@listen-fire/engine-contracts 0.12.0-rc.6 → 0.12.0-rc.8

package/dist/catalog.d.ts

@@ -1386,7 +1386,7 @@ declare const transformSignatureSchema: z.ZodObject<{
         }, z.core.$strip>>>;
         nodes: z.ZodOptional<z.ZodArray<z.ZodType<ExpressionType, unknown, z.core.$ZodTypeInternals<ExpressionType, unknown>>>>;
     }, z.core.$strip>;
-    output: z.ZodOptional<z.ZodIntersection<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    output: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"value">;
         type: z.ZodType<ExpressionType, unknown, z.core.$ZodTypeInternals<ExpressionType, unknown>>;
         optional: z.ZodOptional<z.ZodBoolean>;
@@ -1406,32 +1406,7 @@ declare const transformSignatureSchema: z.ZodObject<{
             description: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         description: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>], "kind">, z.ZodObject<{
-        previously: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            before: z.ZodNumber;
-            output: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                kind: z.ZodLiteral<"value">;
-                type: z.ZodType<ExpressionType, unknown, z.core.$ZodTypeInternals<ExpressionType, unknown>>;
-                optional: z.ZodOptional<z.ZodBoolean>;
-                description: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>, z.ZodObject<{
-                kind: z.ZodLiteral<"record">;
-                fields: z.ZodRecord<z.ZodString, z.ZodObject<{
-                    type: z.ZodType<ExpressionType, unknown, z.core.$ZodTypeInternals<ExpressionType, unknown>>;
-                    optional: z.ZodOptional<z.ZodBoolean>;
-                    description: z.ZodOptional<z.ZodString>;
-                }, z.core.$strip>>;
-            }, z.core.$strip>, z.ZodObject<{
-                kind: z.ZodLiteral<"records">;
-                fields: z.ZodRecord<z.ZodString, z.ZodObject<{
-                    type: z.ZodType<ExpressionType, unknown, z.core.$ZodTypeInternals<ExpressionType, unknown>>;
-                    optional: z.ZodOptional<z.ZodBoolean>;
-                    description: z.ZodOptional<z.ZodString>;
-                }, z.core.$strip>>;
-                description: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>], "kind">;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>>>;
+    }, z.core.$strip>], "kind">>;
 }, z.core.$strip>;
 export type TransformSignature = z.infer<typeof transformSignatureSchema>;
 /**

package/dist/catalog.js

@@ -1083,10 +1083,8 @@ exports.schemaTypeDescriptorSchema = zod_1.z.object({
      * `deleteRecord` — a promise per type, like a field's `writable`. Default
      * (unset) ⇒ no: an adapter declares it on exactly the types its
      * `deleteRecord` removes (Attio objects, but not its notes; Evertrace
-     * searches, lists and list entries, but not its signals). Since language
-     * version 5 the checker refuses `delete x` where `x`'s type does not
-     * declare it; versions 1–4 leave it to the run, which fails where the
-     * adapter refuses.
+     * searches, lists and list entries, but not its signals). The checker refuses
+     * `delete x` where `x`'s type does not declare it.
      */
     deletable: zod_1.z.boolean().optional(),
     /**
@@ -1479,18 +1477,6 @@ const transformOutputKindSchema = zod_1.z.discriminatedUnion('kind', [
         description: zod_1.z.string().optional(),
     }),
 ]);
-/**
- * A plugin whose output changed shape keeps its older shapes beside the
- * current one: `previously` lists what a call handed back to a movement pinned
- * before language version `before`, earliest first. A call runs, and is typed,
- * under its movement's pin (`transformOutputUnder`). Removing a language
- * version removes its entries.
- */
-const transformOutputSchema = transformOutputKindSchema.and(zod_1.z.object({
-    previously: zod_1.z
-        .array(zod_1.z.object({ before: zod_1.z.number().int(), output: transformOutputKindSchema }))
-        .optional(),
-}));
 const transformSignatureSchema = zod_1.z.object({
     /** Unique transform identifier — the value an author writes in
      *  `-[…:#transform { plugin: "<name>" }]->`. Must be unique across
@@ -1523,7 +1509,7 @@ const transformSignatureSchema = zod_1.z.object({
      *  traversal. */
     additions: transformAdditionsSchema,
     /**
-     * What a PLAIN call hands back — see `transformOutputSchema`. Absent is
+     * What a PLAIN call hands back — see `transformOutputKindSchema`. Absent is
      * nobody having said, and the language keeps such a plugin to `through [ … ]`
      * stages, where its output goes to the extractor rather than to a name.
      *
@@ -1531,7 +1517,7 @@ const transformSignatureSchema = zod_1.z.object({
      * when it found something declares that field `optional`, and every read of
      * it downstream then has to discharge the absence.
      */
-    output: transformOutputSchema.optional(),
+    output: transformOutputKindSchema.optional(),
 });
 /**
  * Sentinel type id used in `describe(typeId)` to request the adapter's

package/dist/conformance/recording.d.ts

@@ -9,7 +9,7 @@ export declare const HOST_RECORDING_VERSION = 2;
 export declare function canonicalJson(value: unknown): string;
 declare const runInputSchema: z.ZodObject<{
     source: z.ZodString;
-    languageVersion: z.ZodNumber;
+    languageVersion: z.ZodString;
     movementName: z.ZodOptional<z.ZodString>;
     event: z.ZodCustom<{
         pipelineInputId: string;
@@ -81,7 +81,7 @@ declare const runInputSchema: z.ZodObject<{
 }, z.core.$strip>;
 declare const resumeInputSchema: z.ZodObject<{
     source: z.ZodString;
-    languageVersion: z.ZodNumber;
+    languageVersion: z.ZodString;
     movementName: z.ZodOptional<z.ZodString>;
     event: z.ZodCustom<{
         pipelineInputId: string;
@@ -203,7 +203,7 @@ export declare const hostRecordingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     entry: z.ZodLiteral<"run">;
     input: z.ZodObject<{
         source: z.ZodString;
-        languageVersion: z.ZodNumber;
+        languageVersion: z.ZodString;
         movementName: z.ZodOptional<z.ZodString>;
         event: z.ZodCustom<{
             pipelineInputId: string;
@@ -303,7 +303,7 @@ export declare const hostRecordingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     entry: z.ZodLiteral<"resume">;
     input: z.ZodObject<{
         source: z.ZodString;
-        languageVersion: z.ZodNumber;
+        languageVersion: z.ZodString;
         movementName: z.ZodOptional<z.ZodString>;
         event: z.ZodCustom<{
             pipelineInputId: string;
@@ -411,7 +411,7 @@ export declare const hostRecordingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     entry: z.ZodLiteral<"settleRace">;
     input: z.ZodObject<{
         source: z.ZodString;
-        languageVersion: z.ZodNumber;
+        languageVersion: z.ZodString;
         movementName: z.ZodOptional<z.ZodString>;
         event: z.ZodCustom<{
             pipelineInputId: string;
@@ -520,7 +520,7 @@ export declare const hostRecordingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     entry: z.ZodLiteral<"callbackBody">;
     input: z.ZodObject<{
         source: z.ZodString;
-        languageVersion: z.ZodNumber;
+        languageVersion: z.ZodString;
         movementName: z.ZodOptional<z.ZodString>;
         event: z.ZodCustom<{
             pipelineInputId: string;

package/dist/conformance/recording.js

@@ -37,7 +37,7 @@ const isObject = (value) => typeof value === 'object' && value !== null && !Arra
 const catalogSchema = zod_1.z.custom((value) => isObject(value) && isObject(value.adapters) && isObject(value.credentials) && isObject(value.plugins), 'a catalog snapshot');
 const eventSchema = zod_1.z.custom((value) => isObject(value) && typeof value.adapterType === 'string', 'a trigger event');
 const stateSchema = zod_1.z.custom((value) => isObject(value) && typeof value.address === 'string', 'a parked scope state');
-const languageVersionSchema = zod_1.z.number().int();
+const languageVersionSchema = zod_1.z.string();
 const runInputSchema = zod_1.z.object({
     source: zod_1.z.string(),
     // Optional on the contract (absent: the current version), but a recording

package/dist/park_state.d.ts

@@ -29,8 +29,8 @@ export interface ParkedCode {
     mapping: unknown;
     op: unknown;
 }
-/** Version 1 (the TypeScript engine, language versions 1–4): code rides as
- *  its syntax tree, which the version pin keeps identical. */
+/** Version 1 (the earlier TypeScript engine): code rides as
+ *  its syntax tree, which the pin keeps identical. */
 export interface CodeAsTree extends ParkedCode {
     version: 1;
     closure: ClosureExpression;
@@ -48,7 +48,7 @@ export interface CodeAsTree extends ParkedCode {
  * (`…/expr/nested/<start>-<end>/value/…`).
  */
 export type CodePlace = string;
-/** Version 2 (the Rust engine, language version 5 on): code is its place in
+/** Version 2 (the Rust engine): code is its place in
  *  the pinned program (a collection op its span among its statement's
  *  calls), and the libraries ride beside it (`ParkedScopeState.libraries`). */
 export interface CodeByPlace extends ParkedCode {
@@ -119,7 +119,7 @@ export type BindingDescriptor<C extends ParkedCode = CodeAsTree> = {
     handle: WriteRecord;
     targetType: string;
     graph: HandleGraphDescriptor;
-    /** The record before the handle's write (`-[:@old]->`, version 4 on),
+    /** The record before the handle's write (`-[:@old]->`),
      *  itself a handle. A rehearsed write's `old` is the handle itself, which
      *  JSON cannot nest, so it is said instead (`oldIsSelf`). */
     old?: BindingDescriptor<C>;
@@ -278,7 +278,7 @@ export type BindingDescriptor<C extends ParkedCode = CodeAsTree> = {
      *  node on no edge, and on a park written before landings kept it. */
     landedOn?: string;
     edges: Record<string, NodeEdgeDescriptor<C>>;
-    /** A record an extraction call found (version 5): the content that call
+    /** A record an extraction call found: the content that call
      *  read, as resources (what `-[f:_resources]->` walks off it). Absent
      *  on every other node, and on a park written before calls kept it. */
     resources?: ResourceDescriptor[];
@@ -435,8 +435,8 @@ export type ScopeLink<C extends ParkedCode = CodeAsTree> = {
  * rebuilds the scope chain by rehydrating each scope in order.
  */
 export interface ParkedScopeState<C extends ParkedCode = CodeAsTree> {
-    /** The park state contract's version: 1 for the TypeScript engine's
-     *  states (language versions 1–4), 2 for the Rust engine's (5 on). */
+    /** The park state contract's version: 1 for the earlier TypeScript
+     *  engine's states, 2 for the Rust engine's. */
     version: C['version'];
     /** The parked statement's canonical lexical address — the resume entry
      *  point. */

package/dist/plugin_spec.js

@@ -68,10 +68,6 @@ function pluginSpecOf(declaration) {
     // whatever its scheduling dependency says — `dataDependency` says WHEN it
     // runs, not what it runs on.
     const fedByExtraction = signature.dataDependency === 'extracted_context' && authorParams.length === 0;
-    const earlierOutputs = (signature.output?.previously ?? []).map((entry) => ({
-        before: entry.before,
-        output: pluginOutputOf(entry.output),
-    }));
     // Every argument's declared type, the auto-fed ones included: a plain call
     // writes those itself.
     const argTypes = Object.fromEntries(signature.params.map((p) => [p.name, fieldTypeOfExpressionType(p.type)]));
@@ -84,7 +80,6 @@ function pluginSpecOf(declaration) {
         ...(fedArgs.length ? { fedArgs } : {}),
         ...(fedByExtraction ? { fedByExtraction: true } : {}),
         ...(signature.output !== undefined ? { output: pluginOutputOf(signature.output) } : {}),
-        ...(earlierOutputs.length > 0 ? { earlierOutputs } : {}),
         // The author's words, which the language service's hover leads with.
         ...(signature.description !== undefined && signature.description.length > 0 ? { description: signature.description } : {}),
     };

package/dist/protocol.d.ts

@@ -1498,10 +1498,6 @@ export declare const WirePluginSpec: z.ZodObject<{
     }, z.core.$strip>>>;
     fedByExtraction: z.ZodOptional<z.ZodLiteral<true>>;
     output: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    earlierOutputs: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        before: z.ZodNumber;
-        output: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    }, z.core.$strip>>>;
     description: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type WirePluginSpecShape = z.infer<typeof WirePluginSpec>;
@@ -1528,10 +1524,6 @@ export declare const WirePluginsDeclaration: z.ZodObject<{
             }, z.core.$strip>>>;
             fedByExtraction: z.ZodOptional<z.ZodLiteral<true>>;
             output: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-            earlierOutputs: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                before: z.ZodNumber;
-                output: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-            }, z.core.$strip>>>;
             description: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
     }, z.core.$strip>>;
@@ -1556,8 +1548,11 @@ export type WireModuleKindShape = z.infer<typeof WireModuleKind>;
  *  other host leaves empty (a module asking for a page is refused by name),
  *  and `wake`, which stays empty unless named (nobody is told work is due;
  *  a scheduled worker finds it), and `ocr`, which stays empty unless named
- *  (a scanned file is refused, saying the slot is empty). */
-export declare const CORE_SLOTS: readonly ["models", "judge", "store", "files", "limiter", "loopGuard", "browser", "wake", "ocr"];
+ *  (a scanned file is refused, saying the slot is empty). `secrets` is
+ *  where credentials are kept (`lf`'s default: its secrets file); a secrets
+ *  module's own settings come from the environment or that file, never
+ *  from itself. */
+export declare const CORE_SLOTS: readonly ["models", "judge", "store", "files", "limiter", "loopGuard", "browser", "wake", "ocr", "secrets"];
 export declare const WireCoreSlot: z.ZodEnum<{
     store: "store";
     models: "models";
@@ -1568,6 +1563,7 @@ export declare const WireCoreSlot: z.ZodEnum<{
     browser: "browser";
     wake: "wake";
     ocr: "ocr";
+    secrets: "secrets";
 }>;
 export type WireCoreSlotShape = z.infer<typeof WireCoreSlot>;
 /** One construction argument the install supplies (an Airtable `base`, a
@@ -1626,6 +1622,7 @@ export declare const WireModuleDeclarations: z.ZodObject<{
         browser: "browser";
         wake: "wake";
         ocr: "ocr";
+        secrets: "secrets";
     }>>;
     settings: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -1715,10 +1712,6 @@ export declare const WireModuleDeclarations: z.ZodObject<{
                 }, z.core.$strip>>>;
                 fedByExtraction: z.ZodOptional<z.ZodLiteral<true>>;
                 output: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                earlierOutputs: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                    before: z.ZodNumber;
-                    output: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-                }, z.core.$strip>>>;
                 description: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
         }, z.core.$strip>>;
@@ -1771,6 +1764,7 @@ export declare const WireManifestResult: z.ZodObject<{
         browser: "browser";
         wake: "wake";
         ocr: "ocr";
+        secrets: "secrets";
     }>>;
     settings: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -1860,10 +1854,6 @@ export declare const WireManifestResult: z.ZodObject<{
                 }, z.core.$strip>>>;
                 fedByExtraction: z.ZodOptional<z.ZodLiteral<true>>;
                 output: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                earlierOutputs: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                    before: z.ZodNumber;
-                    output: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-                }, z.core.$strip>>>;
                 description: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
         }, z.core.$strip>>;
@@ -2276,6 +2266,7 @@ export declare const METHODS: {
                 browser: "browser";
                 wake: "wake";
                 ocr: "ocr";
+                secrets: "secrets";
             }>>;
             settings: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 name: z.ZodString;
@@ -2365,10 +2356,6 @@ export declare const METHODS: {
                         }, z.core.$strip>>>;
                         fedByExtraction: z.ZodOptional<z.ZodLiteral<true>>;
                         output: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        earlierOutputs: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                            before: z.ZodNumber;
-                            output: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-                        }, z.core.$strip>>>;
                         description: z.ZodOptional<z.ZodString>;
                     }, z.core.$strip>;
                 }, z.core.$strip>>;

package/dist/protocol.js

@@ -376,7 +376,7 @@ exports.WireSchemaTypeDescriptor = zod_1.z
     references: zod_1.z.array(exports.WireSchemaReferenceDescriptor),
     /** The type's records can be removed by `deleteRecord` (absent ⇒ no) —
      *  named because it is the one promise `delete` is checked against
-     *  (language version 5); it is optional, so an older server is unchanged. */
+     *  ; it is optional, so an older server is unchanged. */
     deletable: zod_1.z.boolean().optional(),
 })
     .passthrough();
@@ -705,7 +705,6 @@ exports.WirePluginSpec = zod_1.z.object({
     fedArgs: zod_1.z.array(zod_1.z.object({ name: zod_1.z.string(), required: zod_1.z.literal(true).optional() })).optional(),
     fedByExtraction: zod_1.z.literal(true).optional(),
     output: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
-    earlierOutputs: zod_1.z.array(zod_1.z.object({ before: zod_1.z.number().int().positive(), output: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) })).optional(),
     /** What the plugin does, in its author's words: shown when an author hovers a call. */
     description: zod_1.z.string().optional(),
 });
@@ -739,8 +738,11 @@ exports.WireModuleKind = zod_1.z.enum(exports.MODULE_KINDS);
  *  other host leaves empty (a module asking for a page is refused by name),
  *  and `wake`, which stays empty unless named (nobody is told work is due;
  *  a scheduled worker finds it), and `ocr`, which stays empty unless named
- *  (a scanned file is refused, saying the slot is empty). */
-exports.CORE_SLOTS = ['models', 'judge', 'store', 'files', 'limiter', 'loopGuard', 'browser', 'wake', 'ocr'];
+ *  (a scanned file is refused, saying the slot is empty). `secrets` is
+ *  where credentials are kept (`lf`'s default: its secrets file); a secrets
+ *  module's own settings come from the environment or that file, never
+ *  from itself. */
+exports.CORE_SLOTS = ['models', 'judge', 'store', 'files', 'limiter', 'loopGuard', 'browser', 'wake', 'ocr', 'secrets'];
 exports.WireCoreSlot = zod_1.z.enum(exports.CORE_SLOTS);
 /** One construction argument the install supplies (an Airtable `base`, a
  *  Sheets `spreadsheet`): asked for when the module is set up (`lf connect`,

package/dist/run_input.d.ts

@@ -83,13 +83,13 @@ export interface RunInput {
      */
     credentialIds?: Readonly<Record<string, string>>;
     /** What each segment of the run may consume (docs/contracts/run-limits.md).
-     *  Absent ⇒ the engine's defaults. Version 5 and later (the Rust engine). */
+     *  Absent ⇒ the engine's defaults. (The Rust engine.) */
     limits?: SegmentLimits;
     /** How long each segment may take, waits on the host included, in whole
      *  seconds. The host keeps it, not the engine: past it, the requests already
      *  at the host finish, nothing more is served, and the segment fails with
      *  MOVENG_LIMIT_WALL_CLOCK. Absent ⇒ the deployment's
-     *  MOVEMENT_MAX_SEGMENT_SECONDS, else 900. Version 5 and later. */
+     *  MOVEMENT_MAX_SEGMENT_SECONDS, else 900. */
     maxSegmentSeconds?: number;
 }
 /** A segment's limits, each a whole positive number; an absent one is the

package/dist/slots/index.d.ts

@@ -5,3 +5,4 @@ export * from './files';
 export * from './browser';
 export * from './wake';
 export * from './ocr';
+export * from './secrets';

package/dist/slots/index.js

@@ -24,3 +24,4 @@ __exportStar(require("./files"), exports);
 __exportStar(require("./browser"), exports);
 __exportStar(require("./wake"), exports);
 __exportStar(require("./ocr"), exports);
+__exportStar(require("./secrets"), exports);

package/dist/slots/judge.d.ts

@@ -12,7 +12,7 @@ export declare const JudgeArbitrateRequest: z.ZodObject<{
             }, z.core.$strip>>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
-    languageVersion: z.ZodNumber;
+    languageVersion: z.ZodString;
 }, z.core.$strip>;
 export type JudgeArbitrateRequestShape = z.infer<typeof JudgeArbitrateRequest>;
 export declare const JudgeArbitrateAnswer: z.ZodObject<{

package/dist/slots/judge.js

@@ -16,8 +16,8 @@ exports.JudgeArbitrateRequest = zod_1.z.object({
     candidates: zod_1.z.array(zod_1.z.record(zod_1.z.string(), zod_1.z.unknown())),
     recordType: zod_1.z.string(),
     constraints: protocol_1.WireUniquenessConstraints,
-    /** The asking run's language version: whether a blank key is a key. */
-    languageVersion: zod_1.z.number().int().positive(),
+    /** The asking run's pin (a release's version): whether a blank key is a key. */
+    languageVersion: zod_1.z.string(),
 });
 exports.JudgeArbitrateAnswer = zod_1.z.object({
     index: zod_1.z.number().int().nonnegative().nullable(),

package/dist/slots/secrets.d.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+export declare const SECRETS_METHODS: readonly ["secrets.resolve", "secrets.writeBack", "secrets.list", "secrets.lock", "secrets.unlock", "secrets.assertWritable", "secrets.create", "secrets.replace", "secrets.delete"];
+/** What `secrets.resolve` answers (or null: nothing is stored under the ref). */
+export declare const SecretsRecord: z.ZodObject<{
+    fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    version: z.ZodString;
+}, z.core.$strip>;
+export declare const SecretsWriteBackAnswer: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"written">;
+    record: z.ZodObject<{
+        fields: z.ZodRecord<z.ZodString, z.ZodString>;
+        version: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"not_persisted">;
+    record: z.ZodObject<{
+        fields: z.ZodRecord<z.ZodString, z.ZodString>;
+        version: z.ZodString;
+    }, z.core.$strip>;
+    why: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"conflict">;
+    current: z.ZodObject<{
+        fields: z.ZodRecord<z.ZodString, z.ZodString>;
+        version: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"missing">;
+}, z.core.$strip>], "kind">;
+/** How an entry is bound: an install of a module, a hand-written legacy
+ *  entry, or a credential the module declares. */
+export declare const SecretsBinding: z.ZodUnion<readonly [z.ZodLiteral<"install">, z.ZodLiteral<"legacy">, z.ZodObject<{
+    credential: z.ZodString;
+}, z.core.$strip>]>;
+export type SecretsBindingShape = z.infer<typeof SecretsBinding>;
+export declare const SecretsListed: z.ZodObject<{
+    ref: z.ZodString;
+    external: z.ZodString;
+    binding: z.ZodUnion<readonly [z.ZodLiteral<"install">, z.ZodLiteral<"legacy">, z.ZodObject<{
+        credential: z.ZodString;
+    }, z.core.$strip>]>;
+    version: z.ZodString;
+}, z.core.$strip>;
+/** `secrets.lock` answers a token, or null when another holds the lease. */
+export declare const SecretsLockAnswer: z.ZodNullable<z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strip>>;
+/** What `secrets.assertWritable`, `create`, `replace` and `delete` answer
+ *  besides null: the module keeps its credentials where lf cannot change them. */
+export declare const SecretsReadOnlyAnswer: z.ZodObject<{
+    kind: z.ZodLiteral<"read_only">;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export declare const SecretsEntryAnswer: z.ZodNullable<z.ZodObject<{
+    kind: z.ZodLiteral<"read_only">;
+    reason: z.ZodString;
+}, z.core.$strip>>;
+export declare const SecretsEntryRequest: z.ZodObject<{
+    ref: z.ZodString;
+    external: z.ZodString;
+    binding: z.ZodUnion<readonly [z.ZodLiteral<"install">, z.ZodLiteral<"legacy">, z.ZodObject<{
+        credential: z.ZodString;
+    }, z.core.$strip>]>;
+    fields: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;

package/dist/slots/secrets.js

@@ -0,0 +1,40 @@
+"use strict";
+// The secrets slot's methods (docs/contracts/secrets-slot.md): where lf's
+// credentials are kept. A module resolves and lists what it holds, takes a
+// write-back by version, holds a credential under a lease while a refresh
+// spends its token, and changes whole entries for `lf connect` and
+// `lf credential`. Token refresh stays in lf; a module only stores.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsEntryRequest = exports.SecretsEntryAnswer = exports.SecretsReadOnlyAnswer = exports.SecretsLockAnswer = exports.SecretsListed = exports.SecretsBinding = exports.SecretsWriteBackAnswer = exports.SecretsRecord = exports.SECRETS_METHODS = void 0;
+const zod_1 = require("zod");
+exports.SECRETS_METHODS = [
+    'secrets.resolve',
+    'secrets.writeBack',
+    'secrets.list',
+    'secrets.lock',
+    'secrets.unlock',
+    'secrets.assertWritable',
+    'secrets.create',
+    'secrets.replace',
+    'secrets.delete',
+];
+const Fields = zod_1.z.record(zod_1.z.string(), zod_1.z.string());
+/** What `secrets.resolve` answers (or null: nothing is stored under the ref). */
+exports.SecretsRecord = zod_1.z.object({ fields: Fields, version: zod_1.z.string().min(1) });
+exports.SecretsWriteBackAnswer = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal('written'), record: exports.SecretsRecord }),
+    zod_1.z.object({ kind: zod_1.z.literal('not_persisted'), record: exports.SecretsRecord, why: zod_1.z.string() }),
+    zod_1.z.object({ kind: zod_1.z.literal('conflict'), current: exports.SecretsRecord }),
+    zod_1.z.object({ kind: zod_1.z.literal('missing') }),
+]);
+/** How an entry is bound: an install of a module, a hand-written legacy
+ *  entry, or a credential the module declares. */
+exports.SecretsBinding = zod_1.z.union([zod_1.z.literal('install'), zod_1.z.literal('legacy'), zod_1.z.object({ credential: zod_1.z.string().min(1) })]);
+exports.SecretsListed = zod_1.z.object({ ref: zod_1.z.string().min(1), external: zod_1.z.string().min(1), binding: exports.SecretsBinding, version: zod_1.z.string() });
+/** `secrets.lock` answers a token, or null when another holds the lease. */
+exports.SecretsLockAnswer = zod_1.z.object({ token: zod_1.z.string().min(1) }).nullable();
+/** What `secrets.assertWritable`, `create`, `replace` and `delete` answer
+ *  besides null: the module keeps its credentials where lf cannot change them. */
+exports.SecretsReadOnlyAnswer = zod_1.z.object({ kind: zod_1.z.literal('read_only'), reason: zod_1.z.string().min(1) });
+exports.SecretsEntryAnswer = exports.SecretsReadOnlyAnswer.nullable();
+exports.SecretsEntryRequest = zod_1.z.object({ ref: zod_1.z.string().min(1), external: zod_1.z.string().min(1), binding: exports.SecretsBinding, fields: Fields });

package/dist/slots/wire.d.ts

@@ -39,6 +39,7 @@ export declare const WireSlotManifest: z.ZodObject<{
         browser: "browser";
         wake: "wake";
         ocr: "ocr";
+        secrets: "secrets";
     }>;
     methods: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;

package/dist/uniqueness.d.ts

@@ -25,7 +25,7 @@ export declare function mergeUniqueness(a: UniquenessConstraints | undefined, b:
  * An identity key component that says nothing: absent, or text with nothing
  * in it. An empty key is no key — two records that both lack a name are not
  * thereby the same record — so such a component never matches and is never
- * matched on. Blank text is no key at every pin: version 1's matching of ""
+ * matched on. Blank text is no key at every pin: the earlier matching of ""
  * like any other value is retired. The pin is still taken so the rules keep
  * one signature with the rest of this file.
  */

package/dist/uniqueness.js

@@ -42,7 +42,7 @@ function mergeUniqueness(a, b) {
  * An identity key component that says nothing: absent, or text with nothing
  * in it. An empty key is no key — two records that both lack a name are not
  * thereby the same record — so such a component never matches and is never
- * matched on. Blank text is no key at every pin: version 1's matching of ""
+ * matched on. Blank text is no key at every pin: the earlier matching of ""
  * like any other value is retired. The pin is still taken so the rules keep
  * one signature with the rest of this file.
  */

package/dist/versions.d.ts

@@ -1,8 +1,8 @@
 import { CATALOG_SNAPSHOT_VERSION, DEPRECATED_CATALOG_SNAPSHOT_VERSIONS, SUPPORTED_CATALOG_SNAPSHOT_VERSIONS } from '@listen-fire/movement-lang';
 export { CATALOG_SNAPSHOT_VERSION, DEPRECATED_CATALOG_SNAPSHOT_VERSIONS, SUPPORTED_CATALOG_SNAPSHOT_VERSIONS };
 /** A parked flow's state (docs/contracts/park-state.md). Engine to engine: a
- *  host stores it and hands it back. Version 2 is the Rust engine's (language
- *  version 5 on); the TypeScript engine (versions 1–4) writes and reads 1. */
+ *  host stores it and hands it back. Version 2 is the Rust engine's; the earlier
+ *  TypeScript engine wrote and read 1. */
 export declare const PARK_STATE_VERSION = 2;
 /** The park state versions this release reads: each engine its own. */
 export declare const SUPPORTED_PARK_STATE_VERSIONS: ReadonlySet<number>;
@@ -42,17 +42,19 @@ export declare const CONTRACTS: {
         readonly supported: readonly [2];
         readonly deprecated: readonly [];
     };
-    readonly 'language-versions': {
-        readonly current: number;
-        readonly supported: readonly number[];
-        readonly deprecated: readonly number[];
-    };
     readonly 'system-caller': {
         readonly current: 1;
         readonly supported: readonly [1];
         readonly deprecated: readonly [];
     };
 };
+/** The language's contract (docs/contracts/language-versions.md) is not an
+ *  integer of its own: it is the release's version, and a release reads the
+ *  pins that share its compatibility key. */
+export declare const LANGUAGE_CONTRACT: {
+    readonly version: string;
+    readonly key: string | undefined;
+};
 /** Refuse a `segment.open` whose host families version this host does not
  *  serve: it names the contract, the version it was handed and the ones it
  *  serves. An opening that names no version is refused the same way. */

package/dist/versions.js

@@ -1,5 +1,5 @@
 "use strict";
-// The six contracts' versions, as one table. Each is an integer the contract's
+// The integer contracts' versions, as one table. Each is an integer the contract's
 // doc under docs/contracts/ states, and a test holds each constant here equal
 // to its doc and the table equal to docs/contracts/README.md.
 //
@@ -8,7 +8,7 @@
 // the version at the point of difference, never by a forked reader. A version
 // this release does not support is refused at the boundary, loudly.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONTRACTS = exports.SYSTEM_CALLER_VERSION = exports.SUPPORTED_HOST_FAMILIES_VERSIONS = exports.HOST_FAMILIES_VERSION = exports.SUPPORTED_PARK_STATE_VERSIONS = exports.PARK_STATE_VERSION = exports.SUPPORTED_CATALOG_SNAPSHOT_VERSIONS = exports.DEPRECATED_CATALOG_SNAPSHOT_VERSIONS = exports.CATALOG_SNAPSHOT_VERSION = void 0;
+exports.LANGUAGE_CONTRACT = exports.CONTRACTS = exports.SYSTEM_CALLER_VERSION = exports.SUPPORTED_HOST_FAMILIES_VERSIONS = exports.HOST_FAMILIES_VERSION = exports.SUPPORTED_PARK_STATE_VERSIONS = exports.PARK_STATE_VERSION = exports.SUPPORTED_CATALOG_SNAPSHOT_VERSIONS = exports.DEPRECATED_CATALOG_SNAPSHOT_VERSIONS = exports.CATALOG_SNAPSHOT_VERSION = void 0;
 exports.refuseUnsupportedHostFamiliesVersion = refuseUnsupportedHostFamiliesVersion;
 exports.refuseUnsupportedParkStateVersion = refuseUnsupportedParkStateVersion;
 const movement_lang_1 = require("@listen-fire/movement-lang");
@@ -17,8 +17,8 @@ Object.defineProperty(exports, "DEPRECATED_CATALOG_SNAPSHOT_VERSIONS", { enumera
 Object.defineProperty(exports, "SUPPORTED_CATALOG_SNAPSHOT_VERSIONS", { enumerable: true, get: function () { return movement_lang_1.SUPPORTED_CATALOG_SNAPSHOT_VERSIONS; } });
 const protocol_1 = require("./protocol");
 /** A parked flow's state (docs/contracts/park-state.md). Engine to engine: a
- *  host stores it and hands it back. Version 2 is the Rust engine's (language
- *  version 5 on); the TypeScript engine (versions 1–4) writes and reads 1. */
+ *  host stores it and hands it back. Version 2 is the Rust engine's; the earlier
+ *  TypeScript engine wrote and read 1. */
 exports.PARK_STATE_VERSION = 2;
 /** The park state versions this release reads: each engine its own. */
 exports.SUPPORTED_PARK_STATE_VERSIONS = new Set([1, 2]);
@@ -45,13 +45,15 @@ exports.CONTRACTS = {
         deprecated: [],
     },
     'adapter-protocol': { current: protocol_1.MANIFEST_PROTOCOL_VERSION, supported: [protocol_1.MANIFEST_PROTOCOL_VERSION], deprecated: [] },
-    'language-versions': {
-        current: movement_lang_1.CURRENT_LANGUAGE_VERSION,
-        supported: [...movement_lang_1.SUPPORTED_LANGUAGE_VERSIONS],
-        deprecated: [...movement_lang_1.DEPRECATED_LANGUAGE_VERSIONS],
-    },
     'system-caller': { current: exports.SYSTEM_CALLER_VERSION, supported: [exports.SYSTEM_CALLER_VERSION], deprecated: [] },
 };
+/** The language's contract (docs/contracts/language-versions.md) is not an
+ *  integer of its own: it is the release's version, and a release reads the
+ *  pins that share its compatibility key. */
+exports.LANGUAGE_CONTRACT = {
+    version: movement_lang_1.LANGUAGE_VERSION,
+    key: (0, movement_lang_1.compatibilityKey)(movement_lang_1.LANGUAGE_VERSION),
+};
 /** Refuse a `segment.open` whose host families version this host does not
  *  serve: it names the contract, the version it was handed and the ones it
  *  serves. An opening that names no version is refused the same way. */

package/dist/write_record.d.ts

@@ -108,7 +108,7 @@ export interface WriteRecord {
      *  target system computed that the author never wrote. In-memory
      *  handle-read surface only. */
     resultData?: Record<string, unknown>;
-    /** What the record held when the write found it (version 4 on): the values
+    /** What the record held when the write found it: the values
      *  the handle reads for fields its write neither sent nor got back. Kept
      *  apart from `resultData` because a handle that parents a later write
      *  hands the adapter only what its own write got back (`ParentLink.data`),
@@ -124,7 +124,7 @@ export interface WriteRecord {
         edgeName: string;
         toRecordType: string;
         toExternalId: string;
-        /** Version 1's link body: the to side was FOUND by the body's criteria
+        /** The earlier language's link body: the to side was FOUND by the body's criteria
          *  in the same statement — never created, never written — rather than a
          *  bound handle. */
         foundTarget?: boolean;
@@ -157,8 +157,8 @@ export interface WriteRecord {
      */
     note?: string;
     /**
-     * This record is a SNAPSHOT — a record as it once stood (`-[:@old]->`,
-     * version 4 on), not a live position — so it has no address: it is equal
+     * This record is a SNAPSHOT — a record as it once stood (`-[:@old]->`),
+     * not a live position — so it has no address: it is equal
      * only to itself, never to the live handle that shares its id.
      */
     snapshot?: true;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@listen-fire/engine-contracts",
   "license": "Apache-2.0",
-  "version": "0.12.0-rc.6",
+  "version": "0.12.0-rc.8",
   "description": "The contracts the movement engine speaks: the tenant id, the host families and entry-point inputs, the parked state, file descriptors, the adapter protocol, the adapter contract and its manifest, the catalog's schema types and positions, the Expression vocabulary, plugins as data and the model names. Runtime-neutral: no Node import, no ambient types.",
   "engines": {
     "node": "22.20.0"
@@ -30,7 +30,7 @@
   "type": "commonjs",
   "dependencies": {
     "zod": "4.1.12",
-    "@listen-fire/movement-lang": "^0.12.0-rc.6"
+    "@listen-fire/movement-lang": "^0.12.0-rc.8"
   },
   "devDependencies": {
     "@types/node": "20.16.5",