@marinoscar/platform-web 0.1.0-next.3 → 0.1.0-next.5

package/CHANGELOG.md

@@ -1,5 +1,275 @@
 # @marinoscar/platform-web
 
+## 0.1.0-next.5
+
+### Patch Changes
+
+- @marinoscar/platform-contract@0.1.0-next.5
+
+## 0.1.0-next.4
+
+### Minor Changes
+
+- a426fd8: Open the AI capability and operation vocabularies, add a custom-operation port, richer transcription results and per-feature usage (PP-14.17). API: `registerAiCapability` and `registerAiOperation` (the 14 built-in capabilities and the usage operations register through them; `AiCapability` and `AiUsageOperation` become `Builtin | (string & {})`; `AI_CAPABILITIES` stays as a deprecated alias of `BUILTIN_AI_CAPABILITIES`); `AiProviderAdapter.operations` and `AiService.forUser(...).run(operationId, input)` run an app's operation through the same gate pipeline as a built-in port (kill switch, schema-validated input and output, model and capability gates, key policy, rate limits, one usage row, one span), never logging or recording its input or output and refusing an output or an error that carries the key; `AiTranscriptionResult.extras` (speaker-labelled segments, language and any JSON, at most 64 KiB, dropped when malformed) reaches the run output, and a transcription's `providerOptions` is bounded to 4 KiB and never logged; `GET /api/admin/ai/capabilities` (`ai_config:read`) lists the vocabularies; the usage reports take a `feature` filter and group by `feature` and `operation`; `AiModule.forRoot({ pricing })` binds the `AI_PRICING` port and the admin and organization reports then carry `priced` and a `cost` per bucket. The provider conformance kit gains `operations.*` scenarios, `FakeAiProvider` gains `operations` and `transcriptionExtras`, and `ai-secret-egress` covers the new route and fields. Contract: `AI_CAPABILITY_ID_PATTERN`, `AI_OPERATION_ID_PATTERN`, `AI_FEATURE_ID_PATTERN` and the capability, operation and cost schemas. Web: `registerAiPlaygroundMode` (subpath `/ai/ui/playground-modes`; the six built-in modes register through it, DOM unchanged; the fixed `AI_PLAYGROUND_MODES` tuple and `AiModePlaceholder` are removed), `useAiCapabilities` and `registerAiCapabilityLabel` (the Models page filter and the override dialog list an app's capabilities), Feature and Operation breakdowns, a Cost tile and column on a priced usage report, and speaker-labelled transcripts. DB: migration `0035_ai_usage_feature` adds the nullable `feature` column to `ai_usage_events` and `ai_runs` and the `(org_id, feature, created_at)` index on usage (both tables are row-level-security tables, so the migration runs in the `app.rls_bypass` transaction form); apply it with `npm run db:sync`, then `prisma:migrate`. Back-compat: every existing route, shape and id is unchanged; rows written before the column have no feature. The OpenAPI document shows a pattern where the models list's `capability` query and a provider's `supportedCapabilities` showed an enum.
+- b2df59a: Let an app or package add an AI provider (PP-14.6, #924): `registerAiProvider(AiProviderDefinition)` of `@marinoscar/platform-api/ai`, backed by the `ai-provider` pluggable kind. A definition carries the provider's id, label, Nest module, zod `settingsSchema` and `defaults` for its non-secret settings, `requiresKey`, `requiresBaseUrl`, `help` and `sdkPackages`; the five built-ins register through the same function. `AiModule.forRoot({ providers })` takes any registered id (default: every registered definition) and imports each definition's `module`; the closed `AiProviderModuleId` union (now `string`) and `PROVIDER_MODULES` are gone.
+
+  `ai.providers` is a record keyed by provider id (`aiProviderIdSchema`, `aiProviderSlotSchema`; `BUILTIN_AI_PROVIDER_IDS`, with `AI_PROVIDER_IDS` kept as a deprecated alias). The namespace reads, merges and validates each slot with its provider's `settingsSchema`: an unregistered id is `400 AI_UNKNOWN_PROVIDER` on write and dropped with one warning on read, so removing a provider never bricks the row. The stored shape of the five built-ins is unchanged. `AI_PROVIDER_SETTINGS_FIELDS` and `PROVIDERS_REQUIRING_BASE_URL` are replaced by the definition; `providerRequiresKey(slot, providerId?)` takes the provider id.
+
+  `GET /api/admin/ai/config` gains `descriptors` (one `PluggableDescriptor` per registered provider) and, per provider, `settings`, `requiresBaseUrl` and `help`; `settingsFields` is now `string[]`. `createAiRuntimeHarness` takes `extraProviders`, `extraAdapters` and `extraProviderSettings`; `ai-no-sdk-leak` takes `providerDirs` and bans the registered definitions' `sdkPackages` outside them; the provider conformance kit checks the provider id pattern (no underscore). `describeConfigField` unwraps `default` and `prefault`.
+
+  Web: `registerAiProviderCard(id, Component)` (`@marinoscar/platform-web/ai/ui`, and the new `/ai/ui/provider-cards` subpath) chooses the component that draws a provider on the admin AI page. The five built-ins register their bespoke cards through it (markup unchanged); any other provider is drawn by `AiGenericProviderCard` from the descriptor the API serves: a switch, `PluggableConfigForm` for its settings and a write-only key with the deployment-key actions, saved as `{ enabled, ...settings }`. The endpoint rule and help text come from the API (`requiresBaseUrl`, `help`) instead of a switch on the provider id; `AiAdminProvider` gained `settings`, `requiresBaseUrl` and `help`, `AiAdminConfig` gained `descriptors`, and `AiProviderSettingsField` is now `string`.
+
+- 3bc72e9: Fix the admin AI page failing to save once an app registers an AI adapter under a new provider id (#921). `GET /api/admin/ai/config` marks a provider that has no settings slot `configurable: false` (a new optional field of the admin provider shape, absent otherwise); `PUT /api/admin/ai/config` ignores such an entry when it is submitted as listed (disabled, no settings) and still answers `400 AI_UNKNOWN_PROVIDER` for any other payload for it and for an id the registry does not know. `AiConfigPage` shows these providers as "Registered, not configurable yet" and does not submit them. The page is unchanged when every provider has a slot.
+- 823ec07: Add the AI slice: `@marinoscar/platform-api/ai` (`AiModule.forRoot` with the `AI_SYSTEM_PRISMA`, `AI_OBJECT_STORE` and `AI_METRICS` host ports, `AiService.forUser(userId, { orgId, feature })` and the gate pipeline, the OpenAI, Anthropic, Gemini, Azure OpenAI and OpenAI-compatible adapters with their SDKs confined to `ai/providers/`, the model catalogue, the `ai` settings namespaces with a tighten-only org layer, the organization key tier (`/api/admin/ai/org-keys`, `org_ai_config:read`/`write`) and `deploymentKeyServesOrgs`, per-organization daily caps (`limits.perOrg`) and usage (`/api/admin/ai/org-usage`, `groupBy=org`), `registerAiFeature` and `GET /api/ai/features`, `AI_TARGET_RESOLVER`, `UserAiKeysService.importKey`, the `ai-outputs/` key prefix registered with the storage slice, and at `/ai/testing` the fake provider, runtime harness, adapter conformance kit and `runOrchestrationBoundarySuite`), `@marinoscar/platform-contract/ai` (the `ai` namespace schemas, `orgAiSettingsSchema`, `tightenAiPolicy`, the org-key and feature shapes) and `@marinoscar/platform-web/ai` (`useOrgAiKeys`, `useOrgAiPolicy`, `OrgAiKeysPage`).
+- 6a7af76: Add the email slice: `@marinoscar/platform-api/email` (`EmailModule.forRoot`, the SES and SMTP transports with inline attachments, the `email` settings row on `SystemSettingsRowStore`, the template registry with `EmailTemplateDataMap` augmentation and explicit overrides, the layout theme and brand-mark slot, the safe-HTML helpers, the `email` conformance suite at `/email/testing`), `@marinoscar/platform-contract/email` (the admin route DTOs) and `@marinoscar/platform-web/email` (`useEmailSettings`, `EmailSettingsPage`); `SystemSettingsRowStore.write` accepts `auditMeta`, and `PlatformViewer` an optional `email`.
+- deeb8b5: Add the notifications slice: `@marinoscar/platform-api/notifications` (`NotificationsModule.forRoot`, the event, channel and template registries with open channel ids and `registerNotificationChannel`, `NotificationsService` with org-aware policy, the `notifications` system namespace with an org layer that only tightens, runtime Web Push (VAPID) configuration on `SystemSettingsRowStore`, broadcasts with `targetOrgId` and the org-scoped `org_broadcasts:*` pair, the SSE stream on `NOTIFICATIONS_EVENT_BUS`, the email channel forwarding template attachments, the `notifications` conformance suite at `/notifications/testing`), `@Auth({ anyPermissions })` in the identity slice, a `SystemSettingsRowStore` row key that admits camelCase (`webPush`), `@marinoscar/platform-contract/notifications` (the wire shapes, `BROADCAST_CHUNK_SIZE`), `@marinoscar/platform-web/notifications/{headless,ui}` (`configureNotificationsWeb`, `NotificationProvider`, `usePushSubscriptionSync`, `NotificationBell` with slots, the banner and the four pages, the service-worker helpers `registerNotificationServiceWorkerHandlers`, `handlePushEvent`, `handleNotificationClick`, `handlePushSubscriptionChange`), any-of card permissions in the settings hub (`SettingsCardDef.permission: string | readonly string[]`, `cardPermissionGranted`), and the platform migration `0032_add_broadcast_target_org` (`notification_broadcasts.target_org_id`).
+- ca591e3: Every module-augmentation target is declared in the entry module its public subpath resolves to, so an app's `declare module '@marinoscar/platform-*/<subpath>'` merges with the slices' own augmentations in any file order (#865): `EmailTemplateDataMap` (`/email`), `IdentityPermissionIds` and `IdentityRoleIds` (`/identity`), `NotificationChannelIds` (`/notifications`), `AppMetricKeys` (`/otel-core`), `MetricGroupIds` (`/telemetry`), `PlatformConformanceSuiteOptions` (`/testing`) and `SettingsFeatureRegistry` (`@marinoscar/platform-web/settings/headless`). The names and import paths an app uses are unchanged, except that `@marinoscar/platform-web/settings/ui` no longer re-exports `SettingsFeatureRegistry`: import and augment it from `/settings/headless`.
+- 3420fbc: Conformance suites for the remaining invariants. `runPlatformConformance` accepts a suite that registers its own tree (`ConformanceAppSuite`) and an opt-out with a reason (`{ skip: 'reason' }`; an empty reason throws) and prints a summary of suites run and skipped. New suites: `on-event-no-io` (`@marinoscar/platform-api/jobs/testing`) and `ai-kill-switch`, `ai-rbac-matrix`, `ai-secret-egress`, `ai-key-policy`, `ai-jobs-server-only`, `ai-no-sdk-leak` and `ai-orchestration-boundary` (`@marinoscar/platform-api/ai/testing`, with `AiConformanceFixture`). `supertest` becomes an optional peer. `@marinoscar/platform-web/testing` gains `runPlatformWebConformance`, and `@marinoscar/platform-web/settings/testing` registers the settings registry suites.
+- f80189d: Add the pluggable-kind primitive (PP-14.5, #923). `@marinoscar/platform-api/core` gains `definePluggableKind` (one registry of implementations per kind, each with its own zod settings schema, defaults, declared secrets and `build`; settings stored as a record keyed by implementation id with `parseSettings`, `mergeSettingsRecord` that rejects unknown ids on write and `readSettingsRecord` that drops them with one warning on read; `describe` and `describeAll` returning the descriptor a generated form renders, with presence flags for secrets), `PluggableUnknownError`, `PluggableSettingsError` and `describeConfigFields` (the organization settings field description, generalised, adding `label` and `help`). The new `@marinoscar/platform-api/core/testing` entry exports `describePluggableKindConformance`. `@marinoscar/platform-contract/settings` gains `configFieldSchema` (with a write-only `secret` kind), `pluggableDescriptorSchema`, `CONFIG_FIELD_KINDS` and `PLUGGABLE_ID_PATTERN`. `orgSettingsFieldSchema` and the organization settings response are unchanged. `@marinoscar/platform-web/settings/ui` gains `PluggableConfigForm` (the generated configuration form of one implementation: Switch, select, text and number inputs, a note for `other`, a write-only `SecretField` for `secret`, optional `slots`) and `@marinoscar/platform-web/settings/headless` gains `usePluggableConfigForm` (`value`, `secrets`, `dirty`, `setField`, `setSecret`, `reset`, `payload()` which omits untouched secrets). The settings web slice now depends on the credentials slice.
+- 3e0c7bb: Open the access-reason, principal/credential-kind and error-code vocabularies, and let an extension package declare a web host port (PP-14.14, #932).
+
+  `@marinoscar/platform-api/core`: `registerSystemAccessReason({ id, description })` and `systemAccessReasonRegistry`; the platform's nine reasons register through it. `SystemAccessReason` is `BuiltinSystemAccessReason | (string & {})` and the bypass entry points (`forSystem`, `runAsSystem`, `systemScopeExtension`) check the registry, so an unregistered reason still throws `ScopedAccessError`. Opening which reason does not open who may bypass: the system-client injection allowlist is unchanged. `SYSTEM_ACCESS_REASONS` stays as a deprecated alias of `BUILTIN_SYSTEM_ACCESS_REASONS`.
+
+  `PrincipalKind` and `CredentialKind` are `keyof` the augmentable `PrincipalKinds` and `CredentialKinds` interfaces (unaugmented, exactly the old unions; the closed originals are `BuiltinPrincipalKind` and `BuiltinCredentialKind`), with `registerPrincipalKind`, `registerCredentialKind`, `requireCredentialKind` and `UnknownCredentialKindError`. Unknown means denied: `toPrincipal` of the identity slice answers 401 for a credential kind that is not registered, or whose principal kind has no factory there, and a custom kind never becomes a node principal.
+
+  `registerErrorCode({ code, status, description })` and `errorCodeRegistry` (the ten status-derived codes plus `PAYLOAD_TOO_LARGE` register through it). `HttpExceptionFilter` passes a thrown payload's `code` through only when it is registered for the exception's own status; every other response is unchanged. `ErrorMapper` and `PlatformHostCoreModule.forRoot({ errorMappers })` map a foreign error (a Prisma `P2002`) to an `HttpException`; mappers see only values that are not already an `HttpException`, and the foreign error's message is never copied into the response. OpenAPI: `ErrorDto.code` changes from a closed enum to a string whose `examples` list every registered code (the only difference in `openapi.json`). `describeVocabularyConformance` (`@marinoscar/platform-api/core/testing`) is the kit.
+
+  `@marinoscar/platform-web/core`: `PlatformWebHost.extensions` (an optional record of ports keyed by string or symbol), `usePlatformPort<T>(key)` (throws, naming the key, when the app did not supply it) and `useOptionalPlatformPort<T>(key)`; `createTestPlatformHost({ extensions })`.
+
+  Migration: none for an app that registers nothing. Code that relied on `toPrincipal` treating an unregistered credential kind as a user now gets a 401.
+
+- 115705f: Add the credentials slice (#735). platform-api: the `./credentials` subpath with `CredentialsModule`/`CredentialsService` (the deployment store), `UserCredentialsModule`/`UserCredentialsService` (a user's own keys) and the new `OrgCredentialsModule`/`OrgCredentialsService` (an organization's keys in `org_credentials`, under row-level security, encrypted under `org:<orgId>:<purpose>`), `UserCredentialResolver.resolve(userId, purpose, name?, { orgId })` (user, then the purpose's `fallback` of org and system, then none), the purpose registries `registerCredentialPurpose` and `registerUserCredentialPurpose` (writes to an undeclared purpose throw), `CREDENTIALS_MODEL_OWNERSHIP`/`CREDENTIALS_USER_OWNED_MODELS`, and `./credentials/testing` with the `credentials` conformance suite and `withCredentialPurposes`; core gains `orgCredentialPurpose` and `ORG_CREDENTIAL_DOMAIN_PREFIX`; telemetry exports `TELEMETRY_GREPTIME_CREDENTIAL_PURPOSE`. platform-web: `./credentials/headless` (`savedSecretHelperText`, `secretForSubmit`) and `./credentials/ui` (`SecretField`). platform-contract: `./credentials` (`credentialInfoSchema`, `userCredentialInfoSchema`, `orgCredentialInfoSchema`, `CREDENTIAL_TIERS`, `CREDENTIAL_SOURCES`, `SECRET_BEARING_KEYS`).
+- d1d1258: The database backup slice has three new extension points (PP-14.12, #930).
+
+  Backup target. Where an archive is written is now a port: `DB_BACKUP_TARGET` (a `BackupTarget`: `id`, `label`, `openWrite(key, meta)` returning `{ stream, done }`, `openRead`, `delete`, an optional `list`, `isConfigured()` and `describe()`), bound with `DbBackupModule.forRoot({ target, mirrorTargets })`. The default adapter (`StorageBackupTarget`) wraps the deployment's `STORAGE_PROVIDER`, so a deployment that binds nothing behaves exactly as before. The archive is still never buffered: `pg_dump` streams through the checksum meter into the sink, and the runner awaits both the sink's `done` and the dump's exit code. The `database-backups/` key prefix rule stays in the server. After the primary archive is written and verified, the same `db.backup.run` job copies it to every mirror target (read back from the primary, written through the mirror's sink, read back from the mirror and compared by sha256, deleted on a mismatch); a mirror failure never fails the run. Each copy is recorded as an `audit_events` row (`db_backup.mirror.completed` / `db_backup.mirror.failed`), so no migration is needed, and the new `backup.mirrors` Doctor check warns when a mirror's latest copy failed or has never run. Retention deletes the same key from every mirror. `describeBackupTargetConformance` (`@marinoscar/platform-api/db-backup/testing`) is the kit every target runs: streaming without buffering, a failing sink rejects `done`, read-back equals write, delete is idempotent, an unconfigured target says so.
+
+  Schedule policy. `frequency` gains `'cron'` with a `cron` field (five fields: `*`, numbers, ranges, steps and lists; month `*`; at most one of day-of-month and day-of-week restricted; at least one hour between runs, enforced when the setting is saved and when the schedule is read), evaluated in the policy's timezone with the same DST handling as the other frequencies. `retention` is now `{ count?, maxAgeDays? }`; `retentionCount` stays as an alias that is read and written in step with `retention.count`, so existing settings rows, API clients and the web page keep working. Retention deletes a completed archive when it is beyond either bound, and never the newest completed one.
+
+  Restore gates. `registerRestoreGate({ id, label, kind, check })` adds a pre-flight gate from an app or a package at import time; the eight built-in gates register through the same function (`BUILTIN_RESTORE_GATE_IDS`). Gates run in registration order (built-ins first), fail closed (a gate that throws or exceeds 10 seconds is a block), and an app gate (`kind: 'app'`) that fails is a hard block that cannot be overridden. `describeRestoreGateConformance` is the kit every gate runs: it answers within the bound, writes nothing to its context, is repeatable, and evaluates to a pre-flight row. The pre-flight stays read-only: no gate creates, drops or renames anything, and the cluster admin connection stays outside the Prisma pool.
+
+  Events. `db_backup.run.completed` and `db_backup.restore.completed`, each with `{ runId, status, targetId, sizeBytes, durationMs }`, are emitted on the event bus after the run settles and outside any transaction.
+
+  Invariants unchanged: every dump and restore still carries both `--enable-row-security` and `PGOPTIONS=-c app.rls_bypass=on` (`buildPgDumpArgs` and `buildPgRestoreArgs` are untouched), and all work stays inside the registered `db.backup.run` job.
+
+  Migration notes: `RESTORE_GATE_IDS` is now a deprecated alias of `BUILTIN_RESTORE_GATE_IDS`, and a restore gate id is an open string (`RESTORE_GATE_ID_PATTERN`) rather than a closed union; a pre-flight row can carry `kind: 'app'`; `frequency` can be `'cron'`, so code that switches over it must handle the new member; the stored `cron` and `retention` fields are optional (the defaults are unchanged); `DbBackupTx` gains `auditEvent.findMany`, so a hand-built double of that structural type needs it; the runner, retention service, restore service and pre-flight service take trailing optional constructor parameters, so code that constructs them by hand keeps working; node offload is withheld while an app binds its own primary target (only the storage-backed adapter can be read by a node).
+
+  Web: `DbBackupPage` accepts `slots.Sections` (an app's own sections below the packaged ones; the markup is identical when it is not passed), the policy panel renders a cron field for `frequency: 'cron'`, and the restore dialog lists app gates. Contract: `backupRetentionSchema`, `restoreGateIdSchema`, `BACKUP_CRON_*` limits, the event name constants and payload types, and `BackupMirrorResult`.
+
+- b46725d: Add the database backup and restore slice: `@marinoscar/platform-contract/db-backup` (the wire shapes and the `databaseBackup` namespace), `@marinoscar/platform-api/db-backup` (`DbBackupModule.forRoot` with the deployment-mode restore gate, the `RestoreCarryOver` registry, the `rls_bypass` pre-flight gate and the `database-backups/` key prefix) and `@marinoscar/platform-web/db-backup` (the admin page, its hook and client, and the admin section entry).
+- e6acb4b: Email transports are pluggable (PP-14.8, #926). `registerEmailTransport` adds a way of sending mail (SendGrid, Postmark, a log) from an app or a package: its own settings schema, declared secrets (stored encrypted at the credential purpose `email_<id>`, never in settings or the environment), and `build`, which returns an `EmailTransport` (`send`, optionally `verify` and `destroy`). Extend `BaseEmailProvider` to inherit the never-throw guarantee, secret redaction and rate-limit classification. `ses` and `smtp` are transports registered through the same function and still wrap `SesEmailProvider` and `SmtpEmailProvider` unchanged. `EmailTransportResolver` (provided and exported once by `EmailModule`) resolves the transport the settings' `provider` names; `EmailNotificationChannel` and the admin "Send test email" depend on it instead of the concrete SES and SMTP classes, so a registered transport is used by both. The Doctor check, the network-egress view and the test email name a transport by what it registers (`label`, `summary`, `missing`, `egressCapability`, `egressHosts`). `describeEmailTransportConformance` (`@marinoscar/platform-api/email/testing`) is the kit every transport runs: `send` never throws, no secret or message content in error text, attachments and headers passed through, throttles classified.
+
+  The `email` settings row stores `provider` (a transport id) and a `transports` record validated per transport. A row stored before this release loads unchanged (its `sesRegion`, `sesAccessKeyId`, `smtpHost`, `smtpPort`, `smtpUseTls` and `smtpUsername` become `transports.ses` and `transports.smtp`, field by field, and are rewritten in the new shape on the next save), the flat fields stay accepted on `PUT /api/email-settings` as aliases and published as a deprecated read view, and `smtpPassword` / `sesSecretAccessKey` stay accepted beside the new `secrets` record. A stored `provider` that names a transport nobody registers no longer makes the row unreadable: the send and the Doctor report it.
+
+  Contract: `BUILTIN_EMAIL_PROVIDER_KINDS` (`EMAIL_PROVIDER_KINDS` stays as a deprecated alias), `EMAIL_TRANSPORT_ID_PATTERN`, `emailTransportIdSchema`; `EmailProviderKind` widens to `string`; the response gains `transports`, `descriptors` and `secretStatuses`; the PUT body gains optional `transports` and `secrets`. The `email` contract slice now depends on the `settings` slice.
+
+  Migration notes for code that builds these by hand: `EmailNotificationChannel` and `EmailTestSendService` take an `EmailTransportResolver` instead of `SesEmailProvider` and `SmtpEmailProvider`; `SesEmailProvider` and `SmtpEmailProvider` take a `Pick<EmailSettingsService, 'get'>` and a `Pick<CredentialsService, 'getSecret'>`; the egress view lists transports in registration order (`email.ses`, `email.smtp`, then the app's).
+
+  Web: `registerEmailTransportPanel(id, Component, { validate, toForm, toInput })` (`@marinoscar/platform-web/email/ui`, and the new `/email/ui/transport-panels` subpath) chooses the form the admin email page draws for a transport. The page lists one radio per descriptor the API serves; the built-in `ses` and `smtp` transports register their bespoke forms through the registry (markup unchanged); any other transport is drawn by `EmailGenericTransportPanel` from its descriptor (`PluggableConfigForm`, with write-only secrets), so an app that adds a transport with `registerEmailTransport` needs no web code. The page saves `{ provider, enabled, fromAddress, fromName, transports: { <selected>: settings }, secrets: { <selected>: { <name>: value } } }`, and completes a response from an API that predates the transports from its flat fields.
+
+- c778f65: Extension-author test kits for Doctor checks and job handlers, and configurable web conformance suites (PP-14.26, #944).
+
+  API. New subpath `@marinoscar/platform-api/doctor/testing`: `describeDoctorCheckConformance(name, factory, { scenarios })` proves one check against the contract (identity, a guarded run that never throws, a valid outcome with a remedy on `warn` and `fail`, no seeded secret, read-only); `runDoctorCheck`, `findOutcomeProblems` and `findIdentityProblems`; and the doubles it runs over, `createRecordingPrisma` (records every call, refuses `create`, `update`, `upsert`, `delete`, `*Many`, `$executeRaw` and a raw write statement) and `createWriteFailingStorage`. Importing the entry registers the `doctor-read-only` conformance suite (`runPlatformConformance({ suites: { doctorReadOnly: { fixture, minChecks?, exempt?, forbiddenServices? } } })`), which runs the same proof over every check of the booted app's `DoctorCheckRegistry`: none writes through Prisma or to storage, none holds a side-effecting "test" service, and each check whose `dependsOn` passed returns a valid outcome. An app that does not list the key runs nothing.
+
+  `@marinoscar/platform-api/jobs/testing` gains `createFakeJobQueue()` (an in-memory queue with the real dedup rule, claim order, attempt budget and delete decision; `asJobsService()` for a service under test), `describeJobHandlerConformance(name, handler, { payloads })` (type, label, a profile of exactly two numbers inside ceilings, the node pair both or neither, `ai.*` server-only; per payload a settle, a double run, a failure by throwing, dedup and `canDelete`) and the pure `findJobHandlerContractViolations(handler)`. `@marinoscar/platform-api/testing` gains `resolveConformanceTestApi`, the helper both kits use. The `doctor` slice now lists `testing` as a slice dependency (`packages/platform-slices.json`); the testing README documents adding a suite from an app with `conformanceSuites.register` and a `declare module` augmentation.
+
+  Web. `runPlatformWebConformance({ suites })` takes `Record<string, options | { skip: 'reason' }>`: the entry under a suite's id is handed to `register(api, context, options)` as a third argument (`WebConformanceSuite<TOptions>`, default `undefined`, so the `settings-*` suites are unchanged). `webConformanceSuites.register` now throws on a duplicate id instead of ignoring it (a testing entry imported once registers once; guard a repeat with the new `webConformanceSuites.has(id)`). The `expect` subset gains `toBe`, `toMatchObject`, `toHaveLength` and `toThrow`; a hand-written `WebConformanceTestApi` fake must provide them.
+
+- 65d4522: Add the host About module and web slice: `@marinoscar/platform-api/host` now owns `GET /api/admin/about` (`AboutModule.forRoot({ apiVersion })`, `AboutService`, `readDeployInfo`, the `versions` support-bundle section; the database probe reads through `PLATFORM_PRISMA`), and `@marinoscar/platform-web/host/headless` and `/host/ui` own the About page, the admin Maintenance page, the public maintenance screen, the maintenance block store and recogniser and the `useAbout`, `useMaintenance` and `useMaintenanceBlock` hooks. The deploy-info fixture the CLI's tests read moved to `packages/platform-api/test/fixtures`.
+- 68660c1: Host: the health probes, the maintenance window, the About report, the deployment modes, the global guards and the response envelope are open to the app. `registerHealthIndicator({ id, critical, check, timeoutMs? })` adds an indicator to `GET /api/health` and, when critical, to `/api/health/ready` (the `database` indicator registers through the same function; details are bounded and secret-filtered because the probes are public; `/live` is unchanged). `registerMaintenanceBypass({ id, allows })` lets a request through an open window after the built-in admin rule; it is fail-closed (only `true` allows) and passes the window, not authentication. `registerAboutContributor({ id, label, describe })` adds `extras` to `GET /api/admin/about` and sections to the web `AboutPage` (the DOM is unchanged when none is registered). `registerDeploymentMode` and `registerDeploymentCapability` open `DEPLOYMENT_MODE` and `DeploymentModeService.can`; `DEPLOYMENT_MODES` is a deprecated alias of `BUILTIN_DEPLOYMENT_MODES` and `DeploymentMode` widens to any registered id (so do `DbBackupDeploymentMode` and `UserDataEnvironment`). The `host` conformance suite takes `allowedAppGuards: [{ name, why }]` (an empty `why` throws) and now requires `MaintenanceGuard` to be the first `APP_GUARD`. `PlatformHostCoreModule.forRoot({ host, permissions })` and `AboutModule.forRoot({ host, permission })` route the host controllers through the app's access decorators and permission strings (defaults unchanged). `buildCorsOptions(raw, extra?)` adds `methods`, `allowedHeaders`, `exposedHeaders` and `maxAge`; `registerResponseMetaContributor` adds bounded keys to the envelope `meta`. OpenAPI: `GET /api/admin/about` gains an optional `extras` array and `api.deploymentMode` is an id pattern instead of a two-value enum. Migration: `capabilitiesFor` throws for a mode nobody registered; `HealthController`'s constructor takes a `HealthIndicatorRunner` in place of `DatabaseHealthIndicator`.
+- 2c4bf2c: Slots for the identity and sharing pages, the login layout, and the shell's navigation and themes (PP-14.25, #943).
+
+  API: `registerCurrentUserExtension({ id, resolve(userId, ctx) })` and `registerUserListExtension({ id, resolve(userIds, ctx) => Map })` of `@marinoscar/platform-api/identity` add bounded JSON of the app's own to `GET /api/auth/me` and to each row of `GET /api/users` under `extensions.<id>`. The list resolver is batched: one call per request with the ids of the page, a `Map` keyed by user id, so a list never costs a query per row. Every contribution is checked (plain JSON, at most 5 levels, 4 KiB on `/auth/me` and 1 KiB per list row, no secret-named key such as `token`, `apiKey` or `clientSecret`, no credential-looking value such as a JWT or a `pat_` token) and every extension runs isolated under its own timeout: a throw, a timeout or a refused contribution skips that extension and logs a warning with its id, and never fails the request. `checkUserExtensionContribution`, `resolveCurrentUserExtensions` and `resolveUserListExtensions` are exported. OpenAPI: `CurrentUserDto` gains an optional `extensions`; the rows of `GET /api/users` reference the new `UserListItemDto` (`UserResponseDto` plus an optional `extensions`); nothing changes on the wire while no extension is registered.
+
+  Contract: `currentUserSchema` gains an optional `extensions`; new `userExtensionsSchema`, `UserExtensions`, `USER_EXTENSION_ID_PATTERN` and `USER_EXTENSION_LIMITS`.
+
+  Web: `UsersPage`, `UserList`, `OrganizationPage`, `OrgMembersPanel`, `OrganizationsPage`, `UserTokensPage`, `ActivateDevicePage`, `LoginPage`, `AuthCallbackPage`, `GroupsPage`, `GroupDetailPage` and `PublicLinkPage` take the packaged-page slot contract (`PageSlotsBase`) and leave the exempt list; the pages that draw rows add the table slots (`Columns` on the users table; `RowActions`, `DetailPanel` and `Toolbar` on the member and organization lists, which are cards, not tables). `UsersPage` adds an append-only `Tabs` slot (the Users and Allowlist tabs stay; the Settings UI rule 2 still holds), `GroupDetailPage` adds `MemberRowActions` and `Tabs`, `ShareDialog` adds `Sections` (both ends) and `Footer`, and `LoginPage` finishes its layout slots with the contract's. `AuthUser.extensions`, `UserListItem.extensions`, `useCurrentUserExtension` and `userExtension` read what the API added. `ShellDestination` gains `badge`, `group`, `external` (an `http(s)` URL opened in a new tab; any other scheme is not drawn) and `onClick` (cancel the navigation with `preventDefault`) on the rail, the bottom bar and the user menu; `ShellBottomNav` gains `maxItems` (default 4) with a More sheet for the rest (a navigation with four or fewer visible destinations renders what it did); `ShellThemeMode` and `ShellThemes` are open, `registerThemeMode({ id, label, theme })` adds a theme mode, and the `applyTheme` host port and `useUserSettings` hand a stored theme id to the app when the settings document lists it in `themeOptions` (pairs with `registerThemePreference`, #939). The five breakpoint gates did not move. A `Header` slot written against the old props of the groups and group pages keeps working; `LoginPage.slots.Title` keeps working and `Header` replaces it.
+
+- c6f97da: Let an app or package add a sign-in provider (PP-14.9, #927): `registerAuthProvider(AuthProviderDefinition)` of `@marinoscar/platform-api/identity` now completes a full login. A definition supplies its Passport strategy as `strategy` + `guard` classes (Google) or as `createStrategy(ctx)`, built on every sign-in request from the credential store (purpose `auth_<id>`, `authCredentialPurpose`), plus `label`, `mode` (`redirect` default, or `custom`), an optionally asynchronous `isEnabled(config, ctx)`, `mapProfile`, `linkExistingByEmail`, `egressHosts` and `doctorRemedy`. `AuthProviderRegistration` is the same type under its old name: a registration written as `isEnabled: (config) => ...` is unchanged, and `strategy` and `guard` became optional (one of that pair or `createStrategy` is required).
+
+  `AuthService.completeExternalLogin(ExternalProfile)` runs the shared sign-in for any provider (`handleGoogleLogin` maps the Google profile and runs the same path with Google's rules; tokens, cookie attributes, redirects, events and metrics are unchanged). The slice mounts `GET /api/auth/:providerId` and `/callback` for every registered `redirect` provider (Google keeps its own routes; new in OpenAPI, reachable during a maintenance window), and exports the browser ending as `respondToSignIn`, `setRefreshTokenCookie`, `buildSignInSuccessRedirectUrl`, `REFRESH_TOKEN_COOKIE` and `REFRESH_TOKEN_COOKIE_OPTIONS`; the refresh cookie and its rules are unchanged. The callback no longer logs the redirect URL, which carried the access token.
+
+  Safety rules of the generic path: a profile with no address or an unverified one is refused (`access_denied`) before any lookup; a new provider is never linked to an existing user by address (matched case-insensitively) unless its definition declares `linkExistingByEmail`, which means "trusted to vouch for the address" (Google does, as it always did), otherwise that sign-in is refused; the same flag gates the `INITIAL_ADMIN_EMAIL` allowlist bypass and the first administrator's grant, so any other provider is allowlist-only; optional `pictureUrl` (https, at most 2048) and `displayName` (at most 255) are dropped when out of bounds; the ids `jwt` and `session` are reserved and a `createStrategy` strategy is registered with Passport as `auth-provider:<id>`; `createCookieStateStore` gives a `passport-oauth2` strategy login-CSRF `state` without a session plugin (`state: true` without a store throws on every sign-in here); the route overwrites `ExternalProfile.provider` with the serving definition's id; `ExternalProfile.raw` is never logged or stored.
+
+  `IdentityModule.forRoot({ signInPolicy })` binds a `SignInPolicy` (`IDENTITY_SIGNIN_POLICY`): `beforeLogin(profile, ctx)` returns `{ allow: true, roles? }` or `{ allow: false, reason }`, runs for every provider after the allowlist and before any write, maps roles onto a NEW user only, and fails closed when it throws. `IDENTITY_AUTH_CREDENTIALS` binds the credential store a provider reads (unbound, every secret is absent). New events `identity.login.succeeded` (`{ userId, provider, isNewUser }`) and `identity.org.created` (`{ orgId, createdBy }`); `identity.user.created` `source` is now the provider id. The Doctor's `auth.providers` check lists every registered provider with its `doctorRemedy`, and the egress inventory reads `egressHosts` from the definitions. `describeAuthProviderConformance` of `@marinoscar/platform-api/identity/testing` is the provider kit; `createStubIdentityHost` takes `authCredentials`.
+
+  Contract: `authProviderSchema` gains the optional `mode: 'custom'`, which `GET /api/auth/providers` sends only for a provider that owns its flow; a redirect provider's entry is unchanged. Web: `login(id)` calls the `start()` of the look registered with `registerAuthProvider` for a `custom` provider instead of navigating; `LoginPage` gains `BeforeProviders` and `AfterProviders` slots (props `{ providers, login }`); `AuthCallbackPage` reads the provider to retry from its `provider` prop, a `:provider` route segment, or the provider the sign-in started with (`lastAuthProvider`), validated as a provider id, before falling back to `google`; `AuthProviderInfo` gains `mode`. `AUTH_ERROR_CODES` stays closed.
+
+- 8a0f3b9: Open the jobs and nodes vocabularies to an app (PP-14.19). Jobs: `registerRetentionPolicy` puts an app table on the nightly retention (the `retention` settings namespace is composed from the registry: schemas, defaults, merge and policy-by-policy read-compat; the platform's four keep their order and defaults, and the enqueue-only `RetentionPurgeTask` enqueues one purge per enabled policy whose handler is mounted); `registerJobReason` opens `jobs.reason`, with `reasonLabel` on the admin job row. Migration `0034_open_job_reason` turns `jobs.reason` from the `JobReason` enum into `TEXT`, keeping every stored value (apply it with `npm run db:sync`, then `prisma:migrate`; the table is rewritten under a short lock); `JobReason` becomes `BuiltinJobReason | (string & {})` and the contract's `reason` a pattern (`jobReasonSchema`), so the OpenAPI document shows a pattern where it showed an enum. Nodes: a heartbeat may carry `vitals.extra` (at most 16 numeric keys), `registerNodeVital` words them in the vitals dialog, which also lists the node's reported capabilities; relayed spans may be named `job.app.<name>` with attributes registered through `registerNodeSpanAttribute` (emitted as `job.app.<key>`), and a span that fails validation is now dropped and counted instead of failing its whole batch with a 400. CLI: `registerJobRequirement` and `registerProbedBinary` (with `versionArgs`) are exported from `@marinoscar/platform-cli/node` and used by the startup self-test and `node doctor`; `JobExecutor.vitals()` feeds `vitals.extra`. Back-compat: with only the built-ins nothing served changes; `JOB_REASONS` and `RETENTION_POLICY_KEYS` remain as deprecated aliases of `BUILTIN_JOB_REASONS` and `BUILTIN_RETENTION_POLICY_KEYS`. Upgrade the API before the nodes: an API that predates `vitals.extra` answers a heartbeat that carries it with a 400, and the CLI then stops sending vitals for the process.
+- aeace4a: Add the worker-node admin response schemas to `@marinoscar/platform-contract/nodes` (`adminNodeSchema`, `adminNodeCredentialSchema`, `nodeCredentialListItemSchema`, `nodeCredentialCreatedSchema`, `NODE_STATUSES`, `NODE_HEALTHS`) that the API's Swagger classes now implement (#881), and add `@marinoscar/platform-web/nodes` (`/nodes/headless`, `/nodes/ui`): the fleet and credential client, hooks, adapters and the Worker Nodes page, which `@marinoscar/platform-web/jobs` re-exports for compatibility.
+- fce5417: Make an app's notification channel (Slack, SMS, Teams, a webhook) first-class (PP-14.10, #928). `NotificationChannelSender.resolveRecipient(recipient, context)` resolves a destination asynchronously and returns `{ to, display }`: `to` goes to `deliver`, the redacted `display` is what the delivery row's `recipient` stores. `resolveTo` still works and is now optional (a sender has one of the two). `context.handle()` reads the app's `RecipientHandleSource` (`handleFor(userId, channelId)`), bound with `NotificationsModule.forRoot({ recipientHandles })` to the new `NOTIFICATION_RECIPIENT_HANDLES` token. `forRoot({ pushPayload })` adds allowlisted extras (`actions`, `icon`, `badge`, `urgency`, `tag`) to a Web Push payload; the service worker shows them. `registerChannelTemplate` (and `registerNotification({ channelTemplates })`) is a registry of per-channel renderers validated at registration; `renderChannelPayload` reads one from `deliver`. `NotificationChannelDef` gains `criticalCapable`, `broadcastDefault` and `rendersRawData`. `describeNotificationSenderConformance` joins `@marinoscar/platform-api/notifications/testing`, and the `notifications` conformance suite gains a `channel-templates` case.
+
+  The `notifications` system namespace (and its org layer) gains an optional `channels` record, `{ <channelId>: { enabled } }`: a switch per channel, sparse, an absent channel is enabled. `browserEnabled` stays the browser channel's spelling and `channels.browser.enabled` is its alias (a write of either sets both; the stricter wins on read), so stored rows and old clients load unchanged. `policyChannels` applies the switch to every channel; a `mandatory` event keeps its `browser` row but is no longer exempt from another channel's switch. A broadcast over a channel an administrator switched off gets a warning.
+
+  `GET /api/notifications/channels` (any signed-in user) serves every registered channel (`notificationChannelDescriptorSchema`: label, `userConfigurable`, `criticalCapable`, `broadcastCapable`, `broadcastDefault`, `order`). The critical-broadcast rule reads "a channel flagged `criticalCapable`" (`browser`) and moves from `createBroadcastSchema` to the API's registry check. The `push` channel's label is `Push`. `AndroidAppNotificationChannel` takes the push payload hook as its third constructor argument (before the sender registry). OpenAPI: one new route and optional fields only.
+
+  Web: the broadcast composer, the preferences matrix and the admin Notifications page draw channels from the descriptors (`useNotificationChannels`) instead of `CHANNEL_ORDER`, `DEFAULT_CHANNELS` and `CHANNEL_LABELS`; with only the platform's channels the markup is unchanged (a recorded-DOM snapshot test). The admin page gains one switch per app channel, `UserNotificationsPage` takes `channelStates` to gate an app channel's column like push's, and `NotificationChannelDescriptor`, `NotificationChannelSwitch`, `NotificationAction`, `ChannelState` and `ChannelAlert` are exported.
+
+- 48b275d: Close the small vocabularies of onboarding, the DataTable and exports (PP-14.20, #938).
+
+  Onboarding. The audience vocabulary is open: `registerOnboardingAudience({ id, label, matches(principal, ctx) })` of `@marinoscar/platform-api/onboarding`, with `user`, `admin` and the new `org_admin` (the holder of the `org_admin` role of an active organization) registered through it. `OnboardingAudience` is `Builtin | (string & {})`; `onboardingAudienceSchema` is a string pattern (the OpenAPI `audience` enum becomes a pattern); `ONBOARDING_AUDIENCES` (`admin`, `user`) is deprecated for `BUILTIN_ONBOARDING_AUDIENCES`. `GET /api/onboarding` gains an optional `audiences` record with the block of every other audience the caller matches and that has a step for them, absent otherwise; `user` and `admin` keep their rules (the engine ignores a rule registered for those ids). `evaluateOnboarding` takes optional `audiences` and `audienceContext`, the `onboarding` conformance suite derives the `org_admin` block and flags a step naming an unregistered audience, and the web provider keeps the `audiences` blocks and their skip overlay.
+
+  DataTable. `registerDataTableFilterType({ type, operators, Editor, matches, coerce?, format? })` of `@marinoscar/platform-web/datatable/headless`; the five built-ins register through it, `FilterOperator` and `DataTableFilterType` are open (`BuiltinFilterOperator`, `BuiltinDataTableFilterType`), `DataTableColumn.filter = { type, editor?, operators? }` declares a column's filter, and `matchesFilters` filters rows on the page with the type's rules. `DataTableStoredLayout` gains `extra` (bounded plain JSON, 8 KiB, 32 keys, 8 levels) and `savedViews` (at most 20), validated by the user-settings API on write (`dataTableExtraSchema`, `dataTableSavedViewSchema`, a 32 KiB cap per table entry; the user-settings OpenAPI gains both fields) and sanitised on read; `useDataTableLayoutPrefs` gains `extra`, `setExtra`, `savedViews`, `saveView`, `applyView` and `deleteView`, and `reset` keeps the saved views. `DataTable` takes `slots={{ Toolbar, BulkBar }}`. The filter-model operator unions of the jobs, nodes, identity and db-backup slices gain `(string & {})`. A table that uses none of this renders the markup it did.
+
+  Exports. `registerExportWriter({ attachTo: '*' | string[], columnTypes? })` offers a writer on sources that do not list it, `ExportSource.columnTypes` and `acceptsAttachedWriters` gate and pin it, and `writersFor` returns the listed formats then the attached ones (platform writers first). The platform sources list no formats: their formats are the writers attached to them, so json, csv and xlsx are unchanged and an app's writer follows. A writer that cannot write a column type fails the export before any row (`guardWriterColumns`). `ExportColumn.meta` (flat scalars, at most 16 keys) carries a custom writer's own typing; the built-in writers never write it. `ExportsList` takes `slots={{ Columns, RowActions }}`. A source may now list an empty `formats`; `exports` conformance flags a writer attached to an unknown source.
+
+- fe61ffe: Roles: an app's own roles are assignable end to end, and an app can grant platform permissions to them, with no package edit and no migration (roles are strings). New `GET /api/roles?scope=system|org` lists `{ id, label, description, scope, assignable }` (`users:read` for `system`, `org_members:read` for `org`). `RoleDeclaration` gains `label` and `assignable` (registry-only, never seeded). The invite, org member update, user-role and test-login routes check the role registry and fail closed: an unknown role, a role of the other scope (`admin` on an invitation) or an `assignable: false` role is a `400` with the error code `ROLE_NOT_ASSIGNABLE` (registered through `registerErrorCode`, also `details.reason`); an invitation whose role stopped being assignable is left pending at sign-in, and `PUT /api/users/:id/roles` leaves a user's `assignable: false` system role in place. Manifest: `registerPlatformPermissions({ app: { grants } })` and `grantPermissions` give an app role platform permissions (validated, folded into the catalog's `rolePermissions`, so the seed and the permission resolver agree; a platform role cannot be the target), and `registerPermissionSet({ slice, roles, permissions })` lets a package declare its own slice, with `PlatformPermissionSlice` open and `identity` still mandatory. Contract: `roleIdSchema` (a string pattern) replaces the `z.enum` of `roleName` on the invite and member routes (OpenAPI: enum to pattern), `BUILTIN_ORG_ROLES` is the new name of `ASSIGNABLE_ORG_ROLES` (kept as a deprecated alias), `AssignableOrgRole` widens to any string. Web: `useRoles` reads the API; the invite dialog, member role select, invitation labels and Manage roles dialog offer the assignable roles with the API's labels and the hard-coded role lists are gone (`ORG_ROLES` is deprecated, `buildUserColumns(roles?)` and `ManageRolesDialog` take the roles, `InviteMemberDialog` takes `roles`); the user-roles call now sends `roleNames`, the field the API reads. Migration: a request that named `admin` as an org role used to fail request validation and is now refused by the service with the same `400` status; group roles stay `admin`, `editor` and `viewer` (a database enum).
+- b480c02: Open the settings slice to an app and to an installed package (PP-14.21, #939). Nothing changes for an app that registers none of the new points: no schema, stored value or OpenAPI field moves.
+
+  `@marinoscar/platform-api/settings`: `extendSystemSettingsNamespace` and `extendUserSettingsNamespace` take a dot `path` to an object field and add the fields inside it (an existing leaf key is refused, the parent is not; a stored value that predates the field keeps everything else). A system extension takes an `org` block (`mode: 'override' | 'tighten'`, `fields`, `tighten` per field as `'and'`, `'or'`, `'min'`, `'max'` or a function) that makes ONLY the added fields organization-overridable, composed with an existing org layer (`SettingsNamespaceOrgLayer` gained an optional `mode`). `overrideSettingsNamespaceDefaults(key, partial)` changes a namespace's defaults only, checked against its stored schema. `registerSettingsContribution({ id, system, user, extensions })` lets a package contribute namespaces and extensions from a side-effect import; `assembleSystemSettingsNamespaces` and `assembleUserSettingsNamespaces` list the platform's namespaces, the contributions' (import order) and the app's, fold the extensions and apply the defaults overrides. `extendUserProfile({ fields })` adds optional, bounded fields to the core user `profile`, and `registerThemePreference({ id, label })` adds a theme id `theme` accepts, listed in the new optional `themeOptions` of `GET /api/user-settings` while any is registered. `security` stays closed.
+
+  `@marinoscar/platform-contract/settings`: `THEME_PREFERENCE_ID_PATTERN`, `THEME_OPTION_LABEL_MAX`, `themePreferenceIdSchema`, `themeOptionSchema`, `ThemeOption`, `ThemePreferenceId` and `UserSettingsResponseBase.themeOptions`.
+
+  `@marinoscar/platform-web/settings`: `ProfileSettings` and `ThemeSettings` take `slots.ExtraFields` (and `UserProfilePage` and `UserAppearancePage` pass `slots` through), `ThemeSettings` offers `extraOptions`, `themePreferenceOptions` and `useThemePreferenceOptions` derive them from the settings document, and `registerOrgSettingsFieldRenderer(namespace, field, Component)` draws an `other` field of the organization settings page. `useUserSettings` hands `applyTheme` only `light`, `dark` and `system`; `UserSettingsDocument.theme`, `UserSettingsUpdateBase.theme` and `ThemeSettings`' `currentTheme` and `onThemeChange` widened to a theme id. The DOM of the three controls is unchanged without a slot, a renderer or a registered theme.
+
+- 9f4c147: Open the two places sharing hard-coded (PP-14.16, #934): who a grant can name, and how a decision is made.
+
+  `@marinoscar/platform-api/sharing`: `registerGranteeKind(GranteeKindDef)` and `registerAccessRule(AccessRuleDef)`. The built-in `user`, `group` and `link` kinds register through `registerGranteeKind` (no private fast path); `AccessPolicy`, `accessibleWhere`, `accessibleSql` and `POST /api/grants` compose the registry, with behaviour and SQL shape unchanged for the built-ins. A kind supplies `validateGrantee`, `describe` and the in-memory (`matchesPrincipal`) and SQL (`resolvePrincipalMatch`, parameterised through the app's SQL kit) spellings of one predicate. An access rule joins the documented order (owner and bypass first, rules `before-grants`, grants, rules `after-grants`, the org default): `deny` from any rule wins, a failing rule denies (logged with the rule id only), the record's user owner and a bypass holder are decided before the rules, and an allow confers a `role` (default the weakest). A rule gives `sql({ allow?, deny? })` so lists agree with decisions; a rule that can deny (`mayDeny`) must. `AccessVia` is open (`BuiltinAccessVia | (string & {})`: a widening of a stable type), rule ids and kind `via` values cannot impersonate a platform source, registered definitions are shallow-frozen, the decision counter's `via` label gains `app` and its `outcome` label gains `rule_error` (an access rule failed or was misconfigured; `AccessDecision.ruleFailure`). `AccessPolicy` takes a savepoint per call when rules apply so a failing rule statement cannot abort the shared transaction; the slice refuses the caller alias `g` in `accessibleSql`. `GET /api/sharing/grantee-kinds` (`sharing:read`) serves the registered kinds. `POST /api/grants` accepts `{ kind: 'custom', granteeKind, ref }` and answers 422 `GRANTEE_KIND_UNKNOWN`, `GRANTEE_INVALID` or `GRANTEE_KIND_NOT_PERSISTABLE`. New kits in `@marinoscar/platform-api/sharing/testing`: `describeGranteeKindConformance`, `describeAccessRuleConformance`, `recordingSqlKit`, `HOSTILE_STRINGS`.
+
+  A grant of an app-registered kind cannot be stored yet: `grants.grantee_kind` is an enum, so `registerGranteeKind` refuses `persisted: true` for a non-built-in kind until the sharing storage migration (tracked with the group-role migration) ships. No migration in this change.
+
+  `@marinoscar/platform-contract/sharing`: `BUILTIN_GRANTEE_KINDS`, `GRANTEE_KIND_ID_PATTERN`, `GRANTEE_KIND_INPUTS`, `granteeKindDescriptorSchema`, `granteeKindListSchema`, `customGranteeSchema` (a third `grantGranteeInputSchema` variant; the `user` and `group` shapes keep their validation), `SHARING_LIMITS.granteeRefMax`. `GRANT_GRANTEE_KINDS` is unchanged (the stored vocabulary).
+
+  `@marinoscar/platform-web/sharing`: `registerGranteePicker(kind, Component)`, `freezeGranteePickers()`, `useGranteeKinds()`, `SharingClient.listGranteeKinds`, `ShareActions.shareWithGrantee` and the `granteePickers` prop of `ShareDialog`. The dialog offers each non-built-in kind a grant can be stored for as one more choice (a text field, or the registered picker); the DOM is unchanged when only the built-ins are listed.
+
+- d35900e: Sharing: open group roles and persisted app grantee kinds. Migration `0037_open_sharing_vocabularies` turns `group_members.role`, `group_invites.role` and `grants.grantee_kind` from Prisma enums into text, adds the nullable `grants.grantee_ref` and relaxes `grants_grantee_consistency_check`; an app registers a group role with `registerGroupRole` and a persisted grantee kind with `registerGranteeKind({ persisted: true })`, and the share dialog and member role pickers read the registries.
+- 74c4aff: Declare peer dependencies per slice (`packages/platform-slice-peers.json`, checked by `npm run check:slice-peers`) and make every peer that the universal slice does not need optional. `platform-api` now requires only what `core` needs (`@nestjs/common`, `@nestjs/core`, `@nestjs/swagger`, `@opentelemetry/api`, `@prisma/client`, `nestjs-zod`, `reflect-metadata`, `rxjs`, `zod`); `@nestjs/config`, `@nestjs/schedule`, `@nestjs/event-emitter`, `@nestjs/jwt`, `@nestjs/passport`, `passport`, `@nestjs/terminus` and `@prisma/client-runtime-utils` become optional peers an app installs for the slices that use them. `platform-web` requires only `@mui/material`, Emotion, `react` and `react-dom`; `@mui/icons-material`, `react-router-dom` and `zod` become optional. `platform-db` no longer lists `@prisma/client` (its seed takes the app's client structurally) and `prisma` becomes optional; `platform-cli`'s `react` becomes optional. An app that installed every peer needs no change; an app that imports only some slices can now install only their peers. The datatable no longer imports the undeclared transitive `@mui/utils`.
+- 5e98e3d: Storage drivers are pluggable (PP-14.7, #925). `registerStorageDriver` adds an object store (Azure Blob, Google Cloud Storage, a local disk) from an app or a package: its own settings schema, declared secrets (stored encrypted at the credential purpose `storage_<id>`, never in settings or the environment), `build`, `testConnection`, and optionally `provision`, `listKeys` and `purge`. `s3`, `r2` and `s3compatible` are drivers registered through the same function, and all S3-specific code (the connection test, bucket provisioning, the purge lister, the per-flavour requirements and region fallback, the Doctor egress host) moved into them. The connection test, provisioning, purge, egress and the resolving provider delegate to the active driver. `describeStorageDriverConformance` (`@marinoscar/platform-api/storage/testing`) is the kit every driver runs.
+
+  The `storage` settings namespace stores `provider` (a driver id) and a `drivers` record validated per driver. A row stored before this release loads unchanged (its flat fields become `drivers.<provider>`, field by field), and the flat fields (`bucket`, `region`, `endpoint`, `accountId`, `accessKeyId`, `forcePathStyle`) stay accepted on PUT, PATCH and the admin routes and published as a deprecated read view. `databaseBackup.storageProvider` accepts any driver id.
+
+  Contract: `BUILTIN_STORAGE_PROVIDER_KINDS` (`STORAGE_PROVIDER_KINDS` stays as a deprecated alias), `storageDriverIdSchema`, `StorageProviderKind` widens to `string`; the admin config view gains `drivers` and `descriptors` and `missing` becomes a list of strings; the admin PUT, test and bucket bodies gain optional `drivers` and `secrets`; the test and provisioning results gain `message`. The `storage` contract slice now depends on the `settings` slice.
+
+  Migration notes for code that builds these by hand: `ResolvedStorageConfig` is the generic active configuration (`provider`, `bucket`, `region`, `endpoint?`, `settings`, `secrets`; the S3 family's is `ResolvedS3Config`); `StorageConnectionTestService` and `StorageBucketProvisionService` take a `StorageSubmissionService`; `resolveStorageConfig` (S3 only) is deprecated; `npm run storage:purge` exits `3` for a driver that can neither purge nor list its keys. New installs seed `storage` as `{ provider, drivers }`.
+
+  Web: `registerStorageDriverPanel(id, Component, { validate })` (`@marinoscar/platform-web/storage/ui`, and the new `/storage/ui/driver-panels` subpath) chooses the form the admin storage page draws for a driver. The page lists one radio per descriptor the API serves and the built-in `s3`, `r2` and `s3compatible` drivers register their bespoke form through the registry (markup unchanged); any other driver is drawn by `StorageGenericDriverPanel` from its descriptor (`PluggableConfigForm`, with write-only secrets), so an app that adds a driver with `registerStorageDriver` needs no web code. The page saves, tests and provisions with `{ provider, drivers: { <id>: settings }, secrets: { <id>: { <name>: value } } }`, shows a driver's `message` and `details` and offers provisioning after a failed test that reported no checks. `StorageProviderKind` and `MissingStorageConfigField` are `string`, `StorageConfigView` gained `drivers` and `descriptors`, `StorageConfigInput` needs only `provider`, and the test and provisioning results gained `message`. The S3-compatible radio label is now the driver's own ("S3-compatible"). The `storage` web slice now depends on `settings`.
+
+- 5425626: Let an app put its own numbers on the Telemetry Dashboard and in the assistant (PP-14.18, #936).
+
+  Units: `registerMetricUnit(MetricUnitDef)` of `@marinoscar/platform-api/telemetry`; the 15 built-in units register through it (`BUILTIN_METRIC_UNITS`, with `METRIC_UNITS` kept as a deprecated alias), `assertUnit` reads the registry and `GET dashboard/metric-groups` serves, per group, `units` (the descriptors of the units it uses beyond the built-ins) so the browser formats an app unit with no web change. A unit descriptor has one of nine fixed formats and no code (`metricUnitDescriptorSchema`).
+
+  Presentation: `MetricGroupDef.presentation` is data (tiles, charts with theme-token colours, tables with Top N and `problems-first` or `value-desc` sort and column displays, and `ratio`, `delta` and `rate` virtual columns), zod-validated and bounded when the group is registered, and served on `/metric-groups`. The six platform groups declare theirs (`PLATFORM_METRIC_PRESENTATIONS` of the contract) instead of the web's section table, and draw with the same DOM. `metricGroupPresentationSchema` and the presentation interfaces are new contract exports.
+
+  Panels: `registerDashboardPanel(DashboardPanelDef)` and `dashboardPanelRegistry` (API; `GET dashboard/panels` and `panels/:id`, payload at most 256 KiB, a time budget, a generic failure) with `registerDashboardPanelView(id, View, { frame? })` (web, also from the new `@marinoscar/platform-web/telemetry/ui/dashboard-panels`). The platform's `api` and `logs` panels register through the same calls. `TelemetryQueryFacade` (`query`, `sql`, `dialect`) is the only way a panel reads the store: one guarded, capped, timed-out and audited statement per call (audit source `panel`), under a per-request statement budget.
+
+  Assistant: `registerTelemetryAssistantTool(TelemetryAssistantToolDef)` adds a read-only tool that receives the facade and never a client (a name that shadows one of the eight built-ins is refused; `rows` output is withheld from the model while `assistant.shareResults` is off), and `TelemetryModule.forRoot({ assistant: { extraInstructions } })` appends developer notes (at most 4 000 characters of plain text) to the system prompt as an `APPLICATION NOTES` section.
+
+  Pages: `TelemetryDashboardPage`, `TelemetrySettingsPage` and `TelemetryExplorerPage` take `slots` of the page-slot contract and are off `page-slots.exempt.json`; the explorer also takes `starterQueries`.
+
+  otel-core: `initializeOtel` accepts `spanProcessors`, `logRecordProcessors`, `metricReaders`, `views`, `sampler`, `textMapPropagator` and `resourceAttributes`; every processor and reader is wrapped in a gated one (`GatedSpanProcessor`, `GatedLogRecordProcessor`, `GatedMetricReader`), so nothing exports while the runtime gate is closed.
+
+  Conformance: the `telemetry` suite gains check 9 (registered panels and tools are well formed, the platform's panels remain) and check 10 (the facade has exactly `query`, `sql` and `dialect` and is frozen), and check 1 validates presentations. `/telemetry/testing` exports `createQueryFacade`, `checkFacadeSurface` and `checkRegisteredExtensions`.
+
+  Additive: a host that registers nothing sees no change except the new optional `presentation` and `units` fields on `GET dashboard/metric-groups` and the new `dashboard/panels` routes.
+
+- 175ddd3: Make the dashboard metric tables' freshness window an option: `TelemetryModule.forRoot({ metrics: { freshMs } })` (default `METRIC_FRESH_MS`, 150 s; resolved into the `TELEMETRY_METRIC_FRESH_MS` token). The `/metrics` response reports it as the optional `freshMs`, and each dashboard section with a table shows it in its header ("Current within 2 min 30 s").
+- 1171b1c: Complete the telemetry slice in all five packages. `@marinoscar/platform-api/telemetry/testing` gains the telemetry conformance suite (registered with `runPlatformConformance()` as `suites.telemetry`: metric groups, route permissions, read-only Doctor checks, no secrets in responses, the cron coverage and the boot without a store), the stub host ports, and the five activity and six coach fixture tables; `ConformanceCase.run` may be async and a slice may add a suite key by augmenting `PlatformConformanceSuiteOptions`. Every telemetry slice README now follows the Package documentation standard with a catalog that links a working example in the reference app.
+- 2732024: The telemetry store is replaceable (PP-14.11, #929). The explorer, the export, the assistant's statements, the Telemetry Dashboard, the status page, the retention job, the Doctor checks and the support bundle now depend on two injection tokens, `TELEMETRY_STORE` (a `TelemetryStore`: `query(sql, params, { readOnly: true, timeoutMs, signal })`, `schema()`, `ping()`, `close()`, `isConfigured()`, an optional `retention` control) and `TELEMETRY_SQL_DIALECT` (a `TelemetrySqlDialect`: the time bucket, the percentile, the regular-expression replace, the JSON attribute read, the case-insensitive substring match, the text cast, the row cap and the metric tables' time and value columns), and never on `GreptimeClient`. `registerTelemetryStore` adds a store from an app or a package at import time (its own settings schema, defaults and declared secrets, stored encrypted at the credential purpose `telemetry_<id>`, and `build`, which returns the store and its dialect), and `TelemetryModule.forRoot({ store: '<id>' })` selects it (default `greptime`; an id nobody registered fails boot naming the registered ones). `greptime` is the built-in store, registered through the same function: `GreptimeClient` now implements `TelemetryStore` (its `query()` runs on the read-only login, `queryReader()` and `queryAdmin()` are unchanged), its dialect, retention control and schema read live under `telemetry/stores/greptime/`, and its connection, the `telemetry_connection` row and the `telemetry_greptime` credential purpose are unchanged. The explorer's guard (one read-only statement, the row cap, the timeout, the audit row) stays in the platform, above the store. `describeTelemetryStoreConformance` (`@marinoscar/platform-api/telemetry/testing`) is the kit every store runs: writes refused, timeout and abort honoured, `schema()` shape, a `ping()` that never throws or leaks a secret, an unconfigured store, and, over a fixture, every dashboard statement built with the store's dialect.
+
+  A store that is not GreptimeDB has `GET` and `PUT /api/admin/telemetry/store` (`telemetry:read` / `telemetry:write`, `If-Match`): its non-secret settings are one entry of the new `telemetry_store` system-settings row and its secrets are write-only. `GET /api/admin/telemetry/config` gains an optional `store: { id, label }`. The dashboard SQL builders take an optional trailing `TelemetrySqlDialect` (default: the GreptimeDB one, so their text is unchanged), and the stub ports of `telemetry/testing` take a `policy` patch and per-purpose secrets.
+
+  Migration notes: the app's `TELEMETRY_SETTINGS_STORE` adapter must allow the new row key (`telemetry_store`, beside `telemetry_connection`; the reference app's `TELEMETRY_OWNED_ROW_KEYS`); code that constructs `TelemetryQueryService`, `TelemetrySchemaService`, `TelemetryStatusService`, `TelemetryRetentionHandler`, `TelemetrySettingsService`, the Doctor reachability and freshness checks or the support-bundle section by hand now passes a `TelemetryStore` (a `GreptimeClient` is one) where it passed the client; the `greptime/greptime.client.ts`, `greptime-host.ts` and `greptime.errors.ts` files moved under `telemetry/stores/` (the public exports are unchanged, and the store errors are now exported too); the `telemetry` platform-api slice depends on `credentials`, and the `telemetry` contract and web slices on `settings`.
+
+  Web: the Telemetry settings page keeps the Telemetry services and GreptimeDB Connection sections for the built-in store (markup unchanged) and draws a Store section for any other registered store: the settings slice's `PluggableConfigForm` over the descriptor `GET /admin/telemetry/store` serves, with write-only secrets and an `If-Match` on every save, so an app that registers a store needs no web code. `useTelemetryStore` and the `TelemetryStoreConfig` types are exported from `@marinoscar/platform-web/telemetry/headless`; the settings slice's index exports `usePluggableConfigForm`. Contract: `telemetryStoreSummarySchema`, `telemetryStoreResponseSchema` and `updateTelemetryStoreSchema`.
+
+- 125b54b: User-data slice: `UserDataModule.forRoot` now defaults `USER_DATA_ENVIRONMENT` (the host slice's `DeploymentModeService` and identity's `TenancyService`; override with `environment`), so an app binds only the bypass client `USER_DATA_DB`. Adds `composedSchemaDatamodel(__dirname)` / `findComposedSchemaPath` for the `datamodel` option and the `user-data.registries` Doctor check (the conformance suite's three checks, on a running deployment; they now live in `registry-checks.ts` and are re-exported from `user-data/testing`). The slice now depends on the `doctor` and `host` slices. Web: `PlatformViewer` gains an optional `refresh()`, and the Danger Zone and factory reset pages call it after a successful action, so an app mounts them without a callback.
+- 39b5300: Add the user-data slice (#743): registry-driven per-user deletion with scopes (`user.data.purge`), the admin factory reset (`admin.factory_reset`) and organization offboarding (`org.offboard`), with the Danger Zone, factory reset and offboarding UI; `StorageKeyPrefixDef.survivesFactoryReset`; `OrganizationsPage` `renderActions`.
+- 56a68c0: The AI pages draw the model catalogue and the usage breakdowns with the datatable slice's `DataTable` directly. Removed `AiWebAdapters.DataTable` and the `AiDataTableComponent`, `AiDataTableProps`, `AiTableColumn`, `AiTableColumnPriority` and `AiTableRowAction` types of `/ai/headless`; the `ai` slice now depends on `datatable`.
+- 4c003a1: Move the AI web pages into `@marinoscar/platform-web/ai`: the admin AI, AI Models and AI Usage pages, the user AI Keys page and the Playground (`AiConfigPage`, `AiModelsPage`, `AiUsagePage`, `UserAiKeysPage`, `AiPlaygroundPage`, each also a subpath such as `/ai/ui/models-page`), the hooks behind them (`useAiConfig`, `AiConfigProvider`, `useAiAdminConfig`, `useAiModels`, `useAiUsage`, `useUserAiKeys`, `useUsableAiModels`, `useAiChat`, `useAiRun`, `useAiRealtimeSession`, `useMicrophonePermission`, `useAiUserSettings`) and the AI calls over the host transport (`createAiResponse`, `streamAiResponse`, ... each taking the `PlatformApiClient` first), with `AiWebAdaptersProvider` slots for the app's spinner and table. `PlatformApiClient` gains an optional `postFormData` (uploads) and `PlatformRequestOptions.jsonBody` (a DELETE with a typed confirmation); the storage and settings slices gain a sibling entry for the AI slice.
+- 3390de6: Add the `RequireAiEnabled` route guard to `@marinoscar/platform-web/ai` (`/ai/ui`, and a subpath of its own, `/ai/ui/require-ai-enabled`, so a router can import it without the pages).
+- fe122b9: Add `@marinoscar/platform-web/android-app` (`/headless`: the TWA launch helpers, `androidIdentity`, the client and hooks; `/ui`: `AndroidAppPage`, `AndroidUpdateBanner`, `DownloadApkButton` and the `androidAppSettingsPage` descriptor) (#746).
+- b1a2838: Add `createPlatformApiClient(http, { postSse? })` to `@marinoscar/platform-web/core`: the adapter from the app's one `PlatformHttpClient` to the `PlatformApiClient` every packaged page calls (the `ApiError` to `PlatformApiError` mapping, `If-Match`, extra headers first, `getBlob`/`postBlob` as `blobWithHeaders`), with `toPlatformApiError` and `toHttpRequestOptions`. Moved from the reference app's platform host.
+- 05284de: Add `PlatformHttpClient` and `ApiError` to `@marinoscar/platform-web/core`: the browser transport (access-token holder, one-shot refresh and retry, cross-page refresh lock, session-expired signal) moved from the reference app, with the API base, the refresh lock name and an error-response hook as options (experimental; `ApiError` stable).
+- a697d5a: Add the Server-Sent Events client to `@marinoscar/platform-web/core` (#900): `connectSse` (reconnecting `GET` stream), `postSse` (one `POST`ed request, one streamed answer) and `SseParser`, moved from the reference app's `services/sse.ts` with their tests. `postSse` takes an optional `onErrorResponse` hook in place of the app's maintenance import; behaviour is otherwise unchanged.
+- 1cd5fc6: Add `@marinoscar/platform-web/datatable/headless`, `/datatable/ui` and `/datatable/testing` (#897): the responsive `DataTable` (desktop grid, tablet expander, phone cards) with filters, view bar, CSV export and bulk actions, the `DataTablePreferencesPort` that keeps a table's layout (default: the user-settings routes over the host transport), and the jsdom layout stubs and the shared conformance suite.
+- 0b9962b: Add `@marinoscar/platform-web/exports/headless` and `/exports/ui` (#744): the exports client and hooks (`useExportSources`, `useExports`, `useCreateExport`, `useExport`, with polling), `ExportDialog` (request fields from the source's descriptor, or `slots.form`), `ExportsList`, `DataExportPage` and the "Download your data" settings card descriptor.
+- ff1a1a7: Move `MaintenanceGate`, `MaintenanceBanner`, `InstallPrompt` and `UpdatePrompt` into `@marinoscar/platform-web/host/ui` (#901). DOM and styles are unchanged; the gate and the install prompt take `appName`, and the update prompt takes vite-plugin-pwa's `useRegisterSW` as a prop.
+- 677b58e: Add `@marinoscar/platform-web/identity/headless`: `AuthProvider`, `useAuth`, `usePermissions`, `RequireAuth`, `RequirePermission`, `RequireMultiOrg` and `useOrgsFeature` (stable), plus the identity API client and data hooks, the web `registerAuthProvider` registry and `IdentityWebAdaptersProvider` (experimental), moved from the reference app.
+- 61ac4ee: Add `@marinoscar/platform-web/identity/ui`: the login page with `slots` (`Logo`, `Title`, `Footer`, `ProviderButton`), the callback and device-activation pages, `SignInErrorView`, a registry-driven `OAuthButton`, `OrgSwitcher`, the Access Tokens, Users & Allowlist, Organization and Organizations pages (the app's table through the identity adapters), and the `identityAdminSections` / `identityUserSettingsSections` registry entries as data, moved from the reference app (stable pages, experimental slots and entries).
+- 1f4a163: Add `@marinoscar/platform-web/jobs` (#854): `/jobs/headless` (`createJobsApi` over the host transport with the `orgId` list filter, the wire types from `@marinoscar/platform-contract/jobs` and `/nodes`, `useJobs`, `useJobStats`, `useJobActions`, `useJobInsights`, `useWorkerNodes`, `useWorkerNode`, `useNodeCredentials`, `useNodeActions`, `useVisiblePolling`, `JobsWebAdaptersProvider`, the formatters) and `/jobs/ui` (`JobsPage`, `JobInsightsPage`, `WorkersPage` with a `slots.Header`, and `jobsAdminSections`), moved from the reference app with the same DOM, styles, routes and permissions.
+- 077c0c0: Add the `./onboarding/headless` and `./onboarding/ui` subpaths (#745): `OnboardingProvider`, `useOnboarding`, `useOnboardingMetrics`, the onboarding client, the feature-notice registry and the "Getting started" action; `WelcomeDialog` (app panes as slots), `OnboardingChecklist`, `SetupGuidePage` with the Activation section, `GettingStartedPage`, `FeatureUnavailableNotice`, `GettingStartedMenuItem` and the `setupGuideSettingsPage` / `gettingStartedSettingsPage` descriptors.
+- 6321fa5: Apply the page-slot contract to the last three packaged pages (PP-14.24b, #974), so `test/page-slots.exempt.json` is empty. `DataExportPage` takes `slots: DataExportPageSlots` (`PageSlotsBase`, plus the exports list's `Columns` and `RowActions`, which it forwards to `ExportsList`, plus the existing `form`); `GettingStartedPage` takes `slots: GettingStartedPageSlots` and `SetupGuidePage` takes `slots: SetupGuidePageSlots` (both `PageSlotsBase`: `Header`, `BeforeContent`, `Sections` at both ends, `AfterContent`). New exported types: `DataExportPageSlots` (`@marinoscar/platform-web/exports/ui`), `GettingStartedPageProps`, `GettingStartedPageSlots` and `SetupGuidePageSlots` (`@marinoscar/platform-web/onboarding/ui`). Back-compat: every slot is optional and the pages' markup with none is unchanged (pinned by snapshots recorded from the old pages); `SetupGuidePage` keeps `showActivation` and `footer`, and `<GettingStartedPage />` takes no required props.
+- 8246e10: The packaged-page slot contract (PP-14.23) is applied to the AI, storage, email, Android, host, profile, appearance, organization settings, user-data and notification pages (PP-14.24, #942). Every page takes an optional `slots` prop typed to `PageSlotsBase`; a page given none renders the markup it always did (each page group has a DOM snapshot recorded from the old components).
+
+  - **Web, `@marinoscar/platform-web/core`**: `PageSlotsFrame` lays a page body out in slot order (no wrapper element), for the packaged pages and for an app's own page.
+  - **AI**: `AiConfigPage` (`ProviderCardExtra`, drawn under each provider's card), `AiModelsPage` and `AiUsagePage` (the table slots), `UserAiKeysPage`, `OrgAiKeysPage` and `AiPlaygroundPage` (the playground `Header` receives its "New conversation" button as `actions`). `AiUsageTable` takes `slots` too.
+  - **Storage, email**: `StorageConfigPage` and `EmailSettingsPage` take the base slots (the driver and transport panels stay registries).
+  - **Android**: `AndroidAppPage` takes the base slots; `TrustedAppsSection`, `ReleasesSection` and `NotificationsSection` are exported from `android-app/ui`.
+  - **Host**: `AboutPage` and `MaintenancePage` take the base slots. `MaintenanceScreen` gains `logo`, `actions` and `children`; `InstallPrompt` `icon` and `copy`; `MaintenanceBanner` `copy` and `actions`.
+  - **Settings**: `UserProfilePage`, `UserAppearancePage` and `OrgSettingsPage` take the base slots.
+  - **Notifications**: `BroadcastsPage`, `PushConfigPage`, `NotificationSettingsPage` and `UserNotificationsPage` take the base slots.
+  - **User data**: `FactoryResetPage` and `UserDangerZonePage` take `slots` and `copy`, and print the kept and deleted lines of the summary responses instead of constants (the constants stay as the fallback, word for word).
+  - **API and contract (user-data)**: `GET /api/user-data/summary` returns `kept: string[]`, `GET /api/admin/factory-reset/summary` returns `deleted: string[]` and `kept: string[]`. The platform's lines are exactly the text the web bundle held; `UserDataModelHint.summary` (a kept model) and `FactoryResetStepDef.summary` (a step) add one line each. `userDataSummarySchema` and `factoryResetSummarySchema` gain the required arrays: deploy the API before the web, and add the arrays to any hand-built summary in a test.
+  - The telemetry pages, the identity and sharing pages and the exports and onboarding pages stay on `test/page-slots.exempt.json`.
+
+- be4564b: The packaged-page slot contract (PP-14.23, #941) in `@marinoscar/platform-web/core`: `PageSlotsBase` (`Header`, `BeforeContent`, `Sections` rendered at both ends with `position`, `AfterContent`), `TableSlots<Row, Column>` (`Columns`, `RowActions`, `DetailPanel`, `Toolbar`), `PageSlot`, `PageHeaderSlotProps`, `PageSectionsSlotProps`, `SlotTableColumn` and `useTableSlotColumns`. Every slot is optional and a page with none renders the markup it always did. `test/page-slots.contract.test.ts` reads the `ui` entries of the package's `exports` map and fails, naming the page, when an exported `*Page` has no `slots` prop extending `PageSlotsBase`, unless `test/page-slots.exempt.json` lists it with a reason.
+
+  The five operations pages take it. `JobsPage` and `JobInsightsPage`: the base slots, `TableSlots` and `Filters`. `WorkersPage`: the base slots, `TableSlots` and `VitalsPanel` (extra section in the node vitals dialog). `DbBackupPage`: the base slots and `RunRowActions` (its `Sections` now also receives `position` and renders at both ends). `DoctorPage`: the base slots and `CheckRowActions`, plus `registerDoctorCheckRenderer(checkId, Component)` (`@marinoscar/platform-web/doctor/headless`) to draw a check's `data` inside its row. The page `Header` slots of the jobs, nodes and doctor pages keep their props and gain `actions`.
+
+  Migration note: a `slots.Sections` component written for the database backup page, which rendered once at the bottom, now renders at both ends; return `null` when `position === 'top'`.
+
+- 8c69f19: Add the settings pages to `@marinoscar/platform-web/settings/ui`: `OrgSettingsPage` (the Organization settings card), `UserProfilePage`, `UserAppearancePage`, `UserSettingsSection`, `ProfileSettings`, `ThemeSettings` and `ImageUpload`, moved from the reference app with DOM, copy and permissions unchanged, plus `createProfileImageClient`, `useProfileImageClient` and `useStorageStatus` in `/settings/headless`. The host gains optional `applyTheme` and the transport an optional `postFormData` (`createPlatformApiClient` provides it); the test host answers both. The settings slice now depends on `identity` and `onboarding`.
+- fc11b22: Add the `./settings/ui` and `./settings/headless` subpaths (#733): `SettingsHub` (moved without behavioural change; breakpoint gate 4), `SettingsCardDef`, `SettingsSectionDef`, `visibleSettingsSections`, `settingsPageTitle`, `isFeatureEnabled`, the open feature registry (`SettingsFeatureRegistry`, `registerSettingsFeature`, `useSettingsFeatures`) and the hooks `useSystemSettings`, `useUserSettings` and `useOrgSettings`.
+- e30ad6e: Add the sharing UI (#731): `@marinoscar/platform-web/sharing/headless` (the sharing client, `useGroups`, `useGroup`, `useGroupActions`, `useGroupMembers`, `useGroupInvites`, `useMyGroupInvites`, `useGrants`, `useShareActions`, `useLinkGrants`, `useSharedWithMe`, `usePublicLink` and the `registerLinkRenderer` registry) and `@marinoscar/platform-web/sharing/ui` (`ShareDialog`, `GroupsPage`, `GroupDetailPage`, `PendingGroupInvites`, `SharedWithMeList`, `PublicLinkPage` and the `groupsSettingsPage` descriptor). `PlatformRequestOptions` gains `headers` (a page's extra request headers, such as `x-link-token`), and the test host records them and takes an error's `details`.
+- 581a4ab: Add the shell slice: `@marinoscar/platform-web/shell/headless` (the `ShellNavigation` model with `owns`, `isDestinationVisible` and `resolveActiveDestination`, the rail's collapse preference `useShellRailPreference`, `createShellTheme` with its palette and component overrides and the theme context, and the providers composition `ShellProviders`) and `@marinoscar/platform-web/shell/ui` (`ShellLayout`, `ShellAppBar`, `ShellNavigationRail` with Console mode, `ShellBottomNav`, `ShellUserMenu`, `ShellThemeProvider` and `ShellRoot`), with slots for branding and navigation. The five coupled breakpoint gates stay together at `sm`. `@marinoscar/platform-web/settings`' sibling entry now also exposes the registry helpers and the feature map to the shell.
+- 17d6ed1: Add `@marinoscar/platform-web/storage/headless` and `/storage/ui` (#736): `useStorageConfig`, the storage-config client and a new objects client (simple and resumable upload, download URL, delete, status, wait-for-ready) over the host's transport, and the `/admin/settings/storage` page `StorageConfigPage` with `StorageSwitchConfirmDialog`, moved from the reference app with their behaviour unchanged.
+
+### Patch Changes
+
+- f6e319b: Documentation only: every slice README's Extension-point catalog links the new extension author guide (`docs/EXTENDING.md`); the email README no longer promises that a provider of `SmtpEmailProvider` in the app module replaces the transport (it does not reach the package's consumers; a transport registry is not supported yet); the AI READMEs say that a provider cannot be enabled from an app yet; the platform-db README documents `rlsPolicies` in `platform.lock` with the migration SQL for an app table protected by row-level security.
+- fe73d7a: Documentation only: the overview READMEs list every shipped slice and subpath, and the stale "version 0.0.0" status lines are replaced.
+- 7e667e2: `POST /api/admin/ai/models/refresh` now answers `409` with `details.reason` `AI_DISABLED` or `AI_PROVIDER_DISABLED` when AI, or the provider, is switched off, instead of queueing an `ai.catalog.refresh` job that silently skipped. New `AiCatalogService.disabledReason(providerId)` is the single policy read behind both the route and the sync.
+
+  In `@marinoscar/platform-web`, `useAiModels().refreshCatalog` no longer clears `refreshError` per call: it shows the server's own message for these refusals and collects (de-duplicated) the refusals of several providers, and `AiModelsPage` clears the error once before refreshing and shows the "Refresh queued" snackbar only when a job was queued.
+
+- 6487697: Finish the identity slice move (#727): the reference app now imports identity only from `@marinoscar/platform-{api,web,contract}/identity`, so the web identity catalog's examples point at the app's real uses (`App.tsx`, and one example per data hook in `apps/web/src/identity/dataHookExamples.tsx`), the identity hook, page, guard and component suites the app kept run in `platform-web`'s own tests (with a `fakeIdentityApi` test helper), and comments naming the app's old identity paths point at the packages. No API change.
+- 346e661: The sharing slice's READMEs are complete in all three packages (#732): quick start, the full extension-point catalog with a compiled, tested reference example for every entry (`apps/api/test/examples/sharing/`, `apps/web/src/__tests__/examples/sharing/`), minimal examples, observability, security notes, the conformance suite, troubleshooting, and two migration recipes (a per-record share table, kvox-style; circles and public links, MemoriaHub-style). `ownedByMeOrMyGroups`, `ShareDialog`, `useGrants`, `useShareActions` and `useSharedWithMe` are now catalogued extension points.
+- c318559: Add the React-free `@marinoscar/platform-web/notifications/service-worker` entry and point the reference app's `sw.ts` at it. Importing `registerNotificationServiceWorkerHandlers` from the `/headless` barrel loaded React into the service worker in Vite dev mode (nothing is tree-shaken there), which threw "window is not defined" and kept the worker from installing (#886). The barrel still re-exports the handlers.
+- Updated dependencies [a426fd8]
+- Updated dependencies [b2df59a]
+- Updated dependencies [823ec07]
+- Updated dependencies [6a7af76]
+- Updated dependencies [deeb8b5]
+- Updated dependencies [a20f306]
+- Updated dependencies [2be194f]
+- Updated dependencies [0b9962b]
+- Updated dependencies [606d231]
+- Updated dependencies [0426848]
+- Updated dependencies [077c0c0]
+- Updated dependencies [fc11b22]
+- Updated dependencies [685657b]
+- Updated dependencies [5d0dd86]
+- Updated dependencies [03eeaab]
+- Updated dependencies [17d6ed1]
+- Updated dependencies [f80189d]
+- Updated dependencies [115705f]
+- Updated dependencies [d1d1258]
+- Updated dependencies [b46725d]
+- Updated dependencies [f6e319b]
+- Updated dependencies [fe73d7a]
+- Updated dependencies [e6acb4b]
+- Updated dependencies [2c4bf2c]
+- Updated dependencies [c6f97da]
+- Updated dependencies [6487697]
+- Updated dependencies [8a0f3b9]
+- Updated dependencies [aeace4a]
+- Updated dependencies [fce5417]
+- Updated dependencies [48b275d]
+- Updated dependencies [fe61ffe]
+- Updated dependencies [b480c02]
+- Updated dependencies [f994de1]
+- Updated dependencies [346e661]
+- Updated dependencies [9f4c147]
+- Updated dependencies [d35900e]
+- Updated dependencies [74c4aff]
+- Updated dependencies [5e98e3d]
+- Updated dependencies [5425626]
+- Updated dependencies [175ddd3]
+- Updated dependencies [1171b1c]
+- Updated dependencies [2732024]
+- Updated dependencies [39b5300]
+- Updated dependencies [8246e10]
+  - @marinoscar/platform-contract@0.1.0-next.4
+
 ## 0.1.0-next.3
 
 ### Minor Changes

package/README.md

@@ -4,14 +4,32 @@ The React side of the platform: pages, components and hooks built on MUI, expose
 
 ## Purpose and scope
 
-Pages, components, hooks and settings-page descriptors of the platform's web slices. It does not own the app's router, theme or settings registries; the app binds the package's descriptors into its own.
+Pages, components, hooks and settings-page descriptors of the platform's web slices. It does not own the app's router or settings registries; the app binds the package's descriptors into its own. The app's theme is the app's: the shell slice offers one to build on (`createShellTheme`).
 
-Status: pre-release (version `0.0.0`). The root export is only the package name (`PLATFORM_PACKAGE`); the slices are subpath exports, each with its own README:
+Status: pre-release (the current channel and how to install it: the [release runbook](../../docs/runbooks/release-platform-packages.md)). The root export is only the package name (`PLATFORM_PACKAGE`); the slices are subpath exports, each with its own README:
 
 - `@marinoscar/platform-web/core`: the web host ports every packaged page reuses (`PlatformHostProvider`, `PlatformApiClient`, `PlatformViewer`, `PlatformSettingsPage`). [README](src/core/README.md).
 - `@marinoscar/platform-web/testing`: test doubles for those ports (`createTestPlatformHost`). [README](src/testing/README.md).
 - `@marinoscar/platform-web/doctor/headless` and `@marinoscar/platform-web/doctor/ui`: the admin Doctor page, its hook and client, and its settings-page descriptor (#696). [README](src/doctor/README.md).
 - `@marinoscar/platform-web/telemetry/headless` and `@marinoscar/platform-web/telemetry/ui` (plus `/telemetry/ui/settings-page`, `/explorer-page`, `/dashboard-page`): the telemetry settings page, explorer and dashboard, their client, hooks, app adapters, admin cards and theme-token contract (#704). [README](src/telemetry/README.md).
+- `@marinoscar/platform-web/identity/headless` and `@marinoscar/platform-web/identity/ui`: the auth context and route guards, the identity client and data hooks, the sign-in provider registry, and the login, callback, device-activation, Access Tokens, Users & Allowlist and organization pages with their registry entries (#727). [README](src/identity/README.md).
+- `@marinoscar/platform-web/settings/headless` and `@marinoscar/platform-web/settings/ui`: `SettingsHub`, the section registry's types and helpers, the open feature registry (`registerSettingsFeature`) and the settings hooks (`useSystemSettings`, `useUserSettings`, `useOrgSettings`) (#733). [README](src/settings/README.md).
+- `@marinoscar/platform-web/sharing/headless` and `@marinoscar/platform-web/sharing/ui`: the sharing hooks and client (groups, members, invites, grants, link grants, shared with me, the public link), the link-renderer registry, the share dialog, the group pages, the public `/s` page and the groups settings-page descriptor (#731). [README](src/sharing/README.md).
+- `@marinoscar/platform-web/credentials/headless` and `@marinoscar/platform-web/credentials/ui`: the write-only secret field `SecretField` and its unified helper text `savedSecretHelperText` (#735). [README](src/credentials/README.md).
+- `@marinoscar/platform-web/onboarding/headless` and `@marinoscar/platform-web/onboarding/ui`: `OnboardingProvider` and `useOnboarding`, the welcome dialog, the checklist, the Setup guide and Getting started pages, the Activation section, `FeatureUnavailableNotice` and its registry, and the "Getting started" menu item (#745). [README](src/onboarding/README.md).
+- `@marinoscar/platform-web/email/headless` and `@marinoscar/platform-web/email/ui`: the email settings hook `useEmailSettings` and the `/admin/settings/email` page `EmailSettingsPage` (#737). [README](src/email/README.md).
+- `@marinoscar/platform-web/jobs/headless` and `@marinoscar/platform-web/jobs/ui`: the job queue client, hooks and adapters, and the Jobs and Job Insights pages with their registry entries (#854); it re-exports the worker-fleet names of the nodes slice. [README](src/jobs/README.md).
+- `@marinoscar/platform-web/nodes/headless` and `@marinoscar/platform-web/nodes/ui`: the worker-fleet and node-credential client, hooks and adapters, and the Worker Nodes page with its registry entry (#881). [README](src/nodes/README.md).
+- `@marinoscar/platform-web/storage/headless` and `@marinoscar/platform-web/storage/ui`: the storage config hook `useStorageConfig`, the storage-config and objects clients, and the `/admin/settings/storage` page `StorageConfigPage` with its switch dialog (#736). [README](src/storage/README.md).
+- `@marinoscar/platform-web/exports/headless` and `@marinoscar/platform-web/exports/ui`: the exports client and hooks (`useExportSources`, `useExports`, `useCreateExport`, `useExport` with polling), `ExportDialog` (fields from the source's descriptor, `slots.form`), `ExportsList`, `DataExportPage` and the "Download your data" card descriptor (#744). [README](src/exports/README.md).
+- `@marinoscar/platform-web/ai/headless` and `@marinoscar/platform-web/ai/ui`: the organization's own AI keys and effective AI policy hooks (`useOrgAiKeys`, `useOrgAiPolicy`) and the Organization AI keys page `OrgAiKeysPage` (#739). [README](src/ai/README.md).
+- `@marinoscar/platform-web/db-backup/headless` and `@marinoscar/platform-web/db-backup/ui`: the db-backup client `createDbBackupApi`, the hooks `useDbBackupConfig` / `useDbBackupRuns` / `useDbBackupActions`, and the `/admin/settings/db-backup` page `DbBackupPage` with its admin card `dbBackupAdminSections` (#740). [README](src/db-backup/README.md).
+- `@marinoscar/platform-web/notifications/headless` and `@marinoscar/platform-web/notifications/ui`: the notification provider and hooks, the push subscription services, the service-worker helpers, the AppBar bell, the permission banner, the preferences matrix and the user, admin policy, Web Push and Broadcasts pages. [README](src/notifications/README.md).
+- `@marinoscar/platform-web/android-app/headless` and `@marinoscar/platform-web/android-app/ui`: the Trusted Web Activity launch helpers, the Android client and hooks, the update banner and the admin Android app page. [README](src/android-app/README.md).
+- `@marinoscar/platform-web/user-data/headless` and `@marinoscar/platform-web/user-data/ui`: the user Danger Zone page, the admin factory reset page, the organization offboarding dialog, the typed-confirmation dialog and the start-and-poll hook. [README](src/user-data/README.md).
+- `@marinoscar/platform-web/shell/headless` and `@marinoscar/platform-web/shell/ui`: the app shell: `ShellLayout` (the five coupled breakpoint gates), `ShellAppBar`, `ShellNavigationRail` (with Console mode), `ShellBottomNav`, `ShellUserMenu`, the navigation model (`ShellNavigation`, `ShellDestination`), the rail's collapse preference, `createShellTheme` with `ShellThemeProvider` / `ShellRoot`, and `ShellProviders`, with slots for branding and navigation (#868). [README](src/shell/README.md).
+- `@marinoscar/platform-web/host/headless` and `@marinoscar/platform-web/host/ui`: the About page, the admin Maintenance page and the public maintenance screen, with the maintenance recogniser and block store, `createHostApi` and the `useAbout`, `useMaintenance` and `useMaintenanceBlock` hooks (#891). [README](src/host/README.md).
+- `@marinoscar/platform-web/datatable/headless`, `@marinoscar/platform-web/datatable/ui` and `@marinoscar/platform-web/datatable/testing`: the responsive `DataTable` (desktop grid, tablet expander, phone cards) with its filters, view bar, CSV export and bulk actions, the layout-preference port `DataTablePreferencesPort`, and the jsdom layout stubs and conformance suite (#897). [README](src/datatable/README.md).
 
 ## Install and peer dependencies
 
@@ -19,19 +37,32 @@ Status: pre-release (version `0.0.0`). The root export is only the package name
 npm install @marinoscar/platform-web
 ```
 
-Install these in the app; the package never bundles its own copy (a second copy breaks dependency injection, hooks or theme context).
+Install these in the app; the package never bundles its own copy (a second copy breaks dependency injection, hooks or theme context). Which ones depends on the slices you import: only what `core` needs is required, the rest are optional peers npm does not install for you ([the rule](../../docs/PACKAGES.md#peer-dependencies-per-slice)). Import slices by their subpath, never from the package root, which may touch any slice.
+
+Required by every slice (`core`, with the peers MUI and Emotion need in turn):
 
 | Package | Range |
 |---|---|
 | `@emotion/react` | `^11.14.0` |
 | `@emotion/styled` | `^11.14.1` |
-| `@mui/icons-material` | `^9.1.0` |
 | `@mui/material` | `^9.1.0` |
 | `react` | `^19.2.7` |
 | `react-dom` | `^19.2.7` |
-| `react-router-dom` | `^7.17.0` |
 
-Optional peers, needed only by `@marinoscar/platform-web/telemetry/ui` (#704): `@mui/x-charts` `^9.14.0`, `@mui/x-data-grid` `^9.10.1`, `@uiw/react-codemirror` `^4.25.12` and `@codemirror/lang-sql` `^6.10.0`.
+Optional peers, installed for the slices that need them:
+
+| Package | Range | Needed by |
+|---|---|---|
+| `@mui/icons-material` | `^9.1.0` | every slice with a `/ui` entry (`doctor`, `identity`, `settings`, `sharing`, `onboarding`, `email`, `nodes`, `jobs`, `storage`, `notifications`, `exports`, `ai`, `db-backup`, `android-app`, `user-data`, `shell`, `host`, `datatable`, `telemetry`) |
+| `react-router-dom` | `^7.17.0` | the same slices, except `exports` and `datatable` |
+| `zod` | `^4.4.3` | `nodes`, `jobs` (and the app's own use of `@marinoscar/platform-contract`) |
+| `@mui/x-data-grid` | `^9.10.1` | `datatable/ui` and, since the AI lists use it, `ai/ui`; `telemetry/ui` |
+| `@mui/x-charts` | `^9.14.0` | `telemetry/ui` (#704) |
+| `@uiw/react-codemirror` | `^4.25.12` | `telemetry/ui` |
+| `@codemirror/lang-sql` | `^6.10.0` | `telemetry/ui` |
+| `vitest`, `vitest-axe`, `@testing-library/react`, `@testing-library/user-event` | `^4.1.8`, `^1.0.0-pre.5`, `^16.3.2`, `^14.6.1` | `datatable/testing` only |
+
+A slice also needs what the slices it depends on need (`packages/platform-slices.json`); the exact set per slice is `packages/platform-slice-peers.json`, and `node scripts/check-slice-peers.mjs --table` prints it.
 
 ## Quick start
 
@@ -54,6 +85,8 @@ None at the package level. `PlatformHostProvider`'s host is documented in the [c
 
 None. The root export is only the package name; the extension points live in the slice catalogs ([core](src/core/README.md#extension-point-catalog), [doctor](src/doctor/README.md#extension-point-catalog)).
 
+The extension ladder and a recipe per extension: [docs/EXTENDING.md](../../docs/EXTENDING.md).
+
 ## Data
 
 None. The browser holds no data model; it reads and writes through the API.

package/dist/ai/headless/adapters.d.ts

@@ -0,0 +1,55 @@
+import type { ComponentType, ReactElement, ReactNode } from 'react';
+/**
+ * What {@link AiWebAdapters.Spinner} takes.
+ *
+ * @stability experimental
+ */
+export interface AiSpinnerProps {
+    /** A whole-page wait. The AI pages never ask for one. */
+    fullScreen?: boolean;
+}
+/**
+ * What the AI pages take from the app. Every member is optional; keep the
+ * object a module constant.
+ *
+ * @example
+ * ```ts
+ * // apps/web/src/platform/aiAdapters.ts
+ * export const appAiAdapters: AiWebAdapters = { Spinner: LoadingSpinner };
+ * ```
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+export interface AiWebAdapters {
+    /** The app's loading spinner. Default an MUI `CircularProgress`. */
+    Spinner?: ComponentType<AiSpinnerProps>;
+}
+/**
+ * Hands the app's {@link AiWebAdapters} to every AI page below it. Mount it
+ * once, around the signed-in shell.
+ *
+ * @param props - `adapters`: the app's adapters (a module constant); `children`: the routed tree.
+ * @returns the provider element.
+ *
+ * @example
+ * ```tsx
+ * <AiWebAdaptersProvider adapters={appAiAdapters}>{shell}</AiWebAdaptersProvider>
+ * ```
+ *
+ * @extensionPoint component
+ * @stability experimental
+ */
+export declare function AiWebAdaptersProvider(props: {
+    adapters: AiWebAdapters;
+    children: ReactNode;
+}): ReactElement;
+/**
+ * The adapters in context (an empty object without a provider).
+ *
+ * @returns the app's AI adapters.
+ *
+ * @stability experimental
+ */
+export declare function useAiWebAdapters(): AiWebAdapters;
+//# sourceMappingURL=adapters.d.ts.map

package/dist/ai/headless/adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../../../src/ai/headless/adapters.tsx"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,OAAO,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACzC;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,SAAS,CAAC;CACrB,GAAG,YAAY,CAMf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD"}