@openengio/cli 0.36.0 → 0.37.0

package/bin/public/openeng.js

@@ -58,6 +58,11 @@ var LINK_DIRECTIONS = Object.freeze(["outgoing", "incoming", "to-children", "to-
 var SET_OPERATORS = Object.freeze(["union", "intersection", "difference"]);
 var AGGREGATE_OPERATIONS = Object.freeze(["count", "min", "max", "sum", "average"]);
 
+// packages/api-contract/dist/branch-rules.js
+var RULE_EXTENTS = Object.freeze(["ref", "rows"]);
+var RULE_CONSEQUENCES = Object.freeze(["open", "merge-only", "locked-rows-only"]);
+var RULE_ROLES = Object.freeze(["contributor", "maintainer", "owner"]);
+
 // packages/api-contract/dist/entry-form.js
 function verbEntry(type) {
   const subjects = type.allowedSubjectTypes;
@@ -79,6 +84,18 @@ var FIX_REQUEST = { option: "Correct the request and send it again." };
 var ASK_ADMINISTRATOR = { option: "Ask an administrator of the organisation to make the change or to grant the permission." };
 var SIGN_IN_AGAIN = { option: "Sign in again." };
 var RULE_ENTRIES = {
+  "draft-locked": entry("Another person holds this draft lock.", { option: "Wait for the lock to expire or ask its holder to release it." }),
+  "draft-lock-lost": entry("The draft lock is no longer held by you.", { option: "Acquire the draft again before saving." }),
+  "draft-not-flushed": entry("The draft has saves that were not confirmed.", { option: "Save and confirm the latest draft before publishing." }),
+  "draft-changed": entry("The draft changed since it was read, or its saved base no longer matches.", { option: "Acquire the draft again before saving." }),
+  "unknown-block": entry("The save names a block identifier the draft does not hold.", { option: "Send a new block in added, without an identifier; the server mints it." }),
+  "ref-not-found": entry("The branch no longer exists.", { option: "Choose an existing branch." }),
+  "object-not-found": entry("The object is absent from the destination branch.", FIX_REQUEST),
+  "not-a-saver": entry("Only a person who saved this draft may restore it.", { option: "Ask a person who saved the draft to restore it." }),
+  "ref-has-drafts": entry("The branch still has drafts.", { option: "Review its drafts and confirm their removal before disposing the branch." }),
+  "body-not-declared": entry("The object's type version does not declare a body format.", FIX_REQUEST),
+  "body-changed": entry("The body changed since this draft was opened.", { option: "Read the object's current body, discard the draft and acquire it again.", read: "readObject" }),
+  "body-too-large": entry("The body exceeds the limit on blocks, bytes per block or total bytes.", FIX_REQUEST),
   "upstream-changed": entry("The upstream content changed since the link was reviewed; no link was cleared.", {
     option: "Read the link status, review the upstream content and clear against its new version.",
     read: "readLinkStatus"
@@ -99,11 +116,23 @@ var RULE_ENTRIES = {
   "no-commits": entry("The branch holds no change of its own yet."),
   "proposal-open": entry("A proposal for this branch is already waiting for review.", { option: "Read the pending proposal.", read: "readPendingProposal" }),
   "proposal-not-pending": entry("The proposal is no longer waiting for review.", { option: "Read the proposal.", read: "readProposal" }),
+  "proposal-required": entry("A rule on the target requires a proposal from this branch to the target before it merges, and none is pending.", { option: "Submit a proposal for the branch, have it approved, then merge it.", read: "readPendingProposal" }),
+  "approvals-required": entry("A rule on the target requires more approvals of the branch's latest commit than the proposal has.", { option: "Read the proposal's approvals and ask an approver to review its latest commit.", read: "readProposal" }),
+  "deletion-restricted": entry("A rule restricts deleting this branch, and you are not on its bypass list.", { option: "Ask someone on the rule's bypass list to delete the branch.", read: "listRefRules" }),
+  "bypass-required": entry("The branch has a pending proposal and a rule matches it, so only someone on the bypass list of each matching rule may delete it.", { option: "Refuse the proposal first, or ask someone on the rule's bypass list to delete the branch.", read: "readPendingProposal" }),
+  "proposal-head-moved": entry("The branch's latest commit is not the one the approval names, so nothing was recorded.", { option: "Read the branch's latest commit, review it and approve that commit.", read: "readRefHead" }),
+  "author-cannot-approve": entry("An author of the proposal cannot approve it.", { option: "Ask another person who reads the project to approve it." }),
+  "already-approved": entry("You have already approved the proposal at this commit, so nothing was recorded.", { option: "Read the proposal's approvals.", read: "readProposal" }),
+  "invalid-rule-pattern": entry("The rule's pattern is not one its owner and extent take: a project's branch rule names its own branches, an organisation's rule names main or organisation branches and baselines, and a rows rule names main or its project's own branches.", FIX_REQUEST),
+  "invalid-rule-setting": entry("The rule's settings do not fit together or do not fit the rule: approvals need a proposal and an approver, and only a project's branch rule restricts deletions.", FIX_REQUEST),
+  "unknown-rule-member": entry("The rule names a person, service or application that it may not name; the answer is the same whether the member is absent or outside the rule's home.", FIX_REQUEST),
+  "duplicate-rule": entry("Another rule on this pattern and extent already has that consequence; the rule is unchanged.", FIX_REQUEST),
+  "invalid-proposal-target": entry("The proposal's target is not one a proposal may name: main, a writable organisation branch, or a project branch.", FIX_REQUEST),
   "change-set-open": entry("The organisation already has an open change set.", { option: "Read the open change set and continue with it.", read: "readCurrentChangeSet" }),
-  "stale-revision": entry("The change set or app draft has changed since it was read, so nothing was applied.", { option: "Read the change set again, apply your change to what it now holds and send it again.", read: "readChangeSet" }, { option: "Read the app draft again, apply your change to what it now holds and send it again.", read: "readAppDraft" }),
+  "stale-revision": entry("The change set or app draft has changed since it was read, so nothing was applied.", { option: "Read the change set again, apply your change to what it now holds and send it again.", read: "readChangeSet" }, { option: "Read the object set again and retry with its current revision.", read: "readObjectSet" }, { option: "Read the app draft again, apply your change to what it now holds and send it again.", read: "readAppDraft" }),
   "not-open": entry("The change set or app draft is accepted or discarded and takes no further change.", { option: "Read the change set's state.", read: "readChangeSetState" }, { option: "Read the app draft's state.", read: "readAppDraft" }),
   "app-draft-open": entry("The app already has an open draft.", { option: "Read the open draft and continue with it.", read: "readAppDraft" }),
-  "invalid-app": entry("The app document does not pass the checks on apps; the violations say where.", { option: "Correct the document at the paths the violations name and save it again.", read: "readAppDraft" }),
+  "invalid-app": entry("The app key or document is invalid; document violations say where.", { option: "Use a valid app key." }, { option: "Correct the document at the paths the violations name and save it again.", read: "readAppDraft" }),
   "invalid-catalogue": entry("The change set does not pass the checks on types; the violations say where.", {
     option: "Read the change set, correct it at the paths the violations name and revise it. For typeIcon, use a Material Symbols Rounded name from @material-symbols/font-400, such as memory or developer_board. openeng types icons <text> lists valid names and needs no sign-in; the full list is at https://docs.openeng.io/reference/icons/.",
     read: "readChangeSet"
@@ -132,7 +161,7 @@ var RULE_ENTRIES = {
   "no-such-client": entry("The client the request names is not an active client of your organisation.", { option: "List the organisation's clients.", read: "listClients" }),
   "no-such-invitation": entry("The invitation the request names is not one of your organisation.", { option: "List the pending invitations.", read: "listInvitations" }),
   "invitation-not-pending": entry("The invitation was already accepted or revoked.", { option: "List the pending invitations.", read: "listInvitations" }),
-  "invalid-domain": entry("A domain in the rule is not a valid domain name: it needs letters, digits, hyphens and at least one dot.", FIX_REQUEST),
+  "invalid-domain": entry("The rule lacks its switch or list, or a domain is not valid: it needs letters, digits, hyphens and at least one dot.", FIX_REQUEST),
   "domain-not-allowed": entry("The organisation invites only addresses on its allowed domains, and this address is not on the list.", { option: "Use an address on an allowed domain, or ask an owner to change the list.", read: "readInvitationDomainRule" }),
   "membership-exists": entry("The membership already exists.", { option: "List the members.", read: "listMembers" }),
   "no-such-principal": entry("The request names someone who cannot hold the membership.", FIX_REQUEST),
@@ -151,7 +180,7 @@ var RULE_ENTRIES = {
   signature: entry("The sign-in token was not accepted.", SIGN_IN_AGAIN),
   issuer: entry("The sign-in token was not accepted.", SIGN_IN_AGAIN),
   audience: entry("The sign-in token was not accepted.", SIGN_IN_AGAIN),
-  expiry: entry("The sign-in token has expired.", SIGN_IN_AGAIN),
+  expiry: entry("The sign-in token is expired or not yet valid.", SIGN_IN_AGAIN),
   algorithm: entry("The sign-in token was not accepted.", SIGN_IN_AGAIN),
   claims: entry("The sign-in token was not accepted.", SIGN_IN_AGAIN),
   "malformed-query": entry("The query is not one the platform can run; the refusal identifies the path of the invalid field.", FIX_REQUEST),
@@ -164,16 +193,16 @@ var RULE_ENTRIES = {
   "cycle-in-reach": entry("A per-path repeat reach returned to an object already in that path's ancestors; the refusal names the readable object.", { option: "Remove the cycle, or use distinct multiplicity, which admits cycles." }),
   "over-bound": entry("The request exceeds a graph, structure, path, or query limit.", FIX_REQUEST),
   "malformed-history-request": entry("The history request is not one the platform can run.", FIX_REQUEST),
-  "protected-ref": entry("This branch is protected, so an agent cannot write to it.", { option: "Write to another branch." }),
+  "protected-ref": entry("This branch is protected, so this write cannot proceed.", { option: "Write to another branch." }),
   immutable: entry("The record's type is immutable, so it cannot be changed or deleted on any branch.", { option: "Leave the record unchanged." }),
   owned: entry("The record belongs to a connected system, which alone can write it.", { option: "Ask the connected system to make the change." }),
   frozen: entry("The record is locked; it cannot be changed until someone allowed to lock records lifts the lock.", { option: "Ask someone allowed to lock records to lift the lock." }),
   protected: entry("A rule protects this record on this branch, so it changes only by a merge from another branch.", { option: "Make the change on another branch and merge it." }),
   "not-a-ref-head": entry("The commit is not the latest commit of a branch you can use.", { option: "Read the branches you can use and choose one." }),
   "stale-source": entry("The source commit is not the current commit on the named branch.", { option: "Read a branch you can use and merge its current commit." }),
-  "branch-needs-schema-update": entry("This branch's schema is older than the platform's, so it must be updated before it can be written.", { option: "Request a schema update for the branch." }),
+  "branch-needs-schema-update": entry("This branch's schema differs from the platform's, so it must be updated before it can be read or written.", { option: "Request a schema update for the branch." }),
   "organisation-not-ready": entry("The organisation's trunk is not ready yet.", { option: "Try again shortly." }),
-  "read-only-ref": entry("The branch is read-only, so nothing can be written or merged into it.", { option: "Choose a writable branch." }),
+  "read-only-ref": entry("The branch is read-only, the write names a commit, or you cannot write to this branch.", { option: "Choose a branch you can write to." }),
   "ref-exists": entry("An organisation branch or baseline of that name already exists.", { option: "List the organisation's branches and baselines.", read: "listOrganisationRefs" }),
   "concurrent-change": entry("Another write changed the record first, so nothing was applied.", { option: "Try again shortly." }),
   "lock-unavailable": entry("The lock could not be taken now, so nothing was applied.", { option: "Try again shortly." }),
@@ -190,27 +219,31 @@ var RULE_ENTRIES = {
   "subscription-absent": entry("The object has no such subscription to remove.", { option: "Read the object's subscribers to see who is subscribed." }),
   "invalid-body": entry("The comment text is empty or longer than the platform allows.", FIX_REQUEST),
   "invalid-mention": entry("A mention points outside the comment text, overlaps another, or cuts a character in two, or the comment holds too many mentions.", FIX_REQUEST),
+  "anchor-invalid": entry("The comment anchor has invalid offsets, quote length or context length, names a block the object does not have, or quotes text that the block does not hold.", FIX_REQUEST),
   "invalid-ref": entry("The branch the request names is not in a form the platform takes for this operation.", FIX_REQUEST),
   "invalid-query": entry("The search text, or the page the request continues from, is outside what the platform takes.", FIX_REQUEST),
   "invalid-project-id": entry("The project could not be created under the identifier the platform made for it.", { option: "Send it again as a new request." }),
   "import-running": entry("A run of this connection is already running.", { option: "List the connection's runs.", read: "listImportRuns" }),
-  "connection-exists": entry("The organisation already has a live connection to this account on this stack.", { option: "List the connections.", read: "listConnections" }),
-  "run-not-running": entry("The run has already ended.", { option: "List the connection's runs.", read: "listImportRuns" }),
+  "connection-exists": entry("The organisation already has a live connection for this stack and company.", { option: "List the connections.", read: "listConnections" }),
+  "run-not-running": entry("The run is missing, not running, or belongs to someone else.", { option: "List the connection's runs.", read: "listImportRuns" }),
   "connection-revoked": entry("The connection is revoked, so it takes no further change or run."),
   "credential-not-valid": entry("The upstream system did not accept the credential, and nothing was stored.", { option: "Check the credential and send it again." }),
-  "types-not-approved": entry("This connector's types wait for approval by a person who holds the permission to administer types in the organisation.", { option: "Ask such a person to review and accept the connector's change set.", read: "readCurrentChangeSet" }),
-  "connector-template-missing": entry("This deployment holds no type template for the connector's system.")
+  "types-not-approved": entry("This connector's types are not approved for this system and template version; a person who holds the permission to administer types in the organisation accepts them.", { option: "Ask such a person to review and accept the connector's change set.", read: "readCurrentChangeSet" }),
+  "connector-template-missing": entry("This deployment holds no type template for the connector's system."),
+  "step-up-required": entry("This operation needs the person's own confirmation and none stands for this request. Where the refusal carries a pending request, the request now awaits that confirmation.", { option: "Have the person confirm the pending request, then send the same request again with the same key and the proof." }),
+  "step-up-mismatch": entry("The confirmation presented was given for another request or another person, or for a request that differs in its target, key or body.", { option: "Send the request again without the confirmation to start a new one." }),
+  "step-up-capacity": entry("The person already has the most confirmations waiting that the platform allows.", { option: "Confirm the waiting requests, or wait for them to lapse, then send the request again." })
 };
 var KIND_ENTRIES = {
   unauthenticated: entry("The request carried no sign-in it can use: none, or an invalid or expired one.", { option: "Sign in and send the request again." }),
   "not-found": entry("What the request names does not exist, or you may not reach it; the answer is the same either way.", { option: "Check the identifiers; list what you may read.", read: "listProjects" }, { option: "If the request names a verb, list the verbs available for the object.", read: "discoverVerbs" }),
-  "session-moved": entry("Your sign-in is attached to another organisation than the one the token names.", { option: "Sign in again to the organisation your sign-in is attached to." }),
+  "session-moved": entry("Your sign-in moved to another organisation or was detached after this token was issued.", { option: "Sign in again and attach the organisation you want." }),
   "not-attached": entry("Your sign-in is attached to no organisation, and this request acts inside one.", { option: "Attach your sign-in to an organisation, then send the request again." }),
   "invalid-request": entry("The request is not in the shape the call takes.", FIX_REQUEST),
   "bound-exceeded": entry("The request went past a limit the platform sets.", { option: "Make the request smaller, or wait before sending the next." }),
   "in-flight": entry("A request with this key is still being handled.", { option: "Wait, then send the same request with the same key again." }),
   internal: entry("The platform failed while handling the request.", { option: "Send the request again later, and give support the reference code the refusal carries if it persists." }),
-  "protocol-mismatch": entry("This client and the platform no longer speak the same version of the interface.", { option: "Update the client." }),
+  "protocol-mismatch": entry("The version header is missing, repeated, malformed or does not match the platform.", { option: "Send one valid version header or update the client." }),
   "unknown-outcome": entry("The platform cannot tell whether the operation took effect.", { option: "Read the state the operation changes before sending it again; the refusal's reference code names the attempt." })
 };
 var CLASS_ENTRIES = {
@@ -229,7 +262,7 @@ var API_RULE_ENTRIES = {
   "branch-needs-schema-update": RULE_ENTRIES["branch-needs-schema-update"],
   conflict: entry("A property's current value differs from the 'from' value the request expected; the refusal names each such property and its current value.", { option: "Read the current properties, reconcile the changes and send the update again with the from values you now expect." }),
   "unknown-type": entry("The requested type is not a current object or edge type in this namespace.", { option: "Read the current types and use an object or edge type they contain.", read: "readCatalogue" }, { option: "If looking for a verb, list the verbs available for the object.", read: "discoverVerbs" }),
-  "unknown-verb": entry("The object has no verb with that name.", { option: "List the verbs available for the object.", read: "discoverVerbs" }),
+  "unknown-verb": entry("There is no current verb with that name.", { option: "List the verbs available for the object.", read: "discoverVerbs" }),
   "type-version-precondition": entry("The type version the request expected differs from the type's current version.", { option: "Read the type's current version and send the request with that version." }),
   "invalid-properties": entry("The property document failed validation; the violations name each offending path and rule.", { option: "Correct the properties at the paths the violations name and send the request again." }),
   "blocked-by-edge": entry("The object has a link you may not remove, so nothing was deleted.", { option: "Remove that link first, or ask someone who may to remove it." }),
@@ -281,6 +314,31 @@ var API_REFUSAL_RULES = Object.freeze([
 var SHIM_COLLIDING_API_RULES = Object.freeze(["write-refused"]);
 
 // packages/api-contract/dist/route-docs.js
+var ACTOR_LABELS = Object.freeze({
+  person: "person",
+  "agent:explore": "agent:explore",
+  "agent:apply": "agent:apply",
+  "agent:types": "agent:types",
+  "app:client": "app:client",
+  "app:hosted": "app:hosted",
+  service: "service"
+});
+var STEP_UP_LABELS = Object.freeze({ none: "none", "person-present": "person-present" });
+var PREDICATE_LABELS = Object.freeze({
+  unlocks: 'person-present when unlocks (lock is "none")'
+});
+function stepUpLabel(stepUp) {
+  return typeof stepUp === "string" ? STEP_UP_LABELS[stepUp] : PREDICATE_LABELS[stepUp.personPresentWhen];
+}
+function routePolicyDoc(policy) {
+  if ("none" in policy)
+    return Object.freeze({ actors: "none", stepUp: "none" });
+  const entries7 = Object.entries(policy.actors);
+  return Object.freeze({
+    actors: entries7.map(([actor]) => ACTOR_LABELS[actor]).join(", "),
+    stepUp: entries7.map(([actor, stepUp]) => `${ACTOR_LABELS[actor]}: ${stepUpLabel(stepUp)}`).join("; ")
+  });
+}
 function need(capability, scope) {
   return Object.freeze({ capability, scope });
 }
@@ -288,9 +346,11 @@ var PROTECTION_ROUTE_CAPABILITIES = Object.freeze({
   addRefRule: Object.freeze([need("administer projects", "project")]),
   listRefRules: Object.freeze([need("read", "project")]),
   removeRefRule: Object.freeze([need("administer projects", "project")]),
+  updateRefRule: Object.freeze([need("administer projects", "project")]),
   addOrganisationRule: Object.freeze([need("administer projects", "organisation")]),
   listOrganisationRules: Object.freeze([need("read", "organisation")]),
   removeOrganisationRule: Object.freeze([need("administer projects", "organisation")]),
+  updateOrganisationRule: Object.freeze([need("administer projects", "organisation")]),
   createOrganisationRef: Object.freeze([need("administer projects", "organisation")]),
   listOrganisationRefs: Object.freeze([need("read", "organisation")]),
   deleteOrganisationRef: Object.freeze([need("administer projects", "organisation")]),
@@ -350,6 +410,8 @@ var ROUTE_DOCS = Object.freeze({
   updateObjectSet: doc("Renames a saved set or replaces its readable members at the expected revision. Members outside the caller's scope remain. A success raises the revision by one.", [...SCOPED, "stale-revision", "head-moved"]),
   deleteObjectSet: doc("Deletes a saved set and every member at the expected revision.", [...SCOPED, "stale-revision"]),
   health: doc("Answers whether the host is running.", PUBLIC),
+  webSignInStart: doc("Starts a confidential web sign-in with HTTP Basic authentication.", [...PUBLIC, "unauthenticated"]),
+  webRedeem: doc("Redeems only a web-purpose handoff with HTTP Basic authentication.", [...PUBLIC, "unauthenticated"]),
   signInStart: doc("Starts a sign-in with the identity provider and redirects the browser to it.", PUBLIC),
   signInCallback: doc("Receives the identity provider's answer and returns a one-time code for the client.", [...PUBLIC, "kind", "lifecycle", "invitation", "token-shape", "signature", "issuer", "audience", "expiry", "algorithm", "claims"]),
   redeem: doc("Exchanges a one-time sign-in code for the session's access and refresh tokens.", [...PUBLIC, "unauthenticated"]),
@@ -367,8 +429,13 @@ var ROUTE_DOCS = Object.freeze({
   decideConsent: doc("Approves or denies a pending authorization request.", SCOPED),
   listConnectedApps: doc("Lists the applications the caller has connected.", SIGNED_IN),
   revokeConnectedApp: doc("Disconnects an application: every grant the caller holds for it stops.", SCOPED),
-  stageAttachment: doc("Stages attachment bytes for the selected project and ref without writing an engineering row. Admits user, service, client and run-apply tokens.", [...ATTACHMENT_SCOPED, "unsupported-content", "too-large"]),
-  readAttachment: doc("Downloads the attachment held by an object's property at its stored type version. Admits user, service, client, run-explore and run-apply tokens.", [...ATTACHMENT_SCOPED, "organisation-not-ready", "branch-needs-schema-update", "not-an-attachment-property", "no-attachment", "attachment-unavailable"]),
+  readStepUpRequest: doc("Reads the person's pending request, body digest, secret-free summary and requesting actor facts. It explains human-mode duration and unknown-session classification. No organisation attachment is required.", [...SCOPED, "session-moved"]),
+  confirmStepUp: doc("Confirms the person's pending request from a live web session and answers an empty acknowledgement. Only the requesting actor's separate proof poll releases a proof.", [...SCOPED, "session-moved"]),
+  enterHumanMode: doc("Switches the presenting CLI session to human mode after one web confirmation. Already-human sessions return their current state without another write; web sessions are refused. CLI: openeng session human prints the confirm address, polls and retries once with unchanged bytes and key, then prints the stored state. Human mode lasts for this session; a new CLI sign-in starts in agent mode.", SIGNED_IN),
+  readSessionStatus: doc("Reads the presenting person's stored session channel, mode and sign-in time, without organisation attachment. CLI: openeng session status prints { channel, mode, issuedAt } under --json; it never reads a local mode.", SIGNED_IN),
+  readStepUpProof: doc("Polls as the requesting person session or run. Only that actor receives a confirmed live proof. Without an eligible confirmation it answers awaiting. No organisation attachment is required.", SIGNED_IN),
+  stageAttachment: doc("Stages attachment bytes for an existing object after its guard admits the caller on the selected ref. Admits person, service, app:client and agent:apply actors.", [...ATTACHMENT_SCOPED, "not-permitted", "frozen", "protected", "unsupported-content", "too-large"]),
+  readAttachment: doc("Downloads the attachment held by an object's property at its stored type version. Admits person, service, app:client, agent:explore and agent:apply actors.", [...ATTACHMENT_SCOPED, "organisation-not-ready", "branch-needs-schema-update", "not-an-attachment-property", "no-attachment", "attachment-unavailable"]),
   readObject: doc("Reads one object at a branch or baseline.", REF_READ),
   queryObjects: doc(`Runs a filtered, ordered, paged query over the objects of a branch or baseline, or pages the union, intersection or difference of two plain object-set descriptions on that ref. A top-level type filter {kind:"type",op:"in",values:["part","system"]} selects any of 1 to 100 published type keys and may be combined with a text filter; continuation binds to the entire selection. ${QUERY_PROJECT_SCOPE}`, [
     ...REF_READ,
@@ -385,7 +452,7 @@ var ROUTE_DOCS = Object.freeze({
   discoverVerbs: doc("Lists the verbs an object may be given.", REF_READ),
   readHistory: doc("Reads one object's history of changes.", [...REF_READ, "invalid-continuation", "stale-continuation", "malformed-history-request"]),
   mutate: doc('Creates, changes or deletes an object on the selected writable branch. A protected refusal means the change needs a branch and a merge. For a property update, `from` is the value the caller expects now; a mismatch is refused as `conflict`, and `{"absent": true}` clears the property.', [...OBJECT_WRITE, "plan-closed"]),
-  mutateBatch: doc('Applies a list of object and edge operations to a branch in one save, one commit and one audit record, or none of them: a refused operation refuses the whole batch and writes nothing. An edge may name an object created earlier in the same batch. A batch with more operations than the maximum is refused as invalid-request naming input.operations, before any write. For a property update, `from` is the value the caller expects now; a mismatch is refused as `conflict`, and `{"absent": true}` clears the property.', [...OBJECT_WRITE, "plan-closed"]),
+  mutateBatch: doc('Applies a list of object and edge operations in one save and commit, with one audit record. A batch with no change makes no commit; a refused batch writes no engineering data, but its refusal is audited. An edge may name an object created earlier in the same batch. A batch with more operations than the maximum is refused as invalid-request naming input.operations, before any write. For a property update, `from` is the value the caller expects now; a mismatch is refused as `conflict`, and `{"absent": true}` clears the property.', [...OBJECT_WRITE, "plan-closed"]),
   createConnection: doc("Creates a connection to an external source system for the signed-in person: its mirror project and its service identity. The connection commits whether or not its types could be drafted, and the answer says which.", [...SIGNED_IN, "not-permitted", "organisation-not-active", "connection-exists"]),
   listConnections: doc("Lists the connections whose mirror project the caller reads, each with its last run and whether the caller may start a run.", SIGNED_IN),
   setConnectionCredential: doc("Stores the credential the connection reads the source system with, after the source system accepts it, and answers the upstream account and the time it was stored. The credential is never answered.", [...SCOPED, "credential-not-valid"]),
@@ -422,14 +489,33 @@ var ROUTE_DOCS = Object.freeze({
     "lock-unavailable",
     "not-a-ref-head"
   ]),
-  merge: doc("Merges a reviewed head of a project branch or an organisation branch or baseline source into main, or into the writable branch the optional target names; absent target means main. For a proposal, send its reviewedHash as sourceHash. A successful merge into main completes every pending proposal in the project that reviewed that hash. Optional name is checked against the source branch's bound head and is refused stale-source when it differs.", [...REF_WRITE, "read-only-ref", "concurrent-change", "lock-unavailable", "not-a-ref-head", "stale-source"]),
+  merge: doc("Merges a reviewed head of a project branch or an organisation branch or baseline source into main, or into the writable branch the optional target names; absent target means main. For a proposal, send the source branch's current head as sourceHash. Success closes only that source ref's pending proposal for this target. Matching rules may require a proposal and current approvals unless bypassed; approvals-required carries approvals.counted and approvals.required for the subject project. A merge that changes rows a rule protects in another project the caller writes is refused protected, with protection naming the patterns. With no matching rule, writers of every affected project can merge, including Contributors. A merge names exactly one of name and source. name is checked against the source branch's bound head and is refused stale-source when it differs.", [
+    ...REF_WRITE,
+    "read-only-ref",
+    "concurrent-change",
+    "lock-unavailable",
+    "not-a-ref-head",
+    "stale-source",
+    "protected",
+    "proposal-required",
+    "approvals-required",
+    "token-kind-not-admitted"
+  ]),
   readMergeConflicts: doc("Reads conflicts for the source branch named in input.name, always comparing it with main. For each field, base is the common value before either side changed it, ours is main, and theirs is the source branch. If the merge targeted another branch, this read still compares with main and does not report that merge's conflicts.", REF_READ),
-  disposeRef: doc("Disposes a branch that is no longer wanted: a writer of the branch when no proposal on it is pending, otherwise a merger of the project.", [...WRITE, "concurrent-change", "lock-unavailable"]),
+  disposeRef: doc("Disposes a project branch. A writer can dispose when no matching rule restricts deletions and no proposal is pending, or when no rule matches even with a pending proposal. Otherwise the caller must bypass every matching rule. Success discards the pending proposal after the engine disposal. Merge and disposal admit people, services and client apps; agents and hosted apps are refused. Only drafts in projects the caller can read and write block disposal: the call is refused ref-has-drafts and lists each draft's object and holder; send deleteDrafts true to consent, and the disposal then removes the drafts you may write and keeps each in the draft trash for the people who saved it.", [
+    ...WRITE,
+    "concurrent-change",
+    "lock-unavailable",
+    "deletion-restricted",
+    "bypass-required",
+    "token-kind-not-admitted",
+    "ref-has-drafts"
+  ]),
   listProjects: doc("Lists every project the caller may read in the organisation the session is attached to, with its namespace.", SIGNED_IN),
-  listRefs: doc("Lists the branches of a project, each with its head: readable with a hash, withheld when the caller may not read the branch, or unread past the first 50 branches. Each row also carries a schema state as a convenience hint; the branch-needs-schema-update refusal on use remains the guard.", [...SCOPED, "organisation-not-ready"]),
+  listRefs: doc("Lists the branches of a project, each with its head: readable with a hash, withheld when the caller may not read the branch, or unread after the first 50 refs, including main (so at most 49 branch heads are read). Each row also carries a schema state as a convenience hint; the branch-needs-schema-update refusal on use remains the guard.", [...SCOPED, "organisation-not-ready"]),
   readCatalogue: doc("Reads the published catalogue of a project's namespace.", SCOPED),
   readPendingProposal: doc("Reads the proposal waiting for review on a branch, if any.", SCOPED),
-  submitProposal: doc("Submits a branch for review.", [...REF_READ, "proposal-open", "no-commits"]),
+  submitProposal: doc("Submits a branch for review. Optional target names main, a writable organisation ref or a project branch; it defaults to main. An apply run that names any ref other than its plan's is refused write-refused.", [...REF_READ, "proposal-open", "no-commits", "invalid-proposal-target"]),
   createServiceIdentity: doc("Creates a service identity in an organisation.", [...SIGNED_IN, "not-permitted", "capability-missing", "duplicate-name"]),
   revokeServiceIdentity: doc("Revokes a service identity.", [...SIGNED_IN, "not-permitted", "service_identity.revoke"]),
   issueServiceCredential: doc("Issues a credential for a service identity.", [...SIGNED_IN, "not-permitted", "capability-missing"]),
@@ -442,15 +528,24 @@ var ROUTE_DOCS = Object.freeze({
   readAccount: doc("Reads the caller's own principal identifier, display name and registered email.", SIGNED_IN),
   readDisplayNames: doc("Reads the display names of principals the caller may see.", SIGNED_IN),
   listMembers: doc("Lists the members of a project.", SCOPED),
-  changeMembershipRole: doc("Changes a principal's role in a scope.", [...SIGNED_IN, "not-permitted", "above-caller-role", "unknown-role", "last-administrator", "no-such-membership"]),
+  changeMembershipRole: doc("Changes a principal's role in a scope; missing membership administration answers `capability-missing`.", [...SIGNED_IN, "not-permitted", "above-caller-role", "unknown-role", "last-administrator", "no-such-membership"]),
   listOrganisationMembers: doc("Lists the memberships of the caller's organisation and of the projects of it the caller may read.", SCOPED),
-  searchPeople: doc("Finds the people of the caller's organisation whose name has a word starting with the query.", [...SIGNED_IN, "invalid-query"]),
+  searchPeople: doc("Finds people in the caller's organisation when every query word starts a word of their name.", [...SIGNED_IN, "invalid-query"]),
   searchObjectReaders: doc("Finds the people who can read an object on a branch or baseline, by a name prefix.", [...REF_READ, "invalid-query", "invalid-ref"]),
   listSubscribers: doc("Lists the subscriptions on an object.", REF_READ),
   addSubscriber: doc("Adds a person to an object's subscriptions as owner, approver or watcher, when the type's `subscriptionRoles` admits that role. The declaration may set maxima; owner is limited to one. With no declaration, only watchers are admitted.", [...REF_READ, "limit-reached", "role-not-admitted", "unknown-person", "not-permitted", "invalid-ref"]),
   removeSubscriber: doc("Removes a person's subscription to an object in a role.", [...REF_READ, "subscription-absent", "not-permitted", "invalid-ref"]),
   listComments: doc("Lists the comments on an object, oldest first, a page at a time.", [...REF_READ, "invalid-query"]),
-  addComment: doc("Adds a comment to an object, naming the people it mentions.", [...REF_WRITE, "invalid-body", "invalid-mention", "unknown-person", "invalid-ref"]),
+  acquireDraft: doc("Acquires the subject\u2019s draft and lock using the body and base hash read on the server from that object on the selected ref.", [...REF_WRITE, "ref-not-found", "frozen", "protected", "draft-locked", "body-not-declared"]),
+  saveDraft: doc("Saves draft blocks after comparing the current draft hash; the server mints an identifier for each added block and answers them in minted.", [...REF_WRITE, "ref-not-found", "frozen", "protected", "draft-lock-lost", "draft-changed", "unknown-block", "body-not-declared", "body-too-large"]),
+  promoteDraft: doc("Publishes a checked draft. A draft with no edits returns committed false and records no commit; a recovered promote returns committed true with the current head and makes no second save.", [...REF_WRITE, "ref-not-found", "frozen", "protected", "draft-lock-lost", "draft-not-flushed", "body-changed", "body-not-declared", "body-too-large"]),
+  releaseDraft: doc("Releases an unchanged draft.", [...REF_WRITE, "ref-not-found", "draft-lock-lost", "draft-changed"]),
+  discardDraft: doc("Discards the holder\u2019s draft.", [...REF_WRITE, "ref-not-found", "draft-lock-lost"]),
+  breakDraftLock: doc("Breaks a draft lock as a project administrator; person-only objects.draftAdmin capability.", [...REF_WRITE, "ref-not-found"]),
+  readDraftLock: doc("Reads only the holder name and lock expiry.", [...REF_READ, "ref-not-found"]),
+  restoreDraft: doc("Restores a saved draft onto a new branch using its saved body; person-only objects.draftAdmin capability.", [...REF_WRITE, "plan-closed", "ref-exists", "read-only-ref", "concurrent-change", "lock-unavailable", "ref-not-found", "frozen", "protected", "not-a-saver", "draft-locked", "draft-changed", "object-not-found", "body-not-declared"]),
+  setCommentResolved: doc("Resolves or reopens a comment.", WRITE),
+  addComment: doc("Adds a comment to an object, naming the people it mentions and optionally anchoring a quoted block.", [...REF_WRITE, "invalid-body", "invalid-mention", "unknown-person", "invalid-ref", "anchor-invalid"]),
   listServiceIdentities: doc("Lists the service identities of the caller's organisation, for a caller who administers them.", SCOPED),
   createInvitation: doc("Invites an address in an organisation role with up to 50 optional projectRoles, each a projectId and roleKey. Every project must belong to the invitation's organisation. The caller must administer members there and on each project. An unknown role answers unknown-role with the deployment's roleKeys; a known role above the caller's answers above-caller-role.", [
     ...SIGNED_IN,
@@ -472,7 +567,7 @@ var ROUTE_DOCS = Object.freeze({
   reissuePlatformInvitation: doc("Replaces the code and the expiry of a pending platform invitation and answers the new link, for a platform administrator.", [...SIGNED_IN, "capability-missing", "no-such-invitation", "invitation-not-pending"]),
   readWebOrigin: doc("Reads the origin of the deployment's web application, or null when the host is given none.", SIGNED_IN),
   readCallerCapabilities: doc("Lists the capabilities the caller holds in the token's organisation and its projects, and the platform capability for a platform administrator.", [...SIGNED_IN]),
-  queryGraph: doc(`Walks the edges from a start of addresses or an object set, and answers the objects reached with every hop among them. Example: one start address and one hop step of depth 1 reads that object's connections, with a marker for each kind of connection whose far object the caller cannot read. A start takes at most 200 addresses or set members; a walk takes at most 3 steps and 3 total levels. An explicit edgeTypeKeys list holds at most 8 edge types per step; when edgeTypeKeys is absent, the step traverses every edge type. objectLimit is at most 200 and hopLimit at most 400. A continuation reads the next page in the one-object form. For an object-set start, omitting input.start.set.projects reads every project the caller can read on the selected branch or baseline; selector.projectId does not narrow the set. To limit it to one project, include "projects":["<projectId>"] in input.start.set.`, [...REF_READ, "malformed-query", "over-bound", "text-search-unavailable", "search-too-wide", "invalid-continuation", "stale-continuation", "head-moved"]),
+  queryGraph: doc(`Walks the edges from a start of addresses or an object set, and answers the objects reached with every hop among them. Hops follow closeOver or the step's edge types, up to hopLimit. Example: one start address and one hop step of depth 1 reads that object's connections, with a marker for each kind of connection whose far object the caller cannot read. A start takes at most 200 addresses or set members; a walk takes at most 3 steps and 3 total levels. An explicit edgeTypeKeys list holds at most 8 edge types per step; when edgeTypeKeys is absent, the step traverses every edge type. objectLimit is at most 200 and hopLimit at most 400. A continuation reads the next page in the one-object form. For an object-set start, omitting input.start.set.projects reads every project the caller can read on the selected branch or baseline; selector.projectId does not narrow the set. To limit it to one project, include "projects":["<projectId>"] in input.start.set.`, [...REF_READ, "malformed-query", "over-bound", "text-search-unavailable", "search-too-wide", "invalid-continuation", "stale-continuation", "head-moved"]),
   readStructure: doc("Reads the structure of a type's objects as a tree: every root, one object's subtree or one object's ancestors, each placement an occurrence. Example: a forest anchor with maxDepth 1 reads its roots and their children. maxDepth is at most 32 and occurrenceLimit at most 2000. The answer reports whether it is complete or bounded, and a bounded answer says whether the limit was occurrences, depth or level rows; the route does not page. Narrow the walk with maxDepth and occurrenceLimit. A chosen relationship or one-step view places the type itself, and the types above it follow their own declared relationships.", [
     ...REF_READ,
     "malformed-query",
@@ -480,41 +575,44 @@ var ROUTE_DOCS = Object.freeze({
     "over-bound",
     "head-moved"
   ]),
-  findPaths: doc("Finds every shortest path between two objects within a length, answered as the hops each path follows.", [...REF_READ, "malformed-query", "over-bound", "head-moved"]),
+  findPaths: doc("Finds shortest paths between two objects within a length, up to maxPaths; the answer may be bounded.", [...REF_READ, "malformed-query", "over-bound", "head-moved"]),
   listProposals: doc("Lists the proposals of a project.", SCOPED),
   readProposal: doc("Reads one proposal.", SCOPED),
   refuseProposal: doc("Refuses a proposal and returns its branch to its author.", [...SCOPED, "proposal-not-pending"]),
-  readBranchDiff: doc("Reads the objects and edges a proposal's branch changes against its target.", REF_READ),
+  approveProposal: doc("Records the caller's approval of a pending proposal at the head hash the caller read; send that hash as headHash. Any person who reads the project and the proposal's target and is not an author may approve; a target the caller cannot read answers not-found. An approval counts toward a rule only while its hash is the branch's head and the approver holds the rule's approver role or is named on it.", [...SCOPED, "proposal-not-pending", "proposal-head-moved", "author-cannot-approve", "already-approved"]),
+  readBranchDiff: doc("Reads the objects and edges a proposal's branch changes against its target. While the proposal is pending the diff is taken at the branch's current head, and atHash names that head; a closed proposal reads at its reviewed head. A target the caller cannot read answers not-found.", REF_READ),
   readLinkStatus: doc("Reads an object's tracked links at a stable head: review (cleared, suspect, unreviewed, not-visible or too-many-links), clearing attribution, link bounds and aggregate bounds with units and coverage. Only a readable upstream supplies its opaque upstreamVersion, the precondition for clearing.", [...REF_READ, "head-moved"]),
-  clearLinks: doc("Clears 1 to 100 links atomically on the named ref. Send each linkId with the upstreamVersion from readLinkStatus as a precondition; upstream-changed requires a fresh read and review. Records the clearer and time without changing bounds. Admits user, run-apply, client and service; run-explore and run-types are refused at admission. An unknown outcome must be recovered by correlation before retrying.", [...OBJECT_WRITE, "upstream-changed", "upstream-not-readable", "too-many-links"]),
+  clearLinks: doc("Clears 1 to 100 links atomically on the named ref. Send each linkId with the upstreamVersion from readLinkStatus as a precondition; upstream-changed requires a fresh read and review. Records the clearer and time without changing bounds. Admits user, `agent:apply`, client and service; `agent:explore` and `agent:types` are refused at admission. An unknown outcome must be recovered by correlation before retrying.", [...OBJECT_WRITE, "upstream-changed", "upstream-not-readable", "too-many-links"]),
   readChangeImpact: doc("Reads review, link bounds and aggregate bounds state changes against the branch's merge base, plus downstream reach to depth three and hidden counts. Both ref and base are required. Includes added and removed states and pins both heads; over-bound and head-moved refuse the entire read without a partial answer.", [...REF_READ, "over-bound", "head-moved"]),
   diffBranches: doc("Reads the objects and edges one branch or baseline changes against another.", REF_READ),
   readBranchHistory: doc("Reads a branch's history of commits.", [...SCOPED, "invalid-continuation", "stale-continuation", "malformed-history-request"]),
   listAudit: doc("Lists the audit records of a project.", [...SCOPED, "invalid-continuation"]),
   listOrganisationAudit: doc("Lists the organisation-level actions the caller may read.", [...SCOPED, "invalid-continuation"]),
   readRefHead: doc("Reads the head of a branch or baseline.", REF_READ),
-  inspectBranchOperation: doc("Reads the state of a branch operation the caller started.", SCOPED),
+  inspectBranchOperation: doc("Reads any branch operation record the caller may read; only the caller that started it may settle it.", SCOPED),
   abandonBranch: doc("Refuses branch abandonment because this operation is not available in this release.", [
     ...WRITE,
     "not-in-this-release"
   ]),
-  addRefRule: doc("Adds a branch protection rule to the selected project and answers the full rule. Repeating the same pattern and consequence returns the existing rule, ignoring pattern letter case. Consequences are merge-only and locked-rows-only; an invalid pattern or consequence answers invalid-request naming that field.", SCOPED),
-  listRefRules: doc("Lists only the selected project's visible branch protection rules, including each rule's identifier, pattern and consequence.", SCOPED),
-  removeRefRule: doc("Removes a rule by identifier from the selected project and answers its ruleId. An absent or unreadable identifier, or one belonging to another project, answers not-found.", SCOPED),
-  addOrganisationRule: doc("Adds a branch protection rule in the attached organisation and answers the full rule. Repeating the same pattern and consequence returns the existing rule, ignoring pattern letter case. An invalid pattern or consequence answers invalid-request naming that field.", SCOPED),
-  listOrganisationRules: doc("Lists the attached organisation's visible branch rules, including identifier, pattern and consequence.", SCOPED),
-  removeOrganisationRule: doc("Removes a rule by identifier from the attached organisation and answers its ruleId. An absent, unreadable or project-rule identifier answers not-found.", SCOPED),
+  addRefRule: doc("Adds one of the selected project's rules with extent, pattern and settings, and answers the full rule. Extent is ref or rows; organisation rules take ref only. Settings include consequence (open, merge-only or locked-rows-only), requireProposal, requiredApprovals, approverMinRole, restrictDeletions, approvers and bypass. Omitted settings take the defaults. Only project ref rules may restrict deletions; approvals need a proposal and an approver. A repeated add returns the existing rule.", [...SCOPED, "invalid-rule-pattern", "invalid-rule-setting", "unknown-rule-member"]),
+  listRefRules: doc("Lists the selected project's visible rules with each identifier, extent and pattern, and every setting and member list.", SCOPED),
+  removeRefRule: doc("Removes one of the selected project's rules by identifier and answers its ruleId. An absent, unreadable or other owner's identifier answers not-found.", SCOPED),
+  updateRefRule: doc("Changes one of the selected project's rules in place and answers the full rule. Send ruleId and settings only. Omitted settings keep their values; supplied lists replace their members. A consequence already held by another rule on this pattern is refused duplicate-rule. Extent and pattern cannot change. Every update requires step-up confirmation in an agent-mode session. An absent, unreadable or other owner's identifier answers not-found.", [...SCOPED, "invalid-rule-setting", "unknown-rule-member", "duplicate-rule"]),
+  addOrganisationRule: doc("Adds one of the attached organisation's rules with extent, pattern and settings, and answers the full rule. Extent is ref or rows; organisation rules take ref only. Settings include consequence (open, merge-only or locked-rows-only), requireProposal, requiredApprovals, approverMinRole, restrictDeletions, approvers and bypass. Omitted settings take the defaults. Only project ref rules may restrict deletions; approvals need a proposal and an approver. A repeated add returns the existing rule.", [...SCOPED, "invalid-rule-pattern", "invalid-rule-setting", "unknown-rule-member"]),
+  listOrganisationRules: doc("Lists the attached organisation's visible rules with each identifier, extent and pattern, and every setting and member list; read on a project in the organisation is enough.", SCOPED),
+  removeOrganisationRule: doc("Removes one of the attached organisation's rules by identifier and answers its ruleId. An absent, unreadable or other owner's identifier answers not-found.", SCOPED),
+  updateOrganisationRule: doc("Changes one of the attached organisation's rules in place and answers the full rule. Send ruleId and settings only. Omitted settings keep their values; supplied lists replace their members. A consequence already held by another rule on this pattern is refused duplicate-rule. Extent and pattern cannot change. Every update requires step-up confirmation in an agent-mode session. An absent, unreadable or other owner's identifier answers not-found.", [...SCOPED, "invalid-rule-setting", "unknown-rule-member", "duplicate-rule"]),
   createOrganisationRef: doc("Creates a branch or baseline at the organisation's trunk head and answers its name, readOnly and creation attribution. The optional readOnly flag defaults to false; the name is one non-reserved name segment.", [...WRITE, "ref-exists", "read-only-ref", "organisation-not-ready"]),
-  listOrganisationRefs: doc("Lists visible branches and baselines in the attached organisation, including each name, readOnly and creation attribution.", SCOPED),
+  listOrganisationRefs: doc("Lists branches and baselines in the attached organisation, including each name, readOnly and creation attribution; read on a project in the organisation is enough.", SCOPED),
   deleteOrganisationRef: doc("Deletes a writable branch from the attached organisation and answers its name. A baseline cannot be deleted.", [...REF_WRITE, "read-only-ref"]),
-  markOrganisationRefReadOnly: doc("Marks an organisation branch read-only as a baseline and answers its full record. An absent or unreadable name answers not-found.", SCOPED),
+  markOrganisationRefReadOnly: doc("Marks an organisation branch read-only as a baseline and answers its full record. An absent name answers not-found; an unauthorised caller answers not-permitted.", SCOPED),
   setObjectLock: doc("Sets an object's lock on the selected project branch to none, merge-only or frozen and answers objectId and lock. The lock also applies to its existing structural child edges in that project; none lifts the lock. New children on a writable branch are not thereby frozen. Use a baseline for a fixed snapshot. An unknown lock answers invalid-request at lock.", [...REF_WRITE, "read-only-ref", "concurrent-change", "lock-unavailable"]),
   readAgentCeiling: doc("Reads the selected project's maximum agent role as { ceiling }: contributor or maintainer. An absent or unreadable project answers not-found.", SCOPED),
   setAgentCeiling: doc("Sets the selected project's maximum agent role to contributor or maintainer and answers { ceiling }. An unknown role answers invalid-request at ceiling.", SCOPED),
-  requestSchemaUpdate: doc("Records a schema update request for a project branch or organisation branch or baseline and answers its state and attribution. Execution is separate. A branch whose name contains a slash cannot request a schema update today. The trunk main answers invalid-request at `ref`; an unreachable branch or baseline answers not-found.", SCOPED),
-  readSchemaUpdateRequest: doc("Reads the caller's latest schema update request for the branch or baseline in the token's organisation, or null. Project read access is not required. A branch whose name contains a slash cannot read its request today. The trunk main answers invalid-request at `ref`.", SCOPED),
+  requestSchemaUpdate: doc("Records a schema update request for a project branch or organisation branch or baseline and answers its state and attribution. Project refs use `<projectId>/<branch>` with a one-segment branch name; the request may name a branch that does not exist. Organisation refs use one segment. The trunk `main` answers invalid-request at `ref`. Execution is separate.", SCOPED),
+  readSchemaUpdateRequest: doc("Reads the caller's latest schema update request for the branch or baseline in the token's organisation, or null. Project read access is not required. Project refs use `<projectId>/<branch>` with a one-segment branch name; organisation refs use one segment. The trunk `main` answers invalid-request at `ref`.", SCOPED),
   openAgentSession: doc("Opens an agent session on a project.", [...SCOPED, "invalid-configuration"]),
-  listAgentSessions: doc("Lists the caller's agent sessions on a project.", SCOPED),
+  listAgentSessions: doc("Lists every session of the selected agent in the project.", SCOPED),
   readAgentSession: doc("Reads one agent session and its runs.", SCOPED),
   sendMessage: doc("Sends a message to an agent session and starts a run.", [...SCOPED, "run-in-flight", "invalid-configuration", "model-not-configured"]),
   answerPlan: doc("Answers the plan a run proposed.", [...SCOPED, "plan-not-proposed", "plan-answered", "plan-superseded", "plan-closed"]),
@@ -592,6 +690,8 @@ var SCHEMAS = {
   updateObjectSet: { "type": "object", "properties": { "setId": { "type": "string" }, "revision": { "type": "number" }, "name": { "type": "string" }, "members": { "type": "array", "items": { "type": "object", "properties": { "objectId": { "type": "string" }, "projectId": { "type": "string" } }, "required": ["objectId", "projectId"], "additionalProperties": false } } }, "required": ["setId", "revision"], "additionalProperties": false },
   deleteObjectSet: { "type": "object", "properties": { "setId": { "type": "string" }, "revision": { "type": "number" } }, "required": ["setId", "revision"], "additionalProperties": false },
   health: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
+  webSignInStart: { "type": "object", "properties": { "state": { "type": "string" }, "loopback": { "type": "string" }, "code_challenge": { "type": "string" }, "code_challenge_method": { "const": "S256" } }, "required": ["state", "loopback", "code_challenge", "code_challenge_method"], "additionalProperties": false },
+  webRedeem: { "type": "object", "properties": { "code": { "type": "string" }, "state": { "type": "string" }, "code_verifier": { "type": "string" }, "invitation_code": { "type": "string" } }, "required": ["code", "state", "code_verifier"], "additionalProperties": false },
   signInStart: { "type": "object", "properties": { "state": { "type": "string" }, "loopback": { "type": "string" }, "code_challenge": { "type": "string" }, "code_challenge_method": { "const": "S256" } }, "required": ["state", "loopback", "code_challenge", "code_challenge_method"], "additionalProperties": false },
   signInCallback: { "oneOf": [{ "type": "object", "properties": { "state": { "type": "string" }, "code": { "type": "string" } }, "required": ["state", "code"], "additionalProperties": false }, { "type": "object", "properties": { "state": { "type": "string" }, "error": { "type": "string" } }, "required": ["state", "error"], "additionalProperties": false }] },
   redeem: { "type": "object", "properties": { "code": { "type": "string" }, "state": { "type": "string" }, "code_verifier": { "type": "string" }, "invitation_code": { "type": "string" } }, "required": ["code", "state", "code_verifier"], "additionalProperties": false },
@@ -609,6 +709,11 @@ var SCHEMAS = {
   decideConsent: { "oneOf": [{ "type": "object", "properties": { "interactionId": { "type": "string" }, "decision": { "const": "approve" }, "approvedScopes": { "type": "array", "items": { "enum": ["objects.read", "objects.write", "branches.read", "branches.write", "branches.manage", "offline_access"] } } }, "required": ["interactionId", "decision", "approvedScopes"], "additionalProperties": false }, { "type": "object", "properties": { "interactionId": { "type": "string" }, "decision": { "const": "deny" } }, "required": ["interactionId", "decision"], "additionalProperties": false }] },
   listConnectedApps: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   revokeConnectedApp: { "type": "object", "properties": { "clientId": { "type": "string" } }, "required": ["clientId"], "additionalProperties": false },
+  readStepUpRequest: { "type": "object", "properties": { "pendingId": { "type": "string" } }, "required": ["pendingId"], "additionalProperties": false },
+  confirmStepUp: { "type": "object", "properties": { "pendingId": { "type": "string" } }, "required": ["pendingId"], "additionalProperties": false },
+  enterHumanMode: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
+  readSessionStatus: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
+  readStepUpProof: { "type": "object", "properties": { "pendingId": { "type": "string" } }, "required": ["pendingId"], "additionalProperties": false },
   readAttachment: {
     "type": "object",
     "properties": {
@@ -639,12 +744,12 @@ var SCHEMAS = {
   createBranch: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "name": { "type": "string" }, "from": { "oneOf": [{ "type": "object", "properties": { "ref": { "type": "string" } }, "required": ["ref"], "additionalProperties": false }, { "type": "object", "properties": { "hash": { "type": "string" } }, "required": ["hash"], "additionalProperties": false }] } }, "required": ["correlation", "name"], "additionalProperties": false },
   merge: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "sourceHash": { "type": "string" }, "message": { "type": "string" }, "name": { "type": "string" }, "source": { "type": "string" }, "target": { "type": "string" } }, "required": ["correlation", "sourceHash", "message"], "additionalProperties": false },
   readMergeConflicts: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
-  disposeRef: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "name": { "type": "string" }, "atHash": { "type": "string" } }, "required": ["correlation", "name", "atHash"], "additionalProperties": false },
+  disposeRef: { "type": "object", "properties": { "deleteDrafts": { "type": "boolean" }, "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "name": { "type": "string" }, "atHash": { "type": "string" } }, "required": ["correlation", "name", "atHash"], "additionalProperties": false },
   listProjects: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   listRefs: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   readCatalogue: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   readPendingProposal: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
-  submitProposal: { "type": "object", "properties": { "name": { "type": "string" }, "title": { "type": "string" }, "summary": { "type": "string" } }, "required": ["name", "title", "summary"], "additionalProperties": false },
+  submitProposal: { "type": "object", "properties": { "name": { "type": "string" }, "title": { "type": "string" }, "summary": { "type": "string" }, "target": { "type": "string" } }, "required": ["name", "title", "summary"], "additionalProperties": false },
   createServiceIdentity: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
   revokeServiceIdentity: { "type": "object", "properties": { "principalId": { "type": "string" } }, "required": ["principalId"], "additionalProperties": false },
   issueServiceCredential: { "type": "object", "properties": { "principalId": { "type": "string" } }, "required": ["principalId"], "additionalProperties": false },
@@ -678,6 +783,7 @@ var SCHEMAS = {
   listProposals: { "type": "object", "properties": { "state": { "enum": ["pending", "merged", "refused", "discarded", "all"] }, "cursor": { "type": "string" } }, "required": ["state"], "additionalProperties": false },
   readProposal: { "type": "object", "properties": { "proposalId": { "type": "string" } }, "required": ["proposalId"], "additionalProperties": false },
   refuseProposal: { "type": "object", "properties": { "proposalId": { "type": "string" }, "reason": { "type": "string" } }, "required": ["proposalId", "reason"], "additionalProperties": false },
+  approveProposal: { "type": "object", "properties": { "proposalId": { "type": "string" }, "headHash": { "type": "string" } }, "required": ["proposalId", "headHash"], "additionalProperties": false },
   readBranchDiff: { "type": "object", "properties": { "proposalId": { "type": "string" }, "cursor": { "type": "string" } }, "required": ["proposalId"], "additionalProperties": false },
   readLinkStatus: { "type": "object", "properties": { "objectId": { "type": "string" } }, "required": ["objectId"], "additionalProperties": false },
   clearLinks: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "ref": { "type": "string" }, "entries": { "type": "array", "items": { "type": "object", "properties": { "linkId": { "type": "string" }, "upstreamVersion": { "type": "string" } }, "required": ["linkId", "upstreamVersion"], "additionalProperties": false }, "minItems": 1, "maxItems": 100 } }, "required": ["correlation", "ref", "entries"], "additionalProperties": false },
@@ -689,12 +795,14 @@ var SCHEMAS = {
   readRefHead: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
   inspectBranchOperation: { "type": "object", "properties": { "correlationId": { "type": "string" } }, "required": ["correlationId"], "additionalProperties": false },
   abandonBranch: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "name": { "type": "string" }, "atHash": { "type": "string" } }, "required": ["correlation", "name", "atHash"], "additionalProperties": false },
-  addRefRule: { "type": "object", "properties": { "pattern": { "type": "string" }, "consequence": { "enum": ["merge-only", "locked-rows-only"] } }, "required": ["pattern", "consequence"], "additionalProperties": false },
+  addRefRule: { "type": "object", "properties": { "extent": { "enum": ["ref", "rows"] }, "pattern": { "type": "string" }, "settings": { "type": "object", "properties": { "consequence": { "enum": ["open", "merge-only", "locked-rows-only"] }, "requireProposal": { "type": "boolean" }, "requiredApprovals": { "type": "number" }, "approverMinRole": { "oneOf": [{ "const": "contributor" }, { "const": "maintainer" }, { "const": "owner" }, { "type": "null" }] }, "restrictDeletions": { "type": "boolean" }, "approvers": { "type": "array", "items": { "type": "string" } }, "bypass": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "role" }, "roleKey": { "enum": ["contributor", "maintainer", "owner"] } }, "required": ["kind", "roleKey"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "person" }, "personId": { "type": "string" } }, "required": ["kind", "personId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "service" }, "serviceIdentityId": { "type": "string" } }, "required": ["kind", "serviceIdentityId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "client" }, "clientId": { "type": "string" } }, "required": ["kind", "clientId"], "additionalProperties": false }] } } }, "required": [], "additionalProperties": false } }, "required": ["extent", "pattern"], "additionalProperties": false },
   listRefRules: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   removeRefRule: { "type": "object", "properties": { "ruleId": { "type": "string" } }, "required": ["ruleId"], "additionalProperties": false },
-  addOrganisationRule: { "type": "object", "properties": { "pattern": { "type": "string" }, "consequence": { "enum": ["merge-only", "locked-rows-only"] } }, "required": ["pattern", "consequence"], "additionalProperties": false },
+  updateRefRule: { "type": "object", "properties": { "ruleId": { "type": "string" }, "settings": { "type": "object", "properties": { "consequence": { "enum": ["open", "merge-only", "locked-rows-only"] }, "requireProposal": { "type": "boolean" }, "requiredApprovals": { "type": "number" }, "approverMinRole": { "oneOf": [{ "const": "contributor" }, { "const": "maintainer" }, { "const": "owner" }, { "type": "null" }] }, "restrictDeletions": { "type": "boolean" }, "approvers": { "type": "array", "items": { "type": "string" } }, "bypass": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "role" }, "roleKey": { "enum": ["contributor", "maintainer", "owner"] } }, "required": ["kind", "roleKey"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "person" }, "personId": { "type": "string" } }, "required": ["kind", "personId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "service" }, "serviceIdentityId": { "type": "string" } }, "required": ["kind", "serviceIdentityId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "client" }, "clientId": { "type": "string" } }, "required": ["kind", "clientId"], "additionalProperties": false }] } } }, "required": [], "additionalProperties": false } }, "required": ["ruleId", "settings"], "additionalProperties": false },
+  addOrganisationRule: { "type": "object", "properties": { "extent": { "enum": ["ref", "rows"] }, "pattern": { "type": "string" }, "settings": { "type": "object", "properties": { "consequence": { "enum": ["open", "merge-only", "locked-rows-only"] }, "requireProposal": { "type": "boolean" }, "requiredApprovals": { "type": "number" }, "approverMinRole": { "oneOf": [{ "const": "contributor" }, { "const": "maintainer" }, { "const": "owner" }, { "type": "null" }] }, "restrictDeletions": { "type": "boolean" }, "approvers": { "type": "array", "items": { "type": "string" } }, "bypass": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "role" }, "roleKey": { "enum": ["contributor", "maintainer", "owner"] } }, "required": ["kind", "roleKey"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "person" }, "personId": { "type": "string" } }, "required": ["kind", "personId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "service" }, "serviceIdentityId": { "type": "string" } }, "required": ["kind", "serviceIdentityId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "client" }, "clientId": { "type": "string" } }, "required": ["kind", "clientId"], "additionalProperties": false }] } } }, "required": [], "additionalProperties": false } }, "required": ["extent", "pattern"], "additionalProperties": false },
   listOrganisationRules: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   removeOrganisationRule: { "type": "object", "properties": { "ruleId": { "type": "string" } }, "required": ["ruleId"], "additionalProperties": false },
+  updateOrganisationRule: { "type": "object", "properties": { "ruleId": { "type": "string" }, "settings": { "type": "object", "properties": { "consequence": { "enum": ["open", "merge-only", "locked-rows-only"] }, "requireProposal": { "type": "boolean" }, "requiredApprovals": { "type": "number" }, "approverMinRole": { "oneOf": [{ "const": "contributor" }, { "const": "maintainer" }, { "const": "owner" }, { "type": "null" }] }, "restrictDeletions": { "type": "boolean" }, "approvers": { "type": "array", "items": { "type": "string" } }, "bypass": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "role" }, "roleKey": { "enum": ["contributor", "maintainer", "owner"] } }, "required": ["kind", "roleKey"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "person" }, "personId": { "type": "string" } }, "required": ["kind", "personId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "service" }, "serviceIdentityId": { "type": "string" } }, "required": ["kind", "serviceIdentityId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "client" }, "clientId": { "type": "string" } }, "required": ["kind", "clientId"], "additionalProperties": false }] } } }, "required": [], "additionalProperties": false } }, "required": ["ruleId", "settings"], "additionalProperties": false },
   createOrganisationRef: { "type": "object", "properties": { "name": { "type": "string" }, "readOnly": { "type": "boolean" } }, "required": ["name"], "additionalProperties": false },
   listOrganisationRefs: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   deleteOrganisationRef: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
@@ -719,7 +827,7 @@ var SCHEMAS = {
   readCurrentChangeSet: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   readChangeSet: { "type": "object", "properties": { "changeSetId": { "type": "string" } }, "required": ["changeSetId"], "additionalProperties": false },
   readChangeSetState: { "type": "object", "properties": { "changeSetId": { "type": "string" } }, "required": ["changeSetId"], "additionalProperties": false },
-  reviseChangeSet: { "type": "object", "properties": { "changeSetId": { "type": "string" }, "expectedRevision": { "type": "string" }, "changes": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "object", "properties": { "typeCategory": { "const": "object" }, "typeKey": { "type": "string" }, "version": { "type": "number" }, "displayName": { "type": "string" }, "description": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "schemaLanguageVersion": { "type": "string" }, "propertyDefinitions": { "type": "object", "additionalProperties": {} }, "requiredPropertyKeys": { "type": "array", "items": { "type": "string" } }, "presentationBindings": { "type": "object", "properties": { "views": { "type": "object", "properties": { "object": { "type": "object", "properties": { "root": { "type": "string" }, "elements": { "type": "object", "additionalProperties": { "type": "object", "properties": { "type": { "type": "string" }, "props": { "type": "object", "additionalProperties": {} }, "children": { "type": "array", "items": { "type": "string" } }, "repeat": { "type": "object", "properties": { "statePath": { "type": "string" }, "key": { "type": "string" } }, "required": ["statePath"], "additionalProperties": false }, "on": { "type": "object", "properties": { "press": { "oneOf": [{ "type": "object", "properties": { "action": { "const": "set-properties" }, "params": { "type": "object", "properties": { "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "object", "properties": { "$state": { "type": "string" } }, "required": ["$state"], "additionalProperties": false }] } } }, "required": ["properties"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }, { "type": "object", "properties": { "action": { "const": "run-verb" }, "params": { "type": "object", "properties": { "verb": { "type": "string" } }, "required": ["verb"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }] } }, "required": ["press"], "additionalProperties": false } }, "required": ["type", "props", "children"], "additionalProperties": false } } }, "required": ["root", "elements"], "additionalProperties": false }, "app": { "type": "object", "properties": { "root": { "type": "string" }, "elements": { "type": "object", "additionalProperties": { "type": "object", "properties": { "type": { "type": "string" }, "props": { "type": "object", "additionalProperties": {} }, "children": { "type": "array", "items": { "type": "string" } }, "repeat": { "type": "object", "properties": { "statePath": { "type": "string" }, "key": { "type": "string" } }, "required": ["statePath"], "additionalProperties": false }, "on": { "type": "object", "properties": { "press": { "oneOf": [{ "type": "object", "properties": { "action": { "const": "set-properties" }, "params": { "type": "object", "properties": { "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "object", "properties": { "$state": { "type": "string" } }, "required": ["$state"], "additionalProperties": false }] } } }, "required": ["properties"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }, { "type": "object", "properties": { "action": { "const": "run-verb" }, "params": { "type": "object", "properties": { "verb": { "type": "string" } }, "required": ["verb"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }] } }, "required": ["press"], "additionalProperties": false } }, "required": ["type", "props", "children"], "additionalProperties": false } } }, "required": ["root", "elements"], "additionalProperties": false }, "card": { "type": "object", "properties": { "root": { "type": "string" }, "elements": { "type": "object", "additionalProperties": { "type": "object", "properties": { "type": { "type": "string" }, "props": { "type": "object", "additionalProperties": {} }, "children": { "type": "array", "items": { "type": "string" } }, "repeat": { "type": "object", "properties": { "statePath": { "type": "string" }, "key": { "type": "string" } }, "required": ["statePath"], "additionalProperties": false }, "on": { "type": "object", "properties": { "press": { "oneOf": [{ "type": "object", "properties": { "action": { "const": "set-properties" }, "params": { "type": "object", "properties": { "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "object", "properties": { "$state": { "type": "string" } }, "required": ["$state"], "additionalProperties": false }] } } }, "required": ["properties"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }, { "type": "object", "properties": { "action": { "const": "run-verb" }, "params": { "type": "object", "properties": { "verb": { "type": "string" } }, "required": ["verb"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }] } }, "required": ["press"], "additionalProperties": false } }, "required": ["type", "props", "children"], "additionalProperties": false } } }, "required": ["root", "elements"], "additionalProperties": false } }, "required": [], "additionalProperties": false }, "title": { "type": "string" }, "summary": { "type": "string" }, "icon": { "type": "string" }, "typeIcon": { "type": "string" }, "propertyLabels": { "type": "object", "additionalProperties": { "type": "string" } }, "propertyOrder": { "type": "array", "items": { "type": "string" } }, "rail": { "type": "object", "properties": { "group": { "type": "string" }, "order": { "type": "number" } }, "required": ["group", "order"], "additionalProperties": false } }, "required": [], "additionalProperties": false }, "structureDeclaration": { "type": "object", "properties": { "relationships": { "type": "array", "items": { "type": "string" } }, "views": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "label": { "type": "string" }, "steps": { "type": "array", "items": { "type": "string" } }, "decoration": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "label": { "type": "string" } }, "required": ["key", "label"], "additionalProperties": false } } }, "required": ["key", "label", "steps"], "additionalProperties": false } } }, "required": [], "additionalProperties": false }, "subscriptionRoles": { "type": "object", "properties": { "owner": { "type": "object", "properties": { "max": { "type": "number" } }, "required": [], "additionalProperties": false }, "approver": { "type": "object", "properties": { "max": { "type": "number" } }, "required": [], "additionalProperties": false }, "watcher": { "type": "object", "properties": { "max": { "type": "number" } }, "required": [], "additionalProperties": false } }, "required": [], "additionalProperties": false } }, "required": ["typeCategory", "typeKey", "version", "displayName", "description", "schemaLanguageVersion", "propertyDefinitions", "requiredPropertyKeys"], "additionalProperties": false }, { "type": "object", "properties": { "typeCategory": { "const": "edge" }, "typeKey": { "type": "string" }, "version": { "type": "number" }, "displayName": { "type": "string" }, "sourceObjectType": { "type": "string" }, "targetObjectType": { "type": "string" }, "kind": { "enum": ["structural", "traceability"] }, "subjectEnd": { "enum": ["source", "target"] }, "parentEnd": { "oneOf": [{ "const": "source" }, { "const": "target" }, { "type": "null" }] }, "sourceLabel": { "type": "string" }, "targetLabel": { "type": "string" }, "schemaLanguageVersion": { "type": "string" }, "propertyDefinitions": { "type": "object", "additionalProperties": {} }, "requiredPropertyKeys": { "type": "array", "items": { "type": "string" } }, "readRule": { "enum": ["both-endpoints", "either-endpoint"] }, "writeRule": { "enum": ["both-endpoints", "either-endpoint"] }, "review": { "type": "object", "properties": { "upstream": { "enum": ["source", "target"] }, "significant": { "type": "array", "items": { "type": "string" } }, "newLinks": { "enum": ["cleared", "unreviewed"] }, "propagation": { "enum": ["direct", "chain"] }, "chainDepth": { "type": "number" } }, "required": ["upstream"], "additionalProperties": false } }, "required": ["typeCategory", "typeKey", "version", "displayName", "sourceObjectType", "targetObjectType", "kind", "subjectEnd", "parentEnd", "sourceLabel", "targetLabel", "schemaLanguageVersion", "propertyDefinitions", "requiredPropertyKeys", "readRule", "writeRule"], "additionalProperties": false }, { "type": "object", "properties": { "typeCategory": { "const": "verb" }, "typeKey": { "type": "string" }, "version": { "type": "number" }, "displayName": { "type": "string" }, "description": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "allowedSubjectTypes": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "none" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "types" }, "types": { "type": "array", "items": { "type": "string" } } }, "required": ["kind", "types"], "additionalProperties": false }] }, "inputSchema": {}, "resultSchema": {}, "handlerKey": { "type": "string" }, "template": { "type": "object", "properties": { "query": { "type": "object", "properties": { "typeKey": { "type": "string" }, "filters": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "property" }, "property": { "type": "string" }, "op": { "enum": ["=", ">", ">=", "<", "<="] }, "value": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }] } }, "required": ["kind", "property", "op", "value"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "property" }, "property": { "type": "string" }, "op": { "const": "in" }, "values": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }] } } }, "required": ["kind", "property", "op", "values"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "text" }, "term": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }] }, "properties": { "type": "array", "items": { "type": "string" } } }, "required": ["kind", "term"], "additionalProperties": false }] } }, "sort": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "property" }, "property": { "type": "string" }, "direction": { "enum": ["asc", "desc"] } }, "required": ["kind", "property", "direction"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "identity" }, "direction": { "enum": ["asc", "desc"] } }, "required": ["kind", "direction"], "additionalProperties": false }] }, "limit": { "type": "number" } }, "required": ["typeKey", "limit"], "additionalProperties": false }, "operations": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "create-object" }, "typeKey": { "type": "string" }, "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } } }, "required": ["kind", "typeKey", "properties"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "update-object" }, "typeKey": { "type": "string" }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] }, "changes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "from": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "absent" } }, "required": ["slot"], "additionalProperties": false }] }, "to": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "absent" } }, "required": ["slot"], "additionalProperties": false }] } }, "required": ["from", "to"], "additionalProperties": false } } }, "required": ["kind", "typeKey", "target", "changes"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "delete-object" }, "typeKey": { "type": "string" }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } }, "required": ["kind", "typeKey", "target"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "create-edge" }, "typeKey": { "type": "string" }, "source": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] }, "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } } }, "required": ["kind", "typeKey", "source", "target", "properties"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "delete-edge" }, "typeKey": { "type": "string" }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } }, "required": ["kind", "typeKey", "target"], "additionalProperties": false }] } } }, "required": ["operations"], "additionalProperties": false }, "schemaLanguageVersion": { "type": "string" } }, "required": ["typeCategory", "typeKey", "version", "displayName", "description", "allowedSubjectTypes", "inputSchema", "resultSchema", "schemaLanguageVersion"], "additionalProperties": false }] } }, "railGroups": { "type": "array", "items": { "type": "string" } } }, "required": ["changeSetId", "expectedRevision", "changes"], "additionalProperties": false },
+  reviseChangeSet: { "type": "object", "properties": { "changeSetId": { "type": "string" }, "expectedRevision": { "type": "string" }, "changes": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "object", "properties": { "typeCategory": { "const": "object" }, "typeKey": { "type": "string" }, "version": { "type": "number" }, "displayName": { "type": "string" }, "description": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "schemaLanguageVersion": { "type": "string" }, "propertyDefinitions": { "type": "object", "additionalProperties": {} }, "requiredPropertyKeys": { "type": "array", "items": { "type": "string" } }, "presentationBindings": { "type": "object", "properties": { "views": { "type": "object", "properties": { "object": { "type": "object", "properties": { "root": { "type": "string" }, "elements": { "type": "object", "additionalProperties": { "type": "object", "properties": { "type": { "type": "string" }, "props": { "type": "object", "additionalProperties": {} }, "children": { "type": "array", "items": { "type": "string" } }, "repeat": { "type": "object", "properties": { "statePath": { "type": "string" }, "key": { "type": "string" } }, "required": ["statePath"], "additionalProperties": false }, "on": { "type": "object", "properties": { "press": { "oneOf": [{ "type": "object", "properties": { "action": { "const": "set-properties" }, "params": { "type": "object", "properties": { "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "object", "properties": { "$state": { "type": "string" } }, "required": ["$state"], "additionalProperties": false }] } } }, "required": ["properties"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }, { "type": "object", "properties": { "action": { "const": "run-verb" }, "params": { "type": "object", "properties": { "verb": { "type": "string" } }, "required": ["verb"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }] } }, "required": ["press"], "additionalProperties": false } }, "required": ["type", "props", "children"], "additionalProperties": false } } }, "required": ["root", "elements"], "additionalProperties": false }, "app": { "type": "object", "properties": { "root": { "type": "string" }, "elements": { "type": "object", "additionalProperties": { "type": "object", "properties": { "type": { "type": "string" }, "props": { "type": "object", "additionalProperties": {} }, "children": { "type": "array", "items": { "type": "string" } }, "repeat": { "type": "object", "properties": { "statePath": { "type": "string" }, "key": { "type": "string" } }, "required": ["statePath"], "additionalProperties": false }, "on": { "type": "object", "properties": { "press": { "oneOf": [{ "type": "object", "properties": { "action": { "const": "set-properties" }, "params": { "type": "object", "properties": { "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "object", "properties": { "$state": { "type": "string" } }, "required": ["$state"], "additionalProperties": false }] } } }, "required": ["properties"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }, { "type": "object", "properties": { "action": { "const": "run-verb" }, "params": { "type": "object", "properties": { "verb": { "type": "string" } }, "required": ["verb"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }] } }, "required": ["press"], "additionalProperties": false } }, "required": ["type", "props", "children"], "additionalProperties": false } } }, "required": ["root", "elements"], "additionalProperties": false }, "card": { "type": "object", "properties": { "root": { "type": "string" }, "elements": { "type": "object", "additionalProperties": { "type": "object", "properties": { "type": { "type": "string" }, "props": { "type": "object", "additionalProperties": {} }, "children": { "type": "array", "items": { "type": "string" } }, "repeat": { "type": "object", "properties": { "statePath": { "type": "string" }, "key": { "type": "string" } }, "required": ["statePath"], "additionalProperties": false }, "on": { "type": "object", "properties": { "press": { "oneOf": [{ "type": "object", "properties": { "action": { "const": "set-properties" }, "params": { "type": "object", "properties": { "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "object", "properties": { "$state": { "type": "string" } }, "required": ["$state"], "additionalProperties": false }] } } }, "required": ["properties"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }, { "type": "object", "properties": { "action": { "const": "run-verb" }, "params": { "type": "object", "properties": { "verb": { "type": "string" } }, "required": ["verb"], "additionalProperties": false } }, "required": ["action", "params"], "additionalProperties": false }] } }, "required": ["press"], "additionalProperties": false } }, "required": ["type", "props", "children"], "additionalProperties": false } } }, "required": ["root", "elements"], "additionalProperties": false } }, "required": [], "additionalProperties": false }, "title": { "type": "string" }, "summary": { "type": "string" }, "icon": { "type": "string" }, "typeIcon": { "type": "string" }, "propertyLabels": { "type": "object", "additionalProperties": { "type": "string" } }, "propertyOrder": { "type": "array", "items": { "type": "string" } }, "rail": { "type": "object", "properties": { "group": { "type": "string" }, "order": { "type": "number" } }, "required": ["group", "order"], "additionalProperties": false } }, "required": [], "additionalProperties": false }, "structureDeclaration": { "type": "object", "properties": { "relationships": { "type": "array", "items": { "type": "string" } }, "views": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "label": { "type": "string" }, "steps": { "type": "array", "items": { "type": "string" } }, "decoration": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "label": { "type": "string" } }, "required": ["key", "label"], "additionalProperties": false } } }, "required": ["key", "label", "steps"], "additionalProperties": false } } }, "required": [], "additionalProperties": false }, "bodyFormat": { "const": "markdown" }, "subscriptionRoles": { "type": "object", "properties": { "owner": { "type": "object", "properties": { "max": { "type": "number" } }, "required": [], "additionalProperties": false }, "approver": { "type": "object", "properties": { "max": { "type": "number" } }, "required": [], "additionalProperties": false }, "watcher": { "type": "object", "properties": { "max": { "type": "number" } }, "required": [], "additionalProperties": false } }, "required": [], "additionalProperties": false } }, "required": ["typeCategory", "typeKey", "version", "displayName", "description", "schemaLanguageVersion", "propertyDefinitions", "requiredPropertyKeys"], "additionalProperties": false }, { "type": "object", "properties": { "typeCategory": { "const": "edge" }, "typeKey": { "type": "string" }, "version": { "type": "number" }, "displayName": { "type": "string" }, "sourceObjectType": { "type": "string" }, "targetObjectType": { "type": "string" }, "kind": { "enum": ["structural", "traceability"] }, "subjectEnd": { "enum": ["source", "target"] }, "parentEnd": { "oneOf": [{ "const": "source" }, { "const": "target" }, { "type": "null" }] }, "sourceLabel": { "type": "string" }, "targetLabel": { "type": "string" }, "schemaLanguageVersion": { "type": "string" }, "propertyDefinitions": { "type": "object", "additionalProperties": {} }, "requiredPropertyKeys": { "type": "array", "items": { "type": "string" } }, "readRule": { "enum": ["both-endpoints", "either-endpoint"] }, "writeRule": { "enum": ["both-endpoints", "either-endpoint"] }, "review": { "type": "object", "properties": { "upstream": { "enum": ["source", "target"] }, "significant": { "type": "array", "items": { "type": "string" } }, "newLinks": { "enum": ["cleared", "unreviewed"] }, "propagation": { "enum": ["direct", "chain"] }, "chainDepth": { "type": "number" } }, "required": ["upstream"], "additionalProperties": false } }, "required": ["typeCategory", "typeKey", "version", "displayName", "sourceObjectType", "targetObjectType", "kind", "subjectEnd", "parentEnd", "sourceLabel", "targetLabel", "schemaLanguageVersion", "propertyDefinitions", "requiredPropertyKeys", "readRule", "writeRule"], "additionalProperties": false }, { "type": "object", "properties": { "typeCategory": { "const": "verb" }, "typeKey": { "type": "string" }, "version": { "type": "number" }, "displayName": { "type": "string" }, "description": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "allowedSubjectTypes": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "none" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "types" }, "types": { "type": "array", "items": { "type": "string" } } }, "required": ["kind", "types"], "additionalProperties": false }] }, "inputSchema": {}, "resultSchema": {}, "handlerKey": { "type": "string" }, "template": { "type": "object", "properties": { "query": { "type": "object", "properties": { "typeKey": { "type": "string" }, "filters": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "property" }, "property": { "type": "string" }, "op": { "enum": ["=", ">", ">=", "<", "<="] }, "value": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }] } }, "required": ["kind", "property", "op", "value"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "property" }, "property": { "type": "string" }, "op": { "const": "in" }, "values": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }] } } }, "required": ["kind", "property", "op", "values"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "text" }, "term": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }] }, "properties": { "type": "array", "items": { "type": "string" } } }, "required": ["kind", "term"], "additionalProperties": false }] } }, "sort": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "property" }, "property": { "type": "string" }, "direction": { "enum": ["asc", "desc"] } }, "required": ["kind", "property", "direction"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "identity" }, "direction": { "enum": ["asc", "desc"] } }, "required": ["kind", "direction"], "additionalProperties": false }] }, "limit": { "type": "number" } }, "required": ["typeKey", "limit"], "additionalProperties": false }, "operations": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "create-object" }, "typeKey": { "type": "string" }, "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } } }, "required": ["kind", "typeKey", "properties"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "update-object" }, "typeKey": { "type": "string" }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] }, "changes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "from": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "absent" } }, "required": ["slot"], "additionalProperties": false }] }, "to": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "absent" } }, "required": ["slot"], "additionalProperties": false }] } }, "required": ["from", "to"], "additionalProperties": false } } }, "required": ["kind", "typeKey", "target", "changes"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "delete-object" }, "typeKey": { "type": "string" }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } }, "required": ["kind", "typeKey", "target"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "create-edge" }, "typeKey": { "type": "string" }, "source": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] }, "properties": { "type": "object", "additionalProperties": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "literal" }, "value": {} }, "required": ["slot", "value"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" }, "property": { "type": "string" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } } }, "required": ["kind", "typeKey", "source", "target", "properties"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "delete-edge" }, "typeKey": { "type": "string" }, "target": { "oneOf": [{ "type": "object", "properties": { "slot": { "const": "input" }, "key": { "type": "string" } }, "required": ["slot", "key"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "subject" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "item" } }, "required": ["slot"], "additionalProperties": false }, { "type": "object", "properties": { "slot": { "const": "step" }, "index": { "type": "number" } }, "required": ["slot", "index"], "additionalProperties": false }] } }, "required": ["kind", "typeKey", "target"], "additionalProperties": false }] } } }, "required": ["operations"], "additionalProperties": false }, "schemaLanguageVersion": { "type": "string" } }, "required": ["typeCategory", "typeKey", "version", "displayName", "description", "allowedSubjectTypes", "inputSchema", "resultSchema", "schemaLanguageVersion"], "additionalProperties": false }] } }, "railGroups": { "type": "array", "items": { "type": "string" } } }, "required": ["changeSetId", "expectedRevision", "changes"], "additionalProperties": false },
   validateChangeSet: { "type": "object", "properties": { "changeSetId": { "type": "string" }, "revision": { "type": "string" } }, "required": ["changeSetId", "revision"], "additionalProperties": false },
   discardChangeSet: { "type": "object", "properties": { "changeSetId": { "type": "string" } }, "required": ["changeSetId"], "additionalProperties": false },
   acceptChangeSet: { "type": "object", "properties": { "changeSetId": { "type": "string" }, "revision": { "type": "string" }, "correlationId": { "type": "string" } }, "required": ["changeSetId", "revision"], "additionalProperties": false },
@@ -737,7 +845,16 @@ var SCHEMAS = {
   addSubscriber: { "type": "object", "properties": { "objectId": { "type": "string" }, "role": { "enum": ["owner", "approver", "watcher"] }, "person": { "type": "object", "properties": { "kind": { "const": "person" }, "id": { "type": "string" } }, "required": ["kind", "id"], "additionalProperties": false } }, "required": ["objectId", "role", "person"], "additionalProperties": false },
   removeSubscriber: { "type": "object", "properties": { "objectId": { "type": "string" }, "role": { "enum": ["owner", "approver", "watcher"] }, "person": { "type": "object", "properties": { "kind": { "const": "person" }, "id": { "type": "string" } }, "required": ["kind", "id"], "additionalProperties": false } }, "required": ["objectId", "role", "person"], "additionalProperties": false },
   listComments: { "type": "object", "properties": { "objectId": { "type": "string" }, "after": { "type": "string" } }, "required": ["objectId"], "additionalProperties": false },
-  addComment: { "type": "object", "properties": { "objectId": { "type": "string" }, "body": { "type": "string" }, "mentions": { "type": "array", "items": { "type": "object", "properties": { "from": { "type": "number" }, "to": { "type": "number" }, "person": { "type": "object", "properties": { "kind": { "const": "person" }, "id": { "type": "string" } }, "required": ["kind", "id"], "additionalProperties": false } }, "required": ["from", "to", "person"], "additionalProperties": false } }, "correlationId": { "type": "string" } }, "required": ["objectId", "body", "mentions"], "additionalProperties": false },
+  acquireDraft: { "type": "object", "properties": { "objectId": { "type": "string" } }, "required": ["objectId"], "additionalProperties": false },
+  saveDraft: { "type": "object", "properties": { "objectId": { "type": "string" }, "blocks": { "type": "object", "additionalProperties": { "type": "object", "properties": { "kind": { "const": "markdown" }, "text": { "type": "string" }, "position": { "type": "string" } }, "required": ["kind", "text", "position"], "additionalProperties": false } }, "added": { "type": "array", "items": { "type": "object", "properties": { "kind": { "const": "markdown" }, "text": { "type": "string" }, "position": { "type": "string" } }, "required": ["kind", "text", "position"], "additionalProperties": false } }, "draftHash": { "type": "string" } }, "required": ["objectId", "blocks", "added", "draftHash"], "additionalProperties": false },
+  promoteDraft: { "type": "object", "properties": { "objectId": { "type": "string" }, "draftHash": { "type": "string" } }, "required": ["objectId", "draftHash"], "additionalProperties": false },
+  releaseDraft: { "type": "object", "properties": { "objectId": { "type": "string" } }, "required": ["objectId"], "additionalProperties": false },
+  discardDraft: { "type": "object", "properties": { "objectId": { "type": "string" } }, "required": ["objectId"], "additionalProperties": false },
+  breakDraftLock: { "type": "object", "properties": { "objectId": { "type": "string" } }, "required": ["objectId"], "additionalProperties": false },
+  readDraftLock: { "type": "object", "properties": { "objectId": { "type": "string" } }, "required": ["objectId"], "additionalProperties": false },
+  restoreDraft: { "type": "object", "properties": { "trashId": { "type": "string" }, "newRefName": { "type": "string" } }, "required": ["trashId", "newRefName"], "additionalProperties": false },
+  setCommentResolved: { "type": "object", "properties": { "commentId": { "type": "string" }, "resolved": { "type": "boolean" } }, "required": ["commentId", "resolved"], "additionalProperties": false },
+  addComment: { "type": "object", "properties": { "objectId": { "type": "string" }, "body": { "type": "string" }, "mentions": { "type": "array", "items": { "type": "object", "properties": { "from": { "type": "number" }, "to": { "type": "number" }, "person": { "type": "object", "properties": { "kind": { "const": "person" }, "id": { "type": "string" } }, "required": ["kind", "id"], "additionalProperties": false } }, "required": ["from", "to", "person"], "additionalProperties": false } }, "anchor": { "type": "object", "properties": { "blockId": { "type": "string" }, "from": { "type": "number" }, "to": { "type": "number" }, "exact": { "type": "string" }, "prefix": { "type": "string" }, "suffix": { "type": "string" } }, "required": ["blockId", "from", "to", "exact", "prefix", "suffix"], "additionalProperties": false }, "correlationId": { "type": "string" } }, "required": ["objectId", "body", "mentions"], "additionalProperties": false },
   createConnection: { "type": "object", "properties": { "name": { "type": "string" }, "system": { "const": "onshape" }, "stack": { "type": "string" }, "companyId": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "selection": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "company" }, "label": { "type": "string" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "team" }, "teamId": { "type": "string" }, "label": { "type": "string" } }, "required": ["kind", "teamId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "owner" }, "ownerId": { "type": "string" }, "label": { "type": "string" } }, "required": ["kind", "ownerId"], "additionalProperties": false }] } }, "required": ["name", "system", "stack", "companyId", "selection"], "additionalProperties": false },
   listConnections: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
   setConnectionCredential: { "type": "object", "properties": { "credential": { "type": "object", "properties": { "kind": { "const": "api-key" }, "accessKey": { "type": "string" }, "secretKey": { "type": "string" } }, "required": ["kind", "accessKey", "secretKey"], "additionalProperties": false } }, "required": ["credential"], "additionalProperties": false },
@@ -765,6 +882,7 @@ var SCHEMAS = {
 var ROUTE_INPUT_SCHEMAS = deepFreeze(SCHEMAS);
 var SELECTORS = {
   object: { "type": "object", "properties": { "projectId": { "type": "string" }, "ref": { "type": "string" } }, "required": ["projectId", "ref"], "additionalProperties": false },
+  existingObject: { "type": "object", "properties": { "projectId": { "type": "string" }, "ref": { "type": "string" }, "objectId": { "type": "string" } }, "required": ["projectId", "ref", "objectId"], "additionalProperties": false },
   project: { "type": "object", "properties": { "projectId": { "type": "string" } }, "required": ["projectId"], "additionalProperties": false },
   connection: { "type": "object", "properties": { "connectionId": { "type": "string" } }, "required": ["connectionId"], "additionalProperties": false }
 };
@@ -776,6 +894,8 @@ var EXAMPLES = {
   updateObjectSet: { "setId": "ost_aaaaaaaaaaaaaaaaaaaaaaaaaa", "revision": 1, "name": "Renamed set" },
   deleteObjectSet: { "setId": "ost_aaaaaaaaaaaaaaaaaaaaaaaaaa", "revision": 1 },
   health: {},
+  webSignInStart: { "state": "<state>", "loopback": "<loopback>", "code_challenge": "<code_challenge>", "code_challenge_method": "S256" },
+  webRedeem: { "code": "<code>", "state": "<state>", "code_verifier": "<code_verifier>" },
   signInStart: { "state": "<state>", "loopback": "<loopback>", "code_challenge": "<code_challenge>", "code_challenge_method": "S256" },
   signInCallback: { "state": "<state>", "code": "<code>" },
   redeem: { "code": "<code>", "state": "<state>", "code_verifier": "<code_verifier>" },
@@ -785,14 +905,19 @@ var EXAMPLES = {
   attachOrganisation: { "organisationId": "<organisationId>" },
   detachOrganisation: {},
   listOrganisations: {},
-  registerClient: { "displayName": "<displayName>", "clientType": "public", "redirectUris": [], "scopes": [] },
+  registerClient: { "displayName": "Example client", "clientType": "public", "redirectUris": ["https://example.com/callback"], "scopes": [] },
   listClients: {},
   revokeClient: { "clientId": "<clientId>" },
-  replaceClientKeys: { "clientId": "<clientId>", "publicKeySet": { "keys": [] } },
+  replaceClientKeys: { "clientId": "<clientId>", "publicKeySet": { "keys": [{ "kty": "EC", "crv": "P-256", "x": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY", "y": "T-NC4v4af5uO5-tKfA-eFivOM1drMV7Oy7ZAaDe_UfU" }] } },
   readConsentRequest: { "interactionId": "<interactionId>" },
   decideConsent: { "interactionId": "<interactionId>", "decision": "approve", "approvedScopes": [] },
   listConnectedApps: {},
   revokeConnectedApp: { "clientId": "<clientId>" },
+  readStepUpRequest: { "pendingId": "<pendingId>" },
+  confirmStepUp: { "pendingId": "<pendingId>" },
+  enterHumanMode: {},
+  readSessionStatus: {},
+  readStepUpProof: { "pendingId": "<pendingId>" },
   readAttachment: {
     "objectId": "<objectId>",
     "property": "<property>"
@@ -809,7 +934,7 @@ var EXAMPLES = {
   recover: { "correlationId": "<correlationId>" },
   executeVerb: { "correlation": { "kind": "mint" }, "verb": { "typeKey": "<typeKey>", "typeVersion": 1 }, "subjectIds": [], "input": null },
   createBranch: { "correlation": { "kind": "mint" }, "name": "<name>" },
-  merge: { "correlation": { "kind": "mint" }, "sourceHash": "<sourceHash>", "message": "<message>" },
+  merge: { "correlation": { "kind": "mint" }, "sourceHash": "<sourceHash>", "message": "<message>", "name": "feature" },
   readMergeConflicts: { "name": "<name>" },
   disposeRef: { "correlation": { "kind": "mint" }, "name": "<name>", "atHash": "<atHash>" },
   listProjects: {},
@@ -850,6 +975,7 @@ var EXAMPLES = {
   listProposals: { "state": "pending" },
   readProposal: { "proposalId": "<proposalId>" },
   refuseProposal: { "proposalId": "<proposalId>", "reason": "<reason>" },
+  approveProposal: { "proposalId": "<proposalId>", "headHash": "<headHash>" },
   readBranchDiff: { "proposalId": "<proposalId>" },
   readLinkStatus: { "objectId": "<objectId>" },
   clearLinks: { "correlation": { "kind": "mint" }, "ref": "main", "entries": [{ "linkId": "<linkId>", "upstreamVersion": "<upstreamVersion>" }] },
@@ -861,12 +987,14 @@ var EXAMPLES = {
   readRefHead: { "name": "<name>" },
   inspectBranchOperation: { "correlationId": "<correlationId>" },
   abandonBranch: { "correlation": { "kind": "mint" }, "name": "<name>", "atHash": "<atHash>" },
-  addRefRule: { "pattern": "<pattern>", "consequence": "merge-only" },
+  addRefRule: { "extent": "ref", "pattern": "<pattern>" },
   listRefRules: {},
   removeRefRule: { "ruleId": "<ruleId>" },
-  addOrganisationRule: { "pattern": "<pattern>", "consequence": "merge-only" },
+  updateRefRule: { "ruleId": "<ruleId>", "settings": {} },
+  addOrganisationRule: { "extent": "ref", "pattern": "<pattern>" },
   listOrganisationRules: {},
   removeOrganisationRule: { "ruleId": "<ruleId>" },
+  updateOrganisationRule: { "ruleId": "<ruleId>", "settings": {} },
   createOrganisationRef: { "name": "<name>" },
   listOrganisationRefs: {},
   deleteOrganisationRef: { "name": "<name>" },
@@ -898,7 +1026,7 @@ var EXAMPLES = {
   readApp: { "appKey": "<appKey>" },
   openAppDraft: { "appKey": "<appKey>" },
   readAppDraft: { "appDraftId": "<appDraftId>" },
-  reviseAppDraft: { "appDraftId": "<appDraftId>", "revision": 1, "document": { "title": "<title>", "pages": [] } },
+  reviseAppDraft: { "appDraftId": "<appDraftId>", "revision": 1, "document": { "title": "Example app", "pages": [{ "key": "home", "title": "Home", "view": { "root": "root", "elements": { "root": { "type": "AppBody", "props": {}, "children": ["text"] }, "text": { "type": "Text", "props": { "text": "Example page" }, "children": [] } } } }] } },
   acceptAppDraft: { "appDraftId": "<appDraftId>", "revision": 1 },
   listApps: {},
   validateAppDraft: { "appDraftId": "<appDraftId>", "revision": 1 },
@@ -909,6 +1037,15 @@ var EXAMPLES = {
   addSubscriber: { "objectId": "<objectId>", "role": "owner", "person": { "kind": "person", "id": "<id>" } },
   removeSubscriber: { "objectId": "<objectId>", "role": "owner", "person": { "kind": "person", "id": "<id>" } },
   listComments: { "objectId": "<objectId>" },
+  acquireDraft: { "objectId": "<objectId>" },
+  saveDraft: { "objectId": "<objectId>", "blocks": {}, "added": [], "draftHash": "<draftHash>" },
+  promoteDraft: { "objectId": "<objectId>", "draftHash": "<draftHash>" },
+  releaseDraft: { "objectId": "<objectId>" },
+  discardDraft: { "objectId": "<objectId>" },
+  breakDraftLock: { "objectId": "<objectId>" },
+  readDraftLock: { "objectId": "<objectId>" },
+  restoreDraft: { "trashId": "<trashId>", "newRefName": "<newRefName>" },
+  setCommentResolved: { "commentId": "<commentId>", "resolved": false },
   addComment: { "objectId": "<objectId>", "body": "<body>", "mentions": [] },
   createConnection: { "name": "<name>", "system": "onshape", "stack": "<stack>", "companyId": null, "selection": { "kind": "company" } },
   listConnections: {},
@@ -937,10 +1074,13 @@ var EXAMPLES = {
 var ROUTE_INPUT_EXAMPLES = deepFreeze(EXAMPLES);
 
 // packages/api-contract/dist/routes.js
-var PROTOCOL_VERSION = 36;
+var PROTOCOL_VERSION = 37;
 var VERSION_HEADER = "oe2-protocol-version";
 var TOKEN_HEADER = "authorization";
 var IDEMPOTENCY_HEADER = "oe2-idempotency-key";
+var STEP_UP_HEADER = "oe2-step-up";
+var STEP_UP_KEY_HEADER = "oe2-step-up-key";
+var IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9._~-]{1,128}$/;
 var STREAMED_ROUTE_NAMES = Object.freeze(["sendMessageStreamed", "answerPlanStreamed"]);
 var BINARY_REQUEST_ROUTE_NAMES = Object.freeze(["stageAttachment", "publishHostedVersion"]);
 var BINARY_RESPONSE_ROUTE_NAMES = Object.freeze(["readAttachment"]);
@@ -956,50 +1096,363 @@ var OMITTABLE_GROUPS = Object.freeze([
   "administration",
   "agent"
 ]);
-var NO_ACCESS_TOKEN = Object.freeze({ admits: "none" });
-function admitting(first, ...rest) {
-  const admits = [first, ...rest];
-  return Object.freeze({ admits: Object.freeze(admits) });
+var ACTOR_TOKEN_KINDS = Object.freeze({
+  person: "user",
+  "agent:explore": "agent:explore",
+  "agent:apply": "agent:apply",
+  "agent:types": "agent:types",
+  "app:client": "client",
+  "app:hosted": "hosted-app",
+  service: "service"
+});
+var STEP_UP_ROUTE_GROUPS = Object.freeze({
+  createObjectSet: "unmarked",
+  listObjectSets: "unmarked",
+  readObjectSet: "unmarked",
+  updateObjectSet: "unmarked",
+  deleteObjectSet: "unmarked",
+  health: "unmarked",
+  webSignInStart: "unmarked",
+  signInStart: "unmarked",
+  signInCallback: "unmarked",
+  webRedeem: "unmarked",
+  redeem: "unmarked",
+  refresh: "unmarked",
+  logout: "unmarked",
+  serviceCredential: "unmarked",
+  attachOrganisation: "unmarked",
+  detachOrganisation: "unmarked",
+  listOrganisations: "unmarked",
+  registerClient: "marked",
+  listClients: "unmarked",
+  revokeClient: "unmarked",
+  replaceClientKeys: "marked",
+  readConsentRequest: "unmarked",
+  decideConsent: "marked-refused-to-agents",
+  listConnectedApps: "unmarked",
+  revokeConnectedApp: "unmarked",
+  readStepUpRequest: "unmarked",
+  confirmStepUp: "unmarked",
+  readStepUpProof: "unmarked",
+  enterHumanMode: "marked",
+  readSessionStatus: "unmarked",
+  stageAttachment: "unmarked",
+  readAttachment: "unmarked",
+  readObject: "unmarked",
+  queryObjects: "unmarked",
+  queryRows: "unmarked",
+  aggregateObjects: "unmarked",
+  discoverVerbs: "unmarked",
+  readHistory: "unmarked",
+  mutate: "unmarked",
+  mutateBatch: "unmarked",
+  previewDelete: "unmarked",
+  recover: "unmarked",
+  executeVerb: "unmarked",
+  createBranch: "unmarked",
+  merge: "marked",
+  readMergeConflicts: "unmarked",
+  disposeRef: "marked",
+  listProjects: "unmarked",
+  listRefs: "unmarked",
+  readCatalogue: "unmarked",
+  readPendingProposal: "unmarked",
+  submitProposal: "unmarked",
+  createServiceIdentity: "marked-refused-to-agents",
+  revokeServiceIdentity: "unmarked",
+  issueServiceCredential: "marked-refused-to-agents",
+  revokeServiceCredential: "unmarked",
+  grantMembership: "marked-refused-to-agents",
+  revokeMembership: "unmarked",
+  setModelConfiguration: "marked",
+  setModelId: "unmarked",
+  readModelConfigurationStatus: "unmarked",
+  readAccount: "unmarked",
+  readDisplayNames: "unmarked",
+  listMembers: "unmarked",
+  changeMembershipRole: "marked-refused-to-agents",
+  listOrganisationMembers: "unmarked",
+  listServiceIdentities: "unmarked",
+  createInvitation: "marked-refused-to-agents",
+  listInvitations: "unmarked",
+  revokeInvitation: "unmarked",
+  readInvitationDomainRule: "unmarked",
+  setInvitationDomainRule: "marked",
+  reissueInvitation: "marked-refused-to-agents",
+  createPlatformInvitation: "marked-refused-to-agents",
+  listPlatformInvitations: "unmarked",
+  revokePlatformInvitation: "unmarked",
+  reissuePlatformInvitation: "marked-refused-to-agents",
+  readWebOrigin: "unmarked",
+  readCallerCapabilities: "unmarked",
+  queryGraph: "unmarked",
+  readStructure: "unmarked",
+  findPaths: "unmarked",
+  listProposals: "unmarked",
+  readProposal: "unmarked",
+  refuseProposal: "unmarked",
+  approveProposal: "marked",
+  readBranchDiff: "unmarked",
+  readLinkStatus: "unmarked",
+  clearLinks: "unmarked",
+  readChangeImpact: "unmarked",
+  diffBranches: "unmarked",
+  readBranchHistory: "unmarked",
+  listAudit: "unmarked",
+  listOrganisationAudit: "unmarked",
+  readRefHead: "unmarked",
+  inspectBranchOperation: "unmarked",
+  abandonBranch: "unmarked",
+  addRefRule: "unmarked",
+  listRefRules: "unmarked",
+  removeRefRule: "marked",
+  updateRefRule: "marked",
+  addOrganisationRule: "unmarked",
+  listOrganisationRules: "unmarked",
+  removeOrganisationRule: "marked",
+  updateOrganisationRule: "marked",
+  createOrganisationRef: "unmarked",
+  listOrganisationRefs: "unmarked",
+  deleteOrganisationRef: "marked",
+  markOrganisationRefReadOnly: "unmarked",
+  setObjectLock: "marked",
+  readAgentCeiling: "unmarked",
+  setAgentCeiling: "marked-refused-to-agents",
+  requestSchemaUpdate: "unmarked",
+  readSchemaUpdateRequest: "unmarked",
+  openAgentSession: "unmarked",
+  listAgentSessions: "unmarked",
+  readAgentSession: "unmarked",
+  sendMessage: "unmarked",
+  answerPlan: "unmarked",
+  stopRun: "unmarked",
+  closePlan: "unmarked",
+  sendMessageStreamed: "unmarked",
+  answerPlanStreamed: "unmarked",
+  createProject: "unmarked",
+  createOrganisation: "unmarked",
+  openChangeSet: "unmarked",
+  readCurrentChangeSet: "unmarked",
+  readChangeSet: "unmarked",
+  readChangeSetState: "unmarked",
+  reviseChangeSet: "unmarked",
+  validateChangeSet: "unmarked",
+  discardChangeSet: "unmarked",
+  acceptChangeSet: "unmarked",
+  readApp: "unmarked",
+  openAppDraft: "unmarked",
+  readAppDraft: "unmarked",
+  reviseAppDraft: "unmarked",
+  acceptAppDraft: "unmarked",
+  listApps: "unmarked",
+  validateAppDraft: "unmarked",
+  discardAppDraft: "unmarked",
+  searchPeople: "unmarked",
+  searchObjectReaders: "unmarked",
+  listSubscribers: "unmarked",
+  addSubscriber: "unmarked",
+  removeSubscriber: "unmarked",
+  listComments: "unmarked",
+  acquireDraft: "unmarked",
+  saveDraft: "unmarked",
+  promoteDraft: "unmarked",
+  releaseDraft: "unmarked",
+  discardDraft: "unmarked",
+  breakDraftLock: "marked",
+  readDraftLock: "unmarked",
+  restoreDraft: "unmarked",
+  setCommentResolved: "unmarked",
+  addComment: "unmarked",
+  createConnection: "unmarked",
+  listConnections: "unmarked",
+  setConnectionCredential: "marked",
+  readConnectionIdentity: "unmarked",
+  draftConnectorTypes: "unmarked",
+  revokeConnection: "unmarked",
+  startImportRun: "unmarked",
+  listImportRuns: "unmarked",
+  closeImportRun: "unmarked",
+  createHostedApp: "unmarked",
+  publishHostedVersion: "unmarked",
+  readHostedBundle: "unmarked",
+  listHostedApps: "unmarked",
+  listHostedVersions: "unmarked",
+  revokeHostedApp: "unmarked",
+  revokeHostedVersion: "unmarked",
+  openHostedApp: "unmarked",
+  endHostedLaunch: "unmarked",
+  mintHostedAppToken: "unmarked",
+  setHostedOneWallSwitch: "unmarked",
+  readHostedOneWallSwitch: "unmarked",
+  grantHostedOneWall: "unmarked",
+  withdrawHostedOneWall: "unmarked",
+  listHostedOneWallGrants: "unmarked"
+});
+var POLICY_PREDICATES = Object.freeze({
+  unlocks: (input) => typeof input === "object" && input !== null && "lock" in input && input.lock === "none"
+});
+var NO_ACTORS = Object.freeze({ none: true });
+function admittingActors(first, ...rest) {
+  const actors = Object.fromEntries([first, ...rest].map((actorClass) => [actorClass, "none"]));
+  return Object.freeze({ actors: Object.freeze(actors) });
+}
+function policyFor(name, admission) {
+  const group = STEP_UP_ROUTE_GROUPS[name];
+  if (group === "unmarked")
+    return admission;
+  if (group !== "marked" && group !== "marked-refused-to-agents") {
+    throw new Error(`route ${name}: no step-up group is declared`);
+  }
+  if (!("actors" in admission) || !("person" in admission.actors)) {
+    throw new Error(`route ${name}: a marked route must admit the person`);
+  }
+  const person = name === "setObjectLock" ? Object.freeze({ personPresentWhen: "unlocks" }) : "person-present";
+  return Object.freeze({ actors: Object.freeze({ ...admission.actors, person }) });
+}
+function admittedKinds(policy) {
+  if ("none" in policy)
+    return "none";
+  const classes = Object.keys(policy.actors);
+  if (classes.length === 0)
+    throw new Error("an actors policy must name at least one actor class");
+  const kinds = classes.map((actorClass) => {
+    if (!Object.hasOwn(ACTOR_TOKEN_KINDS, actorClass))
+      throw new Error(`unknown actor class ${actorClass}`);
+    return ACTOR_TOKEN_KINDS[actorClass];
+  });
+  return Object.freeze(kinds);
 }
+function owesStepUp(policy) {
+  return "actors" in policy && Object.values(policy.actors).some((stepUp) => stepUp !== "none");
+}
+var STEP_UP_REFUSALS = Object.freeze(["step-up-required", "step-up-mismatch", "step-up-capacity"]);
 function route(entry2) {
   const doc2 = ROUTE_DOCS[entry2.name];
-  const admitsClient = entry2.admission.admits !== "none" && entry2.admission.admits.includes("client");
-  const documented = admitsClient && !doc2.refuses.includes("grant-scope") ? Object.freeze({ does: doc2.does, refuses: Object.freeze([...doc2.refuses, "grant-scope"]) }) : doc2;
-  return Object.freeze({ ...entry2, doc: documented });
+  const policy = policyFor(entry2.name, entry2.policy);
+  const kinds = admittedKinds(policy);
+  const admitsClient = kinds !== "none" && kinds.includes("client");
+  const withGrantScope = admitsClient && !doc2.refuses.includes("grant-scope") ? Object.freeze({ does: doc2.does, refuses: Object.freeze([...doc2.refuses, "grant-scope"]) }) : doc2;
+  const documented = owesStepUp(policy) ? Object.freeze({
+    does: withGrantScope.does,
+    refuses: Object.freeze([
+      ...withGrantScope.refuses,
+      ...STEP_UP_REFUSALS.filter((refusal2) => !withGrantScope.refuses.includes(refusal2))
+    ])
+  }) : withGrantScope;
+  return Object.freeze({ ...entry2, policy, admittedTokenKinds: kinds, doc: documented });
 }
 var ROUTES = Object.freeze({
-  createObjectSet: route({ name: "createObjectSet", method: "POST", path: "/object-sets", group: "write", selector: "object", subject: "project", idempotent: true, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.createObjectSet" }),
-  listObjectSets: route({ name: "listObjectSets", method: "POST", path: "/object-sets/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.listObjectSets" }),
-  readObjectSet: route({ name: "readObjectSet", method: "POST", path: "/object-sets/read", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.readObjectSet" }),
-  updateObjectSet: route({ name: "updateObjectSet", method: "POST", path: "/object-sets/update", group: "write", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.updateObjectSet" }),
-  deleteObjectSet: route({ name: "deleteObjectSet", method: "POST", path: "/object-sets/delete", group: "write", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.deleteObjectSet" }),
-  health: route({ name: "health", method: "GET", path: "/health", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: NO_ACCESS_TOKEN, versioned: false, module: "sdk-core", capability: "core.health" }),
-  signInStart: route({ name: "signInStart", method: "GET", path: "/auth/sign-in", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: NO_ACCESS_TOKEN, versioned: false, module: "sdk-core", capability: "core.signInStart" }),
-  signInCallback: route({ name: "signInCallback", method: "GET", path: "/auth/callback", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: NO_ACCESS_TOKEN, versioned: false, module: "sdk-core", capability: "core.signInCallback" }),
-  redeem: route({ name: "redeem", method: "POST", path: "/auth/redeem", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: NO_ACCESS_TOKEN, versioned: true, module: "sdk-core", capability: "core.redeem" }),
-  refresh: route({ name: "refresh", method: "POST", path: "/auth/refresh", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: NO_ACCESS_TOKEN, versioned: true, module: "sdk-core", capability: "core.refresh" }),
-  logout: route({ name: "logout", method: "POST", path: "/auth/logout", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user", "service"), versioned: true, module: "sdk-core", capability: "core.logout" }),
-  serviceCredential: route({ name: "serviceCredential", method: "POST", path: "/auth/service", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: NO_ACCESS_TOKEN, versioned: true, module: "sdk-core", capability: "core.serviceCredential" }),
-  attachOrganisation: route({ name: "attachOrganisation", method: "POST", path: "/auth/organisation", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user"), versioned: true, module: "sdk-core", capability: "core.attachOrganisation" }),
-  detachOrganisation: route({ name: "detachOrganisation", method: "POST", path: "/auth/organisation/detach", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user"), versioned: true, module: "sdk-core", capability: "core.detachOrganisation" }),
-  listOrganisations: route({ name: "listOrganisations", method: "POST", path: "/auth/organisations", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user", "service"), versioned: true, module: "sdk-core", capability: "core.listOrganisations" }),
-  registerClient: route({ name: "registerClient", method: "POST", path: "/clients", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.clientRegistration" }),
-  listClients: route({ name: "listClients", method: "POST", path: "/clients/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.clients" }),
-  revokeClient: route({ name: "revokeClient", method: "POST", path: "/client-revocations", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.clientRevocation" }),
-  replaceClientKeys: route({ name: "replaceClientKeys", method: "POST", path: "/client-keys", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.clientKeys" }),
-  readConsentRequest: route({ name: "readConsentRequest", method: "POST", path: "/consent/read", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user"), versioned: true, module: "web-sdk", capability: "web.consentRead" }),
-  decideConsent: route({ name: "decideConsent", method: "POST", path: "/consent-decisions", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user"), versioned: true, module: "web-sdk", capability: "web.consentDecision" }),
-  listConnectedApps: route({ name: "listConnectedApps", method: "POST", path: "/connected-apps", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user"), versioned: true, module: "web-sdk", capability: "web.connectedApps" }),
-  revokeConnectedApp: route({ name: "revokeConnectedApp", method: "POST", path: "/connected-app-revocations", group: "platform", selector: "none", subject: "platform", idempotent: false, admission: admitting("user"), versioned: true, module: "web-sdk", capability: "web.connectedAppRevocation" }),
+  createObjectSet: route({ name: "createObjectSet", method: "POST", path: "/object-sets", group: "write", selector: "object", subject: "project", idempotent: true, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.createObjectSet" }),
+  listObjectSets: route({ name: "listObjectSets", method: "POST", path: "/object-sets/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.listObjectSets" }),
+  readObjectSet: route({ name: "readObjectSet", method: "POST", path: "/object-sets/read", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.readObjectSet" }),
+  updateObjectSet: route({ name: "updateObjectSet", method: "POST", path: "/object-sets/update", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.updateObjectSet" }),
+  deleteObjectSet: route({ name: "deleteObjectSet", method: "POST", path: "/object-sets/delete", group: "write", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.deleteObjectSet" }),
+  health: route({ name: "health", method: "GET", path: "/health", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: false, module: "sdk-core", capability: "core.health" }),
+  webSignInStart: route({ name: "webSignInStart", method: "POST", path: "/auth/web/sign-in", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: true, module: "sdk-core", capability: "core.webSignInStart" }),
+  signInStart: route({ name: "signInStart", method: "GET", path: "/auth/sign-in", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: false, module: "sdk-core", capability: "core.signInStart" }),
+  signInCallback: route({ name: "signInCallback", method: "GET", path: "/auth/callback", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: false, module: "sdk-core", capability: "core.signInCallback" }),
+  webRedeem: route({ name: "webRedeem", method: "POST", path: "/auth/web/redeem", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: true, module: "sdk-core", capability: "core.webRedeem" }),
+  redeem: route({ name: "redeem", method: "POST", path: "/auth/redeem", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: true, module: "sdk-core", capability: "core.redeem" }),
+  refresh: route({ name: "refresh", method: "POST", path: "/auth/refresh", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: true, module: "sdk-core", capability: "core.refresh" }),
+  logout: route({ name: "logout", method: "POST", path: "/auth/logout", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person", "service"), versioned: true, module: "sdk-core", capability: "core.logout" }),
+  serviceCredential: route({ name: "serviceCredential", method: "POST", path: "/auth/service", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: NO_ACTORS, versioned: true, module: "sdk-core", capability: "core.serviceCredential" }),
+  attachOrganisation: route({ name: "attachOrganisation", method: "POST", path: "/auth/organisation", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person"), versioned: true, module: "sdk-core", capability: "core.attachOrganisation" }),
+  detachOrganisation: route({ name: "detachOrganisation", method: "POST", path: "/auth/organisation/detach", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person"), versioned: true, module: "sdk-core", capability: "core.detachOrganisation" }),
+  listOrganisations: route({ name: "listOrganisations", method: "POST", path: "/auth/organisations", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person", "service"), versioned: true, module: "sdk-core", capability: "core.listOrganisations" }),
+  registerClient: route({
+    name: "registerClient",
+    method: "POST",
+    path: "/clients",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.clientRegistration"
+  }),
+  listClients: route({ name: "listClients", method: "POST", path: "/clients/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.clients" }),
+  revokeClient: route({ name: "revokeClient", method: "POST", path: "/client-revocations", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.clientRevocation" }),
+  replaceClientKeys: route({
+    name: "replaceClientKeys",
+    method: "POST",
+    path: "/client-keys",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.clientKeys"
+  }),
+  readConsentRequest: route({ name: "readConsentRequest", method: "POST", path: "/consent/read", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person"), versioned: true, module: "web-sdk", capability: "web.consentRead" }),
+  decideConsent: route({
+    name: "decideConsent",
+    method: "POST",
+    path: "/consent-decisions",
+    group: "platform",
+    selector: "none",
+    subject: "platform",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "web-sdk",
+    capability: "web.consentDecision"
+  }),
+  listConnectedApps: route({ name: "listConnectedApps", method: "POST", path: "/connected-apps", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person"), versioned: true, module: "web-sdk", capability: "web.connectedApps" }),
+  revokeConnectedApp: route({ name: "revokeConnectedApp", method: "POST", path: "/connected-app-revocations", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person"), versioned: true, module: "web-sdk", capability: "web.connectedAppRevocation" }),
+  readStepUpRequest: route({ name: "readStepUpRequest", method: "POST", path: "/step-up/read", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person"), versioned: true, module: "web-sdk", capability: "web.stepUpRead" }),
+  confirmStepUp: route({ name: "confirmStepUp", method: "POST", path: "/step-up/confirmations", group: "platform", selector: "none", subject: "platform", idempotent: false, policy: admittingActors("person"), versioned: true, module: "web-sdk", capability: "web.stepUpConfirmation" }),
+  readStepUpProof: route({
+    name: "readStepUpProof",
+    method: "POST",
+    path: "/step-up/proofs",
+    group: "platform",
+    selector: "none",
+    subject: "platform",
+    idempotent: false,
+    policy: admittingActors("person", "agent:explore", "agent:apply", "agent:types"),
+    versioned: true,
+    module: "sdk-core",
+    capability: "core.stepUpProof"
+  }),
+  enterHumanMode: route({
+    name: "enterHumanMode",
+    method: "POST",
+    path: "/session/human",
+    group: "platform",
+    selector: "none",
+    subject: "platform",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "sdk-core",
+    capability: "core.enterHumanMode"
+  }),
+  readSessionStatus: route({
+    name: "readSessionStatus",
+    method: "POST",
+    path: "/session/status",
+    group: "platform",
+    selector: "none",
+    subject: "platform",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "sdk-core",
+    capability: "core.sessionStatus"
+  }),
   stageAttachment: route({
     name: "stageAttachment",
     method: "POST",
     path: "/attachments/stage",
     group: "write",
-    selector: "object",
+    selector: "existingObject",
     subject: "project",
     idempotent: false,
-    admission: admitting("user", "service", "client", "run-apply"),
+    policy: admittingActors("person", "service", "app:client", "agent:apply"),
     versioned: true,
     module: "objects-sdk",
     capability: "objects.write"
@@ -1012,13 +1465,13 @@ var ROUTES = Object.freeze({
     selector: "object",
     subject: "project",
     idempotent: false,
-    admission: admitting("user", "service", "client", "run-explore", "run-apply"),
+    policy: admittingActors("person", "service", "app:client", "agent:explore", "agent:apply"),
     versioned: true,
     module: "objects-sdk",
     capability: "objects.read"
   }),
-  readObject: route({ name: "readObject", method: "POST", path: "/objects/read", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.read" }),
-  queryObjects: route({ name: "queryObjects", method: "POST", path: "/objects/query", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "run-types", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.query" }),
+  readObject: route({ name: "readObject", method: "POST", path: "/objects/read", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.read" }),
+  queryObjects: route({ name: "queryObjects", method: "POST", path: "/objects/query", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "agent:types", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.query" }),
   queryRows: route({
     name: "queryRows",
     method: "POST",
@@ -1027,62 +1480,207 @@ var ROUTES = Object.freeze({
     selector: "object",
     subject: "project",
     idempotent: false,
-    admission: admitting("user", "service", "run-explore", "run-apply", "run-types", "client", "hosted-app"),
+    policy: admittingActors("person", "service", "agent:explore", "agent:apply", "agent:types", "app:client", "app:hosted"),
     versioned: true,
     module: "objects-sdk",
     capability: "objects.query"
   }),
-  aggregateObjects: route({ name: "aggregateObjects", method: "POST", path: "/objects/aggregate", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.aggregate" }),
-  discoverVerbs: route({ name: "discoverVerbs", method: "POST", path: "/objects/verbs", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.read" }),
-  readHistory: route({ name: "readHistory", method: "POST", path: "/objects/history", group: "history", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.history" }),
-  mutate: route({ name: "mutate", method: "POST", path: "/mutations", group: "write", selector: "object", subject: "project", idempotent: true, admission: admitting("user", "service", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
-  mutateBatch: route({ name: "mutateBatch", method: "POST", path: "/mutations/batch", group: "write", selector: "object", subject: "project", idempotent: true, admission: admitting("user", "service", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
-  previewDelete: route({ name: "previewDelete", method: "POST", path: "/objects/delete-preview", group: "write", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
-  recover: route({ name: "recover", method: "POST", path: "/recoveries", group: "write", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.recovery" }),
-  executeVerb: route({ name: "executeVerb", method: "POST", path: "/verb-executions", group: "verb", selector: "object", subject: "project", idempotent: true, admission: admitting("user", "service", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.verb" }),
-  createBranch: route({ name: "createBranch", method: "POST", path: "/branches", group: "branch", selector: "project", subject: "project", idempotent: true, admission: admitting("user", "service", "run-explore", "run-apply", "client"), versioned: true, module: "branches-sdk", capability: "branches.create" }),
-  merge: route({ name: "merge", method: "POST", path: "/merges", group: "branch", selector: "project", subject: "project", idempotent: true, admission: admitting("user", "service", "client"), versioned: true, module: "branches-sdk", capability: "branches.merge" }),
-  readMergeConflicts: route({ name: "readMergeConflicts", method: "POST", path: "/branches/conflicts", group: "branch", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.conflicts" }),
-  disposeRef: route({ name: "disposeRef", method: "POST", path: "/branch-disposals", group: "branch", selector: "project", subject: "project", idempotent: true, admission: admitting("user", "service", "client"), versioned: true, module: "branches-sdk", capability: "branches.disposal" }),
-  listProjects: route({ name: "listProjects", method: "POST", path: "/projects", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "service", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.projects" }),
-  listRefs: route({ name: "listRefs", method: "POST", path: "/projects/refs", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "branches.list" }),
-  readCatalogue: route({ name: "readCatalogue", method: "POST", path: "/projects/catalogue", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "run-types", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.catalogue" }),
-  readPendingProposal: route({ name: "readPendingProposal", method: "POST", path: "/proposals/pending", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.pendingProposal" }),
-  submitProposal: route({ name: "submitProposal", method: "POST", path: "/proposals", group: "branch", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "client"), versioned: true, module: "branches-sdk", capability: "branches.proposalSubmit" }),
-  createServiceIdentity: route({ name: "createServiceIdentity", method: "POST", path: "/service-identities", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.serviceIdentity" }),
-  revokeServiceIdentity: route({ name: "revokeServiceIdentity", method: "POST", path: "/service-identities/revocation", group: "administration", selector: "none", subject: "service-identity", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.serviceIdentityRevocation" }),
-  issueServiceCredential: route({ name: "issueServiceCredential", method: "POST", path: "/service-credentials", group: "administration", selector: "none", subject: "service-identity", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.serviceCredential" }),
-  revokeServiceCredential: route({ name: "revokeServiceCredential", method: "POST", path: "/service-credentials/revocation", group: "administration", selector: "none", subject: "service-identity", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.serviceCredentialRevocation" }),
-  grantMembership: route({ name: "grantMembership", method: "POST", path: "/memberships", group: "administration", selector: "none", subject: "membership-scope", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.membership" }),
-  revokeMembership: route({ name: "revokeMembership", method: "POST", path: "/membership-revocations", group: "administration", selector: "none", subject: "membership-scope", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.membershipRevocation" }),
-  setModelConfiguration: route({ name: "setModelConfiguration", method: "POST", path: "/model-configuration", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.modelConfiguration" }),
-  setModelId: route({ name: "setModelId", method: "POST", path: "/model-configuration/model", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.modelId" }),
-  readModelConfigurationStatus: route({ name: "readModelConfigurationStatus", method: "POST", path: "/model-configuration/status", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.modelConfigurationStatus" }),
-  readAccount: route({ name: "readAccount", method: "POST", path: "/account", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.account" }),
-  readDisplayNames: route({ name: "readDisplayNames", method: "POST", path: "/principals/names", group: "read", selector: "none", subject: "display-names", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "admin-sdk", capability: "admin.displayNames" }),
-  listMembers: route({ name: "listMembers", method: "POST", path: "/projects/members", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "admin-sdk", capability: "admin.members" }),
-  changeMembershipRole: route({ name: "changeMembershipRole", method: "POST", path: "/membership-roles", group: "administration", selector: "none", subject: "membership-scope", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.membershipRole" }),
-  listOrganisationMembers: route({ name: "listOrganisationMembers", method: "POST", path: "/organisation/members", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "admin-sdk", capability: "admin.organisationMembers" }),
-  listServiceIdentities: route({ name: "listServiceIdentities", method: "POST", path: "/organisation/service-identities", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.serviceIdentities" }),
-  createInvitation: route({ name: "createInvitation", method: "POST", path: "/invitations", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.invitation" }),
-  listInvitations: route({ name: "listInvitations", method: "POST", path: "/invitations/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.invitationList" }),
-  revokeInvitation: route({ name: "revokeInvitation", method: "POST", path: "/invitation-revocations", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.invitationRevocation" }),
-  readInvitationDomainRule: route({ name: "readInvitationDomainRule", method: "POST", path: "/invitation-domain-rule/read", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.invitationDomainRuleRead" }),
-  setInvitationDomainRule: route({ name: "setInvitationDomainRule", method: "POST", path: "/invitation-domain-rule", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.invitationDomainRule" }),
-  reissueInvitation: route({ name: "reissueInvitation", method: "POST", path: "/invitation-reissues", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.invitationReissue" }),
-  createPlatformInvitation: route({ name: "createPlatformInvitation", method: "POST", path: "/platform-invitations", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.platformInvitation" }),
-  listPlatformInvitations: route({ name: "listPlatformInvitations", method: "POST", path: "/platform-invitations/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.platformInvitationList" }),
-  revokePlatformInvitation: route({ name: "revokePlatformInvitation", method: "POST", path: "/platform-invitation-revocations", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.platformInvitationRevocation" }),
-  reissuePlatformInvitation: route({ name: "reissuePlatformInvitation", method: "POST", path: "/platform-invitation-reissues", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.platformInvitationReissue" }),
-  readWebOrigin: route({ name: "readWebOrigin", method: "POST", path: "/web-origin/read", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "service"), versioned: true, module: "admin-sdk", capability: "admin.webOrigin" }),
-  readCallerCapabilities: route({ name: "readCallerCapabilities", method: "POST", path: "/caller-capabilities/read", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "admin-sdk", capability: "admin.callerCapabilities" }),
-  queryGraph: route({ name: "queryGraph", method: "POST", path: "/objects/graph", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.traverse" }),
-  readStructure: route({ name: "readStructure", method: "POST", path: "/objects/structure", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.traverse" }),
-  findPaths: route({ name: "findPaths", method: "POST", path: "/objects/paths", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.traverse" }),
-  listProposals: route({ name: "listProposals", method: "POST", path: "/proposals/list", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.proposalList" }),
-  readProposal: route({ name: "readProposal", method: "POST", path: "/proposals/read", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.proposalRead" }),
-  refuseProposal: route({ name: "refuseProposal", method: "POST", path: "/proposal-refusals", group: "branch", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "client"), versioned: true, module: "branches-sdk", capability: "branches.proposalRefusal" }),
-  readBranchDiff: route({ name: "readBranchDiff", method: "POST", path: "/branches/diff", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.proposalDiff" }),
+  aggregateObjects: route({ name: "aggregateObjects", method: "POST", path: "/objects/aggregate", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.aggregate" }),
+  discoverVerbs: route({ name: "discoverVerbs", method: "POST", path: "/objects/verbs", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.read" }),
+  readHistory: route({ name: "readHistory", method: "POST", path: "/objects/history", group: "history", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.history" }),
+  mutate: route({ name: "mutate", method: "POST", path: "/mutations", group: "write", selector: "object", subject: "project", idempotent: true, policy: admittingActors("person", "service", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  mutateBatch: route({ name: "mutateBatch", method: "POST", path: "/mutations/batch", group: "write", selector: "object", subject: "project", idempotent: true, policy: admittingActors("person", "service", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  previewDelete: route({ name: "previewDelete", method: "POST", path: "/objects/delete-preview", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  recover: route({ name: "recover", method: "POST", path: "/recoveries", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.recovery" }),
+  executeVerb: route({ name: "executeVerb", method: "POST", path: "/verb-executions", group: "verb", selector: "object", subject: "project", idempotent: true, policy: admittingActors("person", "service", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.verb" }),
+  createBranch: route({ name: "createBranch", method: "POST", path: "/branches", group: "branch", selector: "project", subject: "project", idempotent: true, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client"), versioned: true, module: "branches-sdk", capability: "branches.create" }),
+  merge: route({
+    name: "merge",
+    method: "POST",
+    path: "/merges",
+    group: "branch",
+    selector: "project",
+    subject: "project",
+    idempotent: true,
+    policy: admittingActors("person", "service", "app:client"),
+    versioned: true,
+    module: "branches-sdk",
+    capability: "branches.merge"
+  }),
+  readMergeConflicts: route({ name: "readMergeConflicts", method: "POST", path: "/branches/conflicts", group: "branch", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.conflicts" }),
+  disposeRef: route({
+    name: "disposeRef",
+    method: "POST",
+    path: "/branch-disposals",
+    group: "branch",
+    selector: "project",
+    subject: "project",
+    idempotent: true,
+    policy: admittingActors("person", "service", "app:client"),
+    versioned: true,
+    module: "branches-sdk",
+    capability: "branches.disposal"
+  }),
+  listProjects: route({ name: "listProjects", method: "POST", path: "/projects", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "service", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.projects" }),
+  listRefs: route({ name: "listRefs", method: "POST", path: "/projects/refs", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "branches.list" }),
+  readCatalogue: route({ name: "readCatalogue", method: "POST", path: "/projects/catalogue", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "agent:types", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.catalogue" }),
+  readPendingProposal: route({ name: "readPendingProposal", method: "POST", path: "/proposals/pending", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.pendingProposal" }),
+  submitProposal: route({ name: "submitProposal", method: "POST", path: "/proposals", group: "branch", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "app:client", "agent:apply"), versioned: true, module: "branches-sdk", capability: "branches.proposalSubmit" }),
+  createServiceIdentity: route({
+    name: "createServiceIdentity",
+    method: "POST",
+    path: "/service-identities",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.serviceIdentity"
+  }),
+  revokeServiceIdentity: route({ name: "revokeServiceIdentity", method: "POST", path: "/service-identities/revocation", group: "administration", selector: "none", subject: "service-identity", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.serviceIdentityRevocation" }),
+  issueServiceCredential: route({
+    name: "issueServiceCredential",
+    method: "POST",
+    path: "/service-credentials",
+    group: "administration",
+    selector: "none",
+    subject: "service-identity",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.serviceCredential"
+  }),
+  revokeServiceCredential: route({ name: "revokeServiceCredential", method: "POST", path: "/service-credentials/revocation", group: "administration", selector: "none", subject: "service-identity", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.serviceCredentialRevocation" }),
+  grantMembership: route({
+    name: "grantMembership",
+    method: "POST",
+    path: "/memberships",
+    group: "administration",
+    selector: "none",
+    subject: "membership-scope",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.membership"
+  }),
+  revokeMembership: route({ name: "revokeMembership", method: "POST", path: "/membership-revocations", group: "administration", selector: "none", subject: "membership-scope", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.membershipRevocation" }),
+  setModelConfiguration: route({
+    name: "setModelConfiguration",
+    method: "POST",
+    path: "/model-configuration",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.modelConfiguration"
+  }),
+  setModelId: route({ name: "setModelId", method: "POST", path: "/model-configuration/model", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.modelId" }),
+  readModelConfigurationStatus: route({ name: "readModelConfigurationStatus", method: "POST", path: "/model-configuration/status", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.modelConfigurationStatus" }),
+  readAccount: route({ name: "readAccount", method: "POST", path: "/account", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.account" }),
+  readDisplayNames: route({ name: "readDisplayNames", method: "POST", path: "/principals/names", group: "read", selector: "none", subject: "display-names", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "admin-sdk", capability: "admin.displayNames" }),
+  listMembers: route({ name: "listMembers", method: "POST", path: "/projects/members", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "admin-sdk", capability: "admin.members" }),
+  changeMembershipRole: route({
+    name: "changeMembershipRole",
+    method: "POST",
+    path: "/membership-roles",
+    group: "administration",
+    selector: "none",
+    subject: "membership-scope",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.membershipRole"
+  }),
+  listOrganisationMembers: route({ name: "listOrganisationMembers", method: "POST", path: "/organisation/members", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "admin-sdk", capability: "admin.organisationMembers" }),
+  listServiceIdentities: route({ name: "listServiceIdentities", method: "POST", path: "/organisation/service-identities", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.serviceIdentities" }),
+  createInvitation: route({
+    name: "createInvitation",
+    method: "POST",
+    path: "/invitations",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.invitation"
+  }),
+  listInvitations: route({ name: "listInvitations", method: "POST", path: "/invitations/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.invitationList" }),
+  revokeInvitation: route({ name: "revokeInvitation", method: "POST", path: "/invitation-revocations", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.invitationRevocation" }),
+  readInvitationDomainRule: route({ name: "readInvitationDomainRule", method: "POST", path: "/invitation-domain-rule/read", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.invitationDomainRuleRead" }),
+  setInvitationDomainRule: route({
+    name: "setInvitationDomainRule",
+    method: "POST",
+    path: "/invitation-domain-rule",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.invitationDomainRule"
+  }),
+  reissueInvitation: route({
+    name: "reissueInvitation",
+    method: "POST",
+    path: "/invitation-reissues",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.invitationReissue"
+  }),
+  createPlatformInvitation: route({
+    name: "createPlatformInvitation",
+    method: "POST",
+    path: "/platform-invitations",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.platformInvitation"
+  }),
+  listPlatformInvitations: route({ name: "listPlatformInvitations", method: "POST", path: "/platform-invitations/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.platformInvitationList" }),
+  revokePlatformInvitation: route({ name: "revokePlatformInvitation", method: "POST", path: "/platform-invitation-revocations", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.platformInvitationRevocation" }),
+  reissuePlatformInvitation: route({
+    name: "reissuePlatformInvitation",
+    method: "POST",
+    path: "/platform-invitation-reissues",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.platformInvitationReissue"
+  }),
+  readWebOrigin: route({ name: "readWebOrigin", method: "POST", path: "/web-origin/read", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "service"), versioned: true, module: "admin-sdk", capability: "admin.webOrigin" }),
+  readCallerCapabilities: route({ name: "readCallerCapabilities", method: "POST", path: "/caller-capabilities/read", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "admin-sdk", capability: "admin.callerCapabilities" }),
+  queryGraph: route({ name: "queryGraph", method: "POST", path: "/objects/graph", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.traverse" }),
+  readStructure: route({ name: "readStructure", method: "POST", path: "/objects/structure", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.traverse" }),
+  findPaths: route({ name: "findPaths", method: "POST", path: "/objects/paths", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.traverse" }),
+  listProposals: route({ name: "listProposals", method: "POST", path: "/proposals/list", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.proposalList" }),
+  readProposal: route({ name: "readProposal", method: "POST", path: "/proposals/read", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.proposalRead" }),
+  refuseProposal: route({ name: "refuseProposal", method: "POST", path: "/proposal-refusals", group: "branch", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "app:client"), versioned: true, module: "branches-sdk", capability: "branches.proposalRefusal" }),
+  approveProposal: route({ name: "approveProposal", method: "POST", path: "/proposal-approvals", group: "branch", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "branches-sdk", capability: "branches.proposalApproval" }),
+  readBranchDiff: route({ name: "readBranchDiff", method: "POST", path: "/branches/diff", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.proposalDiff" }),
   readLinkStatus: route({
     name: "readLinkStatus",
     method: "POST",
@@ -1091,7 +1689,7 @@ var ROUTES = Object.freeze({
     selector: "object",
     subject: "project",
     idempotent: false,
-    admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"),
+    policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"),
     versioned: true,
     module: "objects-sdk",
     capability: "links.status"
@@ -1104,7 +1702,7 @@ var ROUTES = Object.freeze({
     selector: "project",
     subject: "project",
     idempotent: true,
-    admission: admitting("user", "run-apply", "client", "service"),
+    policy: admittingActors("person", "agent:apply", "app:client", "service"),
     versioned: true,
     module: "objects-sdk",
     capability: "links.clear"
@@ -1117,91 +1715,174 @@ var ROUTES = Object.freeze({
     selector: "project",
     subject: "project",
     idempotent: false,
-    admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"),
+    policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"),
     versioned: true,
     module: "branches-sdk",
     capability: "branches.impact"
   }),
-  diffBranches: route({ name: "diffBranches", method: "POST", path: "/branches/difference", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.diff" }),
-  readBranchHistory: route({ name: "readBranchHistory", method: "POST", path: "/branches/history", group: "history", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.history" }),
-  listAudit: route({ name: "listAudit", method: "POST", path: "/audit", group: "history", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "run-explore", "run-apply", "run-types"), versioned: true, module: "admin-sdk", capability: "admin.audit" }),
-  listOrganisationAudit: route({ name: "listOrganisationAudit", method: "POST", path: "/organisation-audit", group: "history", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisationAudit" }),
-  readRefHead: route({ name: "readRefHead", method: "POST", path: "/branches/head", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "run-types", "client", "hosted-app"), versioned: true, module: "branches-sdk", capability: "branches.head" }),
-  inspectBranchOperation: route({ name: "inspectBranchOperation", method: "POST", path: "/branch-inspections", group: "branch", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "client"), versioned: true, module: "branches-sdk", capability: "branches.inspection" }),
-  abandonBranch: route({ name: "abandonBranch", method: "POST", path: "/branch-abandonments", group: "branch", selector: "project", subject: "project", idempotent: true, admission: admitting("user", "service", "client"), versioned: true, module: "branches-sdk", capability: "branches.abandonment" }),
-  addRefRule: route({ name: "addRefRule", method: "POST", path: "/ref-rules", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
-  listRefRules: route({ name: "listRefRules", method: "POST", path: "/projects/ref-rules", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
-  removeRefRule: route({ name: "removeRefRule", method: "POST", path: "/ref-rule-removals", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
-  addOrganisationRule: route({ name: "addOrganisationRule", method: "POST", path: "/organisation-ref-rules", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
-  listOrganisationRules: route({ name: "listOrganisationRules", method: "POST", path: "/organisation-ref-rules/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
-  removeOrganisationRule: route({ name: "removeOrganisationRule", method: "POST", path: "/organisation-ref-rule-removals", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
-  createOrganisationRef: route({ name: "createOrganisationRef", method: "POST", path: "/organisation-refs", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
-  listOrganisationRefs: route({ name: "listOrganisationRefs", method: "POST", path: "/organisation-refs/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
-  deleteOrganisationRef: route({ name: "deleteOrganisationRef", method: "POST", path: "/organisation-ref-deletions", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
-  markOrganisationRefReadOnly: route({ name: "markOrganisationRefReadOnly", method: "POST", path: "/organisation-ref-read-only", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
-  setObjectLock: route({ name: "setObjectLock", method: "POST", path: "/object-locks", group: "write", selector: "object", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "objects-sdk", capability: "objects.locks" }),
-  readAgentCeiling: route({ name: "readAgentCeiling", method: "POST", path: "/projects/agent-ceiling", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.agent-ceiling" }),
-  setAgentCeiling: route({ name: "setAgentCeiling", method: "POST", path: "/agent-ceiling", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.agent-ceiling" }),
-  requestSchemaUpdate: route({ name: "requestSchemaUpdate", method: "POST", path: "/schema-update-requests", group: "branch", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "branches-sdk", capability: "branches.schema-update" }),
-  readSchemaUpdateRequest: route({ name: "readSchemaUpdateRequest", method: "POST", path: "/schema-update-requests/read", group: "branch", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "branches-sdk", capability: "branches.schema-update" }),
-  openAgentSession: route({ name: "openAgentSession", method: "POST", path: "/agent-sessions", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.session" }),
-  listAgentSessions: route({ name: "listAgentSessions", method: "POST", path: "/agent-sessions/list", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.sessionList" }),
-  readAgentSession: route({ name: "readAgentSession", method: "POST", path: "/agent-sessions/read", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.sessionRead" }),
-  sendMessage: route({ name: "sendMessage", method: "POST", path: "/agent-messages", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.message" }),
-  answerPlan: route({ name: "answerPlan", method: "POST", path: "/agent-plan-answers", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.planAnswer" }),
-  stopRun: route({ name: "stopRun", method: "POST", path: "/agent-run-stops", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.runStop" }),
-  closePlan: route({ name: "closePlan", method: "POST", path: "/agent-plan-closes", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.planClose" }),
-  sendMessageStreamed: route({ name: "sendMessageStreamed", method: "POST", path: "/agent-messages/stream", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.messageStreamed" }),
-  answerPlanStreamed: route({ name: "answerPlanStreamed", method: "POST", path: "/agent-plan-answers/stream", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.planAnswerStreamed" }),
-  createProject: route({ name: "createProject", method: "POST", path: "/project-creations", group: "administration", selector: "none", subject: "none", idempotent: true, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.projects" }),
-  createOrganisation: route({ name: "createOrganisation", method: "POST", path: "/organisation-creations", group: "administration", selector: "none", subject: "creating", idempotent: true, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisations" }),
-  openChangeSet: route({ name: "openChangeSet", method: "POST", path: "/change-sets", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  readCurrentChangeSet: route({ name: "readCurrentChangeSet", method: "POST", path: "/change-sets/current", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  readChangeSet: route({ name: "readChangeSet", method: "POST", path: "/change-sets/read", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  readChangeSetState: route({ name: "readChangeSetState", method: "POST", path: "/change-sets/state", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  reviseChangeSet: route({ name: "reviseChangeSet", method: "POST", path: "/change-sets/revisions", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  validateChangeSet: route({ name: "validateChangeSet", method: "POST", path: "/change-sets/validation", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  discardChangeSet: route({ name: "discardChangeSet", method: "POST", path: "/change-set-discards", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
-  acceptChangeSet: route({ name: "acceptChangeSet", method: "POST", path: "/change-set-acceptances", group: "administration", selector: "none", subject: "none", idempotent: true, admission: admitting("user"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
-  readApp: route({ name: "readApp", method: "POST", path: "/apps/read", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "run-types", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.catalogue" }),
-  openAppDraft: route({ name: "openAppDraft", method: "POST", path: "/app-drafts", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  readAppDraft: route({ name: "readAppDraft", method: "POST", path: "/app-drafts/read", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  reviseAppDraft: route({ name: "reviseAppDraft", method: "POST", path: "/app-drafts/revisions", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  acceptAppDraft: route({ name: "acceptAppDraft", method: "POST", path: "/app-draft-acceptances", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
-  listApps: route({ name: "listApps", method: "POST", path: "/apps", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "run-types", "client", "hosted-app"), versioned: true, module: "objects-sdk", capability: "objects.catalogue" }),
-  validateAppDraft: route({ name: "validateAppDraft", method: "POST", path: "/app-drafts/validation", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user", "run-types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
-  discardAppDraft: route({ name: "discardAppDraft", method: "POST", path: "/app-draft-discards", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
-  searchPeople: route({ name: "searchPeople", method: "POST", path: "/people/search", group: "read", selector: "none", subject: "display-names", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "people.search" }),
-  searchObjectReaders: route({ name: "searchObjectReaders", method: "POST", path: "/objects/readers", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "people.objectReaders" }),
-  listSubscribers: route({ name: "listSubscribers", method: "POST", path: "/objects/subscribers", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "discussion.subscribers" }),
-  addSubscriber: route({ name: "addSubscriber", method: "POST", path: "/objects/subscribers/add", group: "write", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "discussion.subscriberChange" }),
-  removeSubscriber: route({ name: "removeSubscriber", method: "POST", path: "/objects/subscribers/remove", group: "write", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "discussion.subscriberChange" }),
-  listComments: route({ name: "listComments", method: "POST", path: "/objects/comments", group: "read", selector: "object", subject: "project", idempotent: false, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "discussion.comments" }),
-  addComment: route({ name: "addComment", method: "POST", path: "/objects/comments/add", group: "write", selector: "object", subject: "project", idempotent: true, admission: admitting("user", "hosted-app"), versioned: true, module: "objects-sdk", capability: "discussion.commentWrite" }),
-  createConnection: route({ name: "createConnection", method: "POST", path: "/connections", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.connectionCreation" }),
-  listConnections: route({ name: "listConnections", method: "POST", path: "/connections/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.connections" }),
-  setConnectionCredential: route({ name: "setConnectionCredential", method: "POST", path: "/connections/credential", group: "administration", selector: "connection", subject: "connection", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.connectionCredential" }),
-  readConnectionIdentity: route({ name: "readConnectionIdentity", method: "POST", path: "/connections/identity", group: "read", selector: "connection", subject: "connection", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.connectionIdentity" }),
-  draftConnectorTypes: route({ name: "draftConnectorTypes", method: "POST", path: "/connections/types", group: "administration", selector: "connection", subject: "connection", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.connectorTypes" }),
-  revokeConnection: route({ name: "revokeConnection", method: "POST", path: "/connection-revocations", group: "administration", selector: "connection", subject: "connection", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.connectionRevocation" }),
-  startImportRun: route({ name: "startImportRun", method: "POST", path: "/import-runs", group: "write", selector: "connection", subject: "connection", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.importRunStart" }),
-  listImportRuns: route({ name: "listImportRuns", method: "POST", path: "/import-runs/list", group: "read", selector: "connection", subject: "connection", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.importRuns" }),
-  closeImportRun: route({ name: "closeImportRun", method: "POST", path: "/import-run-closes", group: "write", selector: "connection", subject: "connection", idempotent: false, admission: admitting("service", "user"), versioned: true, module: "admin-sdk", capability: "admin.importRunClose" }),
-  createHostedApp: route({ name: "createHostedApp", method: "POST", path: "/hosted-apps", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.app" }),
-  publishHostedVersion: route({ name: "publishHostedVersion", method: "POST", path: "/hosted-apps/versions", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.publish" }),
-  readHostedBundle: route({ name: "readHostedBundle", method: "POST", path: "/hosted-apps/bundle", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.bundle" }),
-  listHostedApps: route({ name: "listHostedApps", method: "POST", path: "/hosted-apps/list", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.apps" }),
-  listHostedVersions: route({ name: "listHostedVersions", method: "POST", path: "/hosted-apps/versions/list", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.versions" }),
-  revokeHostedApp: route({ name: "revokeHostedApp", method: "POST", path: "/hosted-app-revocations", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.appRevocation" }),
-  revokeHostedVersion: route({ name: "revokeHostedVersion", method: "POST", path: "/hosted-version-revocations", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.versionRevocation" }),
-  openHostedApp: route({ name: "openHostedApp", method: "POST", path: "/hosted-app-launches", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.launch" }),
-  endHostedLaunch: route({ name: "endHostedLaunch", method: "POST", path: "/hosted-app-launch-ends", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.launchEnd" }),
-  mintHostedAppToken: route({ name: "mintHostedAppToken", method: "POST", path: "/hosted-app-tokens", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.token" }),
-  setHostedOneWallSwitch: route({ name: "setHostedOneWallSwitch", method: "POST", path: "/hosted-one-wall-switch", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallSwitch" }),
-  readHostedOneWallSwitch: route({ name: "readHostedOneWallSwitch", method: "POST", path: "/hosted-one-wall-switch/read", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallSwitchRead" }),
-  grantHostedOneWall: route({ name: "grantHostedOneWall", method: "POST", path: "/hosted-one-wall-grants", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallGrant" }),
-  withdrawHostedOneWall: route({ name: "withdrawHostedOneWall", method: "POST", path: "/hosted-one-wall-withdrawals", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallWithdrawal" }),
-  listHostedOneWallGrants: route({ name: "listHostedOneWallGrants", method: "POST", path: "/hosted-one-wall-grants/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallGrants" })
+  diffBranches: route({ name: "diffBranches", method: "POST", path: "/branches/difference", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.diff" }),
+  readBranchHistory: route({ name: "readBranchHistory", method: "POST", path: "/branches/history", group: "history", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.history" }),
+  listAudit: route({ name: "listAudit", method: "POST", path: "/audit", group: "history", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "agent:explore", "agent:apply", "agent:types"), versioned: true, module: "admin-sdk", capability: "admin.audit" }),
+  listOrganisationAudit: route({ name: "listOrganisationAudit", method: "POST", path: "/organisation-audit", group: "history", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisationAudit" }),
+  readRefHead: route({ name: "readRefHead", method: "POST", path: "/branches/head", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "agent:types", "app:client", "app:hosted"), versioned: true, module: "branches-sdk", capability: "branches.head" }),
+  inspectBranchOperation: route({ name: "inspectBranchOperation", method: "POST", path: "/branch-inspections", group: "branch", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person", "service", "app:client"), versioned: true, module: "branches-sdk", capability: "branches.inspection" }),
+  abandonBranch: route({ name: "abandonBranch", method: "POST", path: "/branch-abandonments", group: "branch", selector: "project", subject: "project", idempotent: true, policy: admittingActors("person", "service", "app:client"), versioned: true, module: "branches-sdk", capability: "branches.abandonment" }),
+  addRefRule: route({ name: "addRefRule", method: "POST", path: "/ref-rules", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
+  listRefRules: route({ name: "listRefRules", method: "POST", path: "/projects/ref-rules", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
+  removeRefRule: route({
+    name: "removeRefRule",
+    method: "POST",
+    path: "/ref-rule-removals",
+    group: "administration",
+    selector: "project",
+    subject: "project",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.ref-rules"
+  }),
+  updateRefRule: route({ name: "updateRefRule", method: "POST", path: "/ref-rule-updates", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
+  addOrganisationRule: route({ name: "addOrganisationRule", method: "POST", path: "/organisation-ref-rules", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
+  listOrganisationRules: route({ name: "listOrganisationRules", method: "POST", path: "/organisation-ref-rules/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
+  removeOrganisationRule: route({
+    name: "removeOrganisationRule",
+    method: "POST",
+    path: "/organisation-ref-rule-removals",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.organisation-ref-rules"
+  }),
+  updateOrganisationRule: route({ name: "updateOrganisationRule", method: "POST", path: "/organisation-ref-rule-updates", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
+  createOrganisationRef: route({ name: "createOrganisationRef", method: "POST", path: "/organisation-refs", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
+  listOrganisationRefs: route({ name: "listOrganisationRefs", method: "POST", path: "/organisation-refs/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
+  deleteOrganisationRef: route({
+    name: "deleteOrganisationRef",
+    method: "POST",
+    path: "/organisation-ref-deletions",
+    group: "administration",
+    selector: "none",
+    subject: "none",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.organisation-refs"
+  }),
+  markOrganisationRefReadOnly: route({ name: "markOrganisationRefReadOnly", method: "POST", path: "/organisation-ref-read-only", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
+  setObjectLock: route({
+    name: "setObjectLock",
+    method: "POST",
+    path: "/object-locks",
+    group: "write",
+    selector: "object",
+    subject: "project",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "objects-sdk",
+    capability: "objects.locks"
+  }),
+  readAgentCeiling: route({ name: "readAgentCeiling", method: "POST", path: "/projects/agent-ceiling", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.agent-ceiling" }),
+  setAgentCeiling: route({
+    name: "setAgentCeiling",
+    method: "POST",
+    path: "/agent-ceiling",
+    group: "administration",
+    selector: "project",
+    subject: "project",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.agent-ceiling"
+  }),
+  requestSchemaUpdate: route({ name: "requestSchemaUpdate", method: "POST", path: "/schema-update-requests", group: "branch", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "branches-sdk", capability: "branches.schema-update" }),
+  readSchemaUpdateRequest: route({ name: "readSchemaUpdateRequest", method: "POST", path: "/schema-update-requests/read", group: "branch", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "branches-sdk", capability: "branches.schema-update" }),
+  openAgentSession: route({ name: "openAgentSession", method: "POST", path: "/agent-sessions", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.session" }),
+  listAgentSessions: route({ name: "listAgentSessions", method: "POST", path: "/agent-sessions/list", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.sessionList" }),
+  readAgentSession: route({ name: "readAgentSession", method: "POST", path: "/agent-sessions/read", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.sessionRead" }),
+  sendMessage: route({ name: "sendMessage", method: "POST", path: "/agent-messages", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.message" }),
+  answerPlan: route({ name: "answerPlan", method: "POST", path: "/agent-plan-answers", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.planAnswer" }),
+  stopRun: route({ name: "stopRun", method: "POST", path: "/agent-run-stops", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.runStop" }),
+  closePlan: route({ name: "closePlan", method: "POST", path: "/agent-plan-closes", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.planClose" }),
+  sendMessageStreamed: route({ name: "sendMessageStreamed", method: "POST", path: "/agent-messages/stream", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.messageStreamed" }),
+  answerPlanStreamed: route({ name: "answerPlanStreamed", method: "POST", path: "/agent-plan-answers/stream", group: "agent", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "agents-sdk", capability: "agents.planAnswerStreamed" }),
+  createProject: route({ name: "createProject", method: "POST", path: "/project-creations", group: "administration", selector: "none", subject: "none", idempotent: true, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.projects" }),
+  createOrganisation: route({ name: "createOrganisation", method: "POST", path: "/organisation-creations", group: "administration", selector: "none", subject: "creating", idempotent: true, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.organisations" }),
+  openChangeSet: route({ name: "openChangeSet", method: "POST", path: "/change-sets", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  readCurrentChangeSet: route({ name: "readCurrentChangeSet", method: "POST", path: "/change-sets/current", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  readChangeSet: route({ name: "readChangeSet", method: "POST", path: "/change-sets/read", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  readChangeSetState: route({ name: "readChangeSetState", method: "POST", path: "/change-sets/state", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  reviseChangeSet: route({ name: "reviseChangeSet", method: "POST", path: "/change-sets/revisions", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  validateChangeSet: route({ name: "validateChangeSet", method: "POST", path: "/change-sets/validation", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  discardChangeSet: route({ name: "discardChangeSet", method: "POST", path: "/change-set-discards", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
+  acceptChangeSet: route({ name: "acceptChangeSet", method: "POST", path: "/change-set-acceptances", group: "administration", selector: "none", subject: "none", idempotent: true, policy: admittingActors("person"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
+  readApp: route({ name: "readApp", method: "POST", path: "/apps/read", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "agent:types", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.catalogue" }),
+  openAppDraft: route({ name: "openAppDraft", method: "POST", path: "/app-drafts", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  readAppDraft: route({ name: "readAppDraft", method: "POST", path: "/app-drafts/read", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  reviseAppDraft: route({ name: "reviseAppDraft", method: "POST", path: "/app-drafts/revisions", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  acceptAppDraft: route({ name: "acceptAppDraft", method: "POST", path: "/app-draft-acceptances", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
+  listApps: route({ name: "listApps", method: "POST", path: "/apps", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "agent:types", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.catalogue" }),
+  validateAppDraft: route({ name: "validateAppDraft", method: "POST", path: "/app-drafts/validation", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person", "agent:types"), versioned: true, module: "ontology-sdk", capability: "ontology.draft" }),
+  discardAppDraft: route({ name: "discardAppDraft", method: "POST", path: "/app-draft-discards", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "ontology-sdk", capability: "ontology.publish" }),
+  searchPeople: route({ name: "searchPeople", method: "POST", path: "/people/search", group: "read", selector: "none", subject: "display-names", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "people.search" }),
+  searchObjectReaders: route({ name: "searchObjectReaders", method: "POST", path: "/objects/readers", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "people.objectReaders" }),
+  listSubscribers: route({ name: "listSubscribers", method: "POST", path: "/objects/subscribers", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "discussion.subscribers" }),
+  addSubscriber: route({ name: "addSubscriber", method: "POST", path: "/objects/subscribers/add", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "discussion.subscriberChange" }),
+  removeSubscriber: route({ name: "removeSubscriber", method: "POST", path: "/objects/subscribers/remove", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "discussion.subscriberChange" }),
+  listComments: route({ name: "listComments", method: "POST", path: "/objects/comments", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "discussion.comments" }),
+  acquireDraft: route({ name: "acquireDraft", method: "POST", path: "/objects/drafts/acquire", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "agent:apply", "app:client"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  saveDraft: route({ name: "saveDraft", method: "POST", path: "/objects/drafts/save", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "agent:apply", "app:client"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  promoteDraft: route({ name: "promoteDraft", method: "POST", path: "/objects/drafts/promote", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "agent:apply", "app:client"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  releaseDraft: route({ name: "releaseDraft", method: "POST", path: "/objects/drafts/release", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "agent:apply", "app:client"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  discardDraft: route({ name: "discardDraft", method: "POST", path: "/objects/drafts/discard", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "agent:apply", "app:client"), versioned: true, module: "objects-sdk", capability: "objects.write" }),
+  breakDraftLock: route({ name: "breakDraftLock", method: "POST", path: "/objects/drafts/break", group: "write", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "objects-sdk", capability: "objects.draftAdmin" }),
+  readDraftLock: route({ name: "readDraftLock", method: "POST", path: "/objects/drafts/lock", group: "read", selector: "object", subject: "project", idempotent: false, policy: admittingActors("person", "service", "agent:explore", "agent:apply", "app:client", "app:hosted"), versioned: true, module: "objects-sdk", capability: "objects.read" }),
+  restoreDraft: route({ name: "restoreDraft", method: "POST", path: "/draft-restorations", group: "write", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "objects-sdk", capability: "objects.draftAdmin" }),
+  setCommentResolved: route({ name: "setCommentResolved", method: "POST", path: "/objects/comments/resolve", group: "write", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "objects-sdk", capability: "discussion.commentWrite" }),
+  addComment: route({ name: "addComment", method: "POST", path: "/objects/comments/add", group: "write", selector: "object", subject: "project", idempotent: true, policy: admittingActors("person", "app:hosted"), versioned: true, module: "objects-sdk", capability: "discussion.commentWrite" }),
+  createConnection: route({ name: "createConnection", method: "POST", path: "/connections", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.connectionCreation" }),
+  listConnections: route({ name: "listConnections", method: "POST", path: "/connections/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.connections" }),
+  setConnectionCredential: route({
+    name: "setConnectionCredential",
+    method: "POST",
+    path: "/connections/credential",
+    group: "administration",
+    selector: "connection",
+    subject: "connection",
+    idempotent: false,
+    policy: admittingActors("person"),
+    versioned: true,
+    module: "admin-sdk",
+    capability: "admin.connectionCredential"
+  }),
+  readConnectionIdentity: route({ name: "readConnectionIdentity", method: "POST", path: "/connections/identity", group: "read", selector: "connection", subject: "connection", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.connectionIdentity" }),
+  draftConnectorTypes: route({ name: "draftConnectorTypes", method: "POST", path: "/connections/types", group: "administration", selector: "connection", subject: "connection", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.connectorTypes" }),
+  revokeConnection: route({ name: "revokeConnection", method: "POST", path: "/connection-revocations", group: "administration", selector: "connection", subject: "connection", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.connectionRevocation" }),
+  startImportRun: route({ name: "startImportRun", method: "POST", path: "/import-runs", group: "write", selector: "connection", subject: "connection", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.importRunStart" }),
+  listImportRuns: route({ name: "listImportRuns", method: "POST", path: "/import-runs/list", group: "read", selector: "connection", subject: "connection", idempotent: false, policy: admittingActors("person"), versioned: true, module: "admin-sdk", capability: "admin.importRuns" }),
+  closeImportRun: route({ name: "closeImportRun", method: "POST", path: "/import-run-closes", group: "write", selector: "connection", subject: "connection", idempotent: false, policy: admittingActors("service", "person"), versioned: true, module: "admin-sdk", capability: "admin.importRunClose" }),
+  createHostedApp: route({ name: "createHostedApp", method: "POST", path: "/hosted-apps", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.app" }),
+  publishHostedVersion: route({ name: "publishHostedVersion", method: "POST", path: "/hosted-apps/versions", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.publish" }),
+  readHostedBundle: route({ name: "readHostedBundle", method: "POST", path: "/hosted-apps/bundle", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.bundle" }),
+  listHostedApps: route({ name: "listHostedApps", method: "POST", path: "/hosted-apps/list", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.apps" }),
+  listHostedVersions: route({ name: "listHostedVersions", method: "POST", path: "/hosted-apps/versions/list", group: "read", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.versions" }),
+  revokeHostedApp: route({ name: "revokeHostedApp", method: "POST", path: "/hosted-app-revocations", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.appRevocation" }),
+  revokeHostedVersion: route({ name: "revokeHostedVersion", method: "POST", path: "/hosted-version-revocations", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.versionRevocation" }),
+  openHostedApp: route({ name: "openHostedApp", method: "POST", path: "/hosted-app-launches", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.launch" }),
+  endHostedLaunch: route({ name: "endHostedLaunch", method: "POST", path: "/hosted-app-launch-ends", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.launchEnd" }),
+  mintHostedAppToken: route({ name: "mintHostedAppToken", method: "POST", path: "/hosted-app-tokens", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.token" }),
+  setHostedOneWallSwitch: route({ name: "setHostedOneWallSwitch", method: "POST", path: "/hosted-one-wall-switch", group: "administration", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallSwitch" }),
+  readHostedOneWallSwitch: route({ name: "readHostedOneWallSwitch", method: "POST", path: "/hosted-one-wall-switch/read", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallSwitchRead" }),
+  grantHostedOneWall: route({ name: "grantHostedOneWall", method: "POST", path: "/hosted-one-wall-grants", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallGrant" }),
+  withdrawHostedOneWall: route({ name: "withdrawHostedOneWall", method: "POST", path: "/hosted-one-wall-withdrawals", group: "administration", selector: "project", subject: "project", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallWithdrawal" }),
+  listHostedOneWallGrants: route({ name: "listHostedOneWallGrants", method: "POST", path: "/hosted-one-wall-grants/list", group: "read", selector: "none", subject: "none", idempotent: false, policy: admittingActors("person"), versioned: true, module: "hosted-apps-sdk", capability: "hostedApps.oneWallGrants" })
 });
 var ROUTE_CARRIES_CREDENTIAL = Object.freeze({
   createObjectSet: false,
@@ -1210,6 +1891,8 @@ var ROUTE_CARRIES_CREDENTIAL = Object.freeze({
   updateObjectSet: false,
   deleteObjectSet: false,
   health: false,
+  webSignInStart: false,
+  webRedeem: true,
   signInStart: false,
   signInCallback: true,
   redeem: true,
@@ -1227,6 +1910,11 @@ var ROUTE_CARRIES_CREDENTIAL = Object.freeze({
   decideConsent: false,
   listConnectedApps: false,
   revokeConnectedApp: false,
+  readStepUpRequest: false,
+  confirmStepUp: false,
+  readStepUpProof: true,
+  enterHumanMode: false,
+  readSessionStatus: false,
   stageAttachment: false,
   readAttachment: false,
   readObject: false,
@@ -1282,6 +1970,7 @@ var ROUTE_CARRIES_CREDENTIAL = Object.freeze({
   listProposals: false,
   readProposal: false,
   refuseProposal: false,
+  approveProposal: false,
   readBranchDiff: false,
   readLinkStatus: false,
   clearLinks: false,
@@ -1296,9 +1985,11 @@ var ROUTE_CARRIES_CREDENTIAL = Object.freeze({
   addRefRule: false,
   listRefRules: false,
   removeRefRule: false,
+  updateRefRule: false,
   addOrganisationRule: false,
   listOrganisationRules: false,
   removeOrganisationRule: false,
+  updateOrganisationRule: false,
   createOrganisationRef: false,
   listOrganisationRefs: false,
   deleteOrganisationRef: false,
@@ -1341,6 +2032,15 @@ var ROUTE_CARRIES_CREDENTIAL = Object.freeze({
   addSubscriber: false,
   removeSubscriber: false,
   listComments: false,
+  acquireDraft: false,
+  saveDraft: false,
+  promoteDraft: false,
+  releaseDraft: false,
+  discardDraft: false,
+  breakDraftLock: false,
+  readDraftLock: false,
+  restoreDraft: false,
+  setCommentResolved: false,
   addComment: false,
   createConnection: false,
   listConnections: false,
@@ -1443,6 +2143,13 @@ function attachmentNameHeader(name) {
   return `UTF-8''${encodeURIComponent(name).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`)}`;
 }
 
+// packages/api-contract/dist/actor-kind-label.js
+var ACTOR_KIND_LABELS = Object.freeze({
+  "run-explore": "agent:explore",
+  "run-apply": "agent:apply",
+  "run-types": "agent:types"
+});
+
 // packages/api-contract/dist/links.js
 var MAX_CLEAR_ENTRIES = 100;
 
@@ -1503,6 +2210,31 @@ function responseOf(status, body, reason, headers = {}) {
   });
 }
 
+// packages/sdk-dispatch/dist/step-up.js
+function stepUpHeaders(route2, attempt) {
+  if (!owesStepUp(route2.policy)) {
+    throw new Error(`the route ${route2.name} owes no step-up and takes no step-up attempt`);
+  }
+  const headers = {};
+  if (route2.idempotent) {
+    if (attempt.key !== null) {
+      throw new Error(`the route ${route2.name} is idempotent and its idempotency key is its step-up key`);
+    }
+  } else {
+    if (attempt.key === null) {
+      throw new Error(`the route ${route2.name} is not idempotent and a step-up attempt on it carries a key`);
+    }
+    if (!IDEMPOTENCY_KEY_PATTERN.test(attempt.key)) {
+      throw new Error("a step-up key is one to 128 characters of letters, numerals, '.', '_', '~' and '-'");
+    }
+    headers[STEP_UP_KEY_HEADER] = attempt.key;
+  }
+  if (attempt.proof !== null) {
+    headers[STEP_UP_HEADER] = attempt.proof;
+  }
+  return headers;
+}
+
 // packages/sdk-dispatch/dist/explain.js
 var BOUND_LABEL = {
   "request-body": "the request-body size",
@@ -1529,7 +2261,21 @@ function withMeaning(explanation, detail) {
 function explainClass(refusalClass) {
   return Object.freeze({ explanation: BY_CLASS[refusalClass], explains: "class" });
 }
-function explainResultRefusal(rule, refusalClass) {
+function attachmentCreationExplanation(rule, violations) {
+  if (rule !== "invalid-properties" || !Array.isArray(violations) || !violations.some((value) => typeof value === "object" && value !== null && "rule" in value && value.rule === "attachment-requires-object"))
+    return void 0;
+  return Object.freeze({
+    explanation: {
+      meaning: "An attachment needs an existing object.",
+      next: [{ option: "Create the object first, then stage and save its attachment." }]
+    },
+    explains: "rule"
+  });
+}
+function explainResultRefusal(rule, refusalClass, violations) {
+  const attachment = attachmentCreationExplanation(rule, violations);
+  if (attachment !== void 0)
+    return attachment;
   if (Object.hasOwn(BY_API_RULE, rule)) {
     return Object.freeze({ explanation: BY_API_RULE[rule], explains: "rule" });
   }
@@ -1549,6 +2295,9 @@ function explainRefused(refusal2, request3) {
       return Object.freeze({ explanation: withMeaning(explanation, `The requested ref name is ${JSON.stringify(name)}.`), explains: hasRuleExplanation ? "rule" : "class" });
     }
   }
+  const attachment = attachmentCreationExplanation(refusal2.rule, refusal2.violations);
+  if (attachment !== void 0)
+    return attachment;
   if (refusal2.rule === "malformed-query" && refusal2.violations.length > 0) {
     const paths = refusal2.violations.map((violation) => violation.path.join(".") || "the request").join(", ");
     return Object.freeze({ explanation: withMeaning(explanation, `Invalid field path: ${paths}.`), explains: hasRuleExplanation ? "rule" : "class" });
@@ -1612,7 +2361,7 @@ function explainedEnvelopeOf(envelope, request3) {
   if (!("rule" in result) || typeof result.rule !== "string") {
     throw new Error("a refused result arm named no rule, which the host records for every refusal");
   }
-  return { version: envelope.version, result: Object.freeze({ ...result, ...explainResultRefusal(result.rule, result.class) }) };
+  return { version: envelope.version, result: Object.freeze({ ...result, ...explainResultRefusal(result.rule, result.class, "violations" in result ? result.violations : void 0) }) };
 }
 function unauthenticatedEnvelope() {
   return { version: PROTOCOL_VERSION, refusal: explainedRefusalOf({ kind: "unauthenticated" }), correlationId: null };
@@ -2001,7 +2750,7 @@ async function requestBodyOf(route2, body, headers) {
   }
   return bytes;
 }
-async function call(transport, origin, route2, body, token, idempotencyKey) {
+async function call(transport, origin, route2, body, token, idempotencyKey, stepUp = null) {
   const entry2 = ROUTES[route2];
   if (entry2.idempotent !== (idempotencyKey !== null)) {
     throw new Error(entry2.idempotent ? `the route ${route2} is idempotent and takes an idempotency key` : `the route ${route2} is not idempotent and takes no idempotency key`);
@@ -2010,7 +2759,7 @@ async function call(transport, origin, route2, body, token, idempotencyKey) {
     "content-type": "application/json",
     [VERSION_HEADER]: String(PROTOCOL_VERSION)
   };
-  if (entry2.admission.admits !== "none") {
+  if ("actors" in entry2.policy) {
     if (token === null) {
       return unauthenticatedEnvelope();
     }
@@ -2019,6 +2768,9 @@ async function call(transport, origin, route2, body, token, idempotencyKey) {
   if (idempotencyKey !== null) {
     headers[IDEMPOTENCY_HEADER] = idempotencyKey;
   }
+  if (stepUp !== null) {
+    Object.assign(headers, stepUpHeaders(entry2, stepUp));
+  }
   const sent = await requestBodyOf(route2, body, headers);
   const response = await transport(`${origin}${entry2.path}`, { method: entry2.method, headers, body: sent });
   return explainedEnvelopeOf(await readEnvelope(response, entry2.path), body);
@@ -2039,7 +2791,7 @@ function isEnvelopeShaped(value) {
 }
 async function* callStreamed(transport, origin, route2, body, token, signal) {
   const entry2 = ROUTES[route2];
-  if (entry2.admission.admits === "none") {
+  if ("none" in entry2.policy) {
     throw new Error(`the streamed route ${route2} admits no token, which no streamed route does today`);
   }
   if (token === null) {
@@ -2131,7 +2883,7 @@ function freezeDoc(doc2) {
   return Object.freeze({ does: doc2.does, refuses: Object.freeze([...doc2.refuses]) });
 }
 function methodOf(entry2, transport, origin, token) {
-  const send = async (body, idempotencyKey = null) => {
+  const send = async (body, idempotencyKey = null, stepUp = null) => {
     if (entry2.idempotent !== (idempotencyKey !== null)) {
       throw new Error(entry2.idempotent ? `the entry ${entry2.name} is idempotent and takes an idempotency key` : `the entry ${entry2.name} is not idempotent and takes no idempotency key`);
     }
@@ -2139,7 +2891,7 @@ function methodOf(entry2, transport, origin, token) {
       "content-type": "application/json",
       [VERSION_HEADER]: String(PROTOCOL_VERSION)
     };
-    if (entry2.admission.admits !== "none") {
+    if ("actors" in entry2.policy) {
       if (token === null) {
         return unauthenticatedEnvelope();
       }
@@ -2148,6 +2900,9 @@ function methodOf(entry2, transport, origin, token) {
     if (idempotencyKey !== null) {
       headers[IDEMPOTENCY_HEADER] = idempotencyKey;
     }
+    if (stepUp !== null) {
+      Object.assign(headers, stepUpHeaders(entry2, stepUp));
+    }
     const response = await transport(`${origin}${entry2.path}`, { method: entry2.method, headers, body: JSON.stringify(body) });
     return explainedEnvelopeOf(await readEnvelope(response, entry2.path), body);
   };
@@ -2275,6 +3030,109 @@ function createHttpsTransport(origin, options = {}, deadlineMs) {
   };
 }
 
+// packages/sdk-dispatch/dist/step-up-road.js
+var POLL_INTERVAL_MS = 2e3;
+var POLL_LIMIT_MS = 31e4;
+function refusalOf(body) {
+  if (typeof body !== "object" || body === null || !("refusal" in body)) {
+    return null;
+  }
+  const refusal2 = body.refusal;
+  return typeof refusal2 === "object" && refusal2 !== null ? refusal2 : null;
+}
+function replayed(first, body) {
+  return {
+    status: first.status,
+    ...first.reason === void 0 ? {} : { reason: first.reason },
+    header: (name) => first.header(name),
+    bytes: () => first.bytes(),
+    json: async () => body
+  };
+}
+function freshKey() {
+  return `cli-${crypto.randomUUID()}`;
+}
+async function post(transport, origin, route2, token, input) {
+  const entry2 = ROUTES[route2];
+  const response = await transport(`${origin}${entry2.path}`, {
+    method: entry2.method,
+    headers: { "content-type": "application/json", [VERSION_HEADER]: String(PROTOCOL_VERSION), [TOKEN_HEADER]: token },
+    body: JSON.stringify({ input })
+  });
+  return { response, envelope: await readEnvelope(response, entry2.path) };
+}
+async function pollForProof(transport, origin, token, pendingId, road, signal) {
+  const stopped = () => signal?.aborted === true;
+  const stop = road.clock.now() + POLL_LIMIT_MS;
+  while (road.clock.now() < stop) {
+    if (stopped())
+      return { state: "stopped" };
+    const { response, envelope } = await post(transport, origin, "readStepUpProof", token, { pendingId });
+    if (stopped())
+      return { state: "stopped" };
+    if ("refusal" in envelope) {
+      return { state: "refused", response: replayed(response, envelope) };
+    }
+    if (road.clock.now() >= stop)
+      return { state: "timed-out" };
+    const result = envelope.result;
+    if (result.state === "confirmed" && typeof result.proof === "string") {
+      return { state: "confirmed", proof: result.proof };
+    }
+    if (result.state !== "awaiting") {
+      throw new Error("the proof poll answered an unrecognised state");
+    }
+    await road.clock.wait(POLL_INTERVAL_MS);
+  }
+  return { state: "timed-out" };
+}
+function withStepUpRoad(transport, road) {
+  return async (input, init) => {
+    const path = new URL(input).pathname;
+    const entry2 = Object.values(ROUTES).find((candidate) => candidate.path === path && candidate.method === init.method);
+    if (entry2 === void 0 || !owesStepUp(entry2.policy)) {
+      return transport(input, init);
+    }
+    const headers = { ...init.headers };
+    if (!entry2.idempotent && headers[STEP_UP_KEY_HEADER] === void 0) {
+      headers[STEP_UP_KEY_HEADER] = freshKey();
+    }
+    const first = await transport(input, { ...init, headers });
+    if (first.status !== 403) {
+      return first;
+    }
+    const body = await first.json();
+    const refusal2 = refusalOf(body);
+    if (refusal2 === null || refusal2.kind !== "refused" || refusal2.rule !== "step-up-required" || refusal2.pending === void 0) {
+      return replayed(first, body);
+    }
+    const origin = new URL(input).origin;
+    const token = headers[TOKEN_HEADER];
+    const discovery = await post(transport, origin, "readWebOrigin", token, {});
+    if ("refusal" in discovery.envelope) {
+      return replayed(discovery.response, discovery.envelope);
+    }
+    const webOrigin = discovery.envelope.result.webOrigin;
+    if (typeof webOrigin !== "string") {
+      road.note("this action needs your confirmation in a browser, and this host has no web application configured to ask it in");
+      return replayed(first, body);
+    }
+    road.announce(road.confirmAddress(refusal2.pending, webOrigin));
+    road.note("this action needs your confirmation: open the address above and confirm; waiting");
+    const polled = await pollForProof(transport, origin, token, refusal2.pending, road);
+    if (polled.state === "refused") {
+      return polled.response;
+    }
+    if (polled.state === "stopped")
+      return replayed(first, body);
+    if (polled.state === "timed-out") {
+      road.note("the action was refused because nobody confirmed it in time; run the command again");
+      return replayed(first, body);
+    }
+    return transport(input, { ...init, headers: { ...headers, [STEP_UP_HEADER]: polled.proof } });
+  };
+}
+
 // packages/sdk-dispatch/dist/token-routes.js
 async function redeem(transport, origin, body) {
   return call(transport, origin, "redeem", body, null, null);
@@ -2294,6 +3152,12 @@ async function detachOrganisation(transport, origin, token, body) {
 async function listOrganisations(transport, origin, token, body) {
   return call(transport, origin, "listOrganisations", body, token, null);
 }
+function readSessionStatus(transport, origin, token, body) {
+  return call(transport, origin, "readSessionStatus", body, token, null);
+}
+function enterHumanMode(transport, origin, token, body, stepUp) {
+  return call(transport, origin, "enterHumanMode", body, token, null, stepUp);
+}
 
 // packages/sdk-core/dist/index.js
 var SDK_CORE_ROUTE_ENTRIES = routeEntriesOf("sdk-core");
@@ -2339,9 +3203,11 @@ var ADMIN_ROUTE_NAMES = Object.freeze([
   "addRefRule",
   "listRefRules",
   "removeRefRule",
+  "updateRefRule",
   "addOrganisationRule",
   "listOrganisationRules",
   "removeOrganisationRule",
+  "updateOrganisationRule",
   "createOrganisationRef",
   "listOrganisationRefs",
   "deleteOrganisationRef",
@@ -2401,6 +3267,7 @@ var BRANCHES_ROUTE_NAMES = Object.freeze([
   "listProposals",
   "readProposal",
   "refuseProposal",
+  "approveProposal",
   "readBranchDiff",
   "diffBranches",
   "readChangeImpact",
@@ -2521,6 +3388,9 @@ function withViewState(address, state) {
 function branchDiffAddress(organisationId, projectId, ref) {
   return withSubject(`${projectBase(organisationId, projectId)}/branches/diff`, { ref, q: null });
 }
+function stepUpAddress(pendingId) {
+  return `/step-up?${new URLSearchParams({ pending: pendingId }).toString()}`;
+}
 
 // packages/addresses/dist/links.js
 var ORGANISATION_PAGES = Object.freeze([...ORGANISATION_ADMIN_PAGES, "settings"]);
@@ -2667,6 +3537,15 @@ var OBJECTS_ROUTE_NAMES = [
   "removeSubscriber",
   "listComments",
   "addComment",
+  "acquireDraft",
+  "saveDraft",
+  "promoteDraft",
+  "releaseDraft",
+  "discardDraft",
+  "breakDraftLock",
+  "readDraftLock",
+  "restoreDraft",
+  "setCommentResolved",
   "readApp",
   "listApps",
   "setObjectLock"
@@ -3801,6 +4680,7 @@ function objectProspective(published) {
     requiredPropertyKeys: stringListOf(published.requiredPropertyKeys, `${what} requiredPropertyKeys`),
     presentationBindings: published.presentationBindings,
     structureDeclaration: published.structureDeclaration,
+    ...published.bodyFormat === "markdown" ? { bodyFormat: published.bodyFormat } : {},
     ...published.subscriptionRoles === void 0 ? {} : { subscriptionRoles: published.subscriptionRoles }
   };
 }
@@ -4370,17 +5250,28 @@ function refusalLines(refusal2, settle2, request3, host, reference) {
     }
   }
   if (refusal2.kind === "protocol-mismatch") {
-    lines.push("Update with: npm install -g @openengio/cli@latest");
+    lines.push(protocolUpdate(refusal2.versions.host).text);
   }
   if (reference !== void 0) {
     lines.push(`reference: ${reference}`);
   }
   return lines;
 }
+function protocolUpdate(hostProtocol) {
+  if (hostProtocol > PROTOCOL_VERSION) {
+    const command2 = "npm install -g @openengio/cli@latest";
+    return { command: command2, text: `Update with: ${command2} (the CLI for protocol ${hostProtocol} is version 0.${hostProtocol}.x)` };
+  }
+  const command = `npm install -g @openengio/cli@0.${hostProtocol}`;
+  return {
+    command,
+    text: `The host has not been updated to protocol ${PROTOCOL_VERSION} yet. Wait for it, or install the CLI built for its protocol: ${command}`
+  };
+}
 function refusalValue(refusal2, settle2, request3, host, reference) {
   const referenced = reference === void 0 ? {} : { reference };
   if (refusal2.kind === "protocol-mismatch") {
-    return { ...refusal2, clientVersion: PROTOCOL_VERSION, update: "npm install -g @openengio/cli@latest", ...host === void 0 ? {} : { host }, ...referenced };
+    return { ...refusal2, clientVersion: PROTOCOL_VERSION, update: protocolUpdate(refusal2.versions.host).command, ...host === void 0 ? {} : { host }, ...referenced };
   }
   const allowed = allowedFieldOf(refusal2, request3);
   const settled = refusal2.kind === "unknown-outcome" ? { ...refusal2, settle: settle2 } : refusal2;
@@ -5028,6 +5919,10 @@ var buildClients = async (host, store, transport, streamTransport) => {
         detach: () => detachOrganisation(transport, origin, token, { input: {} })
       },
       ontology: createOntologyClient(transport, origin, token),
+      session: {
+        human: () => enterHumanMode(transport, origin, token, { input: {} }),
+        status: () => readSessionStatus(transport, origin, token, { input: {} })
+      },
       streamed: stream === null ? null : {
         sendMessageStreamed: (body, signal) => sendMessageStreamed(stream, origin, body, token, signal),
         answerPlanStreamed: (body, signal) => answerPlanStreamed(stream, origin, body, token, signal)
@@ -5635,13 +6530,14 @@ function usageOf(entry2) {
   return `openeng ${entry2.module} ${entry2.name}${selector} [--input <json> | --input - | --input-file <path>]${key}`;
 }
 function helpOf(entry2) {
-  const admits = entry2.admission.admits === "none" ? "no access token" : entry2.admission.admits.join(", ");
+  const policy = routePolicyDoc(entry2.policy);
   return [
     usageOf(entry2),
     `route:       ${entry2.name} (${entry2.method} ${entry2.path})`,
     `module:      ${entry2.module}`,
     `capability:  ${entry2.capability}`,
-    `admits:      ${admits}`,
+    `actors:      ${policy.actors}`,
+    `step-up:     ${policy.stepUp}`,
     `idempotent:  ${entry2.idempotent ? "yes; a key is minted and printed when --idempotency-key is absent" : "no"}`,
     `selector:    ${entry2.selector === "none" ? "none" : `${entry2.selector}, given as --selector <json>`}`,
     `input:       a JSON object, given as --input <json>, --input - (standard input) or --input-file <path>; {} when none is given`,
@@ -5722,11 +6618,11 @@ async function runGenerated(entry2, context) {
   if ("streamed" in answer && answer.streamed === true) {
     return { kind: "streamed" };
   }
-  const replayed = "replayed" in answer && answer.replayed === true && !key.minted;
-  if (replayed) {
+  const replayed2 = "replayed" in answer && answer.replayed === true && !key.minted;
+  if (replayed2) {
     context.note("the host answered a replay of an earlier request that carried this idempotency key");
   }
-  return outcomeOfEnvelope(replayed ? withoutReplay(answer) : answer, settle2, (result) => displayedObject === void 0 ? JSON.stringify(result, null, 2) : displayedObject, {
+  return outcomeOfEnvelope(replayed2 ? withoutReplay(answer) : answer, settle2, (result) => displayedObject === void 0 ? JSON.stringify(result, null, 2) : displayedObject, {
     command: `openeng ${entry2.module} ${entry2.name}`,
     schemas: schemasOf(entry2),
     sent: body.body
@@ -10776,12 +11672,12 @@ async function playDemoWorld(clients, target, size, data) {
   }
   const objectIdByRef = /* @__PURE__ */ new Map();
   let created = 0;
-  let replayed = 0;
+  let replayed2 = 0;
   const selector = { projectId: target.projectId, ref: TRUNK_REF };
   const mutate = async (ref, operation) => {
     const outcome = succeededEnvelope(await clients.objects.mutate({ selector, input: { correlation: { kind: "mint" }, operation } }, idempotencyKeyOf(target.projectId, ref)), `mutate ${ref}`);
     if (outcome.replayed) {
-      replayed += 1;
+      replayed2 += 1;
     } else {
       created += 1;
     }
@@ -10808,7 +11704,7 @@ async function playDemoWorld(clients, target, size, data) {
       subjectIdOf(outcome, step.edge.ref);
     }
   }
-  return { created, replayed };
+  return { created, replayed: replayed2 };
 }
 
 // packages/cli/src/commands/demo-shared.ts
@@ -10902,6 +11798,42 @@ var publicDemoSeed = {
   }
 };
 
+// packages/cli/src/commands/session.ts
+var CHANNEL_LABELS = { cli: "CLI", web: "web" };
+var MODE_LABELS = { agent: "agent", human: "human" };
+var SETTLE2 = "read openeng session status before trying again";
+function sessionText(status) {
+  const channel = status.channel === null ? "unclassified" : CHANNEL_LABELS[status.channel];
+  const mode = status.mode === null ? "none" : MODE_LABELS[status.mode];
+  return `channel ${channel}  mode ${mode}  signed in ${status.issuedAt}`;
+}
+function sessionCommand(action, description) {
+  const usage = `openeng session ${action}`;
+  return {
+    words: ["session", action],
+    organisation: "none",
+    usage,
+    help: [
+      usage,
+      `does:    ${description}`,
+      `example: ${usage} --json`,
+      "output:  server-stored channel, mode and sign-in time; under --json { channel, mode, issuedAt }"
+    ],
+    run: async ({ host, deps }) => {
+      const run2 = await runAuthenticated(host, deps, (clients) => clients.session[action]());
+      return run2.ok ? outcomeOfEnvelope(run2.answer, SETTLE2, sessionText) : outcomeOfSessionFailure(run2.failure, SETTLE2);
+    }
+  };
+}
+var sessionHuman = sessionCommand(
+  "human",
+  "asks once for web confirmation, then uses human mode for this CLI session; already-human sessions are unchanged"
+);
+var sessionStatus = sessionCommand(
+  "status",
+  "reads this session's channel, mode and sign-in time from the server; needs no organisation attachment"
+);
+
 // packages/cli/src/commands/whoami.ts
 var whoami = async (host, store) => {
   const summary = await storedSummary(store, host.key);
@@ -11159,7 +12091,7 @@ var connectorRun = {
     "example: openeng connector run conn_abc123",
     "output:  one line with the run id; under --json an object with runId",
     "  starts a run that imports the connection's source into its mirror project, and answers the run's identifier once its row has committed",
-    "  needs: merge on the mirror project"
+    "  needs: write ref on the mirror project"
   ],
   run: async (context) => {
     const selector = selectorOf(context);
@@ -11197,7 +12129,7 @@ var connectorRuns = {
 };
 
 // packages/cli/src/commands/link.ts
-var SETTLE2 = "repeat openeng link, which only reads";
+var SETTLE3 = "repeat openeng link, which only reads";
 var IDENTIFIER_FIELD = Object.freeze({
   object: "objectId",
   type: "typeKey",
@@ -11396,7 +12328,7 @@ async function link(context) {
     return { kind: "link-ready", webOrigin: origin.result.webOrigin, path };
   });
   if (!run2.ok) {
-    return outcomeOfSessionFailure(run2.failure, SETTLE2);
+    return outcomeOfSessionFailure(run2.failure, SETTLE3);
   }
   const { answer } = run2;
   if ("kind" in answer) {
@@ -11408,7 +12340,7 @@ async function link(context) {
     const href = new URL(path, webOrigin).href;
     return { kind: "success", value: { link: href }, text: href };
   }
-  return outcomeOfEnvelope(answer, SETTLE2, (result) => JSON.stringify(result));
+  return outcomeOfEnvelope(answer, SETTLE3, (result) => JSON.stringify(result));
 }
 var BARE_USAGE = "openeng link <kind> ...  (openeng link --help)";
 var spec = (argumentCount, usage) => ({
@@ -11448,7 +12380,7 @@ var linkBare = spec(0, BARE_USAGE);
 
 // packages/cli/src/commands/projects.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-var SETTLE3 = "repeat openeng projects list, which only reads";
+var SETTLE4 = "repeat openeng projects list, which only reads";
 function listText(listings) {
   if (listings.length === 0) {
     return "no projects";
@@ -11467,7 +12399,7 @@ var projectsList = {
   ],
   run: async ({ host, deps }) => {
     const run2 = await runAuthenticated(host, deps, (clients) => clients.objects.listProjects({ input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, SETTLE3, listText) : outcomeOfSessionFailure(run2.failure, SETTLE3);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, SETTLE4, listText) : outcomeOfSessionFailure(run2.failure, SETTLE4);
   }
 };
 var projectsCreate = {
@@ -11487,11 +12419,18 @@ var projectsCreate = {
     }
     const key = randomUUID3();
     const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.createProject({ input: { name } }, key));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, SETTLE3, (created) => `created project ${created.projectId} with namespace ${created.namespaceId}`) : outcomeOfSessionFailure(run2.failure, SETTLE3);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, SETTLE4, (created) => `created project ${created.projectId} with namespace ${created.namespaceId}`) : outcomeOfSessionFailure(run2.failure, SETTLE4);
   }
 };
 
 // packages/cli/src/commands/protection-help.ts
+var RULE_SETTINGS_HELP = [
+  "settings: --consequence <open|merge-only|locked-rows-only> --require-proposal <true|false>",
+  "          --required-approvals <0..10> --approver-min-role <contributor|maintainer|owner|null>",
+  "          --restrict-deletions <true|false> --approvers '<JSON person-id array>' --bypass '<JSON member array>'",
+  'bypass:   [{"kind":"role","roleKey":"owner"},{"kind":"person","personId":"person-id"},',
+  '           {"kind":"service","serviceIdentityId":"service-id"},{"kind":"client","clientId":"client-id"}]'
+];
 var SCOPE_LABELS = Object.freeze({
   project: "on the selected project",
   organisation: "in the attached organisation",
@@ -11504,21 +12443,113 @@ function protectionCapabilityHelp(...routes) {
   return `capability: ${[...new Set(requirements)].join(" or ")}`;
 }
 
+// packages/cli/src/commands/rule-settings.ts
+var RuleFlagRefusal = class extends Error {
+};
+function jsonFlag(value, flag) {
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    if (error instanceof SyntaxError) throw new RuleFlagRefusal(`${flag} must be JSON`);
+    throw error;
+  }
+}
+function booleanFlag(value, flag) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new RuleFlagRefusal(`${flag} must be true or false`);
+}
+function role(value) {
+  return value === "contributor" || value === "maintainer" || value === "owner";
+}
+function bypassEntry(input) {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) {
+    throw new RuleFlagRefusal("--bypass must hold member objects");
+  }
+  const entry2 = input;
+  if (Object.keys(entry2).length === 2) {
+    switch (entry2.kind) {
+      case "role":
+        if (role(entry2.roleKey)) return { kind: "role", roleKey: entry2.roleKey };
+        break;
+      case "person":
+        if (typeof entry2.personId === "string" && entry2.personId.length > 0) {
+          return { kind: "person", personId: entry2.personId };
+        }
+        break;
+      case "service":
+        if (typeof entry2.serviceIdentityId === "string" && entry2.serviceIdentityId.length > 0) {
+          return { kind: "service", serviceIdentityId: entry2.serviceIdentityId };
+        }
+        break;
+      case "client":
+        if (typeof entry2.clientId === "string" && entry2.clientId.length > 0) {
+          return { kind: "client", clientId: entry2.clientId };
+        }
+        break;
+    }
+  }
+  throw new RuleFlagRefusal("--bypass entries name a role, person, service or client with its identifier");
+}
+function ruleSettings(options) {
+  const settings = {};
+  if (options.consequence !== void 0) {
+    const value = options.consequence;
+    if (value !== "open" && value !== "merge-only" && value !== "locked-rows-only") {
+      throw new RuleFlagRefusal("--consequence must be open, merge-only or locked-rows-only");
+    }
+    settings.consequence = value;
+  }
+  if (options.requireProposal !== void 0) {
+    settings.requireProposal = booleanFlag(options.requireProposal, "--require-proposal");
+  }
+  if (options.restrictDeletions !== void 0) {
+    settings.restrictDeletions = booleanFlag(options.restrictDeletions, "--restrict-deletions");
+  }
+  if (options.requiredApprovals !== void 0) {
+    const value = Number(options.requiredApprovals);
+    if (!/^\d+$/.test(options.requiredApprovals) || !Number.isInteger(value) || value > 10) {
+      throw new RuleFlagRefusal("--required-approvals must be an integer from 0 to 10");
+    }
+    settings.requiredApprovals = value;
+  }
+  if (options.approverMinRole !== void 0) {
+    const value = options.approverMinRole;
+    if (value !== "null" && !role(value)) {
+      throw new RuleFlagRefusal("--approver-min-role must be contributor, maintainer, owner or null");
+    }
+    settings.approverMinRole = value === "null" ? null : value;
+  }
+  if (options.approvers !== void 0) {
+    const value = jsonFlag(options.approvers, "--approvers");
+    if (!Array.isArray(value) || !value.every((item) => typeof item === "string" && item.length > 0)) {
+      throw new RuleFlagRefusal("--approvers must be a JSON array of person identifiers");
+    }
+    settings.approvers = value;
+  }
+  if (options.bypass !== void 0) {
+    const value = jsonFlag(options.bypass, "--bypass");
+    if (!Array.isArray(value)) throw new RuleFlagRefusal("--bypass must be a JSON array");
+    settings.bypass = value.map(bypassEntry);
+  }
+  return settings;
+}
+
 // packages/cli/src/commands/rules.ts
-var CONSEQUENCES = ["merge-only", "locked-rows-only"];
 var settleWith = (project) => project === void 0 ? "repeat openeng rules list --organisation, which only reads" : `repeat openeng rules list --project ${project}, which only reads`;
-var ruleText = (rule) => `rule ${rule.ruleId}  ${rule.pattern}  ${rule.consequence}`;
+var ruleText = (rule) => `rule ${rule.ruleId}  ${rule.pattern}  ${rule.settings.consequence}`;
 var rulesOutcome = (outcome) => outcome.kind === "success" ? { ...outcome, value: { value: outcome.value } } : outcome;
 var scopeMessage = "choose exactly one of --project <id> or --organisation";
 var rulesAdd = {
   words: ["rules", "add"],
   organisation: "required",
-  usage: "openeng rules add (--project <id>|--organisation) --pattern <pattern> --consequence <value>",
+  usage: "openeng rules add (--project <id>|--organisation) --extent <extent> --pattern <pattern> [settings]",
   help: [
-    "openeng rules add (--project <id>|--organisation) --pattern <pattern> --consequence <merge-only|locked-rows-only>",
-    "does:    adds a project or organisation ref rule; repeating the same content returns the existing rule",
+    "openeng rules add (--project <id>|--organisation) --extent <ref|rows> --pattern <pattern> [settings]",
+    ...RULE_SETTINGS_HELP,
+    "does:    adds a project or organisation rule with the supplied settings and defaults for omitted fields",
     protectionCapabilityHelp("addRefRule", "addOrganisationRule"),
-    "example: openeng rules add --organisation --pattern release-v1 --consequence merge-only",
+    "example: openeng rules add --organisation --extent ref --pattern release-v1 --consequence merge-only",
     "output:  the rule id, pattern and consequence; under --json { scope, value }, with the full RefRule in value"
   ],
   run: async ({ host, deps, options }) => {
@@ -11526,18 +12557,48 @@ var rulesAdd = {
     if (project !== void 0 === organisation) {
       return { kind: "client-refusal", message: scopeMessage };
     }
-    if (pattern === void 0 || options.consequence === void 0) {
-      return {
-        kind: "client-refusal",
-        message: "openeng rules add needs --pattern <pattern> and --consequence <merge-only|locked-rows-only>"
-      };
+    const extent = options.extent;
+    if (pattern === void 0 || extent !== "ref" && extent !== "rows") {
+      return { kind: "client-refusal", message: "rules add needs --pattern <pattern> and --extent <ref|rows>" };
     }
-    const consequence = CONSEQUENCES.find((value) => value === options.consequence);
-    if (consequence === void 0) {
-      return { kind: "client-refusal", message: "--consequence must be merge-only or locked-rows-only" };
+    let settings;
+    try {
+      settings = ruleSettings(options);
+    } catch (error) {
+      if (error instanceof RuleFlagRefusal) return { kind: "client-refusal", message: error.message };
+      throw error;
+    }
+    const settle2 = settleWith(project);
+    const run2 = await runAuthenticated(host, deps, (clients) => project === void 0 ? clients.admin.addOrganisationRule({ input: { extent, pattern, settings } }) : clients.admin.addRefRule({ selector: { projectId: project }, input: { extent, pattern, settings } }));
+    return run2.ok ? rulesOutcome(outcomeOfEnvelope(run2.answer, settle2, ruleText)) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+var rulesUpdate = {
+  words: ["rules", "update"],
+  organisation: "required",
+  usage: "openeng rules update (--project <id>|--organisation) --rule-id <id> [settings]",
+  help: [
+    "openeng rules update (--project <id>|--organisation) --rule-id <id> [settings]",
+    ...RULE_SETTINGS_HELP,
+    "does:    changes settings in place; omitted fields keep their values; lists replace their members",
+    protectionCapabilityHelp("updateRefRule", "updateOrganisationRule"),
+    "example: openeng rules update --project project-one --rule-id rule-one --required-approvals 2",
+    "output:  the full rule under --json; every update asks an agent-mode session to confirm"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { project, organisation, ruleId } = options;
+    if (project !== void 0 === organisation) return { kind: "client-refusal", message: scopeMessage };
+    if (ruleId === void 0) return { kind: "client-refusal", message: "rules update needs --rule-id <id>" };
+    let settings;
+    try {
+      settings = ruleSettings(options);
+    } catch (error) {
+      if (error instanceof RuleFlagRefusal) return { kind: "client-refusal", message: error.message };
+      throw error;
     }
     const settle2 = settleWith(project);
-    const run2 = await runAuthenticated(host, deps, (clients) => project === void 0 ? clients.admin.addOrganisationRule({ input: { pattern, consequence } }) : clients.admin.addRefRule({ selector: { projectId: project }, input: { pattern, consequence } }));
+    const input = { ruleId, settings };
+    const run2 = await runAuthenticated(host, deps, (clients) => project === void 0 ? clients.admin.updateOrganisationRule({ input }) : clients.admin.updateRefRule({ selector: { projectId: project }, input }));
     return run2.ok ? rulesOutcome(outcomeOfEnvelope(run2.answer, settle2, ruleText)) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
@@ -12437,12 +13498,12 @@ async function saveDescriptor(context, selector, objectId, property, file) {
   const name = basename(file);
   const settle2 = `openeng attachment get ${objectId} ${property} --project ${selector.projectId} --ref ${selector.ref}`;
   const run2 = await runAuthenticated(context.host, context.deps, async (clients) => {
-    const staged = await clients.objects.stageAttachment(selector, { name, bytes });
-    if ("refusal" in staged) return { outcome: outcomeOfEnvelope(staged, settle2, (value2) => JSON.stringify(value2)) };
-    if (staged.replayed === true) return { outcome: outcomeOfEnvelope(staged, settle2, (value2) => JSON.stringify(value2)) };
     const object = await clients.objects.readObject({ selector, input: { objectId } });
     if ("refusal" in object) return { outcome: outcomeOfEnvelope(object, settle2, (value2) => JSON.stringify(value2)) };
     if (object.replayed === true) return { outcome: outcomeOfEnvelope(object, settle2, (value2) => JSON.stringify(value2)) };
+    const staged = await clients.objects.stageAttachment({ ...selector, objectId }, { name, bytes });
+    if ("refusal" in staged) return { outcome: outcomeOfEnvelope(staged, settle2, (value2) => JSON.stringify(value2)) };
+    if (staged.replayed === true) return { outcome: outcomeOfEnvelope(staged, settle2, (value2) => JSON.stringify(value2)) };
     const catalogue = await clients.objects.readCatalogue({ selector: { projectId: selector.projectId }, input: {} });
     if ("refusal" in catalogue) return { outcome: outcomeOfEnvelope(catalogue, settle2, (value2) => JSON.stringify(value2)) };
     if (catalogue.replayed === true) return { outcome: outcomeOfEnvelope(catalogue, settle2, (value2) => JSON.stringify(value2)) };
@@ -12730,8 +13791,12 @@ var branchesImpact = {
 
 // packages/cli/src/commands/hosted-app.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-var ONE_WALL_WARNING = "This app runs without the WebRTC wall. Its code can send anything a viewer of the app can read to any host on the internet, over WebRTC or through DNS lookups, and nothing reports it. It runs with each viewer's authority. Review the current code, and every later version, for WebRTC use, DNS hints and other exploits before people open it. A coding agent can do the review. Withdrawing this permission stops the app's next request, but not data it has already read.";
-var ONE_WALL_UNKNOWN = "This account cannot read whether the app may send data out of the browser. An administrator can check its one-wall permission.";
+var ONE_WALL_WARNING_LEAD = "Reduced isolation lets an app use React in the normal way, so agents can build better apps. One browser feature, WebRTC, cannot be blocked which creates a security risk if used by a hosted app.";
+var ONE_WALL_WARNING_DETAIL = "WebRTC lets a web page connect directly to other computers on the internet, for example for video calls. An app with reduced isolation could use WebRTC to send data out of the viewer's browser. The app runs with the access of each person who opens it, so this data could be anything that person can read. Use of WebRTC in an app with reduced isolation is a security risk. Review the app's code for WebRTC use before you allow it, and again for each new version. A coding agent can do the review. If you remove this permission, the app stops at its next request, but data it already read cannot be recalled.";
+var ONE_WALL_WARNING = `${ONE_WALL_WARNING_LEAD}
+
+${ONE_WALL_WARNING_DETAIL}`;
+var ONE_WALL_UNKNOWN = "This account cannot read whether the app may send data out of the browser. An administrator can check its reduced isolation permission.";
 var usagePublish = "openeng hosted-app publish <bundle> --project <id> --key <app key>";
 var usageList2 = "openeng hosted-app list --project <id>";
 var usageVersions = "openeng hosted-app versions <app key> --project <id>";
@@ -12765,7 +13830,7 @@ var hostedAppPublish = {
     usagePublish,
     "does:    publishes a bundle file as the next version of the project's hosted app under the key, creating the app when the project has none under that key",
     "example: openeng hosted-app publish ./dist/app.js --project proj_abc --key rover-dashboard",
-    "output:  the version id, its SHA-256 and its size; for an app that holds the one-wall permission, the one-wall warning as well"
+    "output:  the version id, its SHA-256 and its size; for an app that holds the reduced isolation permission, the reduced isolation warning as well"
   ],
   run: async (context) => {
     const project = projectOf(context, "publish");
@@ -12946,6 +14011,8 @@ var PUBLIC_HAND_WRITTEN_COMMANDS = [
   loginCommand,
   logoutCommand,
   whoamiCommand,
+  sessionHuman,
+  sessionStatus,
   orgList,
   orgAttach,
   orgCreate,
@@ -12954,6 +14021,7 @@ var PUBLIC_HAND_WRITTEN_COMMANDS = [
   projectsList,
   projectsCreate,
   rulesAdd,
+  rulesUpdate,
   rulesList,
   rulesRemove,
   orgRefsCreate,
@@ -13024,6 +14092,13 @@ var CLI_OPTIONS = {
   ceiling: { type: "string" },
   pattern: { type: "string" },
   consequence: { type: "string" },
+  "extent": { type: "string" },
+  "require-proposal": { type: "string" },
+  "required-approvals": { type: "string" },
+  "approver-min-role": { type: "string" },
+  "restrict-deletions": { type: "string" },
+  "approvers": { type: "string" },
+  "bypass": { type: "string" },
   "rule-id": { type: "string" },
   ref: { type: "string" },
   base: { type: "string" },
@@ -13273,6 +14348,13 @@ function parseInvocation(argv) {
         ceiling: values.ceiling,
         pattern: values.pattern,
         consequence: values.consequence,
+        extent: values["extent"],
+        requireProposal: values["require-proposal"],
+        requiredApprovals: values["required-approvals"],
+        approverMinRole: values["approver-min-role"],
+        restrictDeletions: values["restrict-deletions"],
+        approvers: values["approvers"],
+        bypass: values["bypass"],
         ruleId: values["rule-id"],
         ref: values.ref,
         base: values.base,
@@ -13350,7 +14432,13 @@ ${usageLines(commands).join("\n")}` : unknownCommandMessage(commands, invocation
     return { outcome: outcomeOfStoreRefusal(selection.refusal), json: options.json, scope: null };
   }
   const deps = {
-    transport: createTransport(parsedHost.host),
+    transport: withStepUpRoad(createTransport(parsedHost.host), {
+      clock,
+      confirmAddress: (pendingId, webOrigin) => new URL(stepUpAddress(pendingId), webOrigin).href,
+      announce: addressPrinter(options.json),
+      note: (line) => process.stderr.write(`${line}
+`)
+    }),
     store: selection.store,
     clock,
     configDirectory,