@owlmeans/server-planning 0.1.18-rc.19 → 0.1.18-rc.20

package/README.md

@@ -10,7 +10,7 @@ the `@owlmeans/server-planning/store` subpath.
 ## Installation
 
 ```sh
-bun add @owlmeans/server-planning@^0.1.18-rc.19 @owlmeans/planning@^0.1.18-rc.16 ajv
+bun add @owlmeans/server-planning@^0.1.18-rc.20 @owlmeans/planning@^0.1.18-rc.17 ajv
 ```
 
 ## Concepts

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-planning",
-  "version": "0.1.18-rc.19",
-  "generatedAt": "2026-10-03T15:33:53.018Z",
+  "version": "0.1.18-rc.20",
+  "generatedAt": "2026-10-04T01:01:54.399Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-planning/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-planning
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.19"` in `dependencies` (`ajv` is a peer)
+**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.20"` in `dependencies` (`ajv` is a peer)
 
 The general implementation of `@owlmeans/planning`: the planning service (a plugin host), the
 scoped facade, the executor every write goes through, the in-memory reference store, the commit
@@ -321,7 +321,7 @@ decision per request; a throw is the request's answer (an `AuthForbidden` answer
   admits, over `writes`: the project itself, a card whose `parents` name one, a specification
   through its parent card; a create needs every named parent writable, and a create at the root
   (no parent, not a project) is refused. `schema.define` of a project layer needs the project in
-  `writes`. A refusal is `PlanningForbidden` (403) with `writes:<id>`, checked before the grants
+  `writes`. A refusal is `PlanningForbidden` (403, `forbidden:writes:<id>`), checked before the grants
   and before the executor. NOT governed by it: a project create (`grants.createProjects` alone) and
   the organization layer (`grants.defineSchemas`). A card the scope cannot see is still answered
   as absent by the executor. Omitted — every visible project is writable.
@@ -334,26 +334,17 @@ decision per request; a throw is the request's answer (an `AuthForbidden` answer
 
 ## Mounting in a target
 
-A generated target serves the STOCK tree; it never writes card, transition or schema routes of its
-own, and its domain rules are `before` plugins.
-
-- **common** declares the one tree the api and the web share:
-  `makePlanningProtocols({ base: { alias: 'api:planning' }, guards: DEFAULT_GUARD, definitions: true })`.
-- **api** binds `servePlanningEntrypoints(tree, { access })` WITHOUT the commit socket —
-  `.filter(entrypoint => entrypoint.protocol !== tree.commit.events)`: a target has no socket that
-  authenticates after open, so the client long-polls (`commit.get` with `wait`, `execute` with
-  `wait: true`).
-- **The resolver** answers `{ entityId, projects, writes, grants }`: `projects` = the containers the
-  person may view, `writes` = those they may modify, `grants` = `createProjects` / `deleteProjects`
-  / `defineSchemas` from their create and admin rights. A creator sees what they created — stamp
-  ownership in a `before` hook and add it to both lists.
-- **Kit types and flows** are LITERAL objects in the target's `sources/common/src/planning.ts`
-  `PLANNING` plugin, between its sentinels (`// owlmeans: add planning flows above this line`,
-  `… types above this line`) — a spread or an imported constant hides them from the library's
-  registration checks. Card types and flows carry `overridable: true`, `fields` schemas stay open
-  (`additionalProperties: true`), and the container project type carries `scopedCardTypes: true`,
-  so the people of the app can override and extend them as data through `schema.define`.
-- The web side is `client-planning` → Mounting in a target; the store, `planning-postgres`.
+The api half of the target mount (the common tree and the kit literals: `planning` → Mounting in a
+target).
+
+- Bind `servePlanningEntrypoints(tree, { access })` WITHOUT the commit socket —
+  `.filter(entrypoint => entrypoint.protocol !== tree.commit.events)`: nothing authenticates a
+  target's socket after it opens, so the client long-polls (`commit.get` with `wait`, `execute`
+  with `wait: true`). Never write card, transition or schema routes beside it.
+- The resolver maps container permissions onto the access: `projects` = the containers the person
+  may view, `writes` = those they may modify, `grants` = `createProjects` / `deleteProjects` /
+  `defineSchemas` from their create and admin rights. A creator sees what they created — stamp
+  ownership in a `before` hook and add the card to both lists.
 
 ## Data-defined types and flows
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-planning",
-  "version": "0.1.18-rc.19",
+  "version": "0.1.18-rc.20",
   "license": "MIT",
   "description": "The general planning implementation — the planning service and its plugin/middleware registry, the transition executor, the in-memory store, the protocol handlers and the commit feed.",
   "type": "module",
@@ -50,7 +50,7 @@
     "@owlmeans/context": "^0.1.18-rc.32",
     "@owlmeans/entrypoint": "^0.1.18-rc.39",
     "@owlmeans/error": "^0.1.18-rc.36",
-    "@owlmeans/planning": "^0.1.18-rc.16",
+    "@owlmeans/planning": "^0.1.18-rc.17",
     "@owlmeans/queue": "^0.1.18-rc.38",
     "@owlmeans/resource": "^0.1.18-rc.37",
     "@owlmeans/route": "^0.1.18-rc.33",