@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.4

package/CHANGELOG.md

@@ -1,5 +1,271 @@
 # @marinoscar/platform-api
 
+## 0.1.0-next.4
+
+### Minor Changes
+
+- a426fd8: Open the AI capability and operation vocabularies, add a custom-operation port, richer transcription results and per-feature usage (PP-14.17). API: `registerAiCapability` and `registerAiOperation` (the 14 built-in capabilities and the usage operations register through them; `AiCapability` and `AiUsageOperation` become `Builtin | (string & {})`; `AI_CAPABILITIES` stays as a deprecated alias of `BUILTIN_AI_CAPABILITIES`); `AiProviderAdapter.operations` and `AiService.forUser(...).run(operationId, input)` run an app's operation through the same gate pipeline as a built-in port (kill switch, schema-validated input and output, model and capability gates, key policy, rate limits, one usage row, one span), never logging or recording its input or output and refusing an output or an error that carries the key; `AiTranscriptionResult.extras` (speaker-labelled segments, language and any JSON, at most 64 KiB, dropped when malformed) reaches the run output, and a transcription's `providerOptions` is bounded to 4 KiB and never logged; `GET /api/admin/ai/capabilities` (`ai_config:read`) lists the vocabularies; the usage reports take a `feature` filter and group by `feature` and `operation`; `AiModule.forRoot({ pricing })` binds the `AI_PRICING` port and the admin and organization reports then carry `priced` and a `cost` per bucket. The provider conformance kit gains `operations.*` scenarios, `FakeAiProvider` gains `operations` and `transcriptionExtras`, and `ai-secret-egress` covers the new route and fields. Contract: `AI_CAPABILITY_ID_PATTERN`, `AI_OPERATION_ID_PATTERN`, `AI_FEATURE_ID_PATTERN` and the capability, operation and cost schemas. Web: `registerAiPlaygroundMode` (subpath `/ai/ui/playground-modes`; the six built-in modes register through it, DOM unchanged; the fixed `AI_PLAYGROUND_MODES` tuple and `AiModePlaceholder` are removed), `useAiCapabilities` and `registerAiCapabilityLabel` (the Models page filter and the override dialog list an app's capabilities), Feature and Operation breakdowns, a Cost tile and column on a priced usage report, and speaker-labelled transcripts. DB: migration `0035_ai_usage_feature` adds the nullable `feature` column to `ai_usage_events` and `ai_runs` and the `(org_id, feature, created_at)` index on usage (both tables are row-level-security tables, so the migration runs in the `app.rls_bypass` transaction form); apply it with `npm run db:sync`, then `prisma:migrate`. Back-compat: every existing route, shape and id is unchanged; rows written before the column have no feature. The OpenAPI document shows a pattern where the models list's `capability` query and a provider's `supportedCapabilities` showed an enum.
+- b2df59a: Let an app or package add an AI provider (PP-14.6, #924): `registerAiProvider(AiProviderDefinition)` of `@marinoscar/platform-api/ai`, backed by the `ai-provider` pluggable kind. A definition carries the provider's id, label, Nest module, zod `settingsSchema` and `defaults` for its non-secret settings, `requiresKey`, `requiresBaseUrl`, `help` and `sdkPackages`; the five built-ins register through the same function. `AiModule.forRoot({ providers })` takes any registered id (default: every registered definition) and imports each definition's `module`; the closed `AiProviderModuleId` union (now `string`) and `PROVIDER_MODULES` are gone.
+
+  `ai.providers` is a record keyed by provider id (`aiProviderIdSchema`, `aiProviderSlotSchema`; `BUILTIN_AI_PROVIDER_IDS`, with `AI_PROVIDER_IDS` kept as a deprecated alias). The namespace reads, merges and validates each slot with its provider's `settingsSchema`: an unregistered id is `400 AI_UNKNOWN_PROVIDER` on write and dropped with one warning on read, so removing a provider never bricks the row. The stored shape of the five built-ins is unchanged. `AI_PROVIDER_SETTINGS_FIELDS` and `PROVIDERS_REQUIRING_BASE_URL` are replaced by the definition; `providerRequiresKey(slot, providerId?)` takes the provider id.
+
+  `GET /api/admin/ai/config` gains `descriptors` (one `PluggableDescriptor` per registered provider) and, per provider, `settings`, `requiresBaseUrl` and `help`; `settingsFields` is now `string[]`. `createAiRuntimeHarness` takes `extraProviders`, `extraAdapters` and `extraProviderSettings`; `ai-no-sdk-leak` takes `providerDirs` and bans the registered definitions' `sdkPackages` outside them; the provider conformance kit checks the provider id pattern (no underscore). `describeConfigField` unwraps `default` and `prefault`.
+
+  Web: `registerAiProviderCard(id, Component)` (`@marinoscar/platform-web/ai/ui`, and the new `/ai/ui/provider-cards` subpath) chooses the component that draws a provider on the admin AI page. The five built-ins register their bespoke cards through it (markup unchanged); any other provider is drawn by `AiGenericProviderCard` from the descriptor the API serves: a switch, `PluggableConfigForm` for its settings and a write-only key with the deployment-key actions, saved as `{ enabled, ...settings }`. The endpoint rule and help text come from the API (`requiresBaseUrl`, `help`) instead of a switch on the provider id; `AiAdminProvider` gained `settings`, `requiresBaseUrl` and `help`, `AiAdminConfig` gained `descriptors`, and `AiProviderSettingsField` is now `string`.
+
+- 3bc72e9: Fix the admin AI page failing to save once an app registers an AI adapter under a new provider id (#921). `GET /api/admin/ai/config` marks a provider that has no settings slot `configurable: false` (a new optional field of the admin provider shape, absent otherwise); `PUT /api/admin/ai/config` ignores such an entry when it is submitted as listed (disabled, no settings) and still answers `400 AI_UNKNOWN_PROVIDER` for any other payload for it and for an id the registry does not know. `AiConfigPage` shows these providers as "Registered, not configurable yet" and does not submit them. The page is unchanged when every provider has a slot.
+- 823ec07: Add the AI slice: `@marinoscar/platform-api/ai` (`AiModule.forRoot` with the `AI_SYSTEM_PRISMA`, `AI_OBJECT_STORE` and `AI_METRICS` host ports, `AiService.forUser(userId, { orgId, feature })` and the gate pipeline, the OpenAI, Anthropic, Gemini, Azure OpenAI and OpenAI-compatible adapters with their SDKs confined to `ai/providers/`, the model catalogue, the `ai` settings namespaces with a tighten-only org layer, the organization key tier (`/api/admin/ai/org-keys`, `org_ai_config:read`/`write`) and `deploymentKeyServesOrgs`, per-organization daily caps (`limits.perOrg`) and usage (`/api/admin/ai/org-usage`, `groupBy=org`), `registerAiFeature` and `GET /api/ai/features`, `AI_TARGET_RESOLVER`, `UserAiKeysService.importKey`, the `ai-outputs/` key prefix registered with the storage slice, and at `/ai/testing` the fake provider, runtime harness, adapter conformance kit and `runOrchestrationBoundarySuite`), `@marinoscar/platform-contract/ai` (the `ai` namespace schemas, `orgAiSettingsSchema`, `tightenAiPolicy`, the org-key and feature shapes) and `@marinoscar/platform-web/ai` (`useOrgAiKeys`, `useOrgAiPolicy`, `OrgAiKeysPage`).
+- 5d59664: Add `@marinoscar/platform-api/android-app` (trusted apps with typed validation, the public assetlinks route, streamed APK releases with signed download links, the Android test notification, the `android.assetlinks` and `android.releases` doctor checks, the device-source registry and its conformance suite) and the notifications slice's `android_app` channel with `coveredBy` collapse and the push subscription `platform` (#746). The storage key-prefix registry accepts `survivesFactoryReset`.
+- 6a7af76: Add the email slice: `@marinoscar/platform-api/email` (`EmailModule.forRoot`, the SES and SMTP transports with inline attachments, the `email` settings row on `SystemSettingsRowStore`, the template registry with `EmailTemplateDataMap` augmentation and explicit overrides, the layout theme and brand-mark slot, the safe-HTML helpers, the `email` conformance suite at `/email/testing`), `@marinoscar/platform-contract/email` (the admin route DTOs) and `@marinoscar/platform-web/email` (`useEmailSettings`, `EmailSettingsPage`); `SystemSettingsRowStore.write` accepts `auditMeta`, and `PlatformViewer` an optional `email`.
+- 0b9962b: Add `@marinoscar/platform-api/exports` and `/exports/testing` (#744): `ExportsModule.forRoot({ datamodel, appSlug, retentionDays, downloadUrlTtlSeconds, maxInFlightPerSubject, jobProfile, purgeProfile, platformSources, legacyJobTypes, imports })`, the export source and writer registries (`registerExportSource`, `registerExportWriter`), the `user-data` and `org-data` sources driven by the user-owned and ownership registries with a default redaction rule, the `json`, `csv` (zip) and `xlsx` streaming writers, the CSV helpers (`UTF8_BOM`, `csvField`, `neutralizeFormula`, `csvRecord`, `csvCell`), the `Exporter` / `ExporterRegistry` document primitives with `optionsSchemaFor` and `hashExportRequest`, the server-only `export.run` and `export.purge` jobs, `/api/exports`, the `EXPORTS_SYSTEM_DATA` and `EXPORTS_NOTIFIER` ports, the `export.ready` / `export.failed` events, the three export metrics and the `exports` conformance suite (secret egress). Core gains the `export` system access reason.
+- 5eec778: Host: the event bus is pluggable. `registerEventBusAdapter({ id, label, create })` and `eventBusAdapterRegistry` add an adapter (Redis, NATS, a test double) that `EVENT_BUS_ADAPTER` and `PlatformHostCoreModule.forRoot({ eventBusAdapter })` select by id; `in-process` and `postgres` register through the same function. `forRoot({ eventBus })` takes a `PortBinding<EventBus>` that replaces the bus for every package consumer (a provider of `EVENT_BUS` in the app module never reached them, because the host core is global). `EventBusAdapterName` widens to any registered id, `EVENT_BUS_ADAPTERS` is now a deprecated alias of `BUILTIN_EVENT_BUS_ADAPTERS`, `EventBus` gains an optional `close()`, and `describeEventBusConformance` is exported from `@marinoscar/platform-api/host/testing`. Migration: an `eventBusAdapter` option naming an unregistered id now fails the boot instead of falling back to `in-process` (an unregistered `EVENT_BUS_ADAPTER` environment value still falls back with one warning).
+- fe0b900: Move the health probes (`GET /api/health`, `/live`, `/ready`, with `DatabaseHealthIndicator` reading through `PLATFORM_PRISMA`) and `buildCorsOptions` / `isSameOriginOnly` into `@marinoscar/platform-api/host` (#901). `PlatformHostCoreModule.forRoot()` now mounts the health controller; `@nestjs/terminus` is a new peer dependency. Routes, responses and the OpenAPI document are unchanged.
+- 1d8cbae: Add `@marinoscar/platform-api/host` (#867): `PlatformHostCoreModule.forRoot()` packages the API host core every slice assumed, moved from the reference app: the cross-replica event bus (`EVENT_BUS`, `in-process` or `postgres` by `EVENT_BUS_ADAPTER`, with its `core.event-bus` doctor check), the platform's `AppMetricsService` and app-metric declarations (`registerPlatformHostAppMetrics`), maintenance mode (`MaintenanceModeService`, `/api/admin/maintenance`, the `maintenance` settings namespace `MAINTENANCE_SYSTEM_SETTINGS`, the `maintenance.mode` doctor check and `MaintenanceGuard` as the only `APP_GUARD`), the `{ data }` envelope, the request log line, the exception filter and request ids; plus the OpenAPI document and `/api/docs` (`createOpenApiDocument`, `registerPlatformDocs`), and the `host` conformance suite (`@marinoscar/platform-api/host/testing`). `platform-cli`: a comment now names the packaged envelope interceptor.
+- 5227c88: Add `@marinoscar/platform-api/jobs` and `/nodes` (#734): the background job queue (`JobsModule.forRoot()`, the handler contract and registry, the job-type label registry `registerJobTypeLabel`, `JobScope.run`, `enqueueHousekeepingJob`, `job.settled`, `org_id` on enqueued jobs and as the `org.id` span attribute, an `orgId` filter on `GET /api/admin/jobs`) and the worker-node fleet (`NodesModule.forRoot()`, `NodeCredentialModule`, the node control and data planes through the `NODE_OBJECT_STORE` port, the brokered per-job secret, the `nodes.node.offline` event). Moved from the reference app with unchanged routes, permissions and environment variables; `JOB_TYPE_LABELS` is replaced by a `label` on each handler. A cron-enqueue-only exemption may now pin the source `root` it lives under.
+- 96d5b2b: Add the platform model ownership classification to `@marinoscar/platform-api/manifest`: `PLATFORM_MODEL_OWNERSHIP` (every platform model's `org`, `org-optional`, `user` or `system` kind) and `registerPlatformModelOwnership(appModels)`, so an app's ownership registry covers platform and app models without a copied list.
+- a389cc5: Add `@marinoscar/platform-api/manifest`: the platform roles and every slice's permission sets in seed order (`PLATFORM_ROLES`, `PLATFORM_PERMISSION_SETS`, `PLATFORM_PERMISSIONS`), `registerPlatformPermissions()` and the pure `platformPermissionCatalog()` (with the app's own roles and permissions and an optional `slices` filter) for `seedPlatform`, and the inventory of platform models with a foreign key to `User` (`PLATFORM_USER_OWNED_MODELS`, `registerPlatformUserOwnedModels()`), so the `userOwnedData` suite covers platform and app models in any app.
+- deeb8b5: Add the notifications slice: `@marinoscar/platform-api/notifications` (`NotificationsModule.forRoot`, the event, channel and template registries with open channel ids and `registerNotificationChannel`, `NotificationsService` with org-aware policy, the `notifications` system namespace with an org layer that only tightens, runtime Web Push (VAPID) configuration on `SystemSettingsRowStore`, broadcasts with `targetOrgId` and the org-scoped `org_broadcasts:*` pair, the SSE stream on `NOTIFICATIONS_EVENT_BUS`, the email channel forwarding template attachments, the `notifications` conformance suite at `/notifications/testing`), `@Auth({ anyPermissions })` in the identity slice, a `SystemSettingsRowStore` row key that admits camelCase (`webPush`), `@marinoscar/platform-contract/notifications` (the wire shapes, `BROADCAST_CHUNK_SIZE`), `@marinoscar/platform-web/notifications/{headless,ui}` (`configureNotificationsWeb`, `NotificationProvider`, `usePushSubscriptionSync`, `NotificationBell` with slots, the banner and the four pages, the service-worker helpers `registerNotificationServiceWorkerHandlers`, `handlePushEvent`, `handleNotificationClick`, `handlePushSubscriptionChange`), any-of card permissions in the settings hub (`SettingsCardDef.permission: string | readonly string[]`, `cardPermissionGranted`), and the platform migration `0032_add_broadcast_target_org` (`notification_broadcasts.target_org_id`).
+- 077c0c0: Add the `./onboarding` and `./onboarding/testing` subpaths (#745): `OnboardingModule.forRoot({ adminPermission, initialAdminEmailEnv, imports })` with `GET /api/onboarding` (the stored UI state and the derived user and admin checklists, read-only, `refresh` forwarded to the Doctor) and `GET /api/admin/onboarding/metrics` (one aggregate statement: cohort, step funnel and per-milestone activation); the step, fact, ordering and activation-milestone registries with the platform's built-in facts and steps; the `onboarding` user-settings namespace (`ONBOARDING_USER_SETTINGS`, `extendOnboardingSettings`); the host ports `ONBOARDING_DATA` and `ONBOARDING_FEATURES`; and the `onboarding` conformance suite.
+- 6503022: Package the role and permission registries in `@marinoscar/platform-api/core`: `roleRegistry`, `permissionRegistry`, `registerRoles`, `registerPermissions`, `permissionIds`, `roleIds`, the declaration types (`RoleDeclaration`, `PermissionDeclaration`, `PermissionScope`) and the seed catalog built from them (`buildPermissionCatalog`, the detached `composePermissionCatalog`, `catalogGrants`), so an app no longer copies them.
+- a20f306: Move the retention engine into the slices that own the data. `@marinoscar/platform-api/jobs` now exports the one shared `purgeInBatches` / `runRetentionPolicyPurge` loop (the duplicate under `ai/runtime` is gone), the `RetentionPurgeRegistry` a purge handler declares its `retention.*` policy in, the 01:00 enqueue-only `RetentionPurgeTask`, the `retention` settings namespace (`RETENTION_SYSTEM_SETTINGS`, registered by `JobsModule.forRoot()` unless the app's manifest lists it) and `AuditEventsPurgeHandler`; `@marinoscar/platform-api/notifications` provides `notifications.inbox.purge` and `notifications.deliveries.purge`; `ai.runs.purge` uses the shared loop; `@marinoscar/platform-contract/jobs` carries the `retention` schemas. Job type strings and the OpenAPI document are unchanged.
+- fc11b22: Add the `./settings` and `./settings/testing` subpaths (#733): `SettingsModule.forRoot({ systemRowKey, orgLayer, imports })` with `/api/system-settings` and `/api/user-settings` (moved unchanged, the same OpenAPI document) and the new `/api/org-settings` (`org_settings:read|write`, `If-Match`, per-namespace permission filtering); the system and user namespace registries with an optional org layer (`override` or a restricting merge) and `forbiddenKeys`, refusing secret-named fields (now including `privateKey`); `SystemSettingsService`, `UserSettingsService`, `OrgSettingsService`, `SettingsResolver` (system, then org, then user) and `SystemSettingsRowStore`; the host ports `SETTINGS_DATA` and `SETTINGS_PROFILE_IMAGES`; the permission, model-ownership and user-owned declarations; and the `settings` conformance suite.
+- fa1b37b: The sharing slice's conformance suite (#732): importing the new `@marinoscar/platform-api/sharing/testing` entry registers the `sharing` suite with `runPlatformConformance()`. Five checks against the consuming app: no source file touches the sharing tables directly (`prisma.grant`, `.group`, `.groupMember`, `.groupInvite`, or `grants`/`groups`/`group_members`/`group_invites` in raw SQL), every `owner_group_id` model maps to a registered group-owned resource type, every `@LinkGrantResource` route is behind `LinkGrantGuard` (declared, servable, deliberately public), the three partial unique indexes exist in the migration SQL, and the registered resource type ids equal the app's snapshot.
+- 28ca9bb: Add grants to `@marinoscar/platform-api/sharing` (#729): `registerResourceType()` (the resource-type registry, validated at registration), `AccessPolicy` (`can`, `decide`, `require`, `roleFor`, `decideMany`: owner, group owner, active unexpired grants and the org default, batched and memoised per request), the "resources I can see" helpers `accessibleWhere`, `accessibleSql` and `sharedResourceIds`, the `/api/grants` routes with the `sharing:read`, `sharing:write` and `sharing:admin` org permissions, `GrantsService.deleteForResources()`, the `sharing.shared_with_you` notification, the `sharing.grant.*` events, the `app.sharing.access_decisions` counter, the optional `SHARING_JOBS` port and the server-only `sharing.grants.prune` job with its enqueue-only daily cron (`grants.retentionDays`, default 90).
+- d2501c7: Add the `./sharing` subpath (#728): `SharingModule.forRoot({ host, imports, groups })` with the `/api/groups` routes (groups, members, invites, the invitee's own invites), 404 non-disclosure, the last-admin rule, read-time invite expiry, a per-account throttle on failed member lookups by e-mail, audit rows with `org_id`, the `sharing.groups.orphaned` Doctor check and the `app.sharing.group_mutations` counter. Also the ownership contract (`ResourceOwner`, `registerGroupOwnedResource`, `ownedByMeOrMyGroups`), `PrincipalGroupsProvider` (lazy, cached, bus-invalidated `Scope.groupIds`), the host ports `SHARING_DATA`, `SHARING_EVENT_BUS`, `SHARING_EVENT_EMITTER`, `SHARING_NOTIFIER` and `SHARING_TENANCY`, the `SHARING_EVENTS`, the `groups.invitation` notification and its renderers, the org-scope `groups:*` permission declarations, the user-owned and model-ownership declarations and `GroupMembershipPurge`.
+- 86267f5: Link shares in `@marinoscar/platform-api/sharing` (#730): `LinkGrantsService` and `/api/grants/links` (mint `lnk_` tokens returned once and stored as a SHA-256 hash plus a ciphertext bound to the grant id; `reuseActive`; 503 without `SECRETS_ENCRYPTION_KEY`), link management through `PATCH`/`DELETE /api/grants/:id` (label, capped expiry, `grant:link:*` audit), the deliberately public `GET /api/public/links/current` (header `X-Link-Token`, one 404 for every failure, a per-address miss throttle with 429), the public-route pattern `LinkGrantGuard`, `@LinkGrantResource`, `@CurrentLinkGrant`, `LinkGrantsService.withLinkScope` and `PublicLinkInterceptor`, `importLegacyToken` for data migrations, the `links` options of `forRoot` and the `app.sharing.link_resolutions` counter.
+- 79d78a9: Storage: `StorageModule.forRoot({ provider })` now replaces the object store for every package consumer (the objects API, profile images, data exports, user-data, database backups, the AI output writer and the nodes data plane). The documented "provide `STORAGE_PROVIDER` in your app module" override never reached them, because each imports `StorageProvidersModule`; the binding is now held by a global `StorageProviderBindingModule` that `StorageProvidersModule` prefers, with `ResolvingStorageProvider` still the default. `StorageProvider` gains a required `kind: string` and rows record `provider.kind` instead of reading `StorageConfigService.activeProvider()`; `ResolvingStorageProvider.kind` answers the configured kind (`StorageConfigService.lastKnownProvider()`). `S3StorageProvider.providerId` is a deprecated alias of `kind`. Migration: a custom `StorageProvider` must add `kind`; `ObjectsService`, `ProfileImageService` and `ExportRunHandler` no longer take `StorageConfigService` in their constructors.
+- 17d6ed1: Add `@marinoscar/platform-api/storage` and `/storage/testing` (#736): `StorageModule.forRoot({ maxSimpleUploadBytes, partSizeBytes, staleUploadHours, imports })`, `STORAGE_PROVIDER` with the runtime-configured S3 driver (`s3`, `r2`, `s3compatible`), `StorageConfigModule` (the `/api/admin/storage-config` routes, connection test, bucket provisioning, the `storage.config` and `storage.bucket` Doctor checks), the objects API with org-aware keys (`uploads/<orgId>/…`; legacy keys keep working), the `ObjectProcessorRegistry` (replacing the optional `OBJECT_PROCESSOR` injection), the key-prefix registry with scopes, `buildObjectKey`, `allKeyPrefixes` and `orgKeyPrefixes`, `runStoragePurge`, `ProfileImageModule.forRoot()`, `nodeObjectStoreBinding`, the `STORAGE_SYSTEM_DATA` port and the `storage` conformance suite. Job types, routes, permissions and the settings namespace are unchanged.
+- 3420fbc: Conformance suites for the remaining invariants. `runPlatformConformance` accepts a suite that registers its own tree (`ConformanceAppSuite`) and an opt-out with a reason (`{ skip: 'reason' }`; an empty reason throws) and prints a summary of suites run and skipped. New suites: `on-event-no-io` (`@marinoscar/platform-api/jobs/testing`) and `ai-kill-switch`, `ai-rbac-matrix`, `ai-secret-egress`, `ai-key-policy`, `ai-jobs-server-only`, `ai-no-sdk-leak` and `ai-orchestration-boundary` (`@marinoscar/platform-api/ai/testing`, with `AiConformanceFixture`). `supertest` becomes an optional peer. `@marinoscar/platform-web/testing` gains `runPlatformWebConformance`, and `@marinoscar/platform-web/settings/testing` registers the settings registry suites.
+- 0426848: Add `@marinoscar/platform-contract/jobs` and `/nodes` (#734): the admin job routes' list query and row (with the new `orgId`), summary, insights and bulk-action schemas, and the worker-node control plane, data plane, per-job secret and node credential request schemas, moved from the API slices' `dto/` files with their comments, plus the zod-free status, reason, window and node bounds. `@marinoscar/platform-api/jobs` and `/nodes` wrap them with `createZodDto` and still re-export every schema under its old name.
+- aef999d: Core seams for link shares (#730): `PlatformAccessPort.allowPublic` (optional; the app's marker for a deliberately public route, validated by `definePlatformHost`), the `link-resolution` `SystemAccessReason` (one `grants` row by its token hash), and the secret cipher no longer caches the sub-key of a purpose containing `:` (row-bound domains such as `sharing.link:<grantId>`, like the per-user ones), so the cache cannot grow with the number of rows. The derivation is unchanged.
+- e834d93: `@marinoscar/platform-api/core` gains `@AllowDuringMaintenance()` (with `ALLOW_DURING_MAINTENANCE_KEY`) and `@ApiDataResponse` (#727), moved from the reference app so packaged controllers can carry the maintenance exemption and document the `{ data: … }` envelope. Metadata keys and OpenAPI output are unchanged. Stability: `stable`.
+- c644e8b: Add organisation scoping and row-level security to the core data-access slice (#725, ADR 0002 D5): `forOrg`, `forScope`, `orgScopeExtension` and `runInOrg`/`runInScope` set the transaction-local `app.org_id` and `app.user_id` before every operation; `forSystem`, `systemScopeExtension` and `runAsSystem` do the same for the bypass flag on a separate system client, with a closed list of `SystemAccessReason`s recorded on the active span. A scoped client refuses to run inside an interactive transaction (its operations would escape it), and `runInOrg` reuses an outer transaction when nested in the same scope. Also adds the model ownership registry (`modelOwnershipRegistry`, `registerModelOwnership`, `modelsOfKind`, `orgFieldOf`, `orgColumnOf`) that classifies every model as `org`, `org-optional`, `user` or `system`.
+- f80189d: Add the pluggable-kind primitive (PP-14.5, #923). `@marinoscar/platform-api/core` gains `definePluggableKind` (one registry of implementations per kind, each with its own zod settings schema, defaults, declared secrets and `build`; settings stored as a record keyed by implementation id with `parseSettings`, `mergeSettingsRecord` that rejects unknown ids on write and `readSettingsRecord` that drops them with one warning on read; `describe` and `describeAll` returning the descriptor a generated form renders, with presence flags for secrets), `PluggableUnknownError`, `PluggableSettingsError` and `describeConfigFields` (the organization settings field description, generalised, adding `label` and `help`). The new `@marinoscar/platform-api/core/testing` entry exports `describePluggableKindConformance`. `@marinoscar/platform-contract/settings` gains `configFieldSchema` (with a write-only `secret` kind), `pluggableDescriptorSchema`, `CONFIG_FIELD_KINDS` and `PLUGGABLE_ID_PATTERN`. `orgSettingsFieldSchema` and the organization settings response are unchanged. `@marinoscar/platform-web/settings/ui` gains `PluggableConfigForm` (the generated configuration form of one implementation: Switch, select, text and number inputs, a note for `other`, a write-only `SecretField` for `secret`, optional `slots`) and `@marinoscar/platform-web/settings/headless` gains `usePluggableConfigForm` (`value`, `secrets`, `dirty`, `setField`, `setSecret`, `reset`, `payload()` which omits untouched secrets). The settings web slice now depends on the credentials slice.
+- 9f43478: `OrgMembership` gains an optional `status` (`'active' | 'suspended'`, absent means active), so a principal can list every organisation the user belongs to, suspended ones included (#724).
+- 3e0c7bb: Open the access-reason, principal/credential-kind and error-code vocabularies, and let an extension package declare a web host port (PP-14.14, #932).
+
+  `@marinoscar/platform-api/core`: `registerSystemAccessReason({ id, description })` and `systemAccessReasonRegistry`; the platform's nine reasons register through it. `SystemAccessReason` is `BuiltinSystemAccessReason | (string & {})` and the bypass entry points (`forSystem`, `runAsSystem`, `systemScopeExtension`) check the registry, so an unregistered reason still throws `ScopedAccessError`. Opening which reason does not open who may bypass: the system-client injection allowlist is unchanged. `SYSTEM_ACCESS_REASONS` stays as a deprecated alias of `BUILTIN_SYSTEM_ACCESS_REASONS`.
+
+  `PrincipalKind` and `CredentialKind` are `keyof` the augmentable `PrincipalKinds` and `CredentialKinds` interfaces (unaugmented, exactly the old unions; the closed originals are `BuiltinPrincipalKind` and `BuiltinCredentialKind`), with `registerPrincipalKind`, `registerCredentialKind`, `requireCredentialKind` and `UnknownCredentialKindError`. Unknown means denied: `toPrincipal` of the identity slice answers 401 for a credential kind that is not registered, or whose principal kind has no factory there, and a custom kind never becomes a node principal.
+
+  `registerErrorCode({ code, status, description })` and `errorCodeRegistry` (the ten status-derived codes plus `PAYLOAD_TOO_LARGE` register through it). `HttpExceptionFilter` passes a thrown payload's `code` through only when it is registered for the exception's own status; every other response is unchanged. `ErrorMapper` and `PlatformHostCoreModule.forRoot({ errorMappers })` map a foreign error (a Prisma `P2002`) to an `HttpException`; mappers see only values that are not already an `HttpException`, and the foreign error's message is never copied into the response. OpenAPI: `ErrorDto.code` changes from a closed enum to a string whose `examples` list every registered code (the only difference in `openapi.json`). `describeVocabularyConformance` (`@marinoscar/platform-api/core/testing`) is the kit.
+
+  `@marinoscar/platform-web/core`: `PlatformWebHost.extensions` (an optional record of ports keyed by string or symbol), `usePlatformPort<T>(key)` (throws, naming the key, when the app did not supply it) and `useOptionalPlatformPort<T>(key)`; `createTestPlatformHost({ extensions })`.
+
+  Migration: none for an app that registers nothing. Code that relied on `toPrincipal` treating an unregistered credential kind as a user now gets a 401.
+
+- 115705f: Add the credentials slice (#735). platform-api: the `./credentials` subpath with `CredentialsModule`/`CredentialsService` (the deployment store), `UserCredentialsModule`/`UserCredentialsService` (a user's own keys) and the new `OrgCredentialsModule`/`OrgCredentialsService` (an organization's keys in `org_credentials`, under row-level security, encrypted under `org:<orgId>:<purpose>`), `UserCredentialResolver.resolve(userId, purpose, name?, { orgId })` (user, then the purpose's `fallback` of org and system, then none), the purpose registries `registerCredentialPurpose` and `registerUserCredentialPurpose` (writes to an undeclared purpose throw), `CREDENTIALS_MODEL_OWNERSHIP`/`CREDENTIALS_USER_OWNED_MODELS`, and `./credentials/testing` with the `credentials` conformance suite and `withCredentialPurposes`; core gains `orgCredentialPurpose` and `ORG_CREDENTIAL_DOMAIN_PREFIX`; telemetry exports `TELEMETRY_GREPTIME_CREDENTIAL_PURPOSE`. platform-web: `./credentials/headless` (`savedSecretHelperText`, `secretForSubmit`) and `./credentials/ui` (`SecretField`). platform-contract: `./credentials` (`credentialInfoSchema`, `userCredentialInfoSchema`, `orgCredentialInfoSchema`, `CREDENTIAL_TIERS`, `CREDENTIAL_SOURCES`, `SECRET_BEARING_KEYS`).
+- 1822636: App metadata on users and organizations, more extensible models, offline checks for app indexes and policies, and a seed hook (PP-14.27). DB: migration `0036_add_app_metadata` adds `metadata JSONB NOT NULL DEFAULT '{}'` to `users` and `organizations` (each with a CHECK that the document is an object of at most 32 KiB of `jsonb` text, a backstop to the writer's 16 KiB) and a unique `(id, org_id)` key on `ai_runs` and `grants`, the target of a composite foreign key from an org-owned app table (the migration runs in the `app.rls_bypass` transaction form because both are row-level-security tables); apply it with `npm run db:sync`, then `prisma:migrate`. `Role`, `Notification`, `NotificationDelivery`, `Credential` (non-secret relations only), `AiRun` and `Grant` become `// @extensible` (a back-relation changes no SQL); `Permission` stays closed, with the reason documented. `runDbConformance({ appRoot })` gains `app-schema-objects` (every `rawSqlIndexes` and `rlsPolicies` entry of `platform.lock` is created by an app migration and dropped by none, an index definition agrees with the SQL, an unlisted partial or expression index or policy fails; the package's own entries are read, not judged) and `app-migrations`; a `rlsPolicies` lock entry gains optional `usingSha256` and `checkSha256` (`normaliseSqlExpression`, `sqlExpressionSha256`, `platform db policies` prints them), so a weakened policy is caught without a database; `platform db sync` and `platform db check` refuse an app migration named like a package migration (`APP_MIGRATION_ID_COLLISION`) or added after the last sync with a timestamp before an installed platform migration (`APP_MIGRATION_OUT_OF_ORDER`; the lock records the app directories seen at the last sync in `appMigrations`). New exports: `checkAppSchemaObjects`, `assertAppSchemaObjects`, `readAppMigrations`, `scanAllIndexes`, `checkAppMigrations`, `LockRlsPolicy`. Seed: `seedPlatform(prisma, input, { log?, extras? })` runs `SeedStep { id, run(tx, ctx) }` steps after the platform's own, each in a transaction when the client has one, under the same log, validated before any write; `assertSeedIdempotent` proves a second run creates 0; a bare `SeedLogger` third argument still works and the five fixed seed tables are unchanged. API: `registerUserMetadataSchema` and `registerOrganizationMetadataSchema` (a closed zod object per namespace; secret-named fields and open shapes are refused at registration, secret-named keys and a document over 16 KiB at write) and the injectable `IdentityMetadataService` (`get`, `set`, `update` under a row lock, `delete`; users and organizations); no platform route returns the document. Back-compat: no existing table, column, route or response changes; the OpenAPI document is unchanged. A lock written before `appMigrations` skips the ordering rule until its next sync; an app with an unlisted partial index or policy now fails `app-schema-objects` until it lists them in `platform.lock`.
+- d1d1258: The database backup slice has three new extension points (PP-14.12, #930).
+
+  Backup target. Where an archive is written is now a port: `DB_BACKUP_TARGET` (a `BackupTarget`: `id`, `label`, `openWrite(key, meta)` returning `{ stream, done }`, `openRead`, `delete`, an optional `list`, `isConfigured()` and `describe()`), bound with `DbBackupModule.forRoot({ target, mirrorTargets })`. The default adapter (`StorageBackupTarget`) wraps the deployment's `STORAGE_PROVIDER`, so a deployment that binds nothing behaves exactly as before. The archive is still never buffered: `pg_dump` streams through the checksum meter into the sink, and the runner awaits both the sink's `done` and the dump's exit code. The `database-backups/` key prefix rule stays in the server. After the primary archive is written and verified, the same `db.backup.run` job copies it to every mirror target (read back from the primary, written through the mirror's sink, read back from the mirror and compared by sha256, deleted on a mismatch); a mirror failure never fails the run. Each copy is recorded as an `audit_events` row (`db_backup.mirror.completed` / `db_backup.mirror.failed`), so no migration is needed, and the new `backup.mirrors` Doctor check warns when a mirror's latest copy failed or has never run. Retention deletes the same key from every mirror. `describeBackupTargetConformance` (`@marinoscar/platform-api/db-backup/testing`) is the kit every target runs: streaming without buffering, a failing sink rejects `done`, read-back equals write, delete is idempotent, an unconfigured target says so.
+
+  Schedule policy. `frequency` gains `'cron'` with a `cron` field (five fields: `*`, numbers, ranges, steps and lists; month `*`; at most one of day-of-month and day-of-week restricted; at least one hour between runs, enforced when the setting is saved and when the schedule is read), evaluated in the policy's timezone with the same DST handling as the other frequencies. `retention` is now `{ count?, maxAgeDays? }`; `retentionCount` stays as an alias that is read and written in step with `retention.count`, so existing settings rows, API clients and the web page keep working. Retention deletes a completed archive when it is beyond either bound, and never the newest completed one.
+
+  Restore gates. `registerRestoreGate({ id, label, kind, check })` adds a pre-flight gate from an app or a package at import time; the eight built-in gates register through the same function (`BUILTIN_RESTORE_GATE_IDS`). Gates run in registration order (built-ins first), fail closed (a gate that throws or exceeds 10 seconds is a block), and an app gate (`kind: 'app'`) that fails is a hard block that cannot be overridden. `describeRestoreGateConformance` is the kit every gate runs: it answers within the bound, writes nothing to its context, is repeatable, and evaluates to a pre-flight row. The pre-flight stays read-only: no gate creates, drops or renames anything, and the cluster admin connection stays outside the Prisma pool.
+
+  Events. `db_backup.run.completed` and `db_backup.restore.completed`, each with `{ runId, status, targetId, sizeBytes, durationMs }`, are emitted on the event bus after the run settles and outside any transaction.
+
+  Invariants unchanged: every dump and restore still carries both `--enable-row-security` and `PGOPTIONS=-c app.rls_bypass=on` (`buildPgDumpArgs` and `buildPgRestoreArgs` are untouched), and all work stays inside the registered `db.backup.run` job.
+
+  Migration notes: `RESTORE_GATE_IDS` is now a deprecated alias of `BUILTIN_RESTORE_GATE_IDS`, and a restore gate id is an open string (`RESTORE_GATE_ID_PATTERN`) rather than a closed union; a pre-flight row can carry `kind: 'app'`; `frequency` can be `'cron'`, so code that switches over it must handle the new member; the stored `cron` and `retention` fields are optional (the defaults are unchanged); `DbBackupTx` gains `auditEvent.findMany`, so a hand-built double of that structural type needs it; the runner, retention service, restore service and pre-flight service take trailing optional constructor parameters, so code that constructs them by hand keeps working; node offload is withheld while an app binds its own primary target (only the storage-backed adapter can be read by a node).
+
+  Web: `DbBackupPage` accepts `slots.Sections` (an app's own sections below the packaged ones; the markup is identical when it is not passed), the policy panel renders a cron field for `frequency: 'cron'`, and the restore dialog lists app gates. Contract: `backupRetentionSchema`, `restoreGateIdSchema`, `BACKUP_CRON_*` limits, the event name constants and payload types, and `BackupMirrorResult`.
+
+- b46725d: Add the database backup and restore slice: `@marinoscar/platform-contract/db-backup` (the wire shapes and the `databaseBackup` namespace), `@marinoscar/platform-api/db-backup` (`DbBackupModule.forRoot` with the deployment-mode restore gate, the `RestoreCarryOver` registry, the `rls_bypass` pre-flight gate and the `database-backups/` key prefix) and `@marinoscar/platform-web/db-backup` (the admin page, its hook and client, and the admin section entry).
+- e6acb4b: Email transports are pluggable (PP-14.8, #926). `registerEmailTransport` adds a way of sending mail (SendGrid, Postmark, a log) from an app or a package: its own settings schema, declared secrets (stored encrypted at the credential purpose `email_<id>`, never in settings or the environment), and `build`, which returns an `EmailTransport` (`send`, optionally `verify` and `destroy`). Extend `BaseEmailProvider` to inherit the never-throw guarantee, secret redaction and rate-limit classification. `ses` and `smtp` are transports registered through the same function and still wrap `SesEmailProvider` and `SmtpEmailProvider` unchanged. `EmailTransportResolver` (provided and exported once by `EmailModule`) resolves the transport the settings' `provider` names; `EmailNotificationChannel` and the admin "Send test email" depend on it instead of the concrete SES and SMTP classes, so a registered transport is used by both. The Doctor check, the network-egress view and the test email name a transport by what it registers (`label`, `summary`, `missing`, `egressCapability`, `egressHosts`). `describeEmailTransportConformance` (`@marinoscar/platform-api/email/testing`) is the kit every transport runs: `send` never throws, no secret or message content in error text, attachments and headers passed through, throttles classified.
+
+  The `email` settings row stores `provider` (a transport id) and a `transports` record validated per transport. A row stored before this release loads unchanged (its `sesRegion`, `sesAccessKeyId`, `smtpHost`, `smtpPort`, `smtpUseTls` and `smtpUsername` become `transports.ses` and `transports.smtp`, field by field, and are rewritten in the new shape on the next save), the flat fields stay accepted on `PUT /api/email-settings` as aliases and published as a deprecated read view, and `smtpPassword` / `sesSecretAccessKey` stay accepted beside the new `secrets` record. A stored `provider` that names a transport nobody registers no longer makes the row unreadable: the send and the Doctor report it.
+
+  Contract: `BUILTIN_EMAIL_PROVIDER_KINDS` (`EMAIL_PROVIDER_KINDS` stays as a deprecated alias), `EMAIL_TRANSPORT_ID_PATTERN`, `emailTransportIdSchema`; `EmailProviderKind` widens to `string`; the response gains `transports`, `descriptors` and `secretStatuses`; the PUT body gains optional `transports` and `secrets`. The `email` contract slice now depends on the `settings` slice.
+
+  Migration notes for code that builds these by hand: `EmailNotificationChannel` and `EmailTestSendService` take an `EmailTransportResolver` instead of `SesEmailProvider` and `SmtpEmailProvider`; `SesEmailProvider` and `SmtpEmailProvider` take a `Pick<EmailSettingsService, 'get'>` and a `Pick<CredentialsService, 'getSecret'>`; the egress view lists transports in registration order (`email.ses`, `email.smtp`, then the app's).
+
+  Web: `registerEmailTransportPanel(id, Component, { validate, toForm, toInput })` (`@marinoscar/platform-web/email/ui`, and the new `/email/ui/transport-panels` subpath) chooses the form the admin email page draws for a transport. The page lists one radio per descriptor the API serves; the built-in `ses` and `smtp` transports register their bespoke forms through the registry (markup unchanged); any other transport is drawn by `EmailGenericTransportPanel` from its descriptor (`PluggableConfigForm`, with write-only secrets), so an app that adds a transport with `registerEmailTransport` needs no web code. The page saves `{ provider, enabled, fromAddress, fromName, transports: { <selected>: settings }, secrets: { <selected>: { <name>: value } } }`, and completes a response from an API that predates the transports from its flat fields.
+
+- c778f65: Extension-author test kits for Doctor checks and job handlers, and configurable web conformance suites (PP-14.26, #944).
+
+  API. New subpath `@marinoscar/platform-api/doctor/testing`: `describeDoctorCheckConformance(name, factory, { scenarios })` proves one check against the contract (identity, a guarded run that never throws, a valid outcome with a remedy on `warn` and `fail`, no seeded secret, read-only); `runDoctorCheck`, `findOutcomeProblems` and `findIdentityProblems`; and the doubles it runs over, `createRecordingPrisma` (records every call, refuses `create`, `update`, `upsert`, `delete`, `*Many`, `$executeRaw` and a raw write statement) and `createWriteFailingStorage`. Importing the entry registers the `doctor-read-only` conformance suite (`runPlatformConformance({ suites: { doctorReadOnly: { fixture, minChecks?, exempt?, forbiddenServices? } } })`), which runs the same proof over every check of the booted app's `DoctorCheckRegistry`: none writes through Prisma or to storage, none holds a side-effecting "test" service, and each check whose `dependsOn` passed returns a valid outcome. An app that does not list the key runs nothing.
+
+  `@marinoscar/platform-api/jobs/testing` gains `createFakeJobQueue()` (an in-memory queue with the real dedup rule, claim order, attempt budget and delete decision; `asJobsService()` for a service under test), `describeJobHandlerConformance(name, handler, { payloads })` (type, label, a profile of exactly two numbers inside ceilings, the node pair both or neither, `ai.*` server-only; per payload a settle, a double run, a failure by throwing, dedup and `canDelete`) and the pure `findJobHandlerContractViolations(handler)`. `@marinoscar/platform-api/testing` gains `resolveConformanceTestApi`, the helper both kits use. The `doctor` slice now lists `testing` as a slice dependency (`packages/platform-slices.json`); the testing README documents adding a suite from an app with `conformanceSuites.register` and a `declare module` augmentation.
+
+  Web. `runPlatformWebConformance({ suites })` takes `Record<string, options | { skip: 'reason' }>`: the entry under a suite's id is handed to `register(api, context, options)` as a third argument (`WebConformanceSuite<TOptions>`, default `undefined`, so the `settings-*` suites are unchanged). `webConformanceSuites.register` now throws on a duplicate id instead of ignoring it (a testing entry imported once registers once; guard a repeat with the new `webConformanceSuites.has(id)`). The `expect` subset gains `toBe`, `toMatchObject`, `toHaveLength` and `toThrow`; a hand-written `WebConformanceTestApi` fake must provide them.
+
+- 65d4522: Add the host About module and web slice: `@marinoscar/platform-api/host` now owns `GET /api/admin/about` (`AboutModule.forRoot({ apiVersion })`, `AboutService`, `readDeployInfo`, the `versions` support-bundle section; the database probe reads through `PLATFORM_PRISMA`), and `@marinoscar/platform-web/host/headless` and `/host/ui` own the About page, the admin Maintenance page, the public maintenance screen, the maintenance block store and recogniser and the `useAbout`, `useMaintenance` and `useMaintenanceBlock` hooks. The deploy-info fixture the CLI's tests read moved to `packages/platform-api/test/fixtures`.
+- 68660c1: Host: the health probes, the maintenance window, the About report, the deployment modes, the global guards and the response envelope are open to the app. `registerHealthIndicator({ id, critical, check, timeoutMs? })` adds an indicator to `GET /api/health` and, when critical, to `/api/health/ready` (the `database` indicator registers through the same function; details are bounded and secret-filtered because the probes are public; `/live` is unchanged). `registerMaintenanceBypass({ id, allows })` lets a request through an open window after the built-in admin rule; it is fail-closed (only `true` allows) and passes the window, not authentication. `registerAboutContributor({ id, label, describe })` adds `extras` to `GET /api/admin/about` and sections to the web `AboutPage` (the DOM is unchanged when none is registered). `registerDeploymentMode` and `registerDeploymentCapability` open `DEPLOYMENT_MODE` and `DeploymentModeService.can`; `DEPLOYMENT_MODES` is a deprecated alias of `BUILTIN_DEPLOYMENT_MODES` and `DeploymentMode` widens to any registered id (so do `DbBackupDeploymentMode` and `UserDataEnvironment`). The `host` conformance suite takes `allowedAppGuards: [{ name, why }]` (an empty `why` throws) and now requires `MaintenanceGuard` to be the first `APP_GUARD`. `PlatformHostCoreModule.forRoot({ host, permissions })` and `AboutModule.forRoot({ host, permission })` route the host controllers through the app's access decorators and permission strings (defaults unchanged). `buildCorsOptions(raw, extra?)` adds `methods`, `allowedHeaders`, `exposedHeaders` and `maxAge`; `registerResponseMetaContributor` adds bounded keys to the envelope `meta`. OpenAPI: `GET /api/admin/about` gains an optional `extras` array and `api.deploymentMode` is an id pattern instead of a two-value enum. Migration: `capabilitiesFor` throws for a mode nobody registered; `HealthController`'s constructor takes a `HealthIndicatorRunner` in place of `DatabaseHealthIndicator`.
+- a3bf371: Host slice: `PlatformHostCoreModule.forRoot()` now registers the generic Doctor checks that were app code (`db.connection`, `db.migrations`, `db.rls_role` and `secrets.encryption-key` in the `core` category, `core.deployment-mode`, and `network.egress`), reading the database through the `PLATFORM_PRISMA` port (each reports `skip` when it is unbound), and provides `DeploymentModeService` (`DEPLOYMENT_MODE`) and `DeploymentNetworkService` (`DEPLOYMENT_NETWORK`, bound as `DEPLOYMENT_NETWORK_SOURCE`) with their parsers and bootstrap verifiers. Check ids, results and report order are unchanged.
+- b722d24: Add `@marinoscar/platform-api/identity` and `/identity/testing` (#727): the identity slice moved from the reference app. `IdentityModule.forRoot({ imports, defaultOrgRole, initialAdminEmailEnv, enableTestAuth })` mounts sign-in and tokens (JWT sessions, refresh-token rotation, personal access tokens, worker-node credentials, Google sign-in), users, the allowlist, the device flow, organizations and tenancy, two server-only cleanup job types (`auth.token.cleanup`, `device-auth.code.cleanup`, unchanged) and the `auth.*` / `tenancy.mode` Doctor checks. Stable: the route-access decorators and guards (`@Auth`, `@Public`, `@Roles`, `@Permissions`, `@CurrentUser`, `@CurrentPrincipal`, `@CurrentOrg`, `@AuthCredential`, `JwtAuthGuard`, `RolesGuard`, `PermissionsGuard`), the sign-in error codes, the tenancy parser and the role and permission declarations. Experimental: the seams (`registerAuthProvider`; the host ports `IDENTITY_NOTIFIER`, `USER_DEFAULTS`, `IDENTITY_PROFILE_IMAGES`, `IDENTITY_JOBS`, `IDENTITY_METRICS`, `IDENTITY_NODE_CREDENTIALS`, `IDENTITY_EVENT_BUS`; the `identity.user.created`, `identity.membership.changed` and `identity.org.switched` events; `identityConfiguration()`), the `identity` conformance suite and `createStubIdentityHost`. A missing `JWT_SECRET` is now a boot error (`requireJwtSecret`): no fallback secret ships. Routes, permissions, metrics and the OpenAPI document are unchanged.
+- 2c4bf2c: Slots for the identity and sharing pages, the login layout, and the shell's navigation and themes (PP-14.25, #943).
+
+  API: `registerCurrentUserExtension({ id, resolve(userId, ctx) })` and `registerUserListExtension({ id, resolve(userIds, ctx) => Map })` of `@marinoscar/platform-api/identity` add bounded JSON of the app's own to `GET /api/auth/me` and to each row of `GET /api/users` under `extensions.<id>`. The list resolver is batched: one call per request with the ids of the page, a `Map` keyed by user id, so a list never costs a query per row. Every contribution is checked (plain JSON, at most 5 levels, 4 KiB on `/auth/me` and 1 KiB per list row, no secret-named key such as `token`, `apiKey` or `clientSecret`, no credential-looking value such as a JWT or a `pat_` token) and every extension runs isolated under its own timeout: a throw, a timeout or a refused contribution skips that extension and logs a warning with its id, and never fails the request. `checkUserExtensionContribution`, `resolveCurrentUserExtensions` and `resolveUserListExtensions` are exported. OpenAPI: `CurrentUserDto` gains an optional `extensions`; the rows of `GET /api/users` reference the new `UserListItemDto` (`UserResponseDto` plus an optional `extensions`); nothing changes on the wire while no extension is registered.
+
+  Contract: `currentUserSchema` gains an optional `extensions`; new `userExtensionsSchema`, `UserExtensions`, `USER_EXTENSION_ID_PATTERN` and `USER_EXTENSION_LIMITS`.
+
+  Web: `UsersPage`, `UserList`, `OrganizationPage`, `OrgMembersPanel`, `OrganizationsPage`, `UserTokensPage`, `ActivateDevicePage`, `LoginPage`, `AuthCallbackPage`, `GroupsPage`, `GroupDetailPage` and `PublicLinkPage` take the packaged-page slot contract (`PageSlotsBase`) and leave the exempt list; the pages that draw rows add the table slots (`Columns` on the users table; `RowActions`, `DetailPanel` and `Toolbar` on the member and organization lists, which are cards, not tables). `UsersPage` adds an append-only `Tabs` slot (the Users and Allowlist tabs stay; the Settings UI rule 2 still holds), `GroupDetailPage` adds `MemberRowActions` and `Tabs`, `ShareDialog` adds `Sections` (both ends) and `Footer`, and `LoginPage` finishes its layout slots with the contract's. `AuthUser.extensions`, `UserListItem.extensions`, `useCurrentUserExtension` and `userExtension` read what the API added. `ShellDestination` gains `badge`, `group`, `external` (an `http(s)` URL opened in a new tab; any other scheme is not drawn) and `onClick` (cancel the navigation with `preventDefault`) on the rail, the bottom bar and the user menu; `ShellBottomNav` gains `maxItems` (default 4) with a More sheet for the rest (a navigation with four or fewer visible destinations renders what it did); `ShellThemeMode` and `ShellThemes` are open, `registerThemeMode({ id, label, theme })` adds a theme mode, and the `applyTheme` host port and `useUserSettings` hand a stored theme id to the app when the settings document lists it in `themeOptions` (pairs with `registerThemePreference`, #939). The five breakpoint gates did not move. A `Header` slot written against the old props of the groups and group pages keeps working; `LoginPage.slots.Title` keeps working and `Header` replaces it.
+
+- c6f97da: Let an app or package add a sign-in provider (PP-14.9, #927): `registerAuthProvider(AuthProviderDefinition)` of `@marinoscar/platform-api/identity` now completes a full login. A definition supplies its Passport strategy as `strategy` + `guard` classes (Google) or as `createStrategy(ctx)`, built on every sign-in request from the credential store (purpose `auth_<id>`, `authCredentialPurpose`), plus `label`, `mode` (`redirect` default, or `custom`), an optionally asynchronous `isEnabled(config, ctx)`, `mapProfile`, `linkExistingByEmail`, `egressHosts` and `doctorRemedy`. `AuthProviderRegistration` is the same type under its old name: a registration written as `isEnabled: (config) => ...` is unchanged, and `strategy` and `guard` became optional (one of that pair or `createStrategy` is required).
+
+  `AuthService.completeExternalLogin(ExternalProfile)` runs the shared sign-in for any provider (`handleGoogleLogin` maps the Google profile and runs the same path with Google's rules; tokens, cookie attributes, redirects, events and metrics are unchanged). The slice mounts `GET /api/auth/:providerId` and `/callback` for every registered `redirect` provider (Google keeps its own routes; new in OpenAPI, reachable during a maintenance window), and exports the browser ending as `respondToSignIn`, `setRefreshTokenCookie`, `buildSignInSuccessRedirectUrl`, `REFRESH_TOKEN_COOKIE` and `REFRESH_TOKEN_COOKIE_OPTIONS`; the refresh cookie and its rules are unchanged. The callback no longer logs the redirect URL, which carried the access token.
+
+  Safety rules of the generic path: a profile with no address or an unverified one is refused (`access_denied`) before any lookup; a new provider is never linked to an existing user by address (matched case-insensitively) unless its definition declares `linkExistingByEmail`, which means "trusted to vouch for the address" (Google does, as it always did), otherwise that sign-in is refused; the same flag gates the `INITIAL_ADMIN_EMAIL` allowlist bypass and the first administrator's grant, so any other provider is allowlist-only; optional `pictureUrl` (https, at most 2048) and `displayName` (at most 255) are dropped when out of bounds; the ids `jwt` and `session` are reserved and a `createStrategy` strategy is registered with Passport as `auth-provider:<id>`; `createCookieStateStore` gives a `passport-oauth2` strategy login-CSRF `state` without a session plugin (`state: true` without a store throws on every sign-in here); the route overwrites `ExternalProfile.provider` with the serving definition's id; `ExternalProfile.raw` is never logged or stored.
+
+  `IdentityModule.forRoot({ signInPolicy })` binds a `SignInPolicy` (`IDENTITY_SIGNIN_POLICY`): `beforeLogin(profile, ctx)` returns `{ allow: true, roles? }` or `{ allow: false, reason }`, runs for every provider after the allowlist and before any write, maps roles onto a NEW user only, and fails closed when it throws. `IDENTITY_AUTH_CREDENTIALS` binds the credential store a provider reads (unbound, every secret is absent). New events `identity.login.succeeded` (`{ userId, provider, isNewUser }`) and `identity.org.created` (`{ orgId, createdBy }`); `identity.user.created` `source` is now the provider id. The Doctor's `auth.providers` check lists every registered provider with its `doctorRemedy`, and the egress inventory reads `egressHosts` from the definitions. `describeAuthProviderConformance` of `@marinoscar/platform-api/identity/testing` is the provider kit; `createStubIdentityHost` takes `authCredentials`.
+
+  Contract: `authProviderSchema` gains the optional `mode: 'custom'`, which `GET /api/auth/providers` sends only for a provider that owns its flow; a redirect provider's entry is unchanged. Web: `login(id)` calls the `start()` of the look registered with `registerAuthProvider` for a `custom` provider instead of navigating; `LoginPage` gains `BeforeProviders` and `AfterProviders` slots (props `{ providers, login }`); `AuthCallbackPage` reads the provider to retry from its `provider` prop, a `:provider` route segment, or the provider the sign-in started with (`lastAuthProvider`), validated as a provider id, before falling back to `google`; `AuthProviderInfo` gains `mode`. `AUTH_ERROR_CODES` stays closed.
+
+- f37093f: identity: depend on no generated Prisma client. The slice declares the identity fragment's tables structurally (`IdentityPrisma`, `IdentityTx`, `IdentityDelegate`, the `Identity*Row` types, `IdentityJsonValue`, `DEVICE_CODE_STATUS`, `isPrismaErrorCode`), so `@marinoscar/platform-api` builds, type-checks and tests before any `prisma generate`. `AuthenticatedUser` extends `IdentityUserRow` instead of the generated `User`; `resolveOrgId` / `resolveJobOrgId` take a `DefaultOrgReader`, which the app's own client satisfies as is.
+- 8a0f3b9: Open the jobs and nodes vocabularies to an app (PP-14.19). Jobs: `registerRetentionPolicy` puts an app table on the nightly retention (the `retention` settings namespace is composed from the registry: schemas, defaults, merge and policy-by-policy read-compat; the platform's four keep their order and defaults, and the enqueue-only `RetentionPurgeTask` enqueues one purge per enabled policy whose handler is mounted); `registerJobReason` opens `jobs.reason`, with `reasonLabel` on the admin job row. Migration `0034_open_job_reason` turns `jobs.reason` from the `JobReason` enum into `TEXT`, keeping every stored value (apply it with `npm run db:sync`, then `prisma:migrate`; the table is rewritten under a short lock); `JobReason` becomes `BuiltinJobReason | (string & {})` and the contract's `reason` a pattern (`jobReasonSchema`), so the OpenAPI document shows a pattern where it showed an enum. Nodes: a heartbeat may carry `vitals.extra` (at most 16 numeric keys), `registerNodeVital` words them in the vitals dialog, which also lists the node's reported capabilities; relayed spans may be named `job.app.<name>` with attributes registered through `registerNodeSpanAttribute` (emitted as `job.app.<key>`), and a span that fails validation is now dropped and counted instead of failing its whole batch with a 400. CLI: `registerJobRequirement` and `registerProbedBinary` (with `versionArgs`) are exported from `@marinoscar/platform-cli/node` and used by the startup self-test and `node doctor`; `JobExecutor.vitals()` feeds `vitals.extra`. Back-compat: with only the built-ins nothing served changes; `JOB_REASONS` and `RETENTION_POLICY_KEYS` remain as deprecated aliases of `BUILTIN_JOB_REASONS` and `BUILTIN_RETENTION_POLICY_KEYS`. Upgrade the API before the nodes: an API that predates `vitals.extra` answers a heartbeat that carries it with a 400, and the CLI then stops sending vitals for the process.
+- fce5417: Make an app's notification channel (Slack, SMS, Teams, a webhook) first-class (PP-14.10, #928). `NotificationChannelSender.resolveRecipient(recipient, context)` resolves a destination asynchronously and returns `{ to, display }`: `to` goes to `deliver`, the redacted `display` is what the delivery row's `recipient` stores. `resolveTo` still works and is now optional (a sender has one of the two). `context.handle()` reads the app's `RecipientHandleSource` (`handleFor(userId, channelId)`), bound with `NotificationsModule.forRoot({ recipientHandles })` to the new `NOTIFICATION_RECIPIENT_HANDLES` token. `forRoot({ pushPayload })` adds allowlisted extras (`actions`, `icon`, `badge`, `urgency`, `tag`) to a Web Push payload; the service worker shows them. `registerChannelTemplate` (and `registerNotification({ channelTemplates })`) is a registry of per-channel renderers validated at registration; `renderChannelPayload` reads one from `deliver`. `NotificationChannelDef` gains `criticalCapable`, `broadcastDefault` and `rendersRawData`. `describeNotificationSenderConformance` joins `@marinoscar/platform-api/notifications/testing`, and the `notifications` conformance suite gains a `channel-templates` case.
+
+  The `notifications` system namespace (and its org layer) gains an optional `channels` record, `{ <channelId>: { enabled } }`: a switch per channel, sparse, an absent channel is enabled. `browserEnabled` stays the browser channel's spelling and `channels.browser.enabled` is its alias (a write of either sets both; the stricter wins on read), so stored rows and old clients load unchanged. `policyChannels` applies the switch to every channel; a `mandatory` event keeps its `browser` row but is no longer exempt from another channel's switch. A broadcast over a channel an administrator switched off gets a warning.
+
+  `GET /api/notifications/channels` (any signed-in user) serves every registered channel (`notificationChannelDescriptorSchema`: label, `userConfigurable`, `criticalCapable`, `broadcastCapable`, `broadcastDefault`, `order`). The critical-broadcast rule reads "a channel flagged `criticalCapable`" (`browser`) and moves from `createBroadcastSchema` to the API's registry check. The `push` channel's label is `Push`. `AndroidAppNotificationChannel` takes the push payload hook as its third constructor argument (before the sender registry). OpenAPI: one new route and optional fields only.
+
+  Web: the broadcast composer, the preferences matrix and the admin Notifications page draw channels from the descriptors (`useNotificationChannels`) instead of `CHANNEL_ORDER`, `DEFAULT_CHANNELS` and `CHANNEL_LABELS`; with only the platform's channels the markup is unchanged (a recorded-DOM snapshot test). The admin page gains one switch per app channel, `UserNotificationsPage` takes `channelStates` to gate an app channel's column like push's, and `NotificationChannelDescriptor`, `NotificationChannelSwitch`, `NotificationAction`, `ChannelState` and `ChannelAlert` are exported.
+
+- 48b275d: Close the small vocabularies of onboarding, the DataTable and exports (PP-14.20, #938).
+
+  Onboarding. The audience vocabulary is open: `registerOnboardingAudience({ id, label, matches(principal, ctx) })` of `@marinoscar/platform-api/onboarding`, with `user`, `admin` and the new `org_admin` (the holder of the `org_admin` role of an active organization) registered through it. `OnboardingAudience` is `Builtin | (string & {})`; `onboardingAudienceSchema` is a string pattern (the OpenAPI `audience` enum becomes a pattern); `ONBOARDING_AUDIENCES` (`admin`, `user`) is deprecated for `BUILTIN_ONBOARDING_AUDIENCES`. `GET /api/onboarding` gains an optional `audiences` record with the block of every other audience the caller matches and that has a step for them, absent otherwise; `user` and `admin` keep their rules (the engine ignores a rule registered for those ids). `evaluateOnboarding` takes optional `audiences` and `audienceContext`, the `onboarding` conformance suite derives the `org_admin` block and flags a step naming an unregistered audience, and the web provider keeps the `audiences` blocks and their skip overlay.
+
+  DataTable. `registerDataTableFilterType({ type, operators, Editor, matches, coerce?, format? })` of `@marinoscar/platform-web/datatable/headless`; the five built-ins register through it, `FilterOperator` and `DataTableFilterType` are open (`BuiltinFilterOperator`, `BuiltinDataTableFilterType`), `DataTableColumn.filter = { type, editor?, operators? }` declares a column's filter, and `matchesFilters` filters rows on the page with the type's rules. `DataTableStoredLayout` gains `extra` (bounded plain JSON, 8 KiB, 32 keys, 8 levels) and `savedViews` (at most 20), validated by the user-settings API on write (`dataTableExtraSchema`, `dataTableSavedViewSchema`, a 32 KiB cap per table entry; the user-settings OpenAPI gains both fields) and sanitised on read; `useDataTableLayoutPrefs` gains `extra`, `setExtra`, `savedViews`, `saveView`, `applyView` and `deleteView`, and `reset` keeps the saved views. `DataTable` takes `slots={{ Toolbar, BulkBar }}`. The filter-model operator unions of the jobs, nodes, identity and db-backup slices gain `(string & {})`. A table that uses none of this renders the markup it did.
+
+  Exports. `registerExportWriter({ attachTo: '*' | string[], columnTypes? })` offers a writer on sources that do not list it, `ExportSource.columnTypes` and `acceptsAttachedWriters` gate and pin it, and `writersFor` returns the listed formats then the attached ones (platform writers first). The platform sources list no formats: their formats are the writers attached to them, so json, csv and xlsx are unchanged and an app's writer follows. A writer that cannot write a column type fails the export before any row (`guardWriterColumns`). `ExportColumn.meta` (flat scalars, at most 16 keys) carries a custom writer's own typing; the built-in writers never write it. `ExportsList` takes `slots={{ Columns, RowActions }}`. A source may now list an empty `formats`; `exports` conformance flags a writer attached to an unknown source.
+
+- 22d11bb: `TelemetryPermissionDeclaration` gains a required `scope: 'system' | 'org'` field, and the three telemetry permissions declare `scope: 'system'` (#723): an app's permission registry now refuses a declaration without a scope, and refuses a default grant to a role of the other scope.
+- fe61ffe: Roles: an app's own roles are assignable end to end, and an app can grant platform permissions to them, with no package edit and no migration (roles are strings). New `GET /api/roles?scope=system|org` lists `{ id, label, description, scope, assignable }` (`users:read` for `system`, `org_members:read` for `org`). `RoleDeclaration` gains `label` and `assignable` (registry-only, never seeded). The invite, org member update, user-role and test-login routes check the role registry and fail closed: an unknown role, a role of the other scope (`admin` on an invitation) or an `assignable: false` role is a `400` with the error code `ROLE_NOT_ASSIGNABLE` (registered through `registerErrorCode`, also `details.reason`); an invitation whose role stopped being assignable is left pending at sign-in, and `PUT /api/users/:id/roles` leaves a user's `assignable: false` system role in place. Manifest: `registerPlatformPermissions({ app: { grants } })` and `grantPermissions` give an app role platform permissions (validated, folded into the catalog's `rolePermissions`, so the seed and the permission resolver agree; a platform role cannot be the target), and `registerPermissionSet({ slice, roles, permissions })` lets a package declare its own slice, with `PlatformPermissionSlice` open and `identity` still mandatory. Contract: `roleIdSchema` (a string pattern) replaces the `z.enum` of `roleName` on the invite and member routes (OpenAPI: enum to pattern), `BUILTIN_ORG_ROLES` is the new name of `ASSIGNABLE_ORG_ROLES` (kept as a deprecated alias), `AssignableOrgRole` widens to any string. Web: `useRoles` reads the API; the invite dialog, member role select, invitation labels and Manage roles dialog offer the assignable roles with the API's labels and the hard-coded role lists are gone (`ORG_ROLES` is deprecated, `buildUserColumns(roles?)` and `ManageRolesDialog` take the roles, `InviteMemberDialog` takes `roles`); the user-roles call now sends `roleNames`, the field the API reads. Migration: a request that named `admin` as an org role used to fail request validation and is now refused by the service with the same `400` status; group roles stay `admin`, `editor` and `viewer` (a database enum).
+- b480c02: Open the settings slice to an app and to an installed package (PP-14.21, #939). Nothing changes for an app that registers none of the new points: no schema, stored value or OpenAPI field moves.
+
+  `@marinoscar/platform-api/settings`: `extendSystemSettingsNamespace` and `extendUserSettingsNamespace` take a dot `path` to an object field and add the fields inside it (an existing leaf key is refused, the parent is not; a stored value that predates the field keeps everything else). A system extension takes an `org` block (`mode: 'override' | 'tighten'`, `fields`, `tighten` per field as `'and'`, `'or'`, `'min'`, `'max'` or a function) that makes ONLY the added fields organization-overridable, composed with an existing org layer (`SettingsNamespaceOrgLayer` gained an optional `mode`). `overrideSettingsNamespaceDefaults(key, partial)` changes a namespace's defaults only, checked against its stored schema. `registerSettingsContribution({ id, system, user, extensions })` lets a package contribute namespaces and extensions from a side-effect import; `assembleSystemSettingsNamespaces` and `assembleUserSettingsNamespaces` list the platform's namespaces, the contributions' (import order) and the app's, fold the extensions and apply the defaults overrides. `extendUserProfile({ fields })` adds optional, bounded fields to the core user `profile`, and `registerThemePreference({ id, label })` adds a theme id `theme` accepts, listed in the new optional `themeOptions` of `GET /api/user-settings` while any is registered. `security` stays closed.
+
+  `@marinoscar/platform-contract/settings`: `THEME_PREFERENCE_ID_PATTERN`, `THEME_OPTION_LABEL_MAX`, `themePreferenceIdSchema`, `themeOptionSchema`, `ThemeOption`, `ThemePreferenceId` and `UserSettingsResponseBase.themeOptions`.
+
+  `@marinoscar/platform-web/settings`: `ProfileSettings` and `ThemeSettings` take `slots.ExtraFields` (and `UserProfilePage` and `UserAppearancePage` pass `slots` through), `ThemeSettings` offers `extraOptions`, `themePreferenceOptions` and `useThemePreferenceOptions` derive them from the settings document, and `registerOrgSettingsFieldRenderer(namespace, field, Component)` draws an `other` field of the organization settings page. `useUserSettings` hands `applyTheme` only `light`, `dark` and `system`; `UserSettingsDocument.theme`, `UserSettingsUpdateBase.theme` and `ThemeSettings`' `currentTheme` and `onThemeChange` widened to a theme id. The DOM of the three controls is unchanged without a slot, a renderer or a registered theme.
+
+- f994de1: Settings namespace seams for apps built on the packages (#865). `SystemSettingsNamespaces`, `SystemSettingsNamespaceDeclarations`, `UserSettingsNamespaces` and `UserSettingsNamespaceDeclarations` are declared in `@marinoscar/platform-api/settings` itself, so an app's `declare module '@marinoscar/platform-api/settings'` augmentation types `getNamespace(key)` whatever order the compiler meets it in (it used to lose the app's key once an installed slice's augmentation was processed after it). `SystemSettingsService.getNamespace(declaration)` reads a namespace typed by its declaration (`SystemSettingsNamespaceOf<D>`), with no augmentation. The `jobs` and `nodes` namespaces are the slices' own: `JOBS_SYSTEM_SETTINGS` / `mergeJobsSettings` (`/jobs`) and `NODES_SYSTEM_SETTINGS` / `mergeNodesSettings` (`/nodes`), with `DEFAULT_JOBS_POLICY` and `DEFAULT_NODES_POLICY` as defaults, registered by `JobsModule.forRoot()` and `NodesModule.forRoot()` through the new `ensureSystemSettingsNamespaces` unless the app's manifest already did (call them before `SettingsModule.forRoot()`). Their schemas are in `@marinoscar/platform-contract/jobs` and `/nodes`.
+- 9f4c147: Open the two places sharing hard-coded (PP-14.16, #934): who a grant can name, and how a decision is made.
+
+  `@marinoscar/platform-api/sharing`: `registerGranteeKind(GranteeKindDef)` and `registerAccessRule(AccessRuleDef)`. The built-in `user`, `group` and `link` kinds register through `registerGranteeKind` (no private fast path); `AccessPolicy`, `accessibleWhere`, `accessibleSql` and `POST /api/grants` compose the registry, with behaviour and SQL shape unchanged for the built-ins. A kind supplies `validateGrantee`, `describe` and the in-memory (`matchesPrincipal`) and SQL (`resolvePrincipalMatch`, parameterised through the app's SQL kit) spellings of one predicate. An access rule joins the documented order (owner and bypass first, rules `before-grants`, grants, rules `after-grants`, the org default): `deny` from any rule wins, a failing rule denies (logged with the rule id only), the record's user owner and a bypass holder are decided before the rules, and an allow confers a `role` (default the weakest). A rule gives `sql({ allow?, deny? })` so lists agree with decisions; a rule that can deny (`mayDeny`) must. `AccessVia` is open (`BuiltinAccessVia | (string & {})`: a widening of a stable type), rule ids and kind `via` values cannot impersonate a platform source, registered definitions are shallow-frozen, the decision counter's `via` label gains `app` and its `outcome` label gains `rule_error` (an access rule failed or was misconfigured; `AccessDecision.ruleFailure`). `AccessPolicy` takes a savepoint per call when rules apply so a failing rule statement cannot abort the shared transaction; the slice refuses the caller alias `g` in `accessibleSql`. `GET /api/sharing/grantee-kinds` (`sharing:read`) serves the registered kinds. `POST /api/grants` accepts `{ kind: 'custom', granteeKind, ref }` and answers 422 `GRANTEE_KIND_UNKNOWN`, `GRANTEE_INVALID` or `GRANTEE_KIND_NOT_PERSISTABLE`. New kits in `@marinoscar/platform-api/sharing/testing`: `describeGranteeKindConformance`, `describeAccessRuleConformance`, `recordingSqlKit`, `HOSTILE_STRINGS`.
+
+  A grant of an app-registered kind cannot be stored yet: `grants.grantee_kind` is an enum, so `registerGranteeKind` refuses `persisted: true` for a non-built-in kind until the sharing storage migration (tracked with the group-role migration) ships. No migration in this change.
+
+  `@marinoscar/platform-contract/sharing`: `BUILTIN_GRANTEE_KINDS`, `GRANTEE_KIND_ID_PATTERN`, `GRANTEE_KIND_INPUTS`, `granteeKindDescriptorSchema`, `granteeKindListSchema`, `customGranteeSchema` (a third `grantGranteeInputSchema` variant; the `user` and `group` shapes keep their validation), `SHARING_LIMITS.granteeRefMax`. `GRANT_GRANTEE_KINDS` is unchanged (the stored vocabulary).
+
+  `@marinoscar/platform-web/sharing`: `registerGranteePicker(kind, Component)`, `freezeGranteePickers()`, `useGranteeKinds()`, `SharingClient.listGranteeKinds`, `ShareActions.shareWithGrantee` and the `granteePickers` prop of `ShareDialog`. The dialog offers each non-built-in kind a grant can be stored for as one more choice (a text field, or the registered picker); the DOM is unchanged when only the built-ins are listed.
+
+- d35900e: Sharing: open group roles and persisted app grantee kinds. Migration `0037_open_sharing_vocabularies` turns `group_members.role`, `group_invites.role` and `grants.grantee_kind` from Prisma enums into text, adds the nullable `grants.grantee_ref` and relaxes `grants_grantee_consistency_check`; an app registers a group role with `registerGroupRole` and a persisted grantee kind with `registerGranteeKind({ persisted: true })`, and the share dialog and member role pickers read the registries.
+- 74c4aff: Declare peer dependencies per slice (`packages/platform-slice-peers.json`, checked by `npm run check:slice-peers`) and make every peer that the universal slice does not need optional. `platform-api` now requires only what `core` needs (`@nestjs/common`, `@nestjs/core`, `@nestjs/swagger`, `@opentelemetry/api`, `@prisma/client`, `nestjs-zod`, `reflect-metadata`, `rxjs`, `zod`); `@nestjs/config`, `@nestjs/schedule`, `@nestjs/event-emitter`, `@nestjs/jwt`, `@nestjs/passport`, `passport`, `@nestjs/terminus` and `@prisma/client-runtime-utils` become optional peers an app installs for the slices that use them. `platform-web` requires only `@mui/material`, Emotion, `react` and `react-dom`; `@mui/icons-material`, `react-router-dom` and `zod` become optional. `platform-db` no longer lists `@prisma/client` (its seed takes the app's client structurally) and `prisma` becomes optional; `platform-cli`'s `react` becomes optional. An app that installed every peer needs no change; an app that imports only some slices can now install only their peers. The datatable no longer imports the undeclared transitive `@mui/utils`.
+- 5e98e3d: Storage drivers are pluggable (PP-14.7, #925). `registerStorageDriver` adds an object store (Azure Blob, Google Cloud Storage, a local disk) from an app or a package: its own settings schema, declared secrets (stored encrypted at the credential purpose `storage_<id>`, never in settings or the environment), `build`, `testConnection`, and optionally `provision`, `listKeys` and `purge`. `s3`, `r2` and `s3compatible` are drivers registered through the same function, and all S3-specific code (the connection test, bucket provisioning, the purge lister, the per-flavour requirements and region fallback, the Doctor egress host) moved into them. The connection test, provisioning, purge, egress and the resolving provider delegate to the active driver. `describeStorageDriverConformance` (`@marinoscar/platform-api/storage/testing`) is the kit every driver runs.
+
+  The `storage` settings namespace stores `provider` (a driver id) and a `drivers` record validated per driver. A row stored before this release loads unchanged (its flat fields become `drivers.<provider>`, field by field), and the flat fields (`bucket`, `region`, `endpoint`, `accountId`, `accessKeyId`, `forcePathStyle`) stay accepted on PUT, PATCH and the admin routes and published as a deprecated read view. `databaseBackup.storageProvider` accepts any driver id.
+
+  Contract: `BUILTIN_STORAGE_PROVIDER_KINDS` (`STORAGE_PROVIDER_KINDS` stays as a deprecated alias), `storageDriverIdSchema`, `StorageProviderKind` widens to `string`; the admin config view gains `drivers` and `descriptors` and `missing` becomes a list of strings; the admin PUT, test and bucket bodies gain optional `drivers` and `secrets`; the test and provisioning results gain `message`. The `storage` contract slice now depends on the `settings` slice.
+
+  Migration notes for code that builds these by hand: `ResolvedStorageConfig` is the generic active configuration (`provider`, `bucket`, `region`, `endpoint?`, `settings`, `secrets`; the S3 family's is `ResolvedS3Config`); `StorageConnectionTestService` and `StorageBucketProvisionService` take a `StorageSubmissionService`; `resolveStorageConfig` (S3 only) is deprecated; `npm run storage:purge` exits `3` for a driver that can neither purge nor list its keys. New installs seed `storage` as `{ provider, drivers }`.
+
+  Web: `registerStorageDriverPanel(id, Component, { validate })` (`@marinoscar/platform-web/storage/ui`, and the new `/storage/ui/driver-panels` subpath) chooses the form the admin storage page draws for a driver. The page lists one radio per descriptor the API serves and the built-in `s3`, `r2` and `s3compatible` drivers register their bespoke form through the registry (markup unchanged); any other driver is drawn by `StorageGenericDriverPanel` from its descriptor (`PluggableConfigForm`, with write-only secrets), so an app that adds a driver with `registerStorageDriver` needs no web code. The page saves, tests and provisions with `{ provider, drivers: { <id>: settings }, secrets: { <id>: { <name>: value } } }`, shows a driver's `message` and `details` and offers provisioning after a failed test that reported no checks. `StorageProviderKind` and `MissingStorageConfigField` are `string`, `StorageConfigView` gained `drivers` and `descriptors`, `StorageConfigInput` needs only `provider`, and the test and provisioning results gained `message`. The S3-compatible radio label is now the driver's own ("S3-compatible"). The `storage` web slice now depends on `settings`.
+
+- 5425626: Let an app put its own numbers on the Telemetry Dashboard and in the assistant (PP-14.18, #936).
+
+  Units: `registerMetricUnit(MetricUnitDef)` of `@marinoscar/platform-api/telemetry`; the 15 built-in units register through it (`BUILTIN_METRIC_UNITS`, with `METRIC_UNITS` kept as a deprecated alias), `assertUnit` reads the registry and `GET dashboard/metric-groups` serves, per group, `units` (the descriptors of the units it uses beyond the built-ins) so the browser formats an app unit with no web change. A unit descriptor has one of nine fixed formats and no code (`metricUnitDescriptorSchema`).
+
+  Presentation: `MetricGroupDef.presentation` is data (tiles, charts with theme-token colours, tables with Top N and `problems-first` or `value-desc` sort and column displays, and `ratio`, `delta` and `rate` virtual columns), zod-validated and bounded when the group is registered, and served on `/metric-groups`. The six platform groups declare theirs (`PLATFORM_METRIC_PRESENTATIONS` of the contract) instead of the web's section table, and draw with the same DOM. `metricGroupPresentationSchema` and the presentation interfaces are new contract exports.
+
+  Panels: `registerDashboardPanel(DashboardPanelDef)` and `dashboardPanelRegistry` (API; `GET dashboard/panels` and `panels/:id`, payload at most 256 KiB, a time budget, a generic failure) with `registerDashboardPanelView(id, View, { frame? })` (web, also from the new `@marinoscar/platform-web/telemetry/ui/dashboard-panels`). The platform's `api` and `logs` panels register through the same calls. `TelemetryQueryFacade` (`query`, `sql`, `dialect`) is the only way a panel reads the store: one guarded, capped, timed-out and audited statement per call (audit source `panel`), under a per-request statement budget.
+
+  Assistant: `registerTelemetryAssistantTool(TelemetryAssistantToolDef)` adds a read-only tool that receives the facade and never a client (a name that shadows one of the eight built-ins is refused; `rows` output is withheld from the model while `assistant.shareResults` is off), and `TelemetryModule.forRoot({ assistant: { extraInstructions } })` appends developer notes (at most 4 000 characters of plain text) to the system prompt as an `APPLICATION NOTES` section.
+
+  Pages: `TelemetryDashboardPage`, `TelemetrySettingsPage` and `TelemetryExplorerPage` take `slots` of the page-slot contract and are off `page-slots.exempt.json`; the explorer also takes `starterQueries`.
+
+  otel-core: `initializeOtel` accepts `spanProcessors`, `logRecordProcessors`, `metricReaders`, `views`, `sampler`, `textMapPropagator` and `resourceAttributes`; every processor and reader is wrapped in a gated one (`GatedSpanProcessor`, `GatedLogRecordProcessor`, `GatedMetricReader`), so nothing exports while the runtime gate is closed.
+
+  Conformance: the `telemetry` suite gains check 9 (registered panels and tools are well formed, the platform's panels remain) and check 10 (the facade has exactly `query`, `sql` and `dialect` and is frozen), and check 1 validates presentations. `/telemetry/testing` exports `createQueryFacade`, `checkFacadeSurface` and `checkRegisteredExtensions`.
+
+  Additive: a host that registers nothing sees no change except the new optional `presentation` and `units` fields on `GET dashboard/metric-groups` and the new `dashboard/panels` routes.
+
+- 175ddd3: Make the dashboard metric tables' freshness window an option: `TelemetryModule.forRoot({ metrics: { freshMs } })` (default `METRIC_FRESH_MS`, 150 s; resolved into the `TELEMETRY_METRIC_FRESH_MS` token). The `/metrics` response reports it as the optional `freshMs`, and each dashboard section with a table shows it in its header ("Current within 2 min 30 s").
+- 1171b1c: Complete the telemetry slice in all five packages. `@marinoscar/platform-api/telemetry/testing` gains the telemetry conformance suite (registered with `runPlatformConformance()` as `suites.telemetry`: metric groups, route permissions, read-only Doctor checks, no secrets in responses, the cron coverage and the boot without a store), the stub host ports, and the five activity and six coach fixture tables; `ConformanceCase.run` may be async and a slice may add a suite key by augmenting `PlatformConformanceSuiteOptions`. Every telemetry slice README now follows the Package documentation standard with a catalog that links a working example in the reference app.
+- 2732024: The telemetry store is replaceable (PP-14.11, #929). The explorer, the export, the assistant's statements, the Telemetry Dashboard, the status page, the retention job, the Doctor checks and the support bundle now depend on two injection tokens, `TELEMETRY_STORE` (a `TelemetryStore`: `query(sql, params, { readOnly: true, timeoutMs, signal })`, `schema()`, `ping()`, `close()`, `isConfigured()`, an optional `retention` control) and `TELEMETRY_SQL_DIALECT` (a `TelemetrySqlDialect`: the time bucket, the percentile, the regular-expression replace, the JSON attribute read, the case-insensitive substring match, the text cast, the row cap and the metric tables' time and value columns), and never on `GreptimeClient`. `registerTelemetryStore` adds a store from an app or a package at import time (its own settings schema, defaults and declared secrets, stored encrypted at the credential purpose `telemetry_<id>`, and `build`, which returns the store and its dialect), and `TelemetryModule.forRoot({ store: '<id>' })` selects it (default `greptime`; an id nobody registered fails boot naming the registered ones). `greptime` is the built-in store, registered through the same function: `GreptimeClient` now implements `TelemetryStore` (its `query()` runs on the read-only login, `queryReader()` and `queryAdmin()` are unchanged), its dialect, retention control and schema read live under `telemetry/stores/greptime/`, and its connection, the `telemetry_connection` row and the `telemetry_greptime` credential purpose are unchanged. The explorer's guard (one read-only statement, the row cap, the timeout, the audit row) stays in the platform, above the store. `describeTelemetryStoreConformance` (`@marinoscar/platform-api/telemetry/testing`) is the kit every store runs: writes refused, timeout and abort honoured, `schema()` shape, a `ping()` that never throws or leaks a secret, an unconfigured store, and, over a fixture, every dashboard statement built with the store's dialect.
+
+  A store that is not GreptimeDB has `GET` and `PUT /api/admin/telemetry/store` (`telemetry:read` / `telemetry:write`, `If-Match`): its non-secret settings are one entry of the new `telemetry_store` system-settings row and its secrets are write-only. `GET /api/admin/telemetry/config` gains an optional `store: { id, label }`. The dashboard SQL builders take an optional trailing `TelemetrySqlDialect` (default: the GreptimeDB one, so their text is unchanged), and the stub ports of `telemetry/testing` take a `policy` patch and per-purpose secrets.
+
+  Migration notes: the app's `TELEMETRY_SETTINGS_STORE` adapter must allow the new row key (`telemetry_store`, beside `telemetry_connection`; the reference app's `TELEMETRY_OWNED_ROW_KEYS`); code that constructs `TelemetryQueryService`, `TelemetrySchemaService`, `TelemetryStatusService`, `TelemetryRetentionHandler`, `TelemetrySettingsService`, the Doctor reachability and freshness checks or the support-bundle section by hand now passes a `TelemetryStore` (a `GreptimeClient` is one) where it passed the client; the `greptime/greptime.client.ts`, `greptime-host.ts` and `greptime.errors.ts` files moved under `telemetry/stores/` (the public exports are unchanged, and the store errors are now exported too); the `telemetry` platform-api slice depends on `credentials`, and the `telemetry` contract and web slices on `settings`.
+
+  Web: the Telemetry settings page keeps the Telemetry services and GreptimeDB Connection sections for the built-in store (markup unchanged) and draws a Store section for any other registered store: the settings slice's `PluggableConfigForm` over the descriptor `GET /admin/telemetry/store` serves, with write-only secrets and an `If-Match` on every save, so an app that registers a store needs no web code. `useTelemetryStore` and the `TelemetryStoreConfig` types are exported from `@marinoscar/platform-web/telemetry/headless`; the settings slice's index exports `usePluggableConfigForm`. Contract: `telemetryStoreSummarySchema`, `telemetryStoreResponseSchema` and `updateTelemetryStoreSchema`.
+
+- 125b54b: User-data slice: `UserDataModule.forRoot` now defaults `USER_DATA_ENVIRONMENT` (the host slice's `DeploymentModeService` and identity's `TenancyService`; override with `environment`), so an app binds only the bypass client `USER_DATA_DB`. Adds `composedSchemaDatamodel(__dirname)` / `findComposedSchemaPath` for the `datamodel` option and the `user-data.registries` Doctor check (the conformance suite's three checks, on a running deployment; they now live in `registry-checks.ts` and are re-exported from `user-data/testing`). The slice now depends on the `doctor` and `host` slices. Web: `PlatformViewer` gains an optional `refresh()`, and the Danger Zone and factory reset pages call it after a successful action, so an app mounts them without a callback.
+- 39b5300: Add the user-data slice (#743): registry-driven per-user deletion with scopes (`user.data.purge`), the admin factory reset (`admin.factory_reset`) and organization offboarding (`org.offboard`), with the Danger Zone, factory reset and offboarding UI; `StorageKeyPrefixDef.survivesFactoryReset`; `OrganizationsPage` `renderActions`.
+- 8246e10: The packaged-page slot contract (PP-14.23) is applied to the AI, storage, email, Android, host, profile, appearance, organization settings, user-data and notification pages (PP-14.24, #942). Every page takes an optional `slots` prop typed to `PageSlotsBase`; a page given none renders the markup it always did (each page group has a DOM snapshot recorded from the old components).
+
+  - **Web, `@marinoscar/platform-web/core`**: `PageSlotsFrame` lays a page body out in slot order (no wrapper element), for the packaged pages and for an app's own page.
+  - **AI**: `AiConfigPage` (`ProviderCardExtra`, drawn under each provider's card), `AiModelsPage` and `AiUsagePage` (the table slots), `UserAiKeysPage`, `OrgAiKeysPage` and `AiPlaygroundPage` (the playground `Header` receives its "New conversation" button as `actions`). `AiUsageTable` takes `slots` too.
+  - **Storage, email**: `StorageConfigPage` and `EmailSettingsPage` take the base slots (the driver and transport panels stay registries).
+  - **Android**: `AndroidAppPage` takes the base slots; `TrustedAppsSection`, `ReleasesSection` and `NotificationsSection` are exported from `android-app/ui`.
+  - **Host**: `AboutPage` and `MaintenancePage` take the base slots. `MaintenanceScreen` gains `logo`, `actions` and `children`; `InstallPrompt` `icon` and `copy`; `MaintenanceBanner` `copy` and `actions`.
+  - **Settings**: `UserProfilePage`, `UserAppearancePage` and `OrgSettingsPage` take the base slots.
+  - **Notifications**: `BroadcastsPage`, `PushConfigPage`, `NotificationSettingsPage` and `UserNotificationsPage` take the base slots.
+  - **User data**: `FactoryResetPage` and `UserDangerZonePage` take `slots` and `copy`, and print the kept and deleted lines of the summary responses instead of constants (the constants stay as the fallback, word for word).
+  - **API and contract (user-data)**: `GET /api/user-data/summary` returns `kept: string[]`, `GET /api/admin/factory-reset/summary` returns `deleted: string[]` and `kept: string[]`. The platform's lines are exactly the text the web bundle held; `UserDataModelHint.summary` (a kept model) and `FactoryResetStepDef.summary` (a step) add one line each. `userDataSummarySchema` and `factoryResetSummarySchema` gain the required arrays: deploy the API before the web, and add the arrays to any hand-built summary in a test.
+  - The telemetry pages, the identity and sharing pages and the exports and onboarding pages stay on `test/page-slots.exempt.json`.
+
+### Patch Changes
+
+- ca591e3: Every module-augmentation target is declared in the entry module its public subpath resolves to, so an app's `declare module '@marinoscar/platform-*/<subpath>'` merges with the slices' own augmentations in any file order (#865): `EmailTemplateDataMap` (`/email`), `IdentityPermissionIds` and `IdentityRoleIds` (`/identity`), `NotificationChannelIds` (`/notifications`), `AppMetricKeys` (`/otel-core`), `MetricGroupIds` (`/telemetry`), `PlatformConformanceSuiteOptions` (`/testing`) and `SettingsFeatureRegistry` (`@marinoscar/platform-web/settings/headless`). The names and import paths an app uses are unchanged, except that `@marinoscar/platform-web/settings/ui` no longer re-exports `SettingsFeatureRegistry`: import and augment it from `/settings/headless`.
+- ca591e3: The published declarations' type dependencies are declared (#865): `@types/passport`, `@types/passport-jwt`, `@types/passport-google-oauth20` and `@types/pg` are dependencies, so an app compiling with `skipLibCheck: false` no longer fails on the identity and telemetry declarations; `@types/supertest` (beside the optional `supertest`) and `@nestjs/platform-fastify` (the telemetry conformance suite) are optional peers.
+- f6e319b: Documentation only: every slice README's Extension-point catalog links the new extension author guide (`docs/EXTENDING.md`); the email README no longer promises that a provider of `SmtpEmailProvider` in the app module replaces the transport (it does not reach the package's consumers; a transport registry is not supported yet); the AI READMEs say that a provider cannot be enabled from an app yet; the platform-db README documents `rlsPolicies` in `platform.lock` with the migration SQL for an app table protected by row-level security.
+- fe73d7a: Documentation only: the overview READMEs list every shipped slice and subpath, and the stale "version 0.0.0" status lines are replaced.
+- 7e667e2: `POST /api/admin/ai/models/refresh` now answers `409` with `details.reason` `AI_DISABLED` or `AI_PROVIDER_DISABLED` when AI, or the provider, is switched off, instead of queueing an `ai.catalog.refresh` job that silently skipped. New `AiCatalogService.disabledReason(providerId)` is the single policy read behind both the route and the sync.
+
+  In `@marinoscar/platform-web`, `useAiModels().refreshCatalog` no longer clears `refreshError` per call: it shows the server's own message for these refusals and collects (de-duplicated) the refusals of several providers, and `AiModelsPage` clears the error once before refreshing and shows the "Refresh queued" snackbar only when a job was queued.
+
+- aeace4a: Add the worker-node admin response schemas to `@marinoscar/platform-contract/nodes` (`adminNodeSchema`, `adminNodeCredentialSchema`, `nodeCredentialListItemSchema`, `nodeCredentialCreatedSchema`, `NODE_STATUSES`, `NODE_HEALTHS`) that the API's Swagger classes now implement (#881), and add `@marinoscar/platform-web/nodes` (`/nodes/headless`, `/nodes/ui`): the fleet and credential client, hooks, adapters and the Worker Nodes page, which `@marinoscar/platform-web/jobs` re-exports for compatibility.
+- e8dfe86: Correct two comments and the core README: the app no longer ships a pino `LoggerService`, so packaged code's `new Logger(Context)` reaches the app's logger only when the app sets one with `app.useLogger`.
+- 346e661: The sharing slice's READMEs are complete in all three packages (#732): quick start, the full extension-point catalog with a compiled, tested reference example for every entry (`apps/api/test/examples/sharing/`, `apps/web/src/__tests__/examples/sharing/`), minimal examples, observability, security notes, the conformance suite, troubleshooting, and two migration recipes (a per-record share table, kvox-style; circles and public links, MemoriaHub-style). `ownedByMeOrMyGroups`, `ShareDialog`, `useGrants`, `useShareActions` and `useSharedWithMe` are now catalogued extension points.
+- Updated dependencies [a426fd8]
+- Updated dependencies [b2df59a]
+- Updated dependencies [823ec07]
+- Updated dependencies [6a7af76]
+- Updated dependencies [deeb8b5]
+- Updated dependencies [a20f306]
+- Updated dependencies [2be194f]
+- Updated dependencies [0b9962b]
+- Updated dependencies [606d231]
+- Updated dependencies [0426848]
+- Updated dependencies [077c0c0]
+- Updated dependencies [fc11b22]
+- Updated dependencies [685657b]
+- Updated dependencies [5d0dd86]
+- Updated dependencies [03eeaab]
+- Updated dependencies [17d6ed1]
+- Updated dependencies [f80189d]
+- Updated dependencies [115705f]
+- Updated dependencies [d1d1258]
+- Updated dependencies [b46725d]
+- Updated dependencies [f6e319b]
+- Updated dependencies [fe73d7a]
+- Updated dependencies [e6acb4b]
+- Updated dependencies [2c4bf2c]
+- Updated dependencies [c6f97da]
+- Updated dependencies [6487697]
+- Updated dependencies [8a0f3b9]
+- Updated dependencies [aeace4a]
+- Updated dependencies [fce5417]
+- Updated dependencies [48b275d]
+- Updated dependencies [fe61ffe]
+- Updated dependencies [b480c02]
+- Updated dependencies [f994de1]
+- Updated dependencies [346e661]
+- Updated dependencies [9f4c147]
+- Updated dependencies [d35900e]
+- Updated dependencies [74c4aff]
+- Updated dependencies [5e98e3d]
+- Updated dependencies [5425626]
+- Updated dependencies [175ddd3]
+- Updated dependencies [1171b1c]
+- Updated dependencies [2732024]
+- Updated dependencies [39b5300]
+- Updated dependencies [8246e10]
+  - @marinoscar/platform-contract@0.1.0-next.4
+
 ## 0.1.0-next.3
 
 ### Minor Changes

package/README.md

@@ -6,16 +6,34 @@ The NestJS side of the platform: dynamic modules (one subpath export per slice,
 
 Dynamic modules, services, guards and registries of the platform's API slices. It does not own the app's composition root, its product identity or its own feature modules.
 
-Status: pre-release (version `0.0.0`). The root export is only the package name (`PLATFORM_PACKAGE`); the slices are subpath exports, each with its own README:
+Status: pre-release (the current channel and how to install it: the [release runbook](../../docs/runbooks/release-platform-packages.md)). The root export is only the package name (`PLATFORM_PACKAGE`); the slices are subpath exports, each with its own README:
 
-- `@marinoscar/platform-api/core`: the bottom of the slice graph, code only: the typed registry primitive (`defineRegistry`, `Registry`, `RegistryError`, `RegistryFreezeService`, `withTemporaryEntries`), the principal and scope contract (`Principal`, `Scope`, `SystemActor`, ADR 0001), the exception filter and its exceptions (`HttpExceptionFilter`, `ErrorDto`, `withVerbatimErrorBody`, `DatabaseSeedException`), the secret cipher (`encryptSecret`, `decryptSecret`, `userCredentialPurpose`, `deriveSigningKey`, `verifyEncryptionKeyAtStartup`) and the OpenAPI tag registry (`openApiTags`), and scoped data access (`userOwnedModelRegistry`, `forUser`, `userScopeExtension`, `asSystem`, `ScopedAccessError`; schema-independent, #699). [README](src/core/README.md).
+- `@marinoscar/platform-api/core`: the bottom of the slice graph, code only: the typed registry primitive (`defineRegistry`, `Registry`, `RegistryError`, `RegistryFreezeService`, `withTemporaryEntries`), the principal and scope contract (`Principal`, `Scope`, `SystemActor`, ADR 0001), the exception filter and its exceptions (`HttpExceptionFilter`, `ErrorDto`, `withVerbatimErrorBody`, `DatabaseSeedException`), the secret cipher (`encryptSecret`, `decryptSecret`, `userCredentialPurpose`, `deriveSigningKey`, `verifyEncryptionKeyAtStartup`) and the OpenAPI tag registry (`openApiTags`), the role and permission registries (`roleRegistry`, `permissionRegistry`, `registerPermissions`, `buildPermissionCatalog`, #866), and scoped data access (`userOwnedModelRegistry`, `forUser`, `userScopeExtension`, `asSystem`, `ScopedAccessError`; schema-independent, #699). [README](src/core/README.md).
 - `@marinoscar/platform-api/testing`: the conformance harness (`runPlatformConformance`, `conformanceSuites`, the `cron-enqueue-only` and `user-owned-data` suites, and the small Prisma schema reader behind the latter). [README](src/testing/README.md).
-- `@marinoscar/platform-api/doctor`: the admin Doctor, `GET /api/admin/doctor` (`DoctorModule.forRoot({ host })`, `DoctorCheckRegistry`, the check contract). The first packaged slice (#696). [README](src/doctor/README.md).
+- `@marinoscar/platform-api/doctor` and `@marinoscar/platform-api/doctor/testing`: the admin Doctor, `GET /api/admin/doctor` (`DoctorModule.forRoot({ host })`, `DoctorCheckRegistry`, the check contract); the testing entry is the check author's kit (`describeDoctorCheckConformance`, a recording Prisma client, a write-failing storage provider) and the `doctor-read-only` conformance suite. The first packaged slice (#696). [README](src/doctor/README.md).
 - `@marinoscar/platform-api/otel-core` and `@marinoscar/platform-api/otel-core/sdk`: the emitting half of telemetry (#700): `initializeOtel` (the Nest-free SDK bootstrap, loaded first), the runtime export gate `telemetryGate`, the metrics host `MetricsHostService` with the app-metric name registry and the gauge-provider seam, `registerRequestSpanAttributes` and `@Trace()`. [README](src/otel-core/README.md).
+- `@marinoscar/platform-api/identity` and `@marinoscar/platform-api/identity/testing`: identity (#727): `IdentityModule.forRoot()`, the route-access decorators and guards (`@Auth`, `@Public`, `@CurrentUser`, `@CurrentPrincipal`, `JwtAuthGuard`), sessions and refresh tokens, personal access tokens, worker-node credentials, the device flow, users, the allowlist, organizations and tenancy, the sign-in provider registry, the `identity.*` events and the host ports identity reaches the app through; the test login, the stub host and the `identity` conformance suite. [README](src/identity/README.md).
+- `@marinoscar/platform-api/settings` and `@marinoscar/platform-api/settings/testing`: settings (#733): `SettingsModule.forRoot()`, the system and user namespace registries and their composition, `SystemSettingsService`, `UserSettingsService`, the org layer (`OrgSettingsService`, `/api/org-settings`), `SettingsResolver` (system, then org, then user) and `SystemSettingsRowStore`; the `settings` conformance suite. [README](src/settings/README.md).
+- `@marinoscar/platform-api/credentials` and `@marinoscar/platform-api/credentials/testing`: the encrypted credential stores (#735): the deployment's (`CredentialsService`), a user's own (`UserCredentialsService`) and an organization's (`OrgCredentialsService`, `org_credentials` under row-level security), `UserCredentialResolver` (user, then org, then deployment), the purpose registries `registerCredentialPurpose` and `registerUserCredentialPurpose`, and the `credentials` conformance suite. [README](src/credentials/README.md).
+- `@marinoscar/platform-api/onboarding` and `@marinoscar/platform-api/onboarding/testing`: onboarding (#745): `OnboardingModule.forRoot()`, the step, fact, ordering and activation-milestone registries, the platform steps (storage, email, access, AI, Web Push, backups, the org invite; profile, notifications), `GET /api/onboarding` (derived, read-only) and `GET /api/admin/onboarding/metrics` (aggregates only), the `onboarding` user-settings namespace and `extendOnboardingSettings`; the `onboarding` conformance suite. [README](src/onboarding/README.md).
+- `@marinoscar/platform-api/email` and `@marinoscar/platform-api/email/testing`: outgoing email (#737): `EmailModule.forRoot()`, pluggable transports (`registerEmailTransport`; SES and SMTP ship, with inline attachments), the `email` settings row and `/api/email-settings`, the template registry (`registerEmailTemplate`, `EmailTemplateDataMap` augmentation, overrides), the layout theme and brand-mark slot, the safe-HTML helpers, the `email` conformance suite and the `describeEmailTransportConformance` kit. [README](src/email/README.md).
+- `@marinoscar/platform-api/jobs` and `@marinoscar/platform-api/jobs/testing`: the background job queue (#734): `JobsModule.forRoot()`, enqueue with active dedup, the one-statement claim, leases, the terminal state machine, the worker pool, the lease reaper and the temp-file janitor, the `JobHandler` contract and `JobHandlerRegistry`, the label registry, `JobScope`, `enqueueHousekeepingJob`, `job.settled`, `org_id` on jobs and the `/api/admin/jobs` routes; the testing entry holds the `on-event-no-io` suite and the handler kit (`createFakeJobQueue`, `describeJobHandlerConformance`). [README](src/jobs/README.md).
+- `@marinoscar/platform-api/nodes`: the worker-node fleet (#734): `NodesModule.forRoot()`, `NodeCredentialModule` (`nod_` tokens), the node control and data planes (`NODE_OBJECT_STORE`), the brokered per-job secret, the fleet admin routes, sweeps and gauges, and the `nodes.node.offline` event. [README](src/nodes/README.md).
+- `@marinoscar/platform-api/storage` and `@marinoscar/platform-api/storage/testing`: object storage (#736): `StorageModule.forRoot()`, `STORAGE_PROVIDER` (the S3 driver configured per call from runtime settings; the rung-3 override), the objects API, the storage-config admin routes and Doctor checks, the object-processor registry, the key-prefix registry with scopes and org-aware keys (`buildObjectKey`, `allKeyPrefixes`, `orgKeyPrefixes`), `runStoragePurge`, `ProfileImageModule.forRoot()`, `nodeObjectStoreBinding` and the `storage` conformance suite. [README](src/storage/README.md).
+- `@marinoscar/platform-api/exports` and `@marinoscar/platform-api/exports/testing`: data export (#744): `ExportsModule.forRoot()`, the source and writer registries (`registerExportSource`, `registerExportWriter`), the `user-data` and `org-data` sources driven by the user-owned and ownership registries, the `json`, `csv` and `xlsx` writers, the CSV helpers, the `Exporter`/`ExporterRegistry` document primitives, the `export.run` and `export.purge` jobs, `/api/exports` and the `exports` conformance suite (secret egress). [README](src/exports/README.md).
+- `@marinoscar/platform-api/ai` and `@marinoscar/platform-api/ai/testing`: the AI platform (#739): `AiModule.forRoot()` with its host ports (`AI_SYSTEM_PRISMA`, `AI_OBJECT_STORE`, `AI_METRICS`), `AiService.forUser` and the gate pipeline, the five provider adapters (their SDKs confined to `ai/providers/`), the model catalogue, the `ai` settings namespaces with the org layer, the user, organization and deployment key tiers, per-org caps and usage, the feature registry (`registerAiFeature`), `AI_TARGET_RESOLVER`, and the fake provider, runtime harness, adapter conformance kit and orchestration-boundary suite. [README](src/ai/README.md).
+- `@marinoscar/platform-api/db-backup` and `@marinoscar/platform-api/db-backup/testing`: database backup and restore (#740): `DbBackupModule.forRoot()` (deployment-mode aware: `saas` turns in-app restore off), the streaming `pg_dump` engine, schedule and retention, the restore with its read-only pre-flight (the `rls_bypass` gate) and the `RestoreCarryOver` registry, the four job types, the per-job role broker, the host ports and the `db-backup` conformance suite. [README](src/db-backup/README.md).
+- `@marinoscar/platform-api/telemetry` and `@marinoscar/platform-api/telemetry/testing`: the API side of observability: the `telemetry` settings and runtime export gate, the runtime GreptimeDB connection, the explorer, the AI assistant, the dashboard with its metric-group registry and health verdict, the stack-agent surface, two server-only job types, five Doctor checks and a support-bundle section; the `telemetry` conformance suite. [README](src/telemetry/README.md).
+- `@marinoscar/platform-api/sharing` and `@marinoscar/platform-api/sharing/testing`: sharing primitives: groups, members and invites inside an organization, the ownership contract, grants (user, group and link), `AccessPolicy`, the "resources I can see" query helpers, link shares and the public-route pattern; the `sharing` conformance suite. [README](src/sharing/README.md).
+- `@marinoscar/platform-api/notifications` and `@marinoscar/platform-api/notifications/testing`: the notification framework: the event, channel and template registries, the dispatcher and its policy (system, then organization), the email, in-app and Web Push channels, runtime Web Push keys, admin broadcasts and the SSE stream; the `notifications` conformance suite. [README](src/notifications/README.md).
+- `@marinoscar/platform-api/android-app` and `@marinoscar/platform-api/android-app/testing`: the server half of the Android companion: trusted apps and the Digital Asset Links route, hosted APK releases, the `android_app` notification channel and the test notification; the conformance suites of its `testing` entry. [README](src/android-app/README.md).
+- `@marinoscar/platform-api/user-data` and `@marinoscar/platform-api/user-data/testing`: the per-user data deletion with scopes, the admin factory reset and organization offboarding, built from the category, scope, keep-or-delete hint, factory-reset step and offboarding-precondition registries; the conformance suites of its `testing` entry. [README](src/user-data/README.md).
+- `@marinoscar/platform-api/manifest`: what every platform slice registers, in registration order (#866): the platform roles and every slice's permission sets in seed order (`PLATFORM_ROLES`, `PLATFORM_PERMISSION_SETS`, `PLATFORM_PERMISSIONS`), `registerPlatformPermissions()` and its pure twin `platformPermissionCatalog()` (both take the app's own roles and permissions and an optional `slices` filter), and the inventory of platform models with a foreign key to `User` (`PLATFORM_USER_OWNED_MODELS`, `registerPlatformUserOwnedModels()`). Data and plain functions, no Nest module. [README](src/manifest/README.md).
+- `@marinoscar/platform-api/host` and `@marinoscar/platform-api/host/testing`: the API host core (#867): `PlatformHostCoreModule.forRoot()` with the cross-replica event bus (`EVENT_BUS`), the platform's `AppMetricsService` and app-metric declarations, maintenance mode (`MaintenanceModeService`, `/api/admin/maintenance`, `MaintenanceGuard` as the platform's `APP_GUARD`, first; an app's own global guard is declared to the `host` suite), the `{ data }` envelope, the request log line, the exception filter and request ids; the OpenAPI document and `/api/docs` (`createOpenApiDocument`, `registerPlatformDocs`); the `host` conformance suite and `FakeEventBusNetwork`. [README](src/host/README.md).
 
 The `core` slice also holds the **host ports** (#696: `definePlatformHost`, `AUDIT_SINK`, `SYSTEM_SETTINGS_STORE`, `PLATFORM_PRISMA`, `PlatformHostModule`), the one mechanism every packaged slice uses to reach app-owned capabilities, with test doubles in `testing`. [Host ports](src/core/README.md#host-ports).
 
-More slices arrive in later releases of the platform program.
+Every slice that has a `testing` entry registers its conformance suites when that entry is imported; `runPlatformConformance()` runs them ([testing README](src/testing/README.md)).
 
 ## Install and peer dependencies
 
@@ -23,7 +41,9 @@ More slices arrive in later releases of the platform program.
 npm install @marinoscar/platform-api
 ```
 
-Install these in the app; the package never bundles its own copy (a second copy breaks dependency injection, hooks or theme context).
+Install these in the app; the package never bundles its own copy (a second copy breaks dependency injection, hooks or theme context). Which ones depends on the slices you import: only what `core` needs is required, everything else is an optional peer that npm does not install for you ([the rule](../../docs/PACKAGES.md#peer-dependencies-per-slice)). Import slices by their subpath (`@marinoscar/platform-api/telemetry`), never from the package root: the root entry may touch any slice and so would need every peer.
+
+Required by every slice (`core`, with the peers those packages need in turn):
 
 | Package | Range |
 |---|---|
@@ -31,18 +51,38 @@ Install these in the app; the package never bundles its own copy (a second copy
 | `@nestjs/core` | `^11.1.12` |
 | `@nestjs/swagger` | `^11.2.5` |
 | `@opentelemetry/api` | `^1.9.1` |
-| `@prisma/client` | `^7.8.0` |
-| `fastify` | `^5` |
+| `@prisma/client` | `^7.8.0` (only `@prisma/client/extension` is imported, by `core`'s scoped data access; no slice imports the generated client) |
 | `nestjs-zod` | `^5.4.0` |
 | `reflect-metadata` | `^0.2.2` |
 | `rxjs` | `^7.8.1` |
 | `zod` | `^4.4.3` |
 
+Optional peers, installed for the slices that need them:
+
+| Package | Range | Needed by |
+|---|---|---|
+| `@nestjs/config` | `^4.0.2` | `telemetry`, `identity`, `settings`, `onboarding`, `jobs`, `nodes`, `storage`, `notifications`, `db-backup`, `host` |
+| `@nestjs/schedule` | `^6.1.0` | `telemetry`, `sharing`, `identity`, `jobs`, `nodes`, `storage`, `exports`, `ai`, `db-backup` |
+| `@nestjs/event-emitter` | `^3.0.1` | `identity`, `jobs`, `nodes`, `storage`, `notifications`, `ai` |
+| `@nestjs/jwt` | `^11.0.2` | `identity`, `host` |
+| `@nestjs/passport` | `^11.0.5` | `identity` |
+| `passport` | `^0.7.0` | `identity` (with `@nestjs/passport`) |
+| `@nestjs/terminus` | `^11.0.0` | `host` (the health controller) |
+| `@prisma/client-runtime-utils` | `^7.8.0` | `jobs`, `ai`, `db-backup` |
+| `fastify` | `^5` | the slices with controllers that read the request or write the reply (types: `doctor`, `otel-core`, `telemetry`, `identity`, `storage`, `ai`, `android-app`, `host`) |
+| `@nestjs/platform-fastify` | `^11.1.12` | the telemetry conformance suite, `@marinoscar/platform-api/telemetry/testing` |
+| `supertest` | `^7.2.2` | the AI conformance suites, `@marinoscar/platform-api/ai/testing` |
+| `@types/supertest` | `^7.2.0` | with `supertest`, for the same suites' declarations |
+
+A slice also needs what the slices it depends on need (`packages/platform-slices.json`): `settings` needs `identity`'s peers, `storage` needs `jobs`' and `nodes`', and so on. The exact set per slice is `packages/platform-slice-peers.json`; `node scripts/check-slice-peers.mjs --table` prints it. For example `core`, `otel-core` and `telemetry` together need the required peers above plus `@nestjs/config`, `@nestjs/schedule` and `fastify`, and nothing else; [`tests/consumer-smoke/api-slim`](../../tests/consumer-smoke/api-slim/) installs exactly that from packed tarballs.
+
+The type packages the published declarations need whatever an app imports (`@types/passport`, `@types/passport-jwt`, `@types/passport-google-oauth20` for the identity slice, `@types/pg` for telemetry) are dependencies, so an app that type-checks its libraries (`skipLibCheck: false`) installs nothing extra. `test/declaration-type-deps.spec.ts` fails on a declaration import the manifest does not cover (#865).
+
 The OpenTelemetry SDK packages the `otel-core` slice installs (`@opentelemetry/sdk-node`, the auto-instrumentations, the OTLP/HTTP exporters and their SDK siblings) are regular dependencies, not peers: only `@opentelemetry/api`, which holds the process-wide providers, must be a single shared copy.
 
 ## Quick start
 
-Run the platform's conformance suites from a spec of your own (the reference app's is [`apps/api/test/jobs/cron-enqueue-only.spec.ts`](../../apps/api/test/jobs/cron-enqueue-only.spec.ts)):
+Run the platform's conformance suites from a spec of your own (the reference app's is [`apps/api/test/conformance.spec.ts`](../../apps/api/test/conformance.spec.ts)):
 
 ```ts
 import { join } from 'node:path';
@@ -64,6 +104,8 @@ None at the package level. Each slice documents its own options: `DoctorModule.f
 
 None. The root export is only the package name; the extension points live in the slice catalogs ([core](src/core/README.md#extension-point-catalog), [testing](src/testing/README.md#extension-point-catalog), [doctor](src/doctor/README.md#extension-point-catalog), [otel-core](src/otel-core/README.md#extension-point-catalog)).
 
+The extension ladder and a recipe per extension: [docs/EXTENDING.md](../../docs/EXTENDING.md).
+
 ## Data
 
 None yet. A slice that owns models documents them here and in its own README; the schema fragments and migrations ship in `@marinoscar/platform-db`.
@@ -90,7 +132,7 @@ Every packaged controller takes the app's auth decorators through the host acces
 
 ## Conformance suite
 
-The harness is the `testing` slice: `runPlatformConformance()` from `@marinoscar/platform-api/testing` runs the platform's suites in any app: `cron-enqueue-only` and `user-owned-data`. See the [testing README](src/testing/README.md#conformance-suite).
+The harness is the `testing` slice: `runPlatformConformance()` from `@marinoscar/platform-api/testing` runs the platform's suites in any app: `cron-enqueue-only`, `user-owned-data`, and the suites a slice ships in its `testing` entry (`on-event-no-io` with the jobs slice; the AI kill switch, RBAC matrix, secret egress, key policy, jobs server-only, no-SDK-leak and orchestration-boundary suites with the AI slice; one per slice besides). The [testing README](src/testing/README.md#conformance-suite) lists every suite id.
 
 ## Upgrade notes
 

package/dist/ai/ai.constants.d.ts

@@ -0,0 +1,8 @@
+export declare const PERMISSIONS: Readonly<{
+    readonly AI_CONFIG_READ: "ai_config:read";
+    readonly AI_CONFIG_WRITE: "ai_config:write";
+    readonly AI_USE: "ai:use";
+    readonly ORG_AI_CONFIG_READ: "org_ai_config:read";
+    readonly ORG_AI_CONFIG_WRITE: "org_ai_config:write";
+}>;
+//# sourceMappingURL=ai.constants.d.ts.map

package/dist/ai/ai.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.constants.d.ts","sourceRoot":"","sources":["../../src/ai/ai.constants.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,WAAW;;;;;;EAMb,CAAC"}