@owlmeans/server-planning 0.1.18-rc.12 → 0.1.18-rc.14

package/README.md

@@ -10,13 +10,16 @@ the `@owlmeans/server-planning/store` subpath.
 ## Installation
 
 ```sh
-bun add @owlmeans/server-planning@^0.1.18-rc.12 @owlmeans/planning@^0.1.18-rc.10 ajv
+bun add @owlmeans/server-planning@^0.1.18-rc.14 @owlmeans/planning@^0.1.18-rc.12 ajv
 ```
 
 ## Concepts
 
-- **Facade** — `context.planning().for(scope)`: every read and write of one organization entity,
-  with no scope argument on any method.
+- **Facade** — `ctx.service<PlanningHostService>(PLANNING_SERVICE).for(scope)`: every read and
+  write of one organization entity, with no scope argument on any method. `context.planning()` is
+  the same service, but only on a context that went through `appendPlanningService`; a service
+  registered as a plain one (`makePlanningService()`, a generated target's `services/planning.ts`)
+  has no `context.planning`.
 - **Executor** — the only write path: normalize → idempotency → resolve → plugins' `before` →
   validate → id → code → changes → seq CAS → append → project → receipt. Nothing is appended by a
   refusal.
@@ -105,18 +108,33 @@ const cards = await planningFor(ctx, req, { channel: 'web' }).cards.list({ paren
 - Handlers: `servePlanningEntrypoints`, `planningFor`, `listSchemas`, `listCards`,
   `summarizeCards`, `getCard`, `listCardTransitions`, `listCardSpecifications`, `getSpecification`,
   `listSpecificationRevisions`, `listLinks`, `getTransition`, `executePlanning`, `wireExecution`,
-  `executeOptionsOf`, `getCommit`, `watchCommits`, `PlanningHandlerOptions`, `PlanningScopeExtractor`
-- Scope: `scopeOf`, `actorOf`, `handlerFacade`, `planningServiceOf`, `concealed`, `assertScope`,
-  `notFoundOf`, `clampSeconds`
+  `executeOptionsOf`, `assertExecutionGranted`, `getCommit`, `watchCommits`, `defineSchemas`,
+  `applySchemaRequest`, `PlanningHandlerOptions`, `PlanningScopeExtractor`, `PlanningAccessResolver`,
+  `PlanningAccess`, `PlanningAccessGrants`, `PlanningGrant`
+- Scope: `scopeOf`, `accessScopeOf`, `actorOf`, `handlerFacade`, `handlerScopeOf`, `assertGranted`,
+  `planningServiceOf`, `concealed`, `assertScope`, `notFoundOf`, `clampSeconds`, `projectCriteriaOf`
+- Data-defined schemas: `makeDefinitions`, `makeSchemaViews`, `SchemaViews`, `SchemaViewsOptions`
 - Projection: `makeProjectionProcessor`, `planningQueueHooks`, `ProjectionOptions`
-- Constants: `DEFAULT_ALIAS`, `MEMORY_STORE_ALIAS`, `DEFAULT_COMMIT_MEMORY`, `COMMIT_POLL_LADDER`
+- Constants: `DEFAULT_ALIAS`, `MEMORY_STORE_ALIAS`, `DEFAULT_COMMIT_MEMORY`, `COMMIT_POLL_LADDER`,
+  `DEFAULT_SCHEMA_VIEWS`
 - `@owlmeans/server-planning/store`: `makeMemoryPlanningStore`, `foldPending`, `failPending`,
-  `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore`, and the types
-  `BindablePlanningStore`, `CommitListener`, `CommitHub`, `CommitHubOptions`, `FoldOptions`,
-  `FoldResult`, `MemoryPlanningStore`, `MemoryPlanningStoreOptions`, `StoreRoute`
+  `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore`, `wantsSpecifications`,
+  and the types `BindablePlanningStore`, `CommitListener`, `CommitHub`, `CommitHubOptions`,
+  `FoldOptions`, `FoldResult`, `MemoryPlanningStore`, `MemoryPlanningStoreOptions`, `StoreRoute`
+- `@owlmeans/server-planning/conformance`: `planningConformance`, `conformanceCasesFor`,
+  `planningConformancePlugin`, `conformanceClock`, `ConformanceFailure`, `check`, `same`,
+  `sameSet`, `rejects`, the library fixtures (`LIBRARY`, `createBranch`, `createBook`, `transit`)
+  and the types `ConformanceCase`, `ConformanceSubject`, `ConformanceCapability`
 
 ## Common pitfalls
 
+- A create's draft goes under `card` — `draft` is refused as `planning:malformed:create-without-draft`.
+- `{ wait: true }` is the SECOND argument of `execute`; inside the execution it is ignored and the
+  receipt returns before the commit.
+- A type or flow declaration has no `name` or `key`: the display name is `label`, the key is `type`
+  (a type) or `id` (a flow). `definitions.define` refuses anything else with `SchemaInvalid`; a code
+  plugin's registry does not check, so keep the literals typed.
+
 - `after` hooks run where the transition is FOLDED, once per commit — register the same plugins in
   every folding process, and never run hooks from a commit-bus subscription.
 - The memory store is per-process heap: wrong for multiple processes or restarts.
@@ -126,11 +144,15 @@ const cards = await planningFor(ctx, req, { channel: 'web' }).cards.list({ paren
 - `expectSeq` compares against `head`; a stale one is `WorkcardConflict`, re-read and retry.
 - Call `appendPlanningService` before any `ensurePlanningService`, or the appended host replaces
   what was registered on the default one.
+- `opts.access` makes the resolver the only source of the organization; a `grants` object refuses
+  every flag it leaves out.
+- A durable store is not done until it passes `@owlmeans/server-planning/conformance`.
 
 ## Related packages
 
 - `@owlmeans/planning` — records, flows, fold, query language, protocol tree, models
 - `@owlmeans/client-planning` — the remote facade and state mirror
+- `@owlmeans/planning-postgres` — the durable Postgres store
 - `@owlmeans/server-job`, `@owlmeans/queue` — job feeds and the projection queue
 
 <!-- owlmeans:agent-guidance:start -->
@@ -141,7 +163,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.40
+npx @owlmeans/agent-skills@^0.1.18-rc.42
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-planning",
-  "version": "0.1.18-rc.12",
-  "generatedAt": "2026-09-25T21:19:37.942Z",
+  "version": "0.1.18-rc.14",
+  "generatedAt": "2026-09-29T08:01:58.111Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-planning/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-planning
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.12"` in `dependencies` (`ajv` is a peer)
+**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.14"` in `dependencies` (`ajv` is a peer)
 
 The general implementation of `@owlmeans/planning`: the planning service (a plugin host), the
 scoped facade, the executor every write goes through, the in-memory reference store, the commit
@@ -24,13 +24,16 @@ reuses the `./store` subpath (`foldPending`, `makeCommitHub`) without pulling fa
 | `makePlanningService(opts?, alias?)`, `planningServiceApi(opts, self)` | The service, and its body for a specialised service |
 | `PlanningServiceOptions` | `{ store?, plugins?, schemas?, hooks?, ids?, now? }` |
 | `makePluginRegistry`, `makeStoreFacade`, `executeTransition` | The pieces the service is made of |
-| `servePlanningEntrypoints(protocols, opts?)` | One binding per protocol of a `makePlanningProtocols` tree |
+| `servePlanningEntrypoints(protocols, opts?)` | One binding per protocol of a `makePlanningProtocols` tree (`schema.define` too when declared) |
 | `planningFor(ctx, req, extra?)` | The request-scoped facade for a hand-written handler |
-| `PlanningHandlerOptions` | `{ service?, event?, maxPoll?, scope?(req, ctx) }` |
-| `listCards` … `executePlanning`, `getCommit`, `watchCommits` | The handlers, to bind one by hand |
-| `scopeOf(req, extra?)`, `actorOf(req)`, `concealed(run)`, `clampSeconds` | Scope and security helpers |
+| `PlanningHandlerOptions` | `{ service?, event?, maxPoll?, scope?(req, ctx), access?(req, ctx) }` |
+| `PlanningAccessResolver`, `PlanningAccess`, `PlanningAccessGrants`, `PlanningGrant` | The optional access decision a hosting app supplies |
+| `listCards` … `executePlanning`, `getCommit`, `watchCommits`, `listSchemas`, `defineSchemas`, `applySchemaRequest` | The handlers, to bind one by hand |
+| `scopeOf(req, extra?)`, `accessScopeOf(req, access, extra?)`, `handlerScopeOf`, `assertGranted`, `actorOf(req)`, `concealed(run)`, `clampSeconds` | Scope and security helpers |
+| `makeDefinitions(runtime, facade)`, `makeSchemaViews(opts)`, `projectCriteriaOf(projects)` | Data-defined schemas and the project narrowing |
 | `makeProjectionProcessor(ctx, opts?)`, `planningQueueHooks(ctx, opts?)` | A generic projection job body and its `onJobDead` |
-| `./store`: `makeMemoryPlanningStore`, `foldPending`, `failPending`, `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore` | What stores are built from |
+| `./store`: `makeMemoryPlanningStore`, `foldPending`, `failPending`, `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore`, `wantsSpecifications` | What stores are built from |
+| `./conformance`: `planningConformance`, `conformanceCasesFor`, `planningConformancePlugin`, `conformanceClock`, `ConformanceFailure` | The store conformance suite, runner-agnostic |
 
 ## Wiring
 
@@ -58,8 +61,68 @@ context.registerEntrypoints(servePlanningEntrypoints(planningProtocols, {
   `ensurePlanningService(ctx).use(plugin)` works from `makeContext`, before `init()`.
 - Call `appendPlanningService` BEFORE any `ensurePlanningService`: `ensure` registers a default
   host when none exists, and a later `append` replaces it together with whatever was `use`d on it.
-- In code: `ctx.planning().for({ entityId, profileId?, channel?, actor? })` → a `PlanningFacade`
-  with no scope argument on any method.
+- **The facade:** `ctx.service<PlanningHostService>(PLANNING_SERVICE).for({ entityId, profileId?,
+  channel?, actor? })` → a `PlanningFacade` with no scope argument on any method. That form works
+  however the service was registered. `ctx.planning()` is only a shortcut that `appendPlanningService`
+  / `appendPostgresPlanning` install (typed `WithPlanningService`); a context that registered
+  `makePlanningService()` / `makePostgresPlanningService()` as a plain service — a generated target's
+  `services/planning.ts` — has no `ctx.planning` at all. In a request handler use
+  `planningFor(ctx, req)`: the entity comes from `requireEntityKey(req)`, never the token.
+
+## Creating and reading a card
+
+```ts
+import { IntrinsicStatus, PLANNING_SERVICE, TransitionAction, WorkcardKind } from '@owlmeans/planning'
+import type { PlanningHostService } from '@owlmeans/server-planning'
+
+const planning = ctx.service<PlanningHostService>(PLANNING_SERVICE).for({ entityId, profileId })
+
+const shed = await planning.execute({
+  action: TransitionAction.Create,
+  card: { kind: WorkcardKind.Project, type: 'shed:shed', title: 'Maple Street shed' },
+}, { wait: true })
+const drill = await planning.execute({
+  action: TransitionAction.Create,
+  card: { kind: WorkcardKind.Card, type: 'shed:tool', parent: shed.card!.id!, title: 'Cordless drill',
+    fields: { brand: 'Acme' } },
+}, { wait: true })                      // drill.card — the committed record, status 'available'
+
+await planning.cards.get(drill.card!.id!)
+await planning.cards.list({ parent: shed.card!.id!, type: 'shed:tool' })
+await planning.execute({ action: TransitionAction.Transit, card: drill.card!.id!, transition: 'lend' }, { wait: true })
+
+// A card type and a flow as DATA, scoped to this shed — `definitions` exists only where the store
+// keeps schemas (planning-postgres; the memory store with `schemas: true`), and the shed's cards may
+// use them when its project type says `scopedCardTypes: true` (or lists the type in `cardTypes`).
+await planning.definitions!.define({
+  flows: [{
+    id: 'shed:repair', version: 1, label: 'Repair',
+    statuses: [
+      { key: 'reported', intrinsic: IntrinsicStatus.Planned, initial: true, label: 'Reported' },
+      { key: 'fixed', intrinsic: IntrinsicStatus.Closed, terminal: true, label: 'Fixed' },
+    ],
+    transitions: [{ name: 'fix', from: ['reported'], to: 'fixed', label: 'Mark fixed', explicit: true }],
+  }],
+  types: [{
+    type: 'shed:repair', kind: WorkcardKind.Card, version: 1, label: 'Repair ticket',
+    fields: { type: 'object', properties: { tool: { type: 'string' } }, additionalProperties: false },
+    flows: ['shed:repair'], specifications: [],
+  }],
+}, { project: shed.card!.id! })
+```
+
+| Wrong | What happens | Right |
+|---|---|---|
+| `execute({ action, draft: { … } })` | refused: `planning:malformed:create-without-draft` | the draft goes under `card` |
+| `execute({ …, wait: true })` | in process the key is ignored: the receipt returns before the commit, with no `card` | `execute({ … }, { wait: true })` — only the wire body (`ExecuteRequest`) carries `wait` inside |
+| `ctx.planning().for(…)` in a target | `ctx.planning is not a function` | `ctx.service<PlanningHostService>(PLANNING_SERVICE).for(…)` |
+| `{ id, name: 'Repair', … }` on a flow, `{ key, name, … }` on a type | `define` refuses with `SchemaInvalid` (closed schemas); a code plugin's registry does not validate, so the key is silently dropped | a flow's key is `id`, a type's is `type`, the display name is `label` on both |
+| `action: 'create'` | a type error — `TransitionAction` is an enum | `action: TransitionAction.Create` |
+
+Every wrong form is a compile error against the typed facade (`PlanningFacade`,
+`TransitionExecution`, `WorkcardTypeSchema`); it reaches run time only through a helper or a context
+typed `any`, so never type one that way. `tests/create-example.spec.ts` runs this example and each
+wrong form as written.
 
 ## The executor, step by step
 
@@ -69,9 +132,15 @@ Nothing is appended before step 11 — every refusal leaves the log untouched.
 2. **Scope** — `entityId` must be present.
 3. **Idempotency** — a `key` already in the entity's log answers ITS receipt, before any
    validation or middleware.
-4. **Resolve** — the card (`WorkcardNotFound`; another entity's card is `PlanningScopeMismatch`),
-   its type and flow, every draft parent (`ParentNotFound`) and the parent project's
-   `cardTypes`/`projectTypes` (`CardTypeNotAllowed`), the specification slot.
+4. **Resolve** — the card (`WorkcardNotFound`; another entity's card is `PlanningScopeMismatch`;
+   one outside the scope's `projects` is `WorkcardNotFound`), its type and flow, every draft parent
+   (`ParentNotFound` — loaded through the facade, so an invisible parent is absent) and the parent
+   project's `cardTypes`/`projectTypes` (`CardTypeNotAllowed`), the specification slot. Where the
+   default store holds data-defined schemas, the card's project is found first and everything
+   after reads that project's resolved layer (`Resolved.schemas`): a data-defined type of a
+   project with `scopedCardTypes` is admitted, a retired type creates nothing
+   (`UnknownWorkcardType('retired:…')`). Without the port `Resolved.schemas` IS the code registry
+   and the order is unchanged.
 5. **`before` chain** — in plugin order; re-resolved once when it changed the card, type or parent.
 6. **Validate** — shape (`planning:malformed:*`), the flow rule (`IllegalTransition`), immutables
    (`planning:immutable:*`), merged `fields` (`FieldsInvalid`), labels (`LabelNotAllowed`), a moved
@@ -125,11 +194,15 @@ the store; `bind` replaces the listener, so a store has exactly one.
 
 ## The memory store
 
-`makeMemoryPlanningStore({ sync?, ids?, now?, seed?, onCommitted?, alias? })`
+`makeMemoryPlanningStore({ sync?, ids?, now?, seed?, onCommitted?, alias?, schemas? })`
 
 - Cards and projects in one map, specifications in their own, relationships in a third; every read
   goes through the `@owlmeans/resource` query engine. A card list includes specifications only when
-  the criteria asks for `kind: specification` or a `category`.
+  the criteria asks for `kind: specification` or a `category` (`wantsSpecifications`, the rule every
+  store routes by).
+- `schemas: true` adds the data-defined schema port (records per layer, a revision per
+  organization, synchronous `watch`); off by default, so a plain memory store resolves everything
+  in code exactly as before.
 - `sync` (default) folds, publishes and runs `committed` inside `project()`, serialized per card.
   `sync: false` folds nothing until `flush(card?)` — a queued store's shape, for tests that need a
   commit to stay pending.
@@ -155,7 +228,20 @@ the store; `bind` replaces the listener, so a store has exactly one.
   no card to advance, and a store that refuses the advancing write stops the fold with `followUp`,
   leaving the rest pending for a retry. `revisionsFromLog` replays past failed transitions the same
   way.
+- A transactional store passes `FoldOptions.unit` — it wraps each transition's writes (a
+  savepoint), so a write the database refuses is undone whole and the fold marks that transition
+  failed and goes past it. `foldPending` folds PAST a failure it produces; a row that is ALREADY
+  failed at the cursor, or a gap in the seqs, is the store's to step over before calling it
+  (`planning-postgres` does it in a prelude).
 - `failPending` is what a dead projection job must do, or waiters hang to their timeout.
+- The data-defined schema port (`schemas`) is optional; `makeCompositeStore` passes the default
+  store's through. A store that has it must purge a project's layer with the project.
+- **Run the conformance suite.** `@owlmeans/server-planning/conformance` exports
+  `planningConformance` — named cases with no test runner inside (each throws
+  `ConformanceFailure`) — and `conformanceCasesFor(store)`, which drops the data-defined cases for a
+  store without the port. Boot a service with `planningConformancePlugin` and `conformanceClock()`
+  and hand each case `{ service, store, facade }`; every case works in its own organization, so one
+  boot serves them all.
 - `makeCommitHub({ status, remember?, ladder? })` is the `CommitSource`: feed `publish` from the bus,
   answer `status` from transition rows. `wait` subscribes first, polls once, then climbs the ladder.
 - `revisionsFromLog(transitions, limit?)` answers `specs.revisions`.
@@ -180,24 +266,60 @@ mapping external records (`mappers`) belongs to that plugin's own store adapter.
 
 ## Scope and security
 
-- `entityId` is `requireEntityKey(req)`; `opts.scope(req, ctx)` adds a `channel` or `service` and
-  can never replace the entity. `actor` and a create's `createdBy` come from the request, never the
-  body.
+- Without `opts.access`: `entityId` is `requireEntityKey(req)`; `opts.scope(req, ctx)` adds a
+  `channel` or `service` and can never replace the entity. `actor` and a create's `createdBy` come
+  from the request, never the body.
 - Another entity's card, specification or transition answers `WorkcardNotFound` — the same as an
   absent id — on reads and writes alike (`concealed`).
 - Queries arrive in their wire form and are decoded with `decode*Query` before `criteriaOf`, which
   always adds the scope's `entityId`.
 
+### The access resolver
+
+`opts.access: (req, ctx) => Promise<{ entityId, projects?, grants? }>` is the hosting app's
+decision per request; a throw is the request's answer (an `AuthForbidden` answers 403).
+
+- `entityId` is the resolver's — never the token's, never `opts.scope`'s.
+- `projects` becomes `PlanningScope.projects`, which the server facade enforces everywhere: the
+  projects themselves and every card whose `parents` name one are visible (a specification
+  through its parent card); anything else reads as absent (`WorkcardNotFound`, `null`, an empty
+  list), a create under an invisible parent is `ParentNotFound` (the executor's own parent load),
+  lists, counts and summaries are AND'd with `projectCriteriaOf`, links and transitions are
+  filtered by `project` (and post-filtered, for a store that ignores the field), commit
+  subscriptions drop events outside the set and a status or wait refuses them.
+- `grants` gates the stock handlers' writes: `createProjects` (a project create — `true` for the
+  root, a list names the parent projects), `deleteProjects` (the delete of a project card — a list
+  names the projects), `defineSchemas` (`schema.define` — `true` for the organization's layer, a
+  list names project layers). A `grants` object refuses every flag it leaves out with
+  `PlanningForbidden` (403); no `grants` gates nothing. In-process facade writes are not gated.
+
+## Data-defined types and flows
+
+Where the default store has the schema port, `runtime.schemasFor(entityId, project?)` answers the
+resolved layer (`resolveScopedBundle` over the code bundle and the organization's and project's
+records), cached per (organization, project) and keyed by the store's `revision()` and the plugin
+registry's version — a write anywhere moves the revision the next lookup reads, so a cached layer is
+never stale; a store's `watch` evicts early. Without the port it answers the code registry itself.
+`makeDefinitions` gives the facade `definitions`: every write checks the project (a project card the
+scope can see), the seal, the closed-form checks (a type's flows resolve in its layer, counting flows
+written beside it), then the store's compare-and-set. `retire` of a flow refuses with `SchemaInUse`
+while a live type of the layer — or of any project layer, for an organization record — still runs
+it. `facade.model(card)` builds over the layer of the card's own project, and `schema.list` answers
+the scoped bundle (`?project=`) where `definitions` exists, the code bundle otherwise.
+
 ## Testing
 
 Category A. Build one real context with `makeBasicContext` + `appendPlanningService({ store:
 makeMemoryPlanningStore({ now }), plugins: [fixtures] })`, and run a handler through
 `handler.bind({ ref: { ctx } })(req, res)` with a request carrying `auth` and `entity`. A monotonic
 `now` keeps log order deterministic; `sync: false` + `flush()` pins pending and hook-count cases.
+`tests/conformance.spec.ts` runs the conformance suite against the memory store with and without
+`schemas: true`; a durable store's own tests run the same cases against a real database.
 
 ## Related
 
 - `planning` — records, flows, the fold, the query language, the protocol tree, the models
 - `client-planning` — the remote facade and the state mirror that talk to these handlers
+- `planning-postgres` — the durable Postgres store built from these pieces
 - `server-job`, `queue` — the declare/serve/feed pattern and the projection queue
 - `resource` — the criteria engine every memory read goes through

package/build/actions/execute.d.ts

@@ -1,6 +1,6 @@
 import { handlers } from '@owlmeans/server-api';
-import type { ExecuteOptions, ExecuteRequest, PlanningProtocols, PlanningScope, TransitionExecution } from '@owlmeans/planning';
-import type { Context, PlanningHandlerOptions } from '../types.js';
+import type { ExecuteOptions, ExecuteRequest, PlanningFacade, PlanningProtocols, PlanningScope, TransitionExecution } from '@owlmeans/planning';
+import type { Context, PlanningAccess, PlanningHandlerOptions } from '../types.js';
 /**
  * What a wire execution may say. `actor` is dropped — the scope names the writer — and a create's
  * `createdBy` is the authenticated subject, whatever the body claimed.
@@ -8,6 +8,14 @@ import type { Context, PlanningHandlerOptions } from '../types.js';
 export declare const wireExecution: (body: ExecuteRequest, scope: PlanningScope) => TransitionExecution;
 /** `wait`/`timeout` as a server grants them: the timeout never holds a request past `maxPoll`. */
 export declare const executeOptionsOf: (body: Pick<ExecuteRequest, 'wait' | 'timeout'>, maxPoll: number) => ExecuteOptions;
+/**
+ * The grants a wire execution needs: `createProjects` for a project create (its primary parent,
+ * or the root), `deleteProjects` for the delete of a project card. A card this scope cannot see is
+ * left to the executor, which answers it as absent.
+ *
+ * @throws {PlanningForbidden}
+ */
+export declare const assertExecutionGranted: (facade: PlanningFacade, exec: TransitionExecution, access?: PlanningAccess) => Promise<void>;
 /** The one write route. */
 export declare const executePlanning: (protocol: PlanningProtocols['execute'], opts?: PlanningHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['request']>;
 //# sourceMappingURL=execute.d.ts.map

package/build/actions/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EACV,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EACtF,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE;;;GAGG;AACH,eAAO,MAAM,aAAa,SAAU,cAAc,SAAS,aAAa,KAAG,mBAQ1E,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,SAAU,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC,WAAW,MAAM,KAAG,cAOlG,CAAA;AAED,2BAA2B;AAC3B,eAAO,MAAM,eAAe,aAChB,iBAAiB,CAAC,SAAS,CAAC,SAAS,sBAAsB,KACpE,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAWxD,CAAA"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAI/C,OAAO,KAAK,EACV,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAEtG,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlF;;;GAGG;AACH,eAAO,MAAM,aAAa,SAAU,cAAc,SAAS,aAAa,KAAG,mBAQ1E,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,SAAU,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC,WAAW,MAAM,KAAG,cAOlG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,WACzB,cAAc,QAAQ,mBAAmB,WAAW,cAAc,KACzE,OAAO,CAAC,IAAI,CAcd,CAAA;AAED,2BAA2B;AAC3B,eAAO,MAAM,eAAe,aAChB,iBAAiB,CAAC,SAAS,CAAC,SAAS,sBAAsB,KACpE,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAWxD,CAAA"}

package/build/actions/execute.js

@@ -1,6 +1,6 @@
 import { handlers } from '@owlmeans/server-api';
-import { DEFAULT_COMMIT_TIMEOUT, MAX_COMMIT_POLL, TransitionAction } from '@owlmeans/planning';
-import { concealed, handlerFacade } from '../utils/index.js';
+import { DEFAULT_COMMIT_TIMEOUT, isProject, MAX_COMMIT_POLL, normalizeParents, TransitionAction, WorkcardKind, } from '@owlmeans/planning';
+import { assertGranted, concealed, handlerScopeOf } from '../utils/index.js';
 /**
  * What a wire execution may say. `actor` is dropped — the scope names the writer — and a create's
  * `createdBy` is the authenticated subject, whatever the body claimed.
@@ -23,11 +23,35 @@ export const executeOptionsOf = (body, maxPoll) => {
     const asked = Number(body.timeout ?? DEFAULT_COMMIT_TIMEOUT);
     return { wait: true, timeout: Math.min(Number.isFinite(asked) && asked > 0 ? asked : DEFAULT_COMMIT_TIMEOUT, ceiling) };
 };
+/**
+ * The grants a wire execution needs: `createProjects` for a project create (its primary parent,
+ * or the root), `deleteProjects` for the delete of a project card. A card this scope cannot see is
+ * left to the executor, which answers it as absent.
+ *
+ * @throws {PlanningForbidden}
+ */
+export const assertExecutionGranted = async (facade, exec, access) => {
+    if (access?.grants == null) {
+        return;
+    }
+    if (exec.action === TransitionAction.Create && typeof exec.card === 'object' && exec.card?.kind === WorkcardKind.Project) {
+        assertGranted(access, 'createProjects', normalizeParents(exec.card.parent, exec.card.parents)[0]);
+        return;
+    }
+    if (exec.action === TransitionAction.Delete && typeof exec.card === 'string') {
+        const card = await facade.cards.load(exec.card);
+        if (card != null && isProject(card)) {
+            assertGranted(access, 'deleteProjects', card.id);
+        }
+    }
+};
 /** The one write route. */
 export const executePlanning = (protocol, opts) => handlers().request(protocol, async (req, ctx) => concealed(async () => {
-    const facade = await handlerFacade(ctx, req, opts);
+    const { facade, access } = await handlerScopeOf(ctx, req, opts);
     const body = (req.body ?? {});
-    const receipt = await facade.execute(wireExecution(body, facade.scope), executeOptionsOf(body, opts?.maxPoll ?? MAX_COMMIT_POLL));
+    const exec = wireExecution(body, facade.scope);
+    await assertExecutionGranted(facade, exec, access);
+    const receipt = await facade.execute(exec, executeOptionsOf(body, opts?.maxPoll ?? MAX_COMMIT_POLL));
     return receipt.card !== undefined
         ? { transition: receipt.transition, card: receipt.card }
         : { transition: receipt.transition };

package/build/actions/execute.js.map

@@ -1 +1 @@
-{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAK9F,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAE,KAAoB,EAAuB,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAA;QAC/C,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACxE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA8C,EAAE,OAAe,EAAkB,EAAE;IAClH,MAAM,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAA;AACzH,CAAC,CAAA;AAED,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAsC,EAAE,IAA6B,EACR,EAAE,CAC/D,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAoC,EAAE;IAC7G,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmB,CAAA;IAC/C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAC5F,CAAA;IAED,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACxC,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EACL,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,GACrG,MAAM,oBAAoB,CAAA;AAM3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAE5E;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAE,KAAoB,EAAuB,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAA;QAC/C,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACxE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA8C,EAAE,OAAe,EAAkB,EAAE;IAClH,MAAM,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAA;AACzH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,MAAsB,EAAE,IAAyB,EAAE,MAAuB,EAC3D,EAAE;IACjB,IAAI,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;QACzH,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAsC,EAAE,IAA6B,EACR,EAAE,CAC/D,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAoC,EAAE;IAC7G,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmB,CAAA;IAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAA;IAEpG,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACxC,CAAC,CAAC,CAAC,CAAA"}

package/build/actions/schemas.d.ts

@@ -1,6 +1,29 @@
 import { handlers } from '@owlmeans/server-api';
-import type { PlanningProtocols } from '@owlmeans/planning';
+import type { PlanningDefinitions, PlanningProtocols, SchemaDefineReply, SchemaDefineRequest } from '@owlmeans/planning';
 import type { Context, PlanningHandlerOptions } from '../types.js';
-/** The schema bundle the service holds — what a client loads to answer `can()` with no round trip. */
-export declare const listSchemas: (protocol: PlanningProtocols['schema']['list'], opts?: PlanningHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['request']>;
+type RequestHandler = ReturnType<ReturnType<typeof handlers<Context>>['request']>;
+/**
+ * The schema bundle — what a client loads to answer `can()` with no round trip. Scoped like every
+ * other leaf (no organization, no bundle). Where the store holds data-defined schemas it is the
+ * resolved layer of the organization, or of the project the `project` query names (a project this
+ * scope can see); otherwise the service's code bundle.
+ *
+ * @throws {WorkcardNotFound} for a project this scope cannot see
+ */
+export declare const listSchemas: (protocol: PlanningProtocols['schema']['list'], opts?: PlanningHandlerOptions) => RequestHandler;
+/**
+ * Apply one `schema.define` request to a facade's definitions: the declarations in the request's
+ * mode (flows before types), then the retirements — answering what was written and the layer as it
+ * resolves afterwards.
+ */
+export declare const applySchemaRequest: (definitions: PlanningDefinitions, request: SchemaDefineRequest) => Promise<SchemaDefineReply>;
+/**
+ * The write of data-defined types and flows. Gated by `grants.defineSchemas` when the access
+ * resolver answers grants (the organization-wide layer needs `true`, a project layer its id).
+ *
+ * @throws {PlanningUnsupported} where the store holds no data-defined schemas
+ * @throws {PlanningForbidden | SchemaConflict | SchemaSealed | SchemaInvalid | SchemaInUse | WorkcardNotFound}
+ */
+export declare const defineSchemas: (protocol: NonNullable<PlanningProtocols['schema']['define']>, opts?: PlanningHandlerOptions) => RequestHandler;
+export {};
 //# sourceMappingURL=schemas.d.ts.map

package/build/actions/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/actions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE,sGAAsG;AACtG,eAAO,MAAM,WAAW,aACZ,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,sBAAsB,KAC3E,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAMzD,CAAA"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/actions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EACV,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAC/E,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE,KAAK,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AAKjF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,aACZ,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,sBAAsB,KAC3E,cAQE,CAAA;AAEL;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAChB,mBAAmB,WAAW,mBAAmB,KAC7D,OAAO,CAAC,iBAAiB,CAyB3B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,aACd,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,sBAAsB,KAC1F,cAUE,CAAA"}

package/build/actions/schemas.js

@@ -1,9 +1,65 @@
 import { handlers } from '@owlmeans/server-api';
-import { planningServiceOf, scopeOf } from '../utils/index.js';
-/** The schema bundle the service holds — what a client loads to answer `can()` with no round trip. */
-export const listSchemas = (protocol, opts) => handlers().request(protocol, async (req, ctx) => {
-    // Scoped like every other leaf: no organization, no bundle.
-    scopeOf(req);
-    return planningServiceOf(ctx, opts).schemas.bundle();
-});
+import { PlanningUnsupported, SchemaWriteMode } from '@owlmeans/planning';
+import { assertGranted, concealed, handlerScopeOf } from '../utils/index.js';
+const text = (value) => value == null || value === '' ? undefined : `${Array.isArray(value) ? value[0] : value}`;
+/**
+ * The schema bundle — what a client loads to answer `can()` with no round trip. Scoped like every
+ * other leaf (no organization, no bundle). Where the store holds data-defined schemas it is the
+ * resolved layer of the organization, or of the project the `project` query names (a project this
+ * scope can see); otherwise the service's code bundle.
+ *
+ * @throws {WorkcardNotFound} for a project this scope cannot see
+ */
+export const listSchemas = (protocol, opts) => handlers().request(protocol, async (req, ctx) => concealed(async () => {
+    const { facade } = await handlerScopeOf(ctx, req, opts);
+    if (facade.definitions == null) {
+        return facade.schemas.bundle();
+    }
+    return await facade.definitions.bundle(text(req.query?.project));
+}));
+/**
+ * Apply one `schema.define` request to a facade's definitions: the declarations in the request's
+ * mode (flows before types), then the retirements — answering what was written and the layer as it
+ * resolves afterwards.
+ */
+export const applySchemaRequest = async (definitions, request) => {
+    const layer = request.project != null ? { project: request.project } : {};
+    const declarations = { types: request.types ?? [], flows: request.flows ?? [] };
+    const records = [];
+    switch (request.mode ?? SchemaWriteMode.Define) {
+        case SchemaWriteMode.Put:
+            for (const flow of declarations.flows) {
+                records.push(await definitions.putFlow(flow, layer));
+            }
+            for (const type of declarations.types) {
+                records.push(await definitions.putType(type, layer));
+            }
+            break;
+        case SchemaWriteMode.Seed:
+            records.push(...await definitions.seed(declarations, layer));
+            break;
+        default:
+            records.push(...await definitions.define(declarations, layer));
+    }
+    for (const key of request.retire ?? []) {
+        records.push(await definitions.retire(key.kind, key.key, layer));
+    }
+    return { records, bundle: await definitions.bundle(request.project) };
+};
+/**
+ * The write of data-defined types and flows. Gated by `grants.defineSchemas` when the access
+ * resolver answers grants (the organization-wide layer needs `true`, a project layer its id).
+ *
+ * @throws {PlanningUnsupported} where the store holds no data-defined schemas
+ * @throws {PlanningForbidden | SchemaConflict | SchemaSealed | SchemaInvalid | SchemaInUse | WorkcardNotFound}
+ */
+export const defineSchemas = (protocol, opts) => handlers().request(protocol, async (req, ctx) => concealed(async () => {
+    const { facade, access } = await handlerScopeOf(ctx, req, opts);
+    const request = (req.body ?? {});
+    if (facade.definitions == null) {
+        throw new PlanningUnsupported('definitions');
+    }
+    assertGranted(access, 'defineSchemas', request.project);
+    return await applySchemaRequest(facade.definitions, request);
+}));
 //# sourceMappingURL=schemas.js.map

package/build/actions/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/actions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAG/C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE9D,sGAAsG;AACtG,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,QAA6C,EAAE,IAA6B,EACf,EAAE,CAC/D,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvD,4DAA4D;IAC5D,OAAO,CAAC,GAAG,CAAC,CAAA;IAEZ,OAAO,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;AACtD,CAAC,CAAC,CAAA"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/actions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAKzE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAI5E,MAAM,IAAI,GAAG,CAAC,KAAc,EAAsB,EAAE,CAClD,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAA;AAE1F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,QAA6C,EAAE,IAA6B,EAC5D,EAAE,CAClB,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAiC,EAAE;IAC1G,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACvD,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAE,GAAG,CAAC,KAA2C,EAAE,OAAO,CAAC,CAAC,CAAA;AACzG,CAAC,CAAC,CAAC,CAAA;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,WAAgC,EAAE,OAA4B,EAClC,EAAE;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAA;IAC/E,MAAM,OAAO,GAAyB,EAAE,CAAA;IAExC,QAAQ,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;QAC/C,KAAK,eAAe,CAAC,GAAG;YACtB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YACtD,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YACtD,CAAC;YACD,MAAK;QACP,KAAK,eAAe,CAAC,IAAI;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAA;YAC5D,MAAK;QACP;YACE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAA;IAClE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAA;AACvE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,QAA4D,EAAE,IAA6B,EAC3E,EAAE,CAClB,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAgC,EAAE;IACzG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAA;IACvD,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAA;IAC9C,CAAC;IACD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvD,OAAO,MAAM,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC,CAAC,CAAC,CAAA"}

package/build/conformance/assert.d.ts

@@ -0,0 +1,20 @@
+/** A conformance expectation that did not hold. Plain `Error`, so any test runner reports it. */
+export declare class ConformanceFailure extends Error {
+    constructor(message: string);
+}
+/** @throws {ConformanceFailure} */
+export declare const check: (condition: unknown, message: string) => void;
+/** Structural equality over JSON values. @throws {ConformanceFailure} */
+export declare const same: (actual: unknown, expected: unknown, message: string) => void;
+/** The same members in any order. @throws {ConformanceFailure} */
+export declare const sameSet: (actual: readonly unknown[], expected: readonly unknown[], message: string) => void;
+/**
+ * The promise rejects with an error of the class (matched by instance or by its registered type
+ * name, so a duplicate module copy counts). Answers the error.
+ *
+ * @throws {ConformanceFailure}
+ */
+export declare const rejects: (run: Promise<unknown> | (() => Promise<unknown>), expected: {
+    typeName: string;
+}, message: string) => Promise<Error>;
+//# sourceMappingURL=assert.d.ts.map

package/build/conformance/assert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert.d.ts","sourceRoot":"","sources":["../../src/conformance/assert.ts"],"names":[],"mappings":"AAEA,iGAAiG;AACjG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAUD,mCAAmC;AACnC,eAAO,MAAM,KAAK,cAAe,OAAO,WAAW,MAAM,KAAG,IAI3D,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,IAAI,WAAY,OAAO,YAAY,OAAO,WAAW,MAAM,KAAG,IAI1E,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,OAAO,WAAY,SAAS,OAAO,EAAE,YAAY,SAAS,OAAO,EAAE,WAAW,MAAM,KAAG,IAGnG,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,OAAO,QACb,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,WAAW,MAAM,KAChG,OAAO,CAAC,KAAK,CAYf,CAAA"}

package/build/conformance/assert.js

@@ -0,0 +1,54 @@
+import { sameValue } from '@owlmeans/planning';
+/** A conformance expectation that did not hold. Plain `Error`, so any test runner reports it. */
+export class ConformanceFailure extends Error {
+    constructor(message) {
+        super(`planning conformance: ${message}`);
+        this.name = 'ConformanceFailure';
+    }
+}
+const show = (value) => {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return `${value}`;
+    }
+};
+/** @throws {ConformanceFailure} */
+export const check = (condition, message) => {
+    if (condition !== true) {
+        throw new ConformanceFailure(message);
+    }
+};
+/** Structural equality over JSON values. @throws {ConformanceFailure} */
+export const same = (actual, expected, message) => {
+    if (!sameValue(actual, expected)) {
+        throw new ConformanceFailure(`${message}: expected ${show(expected)}, got ${show(actual)}`);
+    }
+};
+/** The same members in any order. @throws {ConformanceFailure} */
+export const sameSet = (actual, expected, message) => {
+    const sort = (values) => [...values].map(show).sort();
+    same(sort(actual), sort(expected), message);
+};
+/**
+ * The promise rejects with an error of the class (matched by instance or by its registered type
+ * name, so a duplicate module copy counts). Answers the error.
+ *
+ * @throws {ConformanceFailure}
+ */
+export const rejects = async (run, expected, message) => {
+    try {
+        await (typeof run === 'function' ? run() : run);
+    }
+    catch (error) {
+        const type = error?.type;
+        if (error instanceof expected
+            || (typeof type === 'string' && type === expected.typeName)) {
+            return error;
+        }
+        throw new ConformanceFailure(`${message}: expected ${expected.typeName}, got ${show(error?.message ?? error)}`);
+    }
+    throw new ConformanceFailure(`${message}: expected ${expected.typeName}, nothing was thrown`);
+};
+//# sourceMappingURL=assert.js.map