@owlmeans/server-planning 0.1.18-rc.15 → 0.1.18-rc.16

package/README.md

@@ -10,7 +10,7 @@ the `@owlmeans/server-planning/store` subpath.
 ## Installation
 
 ```sh
-bun add @owlmeans/server-planning@^0.1.18-rc.15 @owlmeans/planning@^0.1.18-rc.13 ajv
+bun add @owlmeans/server-planning@^0.1.18-rc.16 @owlmeans/planning@^0.1.18-rc.14 ajv
 ```
 
 ## Concepts
@@ -169,7 +169,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.44
+npx @owlmeans/agent-skills@^0.1.18-rc.45
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-planning",
-  "version": "0.1.18-rc.15",
-  "generatedAt": "2026-09-30T09:41:02.821Z",
+  "version": "0.1.18-rc.16",
+  "generatedAt": "2026-10-01T23:27:48.721Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-planning/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-planning
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.15"` in `dependencies` (`ajv` is a peer)
+**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.16"` in `dependencies` (`ajv` is a peer)
 
 The general implementation of `@owlmeans/planning`: the planning service (a plugin host), the
 scoped facade, the executor every write goes through, the in-memory reference store, the commit
@@ -291,6 +291,12 @@ mapping external records (`mappers`) belongs to that plugin's own store adapter.
   from the request, never the body (`wireExecution` drops a draft's claim; the executor's
   `withCreator` stamps the subject, and `assertCreatorFixed` refuses a body whose `changes` or
   `unset` names `createdBy` — an update can never re-own a card).
+- The organization of a scope is the one the request ACTS IN. Behind the integrated IAM
+  (`@owlmeans/server-iam`) that is the session's acting organization, attached to the request by the
+  OIDC guard, so `requireEntityKey(req)` is the right tenant key for a product whose people belong
+  to several organizations — and, for a product with one shared organization (every person acts in
+  the application's own), the same key for everybody. Take it from the request in the handler and
+  pass it down; never read it from the context or from a body.
 - Another entity's card, specification or transition answers `WorkcardNotFound` — the same as an
   absent id — on reads and writes alike (`concealed`).
 - Queries arrive in their wire form and are decoded with `decode*Query` before `criteriaOf`, which
@@ -309,6 +315,10 @@ decision per request; a throw is the request's answer (an `AuthForbidden` answer
   lists, counts and summaries are AND'd with `projectCriteriaOf`, links and transitions are
   filtered by `project` (and post-filtered, for a store that ignores the field), commit
   subscriptions drop events outside the set and a status or wait refuses them.
+- A person who may see only SOME projects of their organization (a lending library's member given
+  one branch) is expressed here: the resolver answers the project ids the person's grants list as
+  `projects`, and omits the key when a grant covers every project — never a hand-written filter in
+  each handler.
 - `grants` gates the stock handlers' writes: `createProjects` (a project create — `true` for the
   root, a list names the parent projects), `deleteProjects` (the delete of a project card — a list
   names the projects), `defineSchemas` (`schema.define` — `true` for the organization's layer, a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-planning",
-  "version": "0.1.18-rc.15",
+  "version": "0.1.18-rc.16",
   "license": "MIT",
   "description": "The general planning implementation — the planning service and its plugin/middleware registry, the transition executor, the in-memory store, the protocol handlers and the commit feed.",
   "type": "module",
@@ -44,21 +44,21 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.36",
-    "@owlmeans/auth-common": "^0.1.18-rc.42",
+    "@owlmeans/auth": "^0.1.18-rc.37",
+    "@owlmeans/auth-common": "^0.1.18-rc.43",
     "@owlmeans/basic-ids": "^0.1.18-rc.34",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.37",
+    "@owlmeans/entrypoint": "^0.1.18-rc.38",
     "@owlmeans/error": "^0.1.18-rc.36",
-    "@owlmeans/planning": "^0.1.18-rc.13",
-    "@owlmeans/queue": "^0.1.18-rc.36",
+    "@owlmeans/planning": "^0.1.18-rc.14",
+    "@owlmeans/queue": "^0.1.18-rc.37",
     "@owlmeans/resource": "^0.1.18-rc.37",
     "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/server-api": "^0.1.18-rc.46",
-    "@owlmeans/server-context": "^0.1.18-rc.38",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.36",
-    "@owlmeans/server-socket": "^0.1.18-rc.49",
-    "@owlmeans/socket": "^0.1.18-rc.35"
+    "@owlmeans/server-api": "^0.1.18-rc.47",
+    "@owlmeans/server-context": "^0.1.18-rc.39",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.37",
+    "@owlmeans/server-socket": "^0.1.18-rc.50",
+    "@owlmeans/socket": "^0.1.18-rc.36"
   },
   "peerDependencies": {
     "ajv": "*",