACT,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,MAAM,EACX,KAAK,GAAG,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/F,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -0,0 +1,24 @@
+/**
+ * `@indorania/contracts` — the platform contract (ECOSYSTEM decision 47; PLATFORM-SESSIONS PL-4).
+ * Zod schemas are the source; the OpenAPI 3.1 document in `openapi/` is generated from them and
+ * committed. Also: `@indorania/contracts/constitution` (the lints) and `/webhooks` (signing).
+ */
+export * from "./common.js";
+export * from "./domain-error.js";
+export * from "./versions.js";
+export { IdempotencyKeyHeader, TAGS, VersionHeader, WebhookHeaders, operation, } from "./op.js";
+export { OPERATIONS, WEBHOOKS, generateDocument } from "./document.js";
+export * from "./routes/meta.js";
+export * from "./routes/backup.js";
+export * from "./routes/organisations.js";
+export * from "./routes/guest.js";
+export * from "./routes/capabilities.js";
+export * from "./routes/entitlements.js";
+export * from "./routes/asks.js";
+export * from "./routes/presentations.js";
+export * from "./routes/standing.js";
+export * from "./routes/sessions.js";
+export * from "./routes/thank-yous.js";
+export * from "./routes/integration.js";
+export { BIRTH_OR_ORIGIN } from "./constitution/words.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,cAAc,EACd,SAAS,GASV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAA0B,MAAM,eAAe,CAAC;AAC/F,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/op.d.ts

@@ -0,0 +1,92 @@
+/**
+ * One builder for every operation, so the conventions live in one place:
+ * - the version header on every dated operation;
+ * - an Idempotency-Key on every mutation of this API, or the protocol's own single-use value, or
+ *   the webhook's `webhook-id` — declared as `x-indorania-idempotency`;
+ * - the one error envelope as every operation's `default` response;
+ * - `x-indorania-pending` naming the session that builds the operation, while it answers 501;
+ * - `x-indorania-collection` on the few GETs allowed to return a list, with the reason.
+ */
+import type { RouteConfig } from "@asteasolutions/zod-to-openapi";
+import { z } from "./zod.ts";
+export declare const TAGS: {
+    readonly meta: "The contract describing itself: its dated versions, its OpenAPI documents, and the keys Indorania signs webhooks with.";
+    readonly trust: "The trust list: which issuers a wallet shows as listed (holder contract §3). A policy, never the format (ECOSYSTEM d47(e)).";
+    readonly backup: "A person's optional account holds one encrypted blob and nothing else (ADR-0001, d47(f)).";
+    readonly organisations: "Businesses, institutes and houses. A house is an organisation whose door opens on place, craft or goal — never on birth (d47(c)).";
+    readonly seats: "Staff logins and their roles in one organisation. For a house, its stewards — never its members, whom the platform never lists.";
+    readonly "guest-links": "A counterparty with no account countersigns through a link: one click, no install, no password (d26, d47(f)).";
+    readonly capabilities: "What an establishment does — visits, money in and out, work and jobs — and the portal sections integrations register for each (architecture §7.2, without brands).";
+    readonly entitlements: "Which capabilities an organisation runs, at which capacity. Granted by payment, sponsorship, trial or the simulation, and never read from billing (d50(f)).";
+    readonly asks: "The public ask library (d42 §5): requests for evidence, answered with a yes and never with the data.";
+    readonly presentations: "One presentation request per encounter, answered by a wallet over OpenID for Verifiable Presentations. A decline sends nothing and leaves no trace (d49(a)).";
+    readonly standing: "Standing is derived on request from presented predicates, signed and expiring; nothing that links is kept (d42 §2, d47(d)).";
+    readonly sessions: "One encounter, both signatures on every line. Indorania relays and anchors, and never signs as a party (d47(d)).";
+    readonly "thank-yous": "A counterparty's promise to a person who answered — never Indorania's, never a balance (d49(b)).";
+    readonly issuance: "OpenID for Verifiable Credential Issuance 1.0 endpoints for credentials the platform issues on an organisation's behalf, such as thank-yous. Standard, so exempt from dated versions.";
+    readonly integration: "How a member's or an outside issuer's system joins: its issuer, its predicate-answer and session-event webhooks, and its portal sections — the same contract for everyone (d47(a)).";
+};
+export type Tag = keyof typeof TAGS;
+export type Scheme = "seat" | "integration" | "personAccount" | "relationshipProof" | "webhookSignature" | "issuanceToken";
+export type Pending = "PL-7" | "PL-8" | null;
+export type Idempotency = "key" | "protocol" | "webhook-id";
+export type Method = "get" | "post" | "put" | "patch" | "delete";
+type Media = "application/json" | "application/x-www-form-urlencoded";
+export interface OperationSpec {
+    readonly operationId: string;
+    readonly method: Method;
+    readonly path: string;
+    readonly tag: Tag;
+    readonly summary: string;
+    readonly description?: string;
+    /** Alternatives: any one scheme suffices. Empty means public. */
+    readonly auth: readonly Scheme[];
+    /** The session that builds it; null once built. */
+    readonly pending: Pending;
+    /** Dated by default. Exempt only for standard protocols and self-describing documents. */
+    readonly versioning?: "dated" | "exempt";
+    /** Required on every mutation, absent on reads. */
+    readonly idempotency?: Idempotency;
+    /** Collection reads only: why listing here is allowed. */
+    readonly collection?: string;
+    readonly params?: z.ZodObject;
+    readonly query?: z.ZodObject;
+    readonly headers?: Readonly<Record<string, z.ZodType>>;
+    readonly body?: {
+        readonly schema: z.ZodType;
+        readonly type?: Media;
+        readonly description?: string;
+    };
+    readonly responses: Readonly<Record<number, {
+        readonly description: string;
+        readonly schema?: z.ZodType;
+        readonly type?: string;
+    }>>;
+}
+/** What apps/api reads back from a built operation. */
+export interface OperationMeta {
+    readonly operationId: string;
+    readonly method: Method;
+    readonly path: string;
+    readonly pending: Pending;
+    readonly versioning: "dated" | "exempt";
+    readonly idempotency: Idempotency | null;
+    /** Alternatives: any one scheme suffices. Empty means public. */
+    readonly auth: readonly Scheme[];
+}
+/** The route as the generator and Hono take it, and what this contract says about it. */
+export interface Operation {
+    readonly route: RouteConfig;
+    readonly meta: OperationMeta;
+}
+export declare const VersionHeader: z.ZodOptional<z.ZodString>;
+/** IETF draft-ietf-httpapi-idempotency-key-header-07: a quoted Structured-Field string. The bare form is also accepted. */
+export declare const IdempotencyKeyHeader: z.ZodString;
+export declare const WebhookHeaders: {
+    readonly "webhook-id": z.ZodString;
+    readonly "webhook-timestamp": z.ZodString;
+    readonly "webhook-signature": z.ZodString;
+};
+export declare function operation(spec: OperationSpec): Operation;
+export {};
+//# sourceMappingURL=op.d.ts.map

package/dist/op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"op.d.ts","sourceRoot":"","sources":["../src/op.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAGlE,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAE7B,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;CAgBP,CAAC;AAEX,MAAM,MAAM,GAAG,GAAG,MAAM,OAAO,IAAI,CAAC;AACpC,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,eAAe,CAAC;AAC3H,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAC7C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,YAAY,CAAC;AAC5D,MAAM,MAAM,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjE,KAAK,KAAK,GAAG,kBAAkB,GAAG,mCAAmC,CAAC;AAEtE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzC,mDAAmD;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACrI;AAED,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IACzC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED,eAAO,MAAM,aAAa,4BAOb,CAAC;AAEd,2HAA2H;AAC3H,eAAO,MAAM,oBAAoB,aAO7B,CAAC;AAEL,eAAO,MAAM,cAAc;;;;CAOjB,CAAC;AAOX,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CA2DxD"}