@owlmeans/server-planning 0.1.18-rc.2 → 0.1.18-rc.20

package/README.md

@@ -10,13 +10,16 @@ the `@owlmeans/server-planning/store` subpath.
 ## Installation
 
 ```sh
-bun add @owlmeans/server-planning@^0.1.18-rc.2 @owlmeans/planning@^0.1.18-rc.2 ajv
+bun add @owlmeans/server-planning@^0.1.18-rc.20 @owlmeans/planning@^0.1.18-rc.17 ajv
 ```
 
 ## Concepts
 
-- **Facade** — `context.planning().for(scope)`: every read and write of one organization entity,
-  with no scope argument on any method.
+- **Facade** — `ctx.service<PlanningHostService>(PLANNING_SERVICE).for(scope)`: every read and
+  write of one organization entity, with no scope argument on any method. `context.planning()` is
+  the same service, but only on a context that went through `appendPlanningService`; a service
+  registered as a plain one (`makePlanningService()`, a generated target's `services/planning.ts`)
+  has no `context.planning`.
 - **Executor** — the only write path: normalize → idempotency → resolve → plugins' `before` →
   validate → id → code → changes → seq CAS → append → project → receipt. Nothing is appended by a
   refusal.
@@ -101,36 +104,61 @@ const cards = await planningFor(ctx, req, { channel: 'web' }).cards.list({ paren
 
 - Service: `appendPlanningService`, `ensurePlanningService`, `makePlanningService`,
   `planningServiceApi`, `makePluginRegistry`, `makeStoreFacade`, `executeTransition`,
-  `PlanningServiceOptions`, `PlanningHostService`, `PlanningRuntime`, `PluginRegistry`
+  `creatorOf`, `withCreator`, `assertCreatorFixed`, `PlanningServiceOptions`, `PlanningHostService`,
+  `PlanningRuntime`, `PluginRegistry`
 - Handlers: `servePlanningEntrypoints`, `planningFor`, `listSchemas`, `listCards`,
   `summarizeCards`, `getCard`, `listCardTransitions`, `listCardSpecifications`, `getSpecification`,
   `listSpecificationRevisions`, `listLinks`, `getTransition`, `executePlanning`, `wireExecution`,
-  `executeOptionsOf`, `getCommit`, `watchCommits`, `PlanningHandlerOptions`, `PlanningScopeExtractor`
-- Scope: `scopeOf`, `actorOf`, `handlerFacade`, `planningServiceOf`, `concealed`, `assertScope`,
-  `notFoundOf`, `clampSeconds`
+  `executeOptionsOf`, `assertExecutionGranted`, `getCommit`, `watchCommits`, `defineSchemas`,
+  `applySchemaRequest`, `PlanningHandlerOptions`, `PlanningScopeExtractor`, `PlanningAccessResolver`,
+  `PlanningAccess`, `PlanningAccessGrants`, `PlanningGrant`
+- Scope: `scopeOf`, `accessScopeOf`, `actorOf`, `handlerFacade`, `handlerScopeOf`, `assertGranted`,
+  `planningServiceOf`, `concealed`, `assertScope`, `notFoundOf`, `clampSeconds`, `projectCriteriaOf`
+- Data-defined schemas: `makeDefinitions`, `makeSchemaViews`, `SchemaViews`, `SchemaViewsOptions`
 - Projection: `makeProjectionProcessor`, `planningQueueHooks`, `ProjectionOptions`
-- Constants: `DEFAULT_ALIAS`, `MEMORY_STORE_ALIAS`, `DEFAULT_COMMIT_MEMORY`, `COMMIT_POLL_LADDER`
+- Constants: `DEFAULT_ALIAS`, `MEMORY_STORE_ALIAS`, `DEFAULT_COMMIT_MEMORY`, `COMMIT_POLL_LADDER`,
+  `DEFAULT_SCHEMA_VIEWS`
 - `@owlmeans/server-planning/store`: `makeMemoryPlanningStore`, `foldPending`, `failPending`,
-  `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore`, and the types
-  `BindablePlanningStore`, `CommitListener`, `CommitHub`, `CommitHubOptions`, `FoldOptions`,
-  `FoldResult`, `MemoryPlanningStore`, `MemoryPlanningStoreOptions`, `StoreRoute`
+  `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore`, `wantsSpecifications`,
+  and the types `BindablePlanningStore`, `CommitListener`, `CommitHub`, `CommitHubOptions`,
+  `FoldOptions`, `FoldResult`, `MemoryPlanningStore`, `MemoryPlanningStoreOptions`, `StoreRoute`
+- `@owlmeans/server-planning/conformance`: `planningConformance`, `conformanceCasesFor`,
+  `planningConformancePlugin`, `conformanceClock`, `ConformanceFailure`, `check`, `same`,
+  `sameSet`, `rejects`, the library fixtures (`LIBRARY`, `createBranch`, `createBook`, `transit`)
+  and the types `ConformanceCase`, `ConformanceSubject`, `ConformanceCapability`
 
 ## Common pitfalls
 
+- A create's draft goes under `card` — `draft` is refused as `planning:malformed:create-without-draft`.
+- `{ wait: true }` is the SECOND argument of `execute`; inside the execution it is ignored and the
+  receipt returns before the commit.
+- A type or flow declaration has no `name` or `key`: the display name is `label`, the key is `type`
+  (a type) or `id` (a flow). `definitions.define` refuses anything else with `SchemaInvalid`; a code
+  plugin's registry does not check, so keep the literals typed.
+
 - `after` hooks run where the transition is FOLDED, once per commit — register the same plugins in
   every folding process, and never run hooks from a commit-bus subscription.
 - The memory store is per-process heap: wrong for multiple processes or restarts.
 - `actor` comes from the scope; a wire `actor` or `createdBy` is ignored.
+- A create's `createdBy` defaults to the scope's subject (`profileId`, else `userId`, else the
+  scope actor's) on every path — in-process facade and HTTP alike; an in-process draft that names
+  one keeps it, a scope naming nobody leaves it unset.
+- After the create `createdBy` never moves: an execution naming it in `changes` or `unset` is
+  refused with `planning:immutable:createdBy` — over HTTP, in process and from a `before` plugin.
 - Another entity's record is `WorkcardNotFound`, never a permission error.
 - Give retried writes a `key` — it is checked before validation, so a retry answers the first receipt.
 - `expectSeq` compares against `head`; a stale one is `WorkcardConflict`, re-read and retry.
 - Call `appendPlanningService` before any `ensurePlanningService`, or the appended host replaces
   what was registered on the default one.
+- `opts.access` makes the resolver the only source of the organization; a `grants` object refuses
+  every flag it leaves out.
+- A durable store is not done until it passes `@owlmeans/server-planning/conformance`.
 
 ## Related packages
 
 - `@owlmeans/planning` — records, flows, fold, query language, protocol tree, models
 - `@owlmeans/client-planning` — the remote facade and state mirror
+- `@owlmeans/planning-postgres` — the durable Postgres store
 - `@owlmeans/server-job`, `@owlmeans/queue` — job feeds and the projection queue
 
 <!-- owlmeans:agent-guidance:start -->
@@ -141,7 +169,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.30
+npx @owlmeans/agent-skills@^0.1.18-rc.46
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-planning",
-  "version": "0.1.18-rc.2",
-  "generatedAt": "2026-09-19T13:42:56.215Z",
+  "version": "0.1.18-rc.20",
+  "generatedAt": "2026-10-04T01:01:54.399Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-planning/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-planning
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.2"` in `dependencies` (`ajv` is a peer)
+**Install:** `"@owlmeans/server-planning": "^0.1.18-rc.20"` in `dependencies` (`ajv` is a peer)
 
 The general implementation of `@owlmeans/planning`: the planning service (a plugin host), the
 scoped facade, the executor every write goes through, the in-memory reference store, the commit
@@ -24,13 +24,18 @@ reuses the `./store` subpath (`foldPending`, `makeCommitHub`) without pulling fa
 | `makePlanningService(opts?, alias?)`, `planningServiceApi(opts, self)` | The service, and its body for a specialised service |
 | `PlanningServiceOptions` | `{ store?, plugins?, schemas?, hooks?, ids?, now? }` |
 | `makePluginRegistry`, `makeStoreFacade`, `executeTransition` | The pieces the service is made of |
-| `servePlanningEntrypoints(protocols, opts?)` | One binding per protocol of a `makePlanningProtocols` tree |
+| `creatorOf(scope)`, `withCreator(exec, scope)`, `assertCreatorFixed(exec)` | The subject a create is stamped with as `createdBy`, the defaulting the executor applies, and its refusal of any later move |
+| `servePlanningEntrypoints(protocols, opts?)` | One binding per protocol of a `makePlanningProtocols` tree (`schema.define` too when declared) |
 | `planningFor(ctx, req, extra?)` | The request-scoped facade for a hand-written handler |
-| `PlanningHandlerOptions` | `{ service?, event?, maxPoll?, scope?(req, ctx) }` |
-| `listCards` … `executePlanning`, `getCommit`, `watchCommits` | The handlers, to bind one by hand |
-| `scopeOf(req, extra?)`, `actorOf(req)`, `concealed(run)`, `clampSeconds` | Scope and security helpers |
+| `PlanningHandlerOptions` | `{ service?, event?, maxPoll?, scope?(req, ctx), access?(req, ctx) }` |
+| `PlanningAccessResolver`, `PlanningAccess`, `PlanningAccessGrants`, `PlanningGrant` | The optional access decision a hosting app supplies |
+| `listCards` … `executePlanning`, `getCommit`, `watchCommits`, `listSchemas`, `defineSchemas`, `applySchemaRequest` | The handlers, to bind one by hand |
+| `scopeOf(req, extra?)`, `accessScopeOf(req, access, extra?)`, `handlerScopeOf`, `assertGranted`, `assertWrites`, `writableIn`, `assertExecutionGranted`, `assertExecutionWrites`, `actorOf(req)`, `concealed(run)`, `clampSeconds` | Scope and security helpers |
+| `makeDefinitions(runtime, facade)`, `makeSchemaViews(opts)`, `projectCriteriaOf(projects, through?)` | Data-defined schemas and the project narrowing |
 | `makeProjectionProcessor(ctx, opts?)`, `planningQueueHooks(ctx, opts?)` | A generic projection job body and its `onJobDead` |
-| `./store`: `makeMemoryPlanningStore`, `foldPending`, `failPending`, `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore` | What stores are built from |
+| `./queue`: `declarePlanningQueue(cfg, opts?)`, `PLANNING_PROJECTION_QUEUE` (`planning-projection`), `PLANNING_PROJECT_JOB` (`planning:project`), `ProjectionRequest` | The projection queue's shared address; each process chooses separately whether to listen |
+| `./store`: `makeMemoryPlanningStore`, `foldPending`, `failPending`, `revisionsFromLog`, `commitEventOf`, `makeCommitHub`, `makeCompositeStore`, `wantsSpecifications` | What stores are built from |
+| `./conformance`: `planningConformance`, `conformanceCasesFor`, `planningConformancePlugin`, `conformanceClock`, `ConformanceFailure` | The store conformance suite, runner-agnostic |
 
 ## Wiring
 
@@ -58,23 +63,89 @@ context.registerEntrypoints(servePlanningEntrypoints(planningProtocols, {
   `ensurePlanningService(ctx).use(plugin)` works from `makeContext`, before `init()`.
 - Call `appendPlanningService` BEFORE any `ensurePlanningService`: `ensure` registers a default
   host when none exists, and a later `append` replaces it together with whatever was `use`d on it.
-- In code: `ctx.planning().for({ entityId, profileId?, channel?, actor? })` → a `PlanningFacade`
-  with no scope argument on any method.
+- **The facade:** `ctx.service<PlanningHostService>(PLANNING_SERVICE).for({ entityId, profileId?,
+  channel?, actor? })` → a `PlanningFacade` with no scope argument on any method. That form works
+  however the service was registered. `ctx.planning()` is only a shortcut that `appendPlanningService`
+  / `appendPostgresPlanning` install (typed `WithPlanningService`); a context that registered
+  `makePlanningService()` / `makePostgresPlanningService()` as a plain service — a generated target's
+  `services/planning.ts` — has no `ctx.planning` at all. In a request handler use
+  `planningFor(ctx, req)`: the entity comes from `requireEntityKey(req)`, never the token.
+
+## Creating and reading a card
+
+```ts
+import { IntrinsicStatus, PLANNING_SERVICE, TransitionAction, WorkcardKind } from '@owlmeans/planning'
+import type { PlanningHostService } from '@owlmeans/server-planning'
+
+const planning = ctx.service<PlanningHostService>(PLANNING_SERVICE).for({ entityId, profileId })
+
+const shed = await planning.execute({
+  action: TransitionAction.Create,
+  card: { kind: WorkcardKind.Project, type: 'shed:shed', title: 'Maple Street shed' },
+}, { wait: true })
+const drill = await planning.execute({
+  action: TransitionAction.Create,
+  card: { kind: WorkcardKind.Card, type: 'shed:tool', parent: shed.card!.id!, title: 'Cordless drill',
+    fields: { brand: 'Acme' } },
+}, { wait: true })                      // drill.card — the committed record, status 'available'
+
+await planning.cards.get(drill.card!.id!)
+await planning.cards.list({ parent: shed.card!.id!, type: 'shed:tool' })
+await planning.execute({ action: TransitionAction.Transit, card: drill.card!.id!, transition: 'lend' }, { wait: true })
+
+// A card type and a flow as DATA, scoped to this shed — `definitions` exists only where the store
+// keeps schemas (planning-postgres; the memory store with `schemas: true`), and the shed's cards may
+// use them when its project type says `scopedCardTypes: true` (or lists the type in `cardTypes`).
+await planning.definitions!.define({
+  flows: [{
+    id: 'shed:repair', version: 1, label: 'Repair',
+    statuses: [
+      { key: 'reported', intrinsic: IntrinsicStatus.Planned, initial: true, label: 'Reported' },
+      { key: 'fixed', intrinsic: IntrinsicStatus.Closed, terminal: true, label: 'Fixed' },
+    ],
+    transitions: [{ name: 'fix', from: ['reported'], to: 'fixed', label: 'Mark fixed', explicit: true }],
+  }],
+  types: [{
+    type: 'shed:repair', kind: WorkcardKind.Card, version: 1, label: 'Repair ticket',
+    fields: { type: 'object', properties: { tool: { type: 'string' } }, additionalProperties: false },
+    flows: ['shed:repair'], specifications: [],
+  }],
+}, { project: shed.card!.id! })
+```
+
+| Wrong | What happens | Right |
+|---|---|---|
+| `execute({ action, draft: { … } })` | refused: `planning:malformed:create-without-draft` | the draft goes under `card` |
+| `execute({ …, wait: true })` | in process the key is ignored: the receipt returns before the commit, with no `card` — hidden while an inline-folding store (`planning-postgres`) lands at once, exposed the first time another process holds the card's fold | `execute({ … }, { wait: true })` — only the wire body (`ExecuteRequest`) carries `wait` inside |
+| `ctx.planning().for(…)` in a target | `ctx.planning is not a function` | `ctx.service<PlanningHostService>(PLANNING_SERVICE).for(…)` |
+| `{ id, name: 'Repair', … }` on a flow, `{ key, name, … }` on a type | `define` refuses with `SchemaInvalid` (closed schemas); a code plugin's registry does not validate, so the key is silently dropped | a flow's key is `id`, a type's is `type`, the display name is `label` on both |
+| `action: 'create'` | a type error — `TransitionAction` is an enum | `action: TransitionAction.Create` |
+
+Every wrong form is a compile error against the typed facade (`PlanningFacade`,
+`TransitionExecution`, `WorkcardTypeSchema`); it reaches run time only through a helper or a context
+typed `any`, so never type one that way. `tests/create-example.spec.ts` runs this example and each
+wrong form as written.
 
 ## The executor, step by step
 
 Nothing is appended before step 11 — every refusal leaves the log untouched.
 
-1. **Normalize** — deep copy, trimmed text, `parents ∋ parent` (first).
+1. **Normalize** — deep copy, trimmed text, `parents ∋ parent` (first); a create's draft without
+   `createdBy` gets `creatorOf(scope)` (below).
 2. **Scope** — `entityId` must be present.
 3. **Idempotency** — a `key` already in the entity's log answers ITS receipt, before any
    validation or middleware.
-4. **Resolve** — the card (`WorkcardNotFound`; another entity's card is `PlanningScopeMismatch`),
-   its type and flow, every draft parent (`ParentNotFound`) and the parent project's
-   `cardTypes`/`projectTypes` (`CardTypeNotAllowed`), the specification slot.
+4. **Resolve** — the card (`WorkcardNotFound`; another entity's card is `PlanningScopeMismatch`;
+   one outside the scope's `projects` is `WorkcardNotFound`), its type and flow, every draft parent
+   (`ParentNotFound` — loaded through the facade, so an invisible parent is absent) and the parent
+   project's `cardTypes`/`projectTypes` (`CardTypeNotAllowed`), the specification slot. Where the
+   default store holds data-defined schemas, the card's project is found first and everything
+   after reads that project's resolved layer (`Resolved.schemas`): a data-defined type of a
+   project with `scopedCardTypes` is admitted, a retired type creates nothing
+   (`UnknownWorkcardType('retired:…')`). Without the port `Resolved.schemas` IS the code registry.
 5. **`before` chain** — in plugin order; re-resolved once when it changed the card, type or parent.
 6. **Validate** — shape (`planning:malformed:*`), the flow rule (`IllegalTransition`), immutables
-   (`planning:immutable:*`), merged `fields` (`FieldsInvalid`), labels (`LabelNotAllowed`), a moved
+   (`planning:immutable:*`, `createdBy` among them — `assertCreatorFixed`), merged `fields` (`FieldsInvalid`), labels (`LabelNotAllowed`), a moved
    parent, the slot (`SpecificationSlotUnknown`, `SpecificationRevisionConflict`, JSON body schema
    → `FieldsInvalid`), relationships (`RelationshipRefused`: undeclared type, `from` not the card,
    missing target, type constraints, `single`, unlinking an absent edge).
@@ -92,6 +163,17 @@ Nothing is appended before step 11 — every refusal leaves the log untouched.
 `actor` is the SCOPE's: `profileId`/`userId`/`service`/`channel` come from the scope only; an
 in-process caller may add `agent`/`runId` on the execution. A handler never passes a wire `actor`.
 
+A create's `createdBy` is the scope's subject too — `creatorOf(scope)`: `profileId`, else `userId`,
+else the same two of `scope.actor`. The executor stamps it on every path, so an in-process facade
+create and the HTTP `execute` produce the same owner. An in-process draft that names `createdBy`
+keeps it (explicit wins — a manager creating on someone's behalf); a scope naming nobody (a service
+or system scope) leaves it unset; the wire drops a draft's `createdBy` before the stamp.
+
+`createdBy` never moves after the create (the rule is `planning` → The record model). The executor
+enforces it itself with `assertCreatorFixed` at step 6, after the `before` chain, so a wire body, an
+in-process caller and a plugin are refused alike, whatever `@owlmeans/planning` build the host
+resolves. The conformance suite checks a store folds a stored row naming it as the pure fold does.
+
 ## Idempotency and `expectSeq`
 
 - Give every retried or replayed write a `key` (`import:<source>:<n>`). The key is unique per entity
@@ -125,11 +207,15 @@ the store; `bind` replaces the listener, so a store has exactly one.
 
 ## The memory store
 
-`makeMemoryPlanningStore({ sync?, ids?, now?, seed?, onCommitted?, alias? })`
+`makeMemoryPlanningStore({ sync?, ids?, now?, seed?, onCommitted?, alias?, schemas? })`
 
 - Cards and projects in one map, specifications in their own, relationships in a third; every read
   goes through the `@owlmeans/resource` query engine. A card list includes specifications only when
-  the criteria asks for `kind: specification` or a `category`.
+  the criteria asks for `kind: specification` or a `category` (`wantsSpecifications`, the rule every
+  store routes by).
+- `schemas: true` adds the data-defined schema port (records per layer, a revision per
+  organization, synchronous `watch`); off by default — without it every type and flow resolves
+  from code.
 - `sync` (default) folds, publishes and runs `committed` inside `project()`, serialized per card.
   `sync: false` folds nothing until `flush(card?)` — a queued store's shape, for tests that need a
   commit to stay pending.
@@ -155,7 +241,20 @@ the store; `bind` replaces the listener, so a store has exactly one.
   no card to advance, and a store that refuses the advancing write stops the fold with `followUp`,
   leaving the rest pending for a retry. `revisionsFromLog` replays past failed transitions the same
   way.
+- A transactional store passes `FoldOptions.unit` — it wraps each transition's writes (a
+  savepoint), so a write the database refuses is undone whole and the fold marks that transition
+  failed and goes past it. `foldPending` folds PAST a failure it produces; a row that is ALREADY
+  failed at the cursor, or a gap in the seqs, is the store's to step over before calling it
+  (`planning-postgres` does it in a prelude).
 - `failPending` is what a dead projection job must do, or waiters hang to their timeout.
+- The data-defined schema port (`schemas`) is optional; `makeCompositeStore` passes the default
+  store's through. A store that has it must purge a project's layer with the project.
+- **Run the conformance suite.** `@owlmeans/server-planning/conformance` exports
+  `planningConformance` — named cases with no test runner inside (each throws
+  `ConformanceFailure`) — and `conformanceCasesFor(store)`, which drops the data-defined cases for a
+  store without the port. Boot a service with `planningConformancePlugin` and `conformanceClock()`
+  and hand each case `{ service, store, facade }`; every case works in its own organization, so one
+  boot serves them all.
 - `makeCommitHub({ status, remember?, ladder? })` is the `CommitSource`: feed `publish` from the bus,
   answer `status` from transition rows. `wait` subscribes first, polls once, then climbs the ladder.
 - `revisionsFromLog(transitions, limit?)` answers `specs.revisions`.
@@ -180,24 +279,100 @@ mapping external records (`mappers`) belongs to that plugin's own store adapter.
 
 ## Scope and security
 
-- `entityId` is `requireEntityKey(req)`; `opts.scope(req, ctx)` adds a `channel` or `service` and
-  can never replace the entity. `actor` and a create's `createdBy` come from the request, never the
-  body.
+- Without `opts.access`: `entityId` is `requireEntityKey(req)`; `opts.scope(req, ctx)` adds a
+  `channel` or `service` and can never replace the entity. `actor` and a create's `createdBy` come
+  from the request, never the body (`wireExecution` drops a draft's claim, `withCreator` stamps the
+  subject, `assertCreatorFixed` refuses a body naming `createdBy` — an update never re-owns a card).
+- The organization of a scope is the one the request ACTS IN. `requireEntityKey(req)` answers
+  `req.entity.id`, the stable record id (the token's `entitySlug` only where no entity resolver is
+  registered). Behind an OIDC relying party (`@owlmeans/server-oidc-rp`) the acting organization is
+  session state: the guard attaches `req.entity` with `id` = the organization claim's frozen
+  `entityKey`, so the tenant key survives a rename and follows a switch. Take it in the handler and
+  pass it down; never read it from the context or from a body.
 - Another entity's card, specification or transition answers `WorkcardNotFound` — the same as an
   absent id — on reads and writes alike (`concealed`).
 - Queries arrive in their wire form and are decoded with `decode*Query` before `criteriaOf`, which
   always adds the scope's `entityId`.
 
+### The access resolver
+
+`opts.access: (req, ctx) => Promise<{ entityId, projects?, writes?, grants? }>` is the hosting app's
+decision per request; a throw is the request's answer (an `AuthForbidden` answers 403).
+
+- `entityId` is the resolver's — never the token's, never `opts.scope`'s.
+- `projects` becomes `PlanningScope.projects`, which the server facade enforces on every read and
+  write. Visible are the projects, every card whose `parents` name one, and every specification
+  whose parent card is visible (its `parents` hold only that card). Anything else reads as absent
+  (`WorkcardNotFound`, `null`, an empty list); a create under an invisible parent is
+  `ParentNotFound`; links and transitions are filtered by `project` (and post-filtered, for a store
+  that ignores the field); commit subscriptions drop events outside the set and a status or wait
+  refuses them.
+- **A narrowed list or count sees a specification whenever its parent card is visible** — exactly
+  what a single read admits. It is AND'd with `projectCriteriaOf(projects, through)`; when its
+  criteria ask for specifications (`wantsSpecifications`) the facade resolves `through` (the visible
+  parent cards) with ONE read per call: the query's `parent`, else the projects' own cards. A
+  summary counts no specification and pays nothing extra. `tests/narrowing.spec.ts` pins it.
+- A person who may see only SOME projects of their organization (a tool-shed volunteer given one
+  shed) is expressed here: the resolver answers the project ids the person's grants list as
+  `projects`, and omits the key when a grant covers every project — never a hand-written filter in
+  each handler.
+- `writes` is the subset of projects the person may WRITE in (`projects` are the ones they VIEW).
+  `execute` on a card, specification or link needs it to be writable — the rule a narrowed read
+  admits, over `writes`: the project itself, a card whose `parents` name one, a specification
+  through its parent card; a create needs every named parent writable, and a create at the root
+  (no parent, not a project) is refused. `schema.define` of a project layer needs the project in
+  `writes`. A refusal is `PlanningForbidden` (403, `forbidden:writes:<id>`), checked before the grants
+  and before the executor. NOT governed by it: a project create (`grants.createProjects` alone) and
+  the organization layer (`grants.defineSchemas`). A card the scope cannot see is still answered
+  as absent by the executor. Omitted — every visible project is writable.
+  `tests/writes.spec.ts` pins viewer, writer and omitted.
+- `grants` gates the stock handlers' writes: `createProjects` (a project create — `true` for the
+  root, a list names the parent projects), `deleteProjects` (the delete of a project card — a list
+  names the projects), `defineSchemas` (`schema.define` — `true` for the organization's layer, a
+  list names project layers). A `grants` object refuses every flag it leaves out with
+  `PlanningForbidden` (403); no `grants` gates nothing. In-process facade writes are not gated.
+
+## Mounting in a target
+
+The api half of the target mount (the common tree and the kit literals: `planning` → Mounting in a
+target).
+
+- Bind `servePlanningEntrypoints(tree, { access })` WITHOUT the commit socket —
+  `.filter(entrypoint => entrypoint.protocol !== tree.commit.events)`: nothing authenticates a
+  target's socket after it opens, so the client long-polls (`commit.get` with `wait`, `execute`
+  with `wait: true`). Never write card, transition or schema routes beside it.
+- The resolver maps container permissions onto the access: `projects` = the containers the person
+  may view, `writes` = those they may modify, `grants` = `createProjects` / `deleteProjects` /
+  `defineSchemas` from their create and admin rights. A creator sees what they created — stamp
+  ownership in a `before` hook and add the card to both lists.
+
+## Data-defined types and flows
+
+Where the default store has the schema port, `runtime.schemasFor(entityId, project?)` answers the
+resolved layer (`resolveScopedBundle` over the code bundle and the organization's and project's
+records), cached per (organization, project) and keyed by the store's `revision()` and the plugin
+registry's version — a write anywhere moves the revision the next lookup reads, so a cached layer is
+never stale; a store's `watch` evicts early. Without the port it answers the code registry itself.
+`makeDefinitions` gives the facade `definitions`: every write checks the project (a project card the
+scope can see), the seal, the closed-form checks (a type's flows resolve in its layer, counting flows
+written beside it), then the store's compare-and-set. `retire` of a flow refuses with `SchemaInUse`
+while a live type of the layer — or of any project layer, for an organization record — still runs
+it. `facade.model(card)` builds over the layer of the card's own project, and `schema.list` answers
+the scoped bundle (`?project=`) where `definitions` exists, the code bundle otherwise.
+
 ## Testing
 
 Category A. Build one real context with `makeBasicContext` + `appendPlanningService({ store:
 makeMemoryPlanningStore({ now }), plugins: [fixtures] })`, and run a handler through
 `handler.bind({ ref: { ctx } })(req, res)` with a request carrying `auth` and `entity`. A monotonic
 `now` keeps log order deterministic; `sync: false` + `flush()` pins pending and hook-count cases.
+`tests/conformance.spec.ts` runs the conformance suite against the memory store with and without
+`schemas: true`; a durable store's own tests run the same cases against a real database.
 
 ## Related
 
 - `planning` — records, flows, the fold, the query language, the protocol tree, the models
 - `client-planning` — the remote facade and the state mirror that talk to these handlers
+- `planning-postgres` — the durable Postgres store built from these pieces
 - `server-job`, `queue` — the declare/serve/feed pattern and the projection queue
 - `resource` — the criteria engine every memory read goes through

package/build/actions/execute.d.ts

@@ -1,13 +1,34 @@
 import { handlers } from '@owlmeans/server-api';
-import type { ExecuteOptions, ExecuteRequest, PlanningProtocols, PlanningScope, TransitionExecution } from '@owlmeans/planning';
-import type { Context, PlanningHandlerOptions } from '../types.js';
+import type { ExecuteOptions, ExecuteRequest, PlanningFacade, PlanningProtocols, PlanningScope, TransitionExecution } from '@owlmeans/planning';
+import type { Context, PlanningAccess, PlanningHandlerOptions } from '../types.js';
 /**
  * What a wire execution may say. `actor` is dropped — the scope names the writer — and a create's
- * `createdBy` is the authenticated subject, whatever the body claimed.
+ * `createdBy` claim is dropped too: the executor's {@link withCreator} stamps the authenticated
+ * subject, the same rule an in-process create follows. Applied here as well, so the returned
+ * execution already carries it. A `createdBy` in `changes` or `unset` is not dropped: the executor
+ * refuses it on every action (`assertCreatorFixed`), so no body moves an owner.
  */
 export declare const wireExecution: (body: ExecuteRequest, scope: PlanningScope) => TransitionExecution;
 /** `wait`/`timeout` as a server grants them: the timeout never holds a request past `maxPoll`. */
 export declare const executeOptionsOf: (body: Pick<ExecuteRequest, 'wait' | 'timeout'>, maxPoll: number) => ExecuteOptions;
+/**
+ * Refuse an execution outside the access's `writes`: the card it acts on (a specification through
+ * its parent card), or every parent a create names, must be one {@link writableIn} admits. A create
+ * of a project is `grants.createProjects`' alone. A card or parent this scope cannot see is left to
+ * the executor, which answers it as absent.
+ *
+ * @throws {PlanningForbidden}
+ */
+export declare const assertExecutionWrites: (facade: PlanningFacade, exec: TransitionExecution, access?: PlanningAccess) => Promise<void>;
+/**
+ * The access a wire execution needs. `writes` first ({@link assertExecutionWrites}); then the
+ * grants: `createProjects` for a project create (its primary parent, or the root),
+ * `deleteProjects` for the delete of a project card. A card this scope cannot see is left to the
+ * executor, which answers it as absent.
+ *
+ * @throws {PlanningForbidden}
+ */
+export declare const assertExecutionGranted: (facade: PlanningFacade, exec: TransitionExecution, access?: PlanningAccess) => Promise<void>;
 /** The one write route. */
 export declare const executePlanning: (protocol: PlanningProtocols['execute'], opts?: PlanningHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['request']>;
 //# sourceMappingURL=execute.d.ts.map

package/build/actions/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EACV,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EACtF,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE;;;GAGG;AACH,eAAO,MAAM,aAAa,SAAU,cAAc,SAAS,aAAa,KAAG,mBAQ1E,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,SAAU,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC,WAAW,MAAM,KAAG,cAOlG,CAAA;AAED,2BAA2B;AAC3B,eAAO,MAAM,eAAe,aAChB,iBAAiB,CAAC,SAAS,CAAC,SAAS,sBAAsB,KACpE,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAWxD,CAAA"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAK/C,OAAO,KAAK,EACV,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAEtG,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,SAAU,cAAc,SAAS,aAAa,KAAG,mBAO1E,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,SAAU,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC,WAAW,MAAM,KAAG,cAOlG,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WACxB,cAAc,QAAQ,mBAAmB,WAAW,cAAc,KACzE,OAAO,CAAC,IAAI,CAqCd,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,WACzB,cAAc,QAAQ,mBAAmB,WAAW,cAAc,KACzE,OAAO,CAAC,IAAI,CAed,CAAA;AAED,2BAA2B;AAC3B,eAAO,MAAM,eAAe,aAChB,iBAAiB,CAAC,SAAS,CAAC,SAAS,sBAAsB,KACpE,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAWxD,CAAA"}

package/build/actions/execute.js

@@ -1,18 +1,21 @@
 import { handlers } from '@owlmeans/server-api';
-import { DEFAULT_COMMIT_TIMEOUT, MAX_COMMIT_POLL, TransitionAction } from '@owlmeans/planning';
-import { concealed, handlerFacade } from '../utils/index.js';
+import { DEFAULT_COMMIT_TIMEOUT, isProject, isSpecification, MAX_COMMIT_POLL, normalizeParents, PlanningForbidden, TransitionAction, WorkcardKind, } from '@owlmeans/planning';
+import { withCreator } from '../executor/creator.js';
+import { assertGranted, concealed, handlerScopeOf, writableIn } from '../utils/index.js';
 /**
  * What a wire execution may say. `actor` is dropped — the scope names the writer — and a create's
- * `createdBy` is the authenticated subject, whatever the body claimed.
+ * `createdBy` claim is dropped too: the executor's {@link withCreator} stamps the authenticated
+ * subject, the same rule an in-process create follows. Applied here as well, so the returned
+ * execution already carries it. A `createdBy` in `changes` or `unset` is not dropped: the executor
+ * refuses it on every action (`assertCreatorFixed`), so no body moves an owner.
  */
 export const wireExecution = (body, scope) => {
     const { wait: _wait, timeout: _timeout, actor: _actor, ...exec } = body;
     if (exec.action === TransitionAction.Create && exec.card != null && typeof exec.card === 'object') {
         const { createdBy: _createdBy, ...draft } = exec.card;
-        const subject = scope.profileId ?? scope.userId;
-        exec.card = subject != null ? { ...draft, createdBy: subject } : draft;
+        exec.card = draft;
     }
-    return exec;
+    return withCreator(exec, scope);
 };
 /** `wait`/`timeout` as a server grants them: the timeout never holds a request past `maxPoll`. */
 export const executeOptionsOf = (body, maxPoll) => {
@@ -23,11 +26,82 @@ export const executeOptionsOf = (body, maxPoll) => {
     const asked = Number(body.timeout ?? DEFAULT_COMMIT_TIMEOUT);
     return { wait: true, timeout: Math.min(Number.isFinite(asked) && asked > 0 ? asked : DEFAULT_COMMIT_TIMEOUT, ceiling) };
 };
+/**
+ * Refuse an execution outside the access's `writes`: the card it acts on (a specification through
+ * its parent card), or every parent a create names, must be one {@link writableIn} admits. A create
+ * of a project is `grants.createProjects`' alone. A card or parent this scope cannot see is left to
+ * the executor, which answers it as absent.
+ *
+ * @throws {PlanningForbidden}
+ */
+export const assertExecutionWrites = async (facade, exec, access) => {
+    if (access?.writes == null) {
+        return;
+    }
+    const admitted = async (card) => {
+        if (writableIn(access, card)) {
+            return true;
+        }
+        if (!isSpecification(card) || card.parent == null) {
+            return false;
+        }
+        const parent = await facade.cards.load(card.parent);
+        return parent == null || writableIn(access, parent);
+    };
+    if (exec.action === TransitionAction.Create && exec.card != null && typeof exec.card === 'object') {
+        if (exec.card.kind === WorkcardKind.Project) {
+            return;
+        }
+        const parents = normalizeParents(exec.card.parent, exec.card.parents);
+        if (parents.length === 0) {
+            throw new PlanningForbidden('writes:root');
+        }
+        for (const id of parents) {
+            const parent = await facade.cards.load(id);
+            if (parent != null && !await admitted(parent)) {
+                throw new PlanningForbidden(`writes:${id}`);
+            }
+        }
+        return;
+    }
+    if (typeof exec.card === 'string' && exec.card !== '') {
+        const card = await facade.cards.load(exec.card);
+        if (card != null && !await admitted(card)) {
+            throw new PlanningForbidden(`writes:${exec.card}`);
+        }
+    }
+};
+/**
+ * The access a wire execution needs. `writes` first ({@link assertExecutionWrites}); then the
+ * grants: `createProjects` for a project create (its primary parent, or the root),
+ * `deleteProjects` for the delete of a project card. A card this scope cannot see is left to the
+ * executor, which answers it as absent.
+ *
+ * @throws {PlanningForbidden}
+ */
+export const assertExecutionGranted = async (facade, exec, access) => {
+    await assertExecutionWrites(facade, exec, access);
+    if (access?.grants == null) {
+        return;
+    }
+    if (exec.action === TransitionAction.Create && typeof exec.card === 'object' && exec.card?.kind === WorkcardKind.Project) {
+        assertGranted(access, 'createProjects', normalizeParents(exec.card.parent, exec.card.parents)[0]);
+        return;
+    }
+    if (exec.action === TransitionAction.Delete && typeof exec.card === 'string') {
+        const card = await facade.cards.load(exec.card);
+        if (card != null && isProject(card)) {
+            assertGranted(access, 'deleteProjects', card.id);
+        }
+    }
+};
 /** The one write route. */
 export const executePlanning = (protocol, opts) => handlers().request(protocol, async (req, ctx) => concealed(async () => {
-    const facade = await handlerFacade(ctx, req, opts);
+    const { facade, access } = await handlerScopeOf(ctx, req, opts);
     const body = (req.body ?? {});
-    const receipt = await facade.execute(wireExecution(body, facade.scope), executeOptionsOf(body, opts?.maxPoll ?? MAX_COMMIT_POLL));
+    const exec = wireExecution(body, facade.scope);
+    await assertExecutionGranted(facade, exec, access);
+    const receipt = await facade.execute(exec, executeOptionsOf(body, opts?.maxPoll ?? MAX_COMMIT_POLL));
     return receipt.card !== undefined
         ? { transition: receipt.transition, card: receipt.card }
         : { transition: receipt.transition };

package/build/actions/execute.js.map

@@ -1 +1 @@
-{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAK9F,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAE,KAAoB,EAAuB,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAA;QAC/C,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACxE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA8C,EAAE,OAAe,EAAkB,EAAE;IAClH,MAAM,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAA;AACzH,CAAC,CAAA;AAED,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAsC,EAAE,IAA6B,EACR,EAAE,CAC/D,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAoC,EAAE;IAC7G,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmB,CAAA;IAC/C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAC5F,CAAA;IAED,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACxC,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EACL,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EACxG,gBAAgB,EAAE,YAAY,GAC/B,MAAM,oBAAoB,CAAA;AAK3B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAExF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAE,KAAoB,EAAuB,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QACrD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAA;IACnB,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA8C,EAAE,OAAe,EAAkB,EAAE;IAClH,MAAM,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAA;AACzH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,MAAsB,EAAE,IAAyB,EAAE,MAAuB,EAC3D,EAAE;IACjB,IAAI,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAc,EAAoB,EAAE;QAC1D,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnD,OAAO,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrD,CAAC,CAAA;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,aAAa,CAAC,CAAA;QAC5C,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC1C,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;YAC7C,CAAC;QACH,CAAC;QACD,OAAM;IACR,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,iBAAiB,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,MAAsB,EAAE,IAAyB,EAAE,MAAuB,EAC3D,EAAE;IACjB,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IACjD,IAAI,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;QACzH,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAsC,EAAE,IAA6B,EACR,EAAE,CAC/D,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAoC,EAAE;IAC7G,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmB,CAAA;IAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAA;IAEpG,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACxC,CAAC,CAAC,CAAC,CAAA"}

package/build/actions/schemas.d.ts

@@ -1,6 +1,30 @@
 import { handlers } from '@owlmeans/server-api';
-import type { PlanningProtocols } from '@owlmeans/planning';
+import type { PlanningDefinitions, PlanningProtocols, SchemaDefineReply, SchemaDefineRequest } from '@owlmeans/planning';
 import type { Context, PlanningHandlerOptions } from '../types.js';
-/** The schema bundle the service holds — what a client loads to answer `can()` with no round trip. */
-export declare const listSchemas: (protocol: PlanningProtocols['schema']['list'], opts?: PlanningHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['request']>;
+type RequestHandler = ReturnType<ReturnType<typeof handlers<Context>>['request']>;
+/**
+ * The schema bundle — what a client loads to answer `can()` with no round trip. Scoped like every
+ * other leaf (no organization, no bundle). Where the store holds data-defined schemas it is the
+ * resolved layer of the organization, or of the project the `project` query names (a project this
+ * scope can see); otherwise the service's code bundle.
+ *
+ * @throws {WorkcardNotFound} for a project this scope cannot see
+ */
+export declare const listSchemas: (protocol: PlanningProtocols['schema']['list'], opts?: PlanningHandlerOptions) => RequestHandler;
+/**
+ * Apply one `schema.define` request to a facade's definitions: the declarations in the request's
+ * mode (flows before types), then the retirements — answering what was written and the layer as it
+ * resolves afterwards.
+ */
+export declare const applySchemaRequest: (definitions: PlanningDefinitions, request: SchemaDefineRequest) => Promise<SchemaDefineReply>;
+/**
+ * The write of data-defined types and flows. A project layer needs the project in the access's
+ * `writes` when the resolver answers it; then `grants.defineSchemas` gates when the resolver answers
+ * grants (the organization-wide layer needs `true`, a project layer its id).
+ *
+ * @throws {PlanningUnsupported} where the store holds no data-defined schemas
+ * @throws {PlanningForbidden | SchemaConflict | SchemaSealed | SchemaInvalid | SchemaInUse | WorkcardNotFound}
+ */
+export declare const defineSchemas: (protocol: NonNullable<PlanningProtocols['schema']['define']>, opts?: PlanningHandlerOptions) => RequestHandler;
+export {};
 //# sourceMappingURL=schemas.d.ts.map

package/build/actions/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/actions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE,sGAAsG;AACtG,eAAO,MAAM,WAAW,aACZ,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,sBAAsB,KAC3E,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAMzD,CAAA"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/actions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EACV,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAC/E,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE,KAAK,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AAKjF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,aACZ,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,sBAAsB,KAC3E,cAQE,CAAA;AAEL;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAChB,mBAAmB,WAAW,mBAAmB,KAC7D,OAAO,CAAC,iBAAiB,CAyB3B,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,aACd,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,sBAAsB,KAC1F,cAaE,CAAA"}