@owlmeans/server-planning 0.1.18-rc.9 → 0.1.18

package/agent-meta/skills/server-planning/parts/executor.md

@@ -0,0 +1,82 @@
+---
+name: executor
+description: The transition executor step by step (refusal order, actor and createdBy stamping) and the plugin seam (registration, order, store routing, before/after hooks).
+metadata:
+  purposes: planning, server-api
+  mentions: executeTransition, creatorHelper, makePluginRegistry, ensurePlanningService, PlanningRefused, mintCode, WorkcardConflict
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/server-planning — The executor and the plugin seam
+
+## The executor, step by step
+
+Nothing is appended before step 11 — every refusal leaves the log untouched.
+
+1. **Normalize** — deep copy, trimmed text, `parents ∋ parent` (first); a create's draft without
+   `createdBy` gets `creatorHelper.creatorOf(scope)` (below).
+2. **Scope** — `entityId` must be present.
+3. **Idempotency** — a `key` already in the entity's log answers ITS receipt, before any
+   validation or middleware.
+4. **Resolve** — the card (`WorkcardNotFound`; another entity's card is `PlanningScopeMismatch`;
+   one outside the scope's `projects` is `WorkcardNotFound`), its type and flow, every draft parent
+   (`ParentNotFound` — loaded through the facade, so an invisible parent is absent) and the parent
+   project's `cardTypes`/`projectTypes` (`CardTypeNotAllowed`), the specification slot. Where the
+   default store holds data-defined schemas, the card's project is found first and everything
+   after reads that project's resolved layer (`Resolved.schemas`): a data-defined type of a
+   project with `scopedCardTypes` is admitted, a retired type creates nothing
+   (`UnknownWorkcardType('retired:…')`). Without the port `Resolved.schemas` IS the code registry.
+5. **`before` chain** — in plugin order; re-resolved once when it changed the card, type or parent.
+6. **Validate** — shape (`planning:malformed:*`), the flow rule (`IllegalTransition`), immutables
+   (`planning:immutable:*`, `createdBy` among them — `creatorHelper.assertCreatorFixed`), merged `fields` against the
+   type's `fieldsSchema` — its own `fields` plus the app's base card fields (`FieldsInvalid`; the fold re-checks it), labels (`LabelNotAllowed`), a moved
+   parent, the slot (`SpecificationSlotUnknown`, `SpecificationRevisionConflict`, JSON body schema
+   → `FieldsInvalid`), relationships (`RelationshipRefused`: undeclared type, `from` not the card,
+   missing target, type constraints, `single`, unlinking an absent edge).
+7. **Card id** — `store.newId?.() ?? options.ids?.() ?? idHelper.uuid()`. Ids are the store's.
+8. **Code** — a supplied code is checked; else the plugins' `mintCode` (first answer wins, checked);
+   else the type's `CodePolicy` (a slug policy derives from the title) → `CodeTaken`.
+9. **Changes** — `changesHelper.computeChanges`. An `update` that changes nothing answers the card's latest
+   receipt and appends nothing.
+10. **Seq** — `transitions.nextSeq(card, expectSeq)`, a CAS against `head` (`WorkcardConflict`).
+11. **Append** — `commit: pending`. A lost race on the key answers the winner's receipt.
+12. **Project** — `store.cards.project(card)`: a sync store folds now, a queued one enqueues.
+13. **Receipt** — `{ transition, card? (once committed), committed(opts) }`.
+14. **`wait: true`** — `committed()` before returning (`CommitTimeout`, `CommitFailed`).
+
+`actor` is the SCOPE's: `profileId`/`userId`/`service`/`channel` come from the scope only; an
+in-process caller may add `agent`/`runId` on the execution. A handler never passes a wire `actor`.
+
+A create's `createdBy` is the scope's subject too — `creatorHelper.creatorOf(scope)`: `profileId`, else `userId`,
+else the same two of `scope.actor`. The executor stamps it on every path, so an in-process facade
+create and the HTTP `execute` produce the same owner. An in-process draft that names `createdBy`
+keeps it (explicit wins — a manager creating on someone's behalf); a scope naming nobody (a service
+or system scope) leaves it unset; the wire drops a draft's `createdBy` before the stamp.
+
+`createdBy` never moves after the create (the rule is `planning` → The record model). The executor
+enforces it itself with `creatorHelper.assertCreatorFixed` at step 6, after the `before` chain, so a wire body, an
+in-process caller and a plugin are refused alike, whatever `@owlmeans/planning` build the host
+resolves. The conformance suite checks a store folds a stored row naming it as the pure fold does.
+
+## The plugin seam
+
+| Concern | Rule |
+|---|---|
+| Registration | `use(plugin)` replaces by `name`; schemas are contributed at `use` time (later type/flow id wins); `schemas.app` is re-merged from the service's own and every registered plugin's in plugin order on each `use` (`appSchemaHelper.merge`) — a malformed one refuses the plugin (`SchemaInvalid`) and changes nothing |
+| Order | `order ?? 50` ascending, registration order among equals |
+| Store routing | `store(type)` = the first plugin whose `owns(type)` is true AND that supplies a `store`; else the default store. A store factory is resolved once |
+| Reads | By id: the default store, then each owned store. A list naming one owned type (or several owned by one store) goes there; any other list — a cross-type query — is the default store's alone |
+| `mintCode` | First non-`undefined` answer wins |
+| `before` | Every plugin in order; may return a replaced execution; a `ResilientError` passes through, anything else becomes `PlanningRefused('<plugin>:<message>')` |
+| `after` | Every plugin in order, once per COMMITTED transition; errors logged, never rethrown |
+
+**Where `after` runs.** The service's `committed(event)` runs the chain, and it is called by the
+process that FOLDS the transition — the memory store inside `project()`, a queued store's projection
+job after marking the commit. Never subscribe a process to the commit bus to run hooks: that fires
+once per subscribed process. Every process that folds registers the same plugins; each commit is
+folded by one of them, so each hook fires once. `hooks: false` makes a process fold without running
+them. A hook sees `ctx.transition` (read back, so `actor.channel` is available) and a facade scoped
+to the event's entity acting as this process's `cfg.service`.
+
+The service hands `committed` to a store through `store.bind?.(listener)` the first time it resolves
+the store; `bind` replaces the listener, so a store has exactly one.

package/agent-meta/skills/server-planning/parts/schemas.md

@@ -0,0 +1,26 @@
+---
+name: schemas
+description: Data-defined card types and flows — the resolved layer per organization and project, the facade's definitions, retiring a flow.
+metadata:
+  purposes: data, planning, config
+  mentions: makeDefinitions, makeSchemaViews, schemasFor, scopedSchemaHelper, definitions, SchemaInUse
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/server-planning — Data-defined types and flows
+
+## Data-defined types and flows
+
+Where the default store has the schema port, `runtime.schemasFor(entityId, project?)` answers the
+resolved layer (`scopedSchemaHelper.resolveScopedBundle` over the code bundle and the organization's and project's
+records), cached per (organization, project) and keyed by the store's `revision()` and the plugin
+registry's version — a write anywhere moves the revision the next lookup reads, so a cached layer is
+never stale; a store's `watch` evicts early. Without the port it answers the code registry itself.
+`makeDefinitions` gives the facade `definitions`: every write checks the project (a project card the
+scope can see), the seal, the closed-form checks (a type's flows resolve in its layer, counting flows
+written beside it; a type's and a flow's `app` bag against the code registry's `app()`), then the
+store's compare-and-set. A layer's registry carries the code declarations, so a data-defined card
+type validates the app's base card fields too. `retire` of a flow refuses with `SchemaInUse`
+while a live type of the layer — or of any project layer, for an organization record — still runs
+it. `facade.model(card)` builds over the layer of the card's own project, and `schema.list` answers
+the scoped bundle (`?project=`) where `definitions` exists, the code bundle otherwise.

package/agent-meta/skills/server-planning/parts/serving.md

@@ -0,0 +1,88 @@
+---
+name: serving
+description: The commit feed, request scope and security, the access resolver (projects, writes, grants), and mounting the handlers in a target.
+metadata:
+  purposes: server-api, auth, planning
+  mentions: servePlanningEntrypoints, planningHandlerOf, PlanningAccessResolver, makeRequestScope, makePlanningAccessModel, guardHelper, executionHelper, PlanningForbidden
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/server-planning — Serving the protocol tree
+
+## The commit feed
+
+- **Poll** — `commit.get` answers the status; with `?wait=<s>` (clamped to `maxPoll`, default 55)
+  it subscribes, re-polls, and holds until the commit settles or the time is up, answering `pending`
+  then — never an error.
+- **Notify** — `commit.events` pushes `planning-commit` frames (or `opts.event`) filtered by the
+  authenticated entity and optional `project`/`card` query values; a frame without `record` gets the
+  card as it reads now. The subscription is released on the socket's `close` frame.
+- `execute` with `wait: true` holds at most `maxPoll` seconds whatever `timeout` the body asked for.
+
+## Scope and security
+
+- Without `opts.access`: `entityId` is `makeEntityScope(req).requireEntityKey()`; `opts.scope(req, ctx)` adds a
+  `channel` or `service` and can never replace the entity. `actor` and a create's `createdBy` come
+  from the request, never the body (`executionHelper.wireExecution` drops a draft's claim, `creatorHelper.withCreator` stamps the
+  subject, `creatorHelper.assertCreatorFixed` refuses a body naming `createdBy` — an update never re-owns a card).
+- The organization of a scope is the one the request ACTS IN. `makeEntityScope(req).requireEntityKey()` answers
+  `req.entity.id`, the stable record id (the token's `entitySlug` only where no entity resolver is
+  registered). Behind an OIDC relying party (`@owlmeans/server-oidc-rp`) the acting organization is
+  session state: the guard attaches `req.entity` with `id` = the organization claim's frozen
+  `entityKey`, so the tenant key survives a rename and follows a switch. Take it in the handler and
+  pass it down; never read it from the context or from a body.
+- Another entity's card, specification or transition answers `WorkcardNotFound` — the same as an
+  absent id — on reads and writes alike (`guardHelper.concealed`).
+- Queries arrive in their wire form and are decoded with `wireHelper.decode*Query` before `queryHelper.criteriaOf`, which
+  always adds the scope's `entityId`.
+
+### The access resolver
+
+`opts.access: (req, ctx) => Promise<{ entityId, projects?, writes?, grants? }>` is the hosting app's
+decision per request; a throw is the request's answer (an `AuthForbidden` answers 403).
+
+- `entityId` is the resolver's — never the token's, never `opts.scope`'s.
+- `projects` becomes `PlanningScope.projects`, which the server facade enforces on reads and
+  writes. A card is visible when at least one project reached through its recursive parent paths
+  is allowed; specifications follow their containing cards. Anything else reads as absent
+  (`WorkcardNotFound`, `null`, an empty list); a create under an invisible parent is
+  `ParentNotFound`. Links, transitions and commits use current endpoint/card ancestry, with a
+  cached project fallback only for purged records. Subscriptions and commit waits enforce the
+  same visibility.
+- **Narrowed lists, counts and summaries use the allowed recursive descendant IDs before paging.**
+  A specification is admitted through the same containing-card hierarchy as a single read.
+  Do not replace this with a direct-parent query or a filter applied after pagination.
+  `tests/narrowing.spec.ts` and shared hierarchy conformance pin this behavior.
+- A person who may see only SOME projects of their organization (a tool-shed volunteer given one
+  shed) is expressed here: the resolver answers the project ids the person's grants list as
+  `projects`, and omits the key when a grant covers every project — never a hand-written filter in
+  each handler.
+- `writes` is the subset of projects the person may WRITE in (`projects` are the ones they VIEW).
+  `execute` on a card, specification or link needs it to be writable — the recursive ancestor
+  rule over `writes`: a card admitted directly or through a writable parent path. A create needs
+  every named parent writable; reparenting checks every supplied destination parent. A create at the root
+  (no parent, not a project) is refused. `schema.define` of a project layer needs the project in
+  `writes`. A refusal is `PlanningForbidden` (403, `forbidden:writes:<id>`), checked before the grants
+  and before the executor. NOT governed by it: a project create (`grants.createProjects` alone) and
+  the organization layer (`grants.defineSchemas`). A card the scope cannot see is still answered
+  as absent by the executor. Omitted — every visible project is writable.
+  `tests/writes.spec.ts` pins viewer, writer and omitted.
+- `grants` gates the stock handlers' writes: `createProjects` (a project create — `true` for the
+  root, a list names the parent projects), `deleteProjects` (the delete of a project card — a list
+  names the projects), `defineSchemas` (`schema.define` — `true` for the organization's layer, a
+  list names project layers). A `grants` object refuses every flag it leaves out with
+  `PlanningForbidden` (403); no `grants` gates nothing. In-process facade writes are not gated.
+
+## Mounting in a target
+
+The api half of the target mount (the common tree and the kit literals: `planning` → Mounting in a
+target, its `mounting` part).
+
+- Bind `servePlanningEntrypoints(tree, { access })` WITHOUT the commit socket —
+  `.filter(entrypoint => entrypoint.protocol !== tree.commit.events)`: nothing authenticates a
+  target's socket after it opens, so the client long-polls (`commit.get` with `wait`, `execute`
+  with `wait: true`). Never write card, transition or schema routes beside it.
+- The resolver maps container permissions onto the access: `projects` = the containers the person
+  may view, `writes` = those they may modify, `grants` = `createProjects` / `deleteProjects` /
+  `defineSchemas` from their create and admin rights. A creator sees what they created — stamp
+  ownership in a `before` hook and add the card to both lists.

package/agent-meta/skills/server-planning/parts/stores.md

@@ -0,0 +1,91 @@
+---
+name: stores
+description: The in-memory store, writing a durable or foreign store (ports, foldHelper.foldPending, the commit hub, the conformance suite), and testing against the memory store.
+metadata:
+  purposes: data, planning, test
+  mentions: makeMemoryPlanningStore, PlanningStore, foldHelper, makeCommitHub, makeCompositeStore, planningConformance, conformanceCasesFor, planningConformancePlugin, makeProjectionProcessor, @owlmeans/server-planning/store, @owlmeans/server-planning/conformance
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/server-planning — Stores
+
+## The memory store
+
+`makeMemoryPlanningStore({ sync?, ids?, now?, seed?, onCommitted?, alias?, schemas? })`
+
+- Cards and projects in one map, specifications in their own, relationships in a third; every read
+  goes through the `@owlmeans/resource` query engine. A card list includes specifications only when
+  the criteria asks for `kind: specification` or a `category` (`wantsSpecifications`, the rule every
+  store routes by).
+- `schemas: true` adds the data-defined schema port (records per layer, a revision per
+  organization, synchronous `watch`); off by default — without it every type and flow resolves
+  from code.
+- `sync` (default) folds, publishes and runs `committed` inside `project()`, serialized per card.
+  `sync: false` folds nothing until `flush(card?)` — a queued store's shape, for tests that need a
+  commit to stay pending.
+- A project `delete` purges the project, everything whose `parents` reach it, their specifications,
+  links and log; the commit hub remembers the settled event so the waiter still gets its answer.
+- Any other `delete` folds as `cards.drop`: the card, its comments and mentions, and its own
+  documents (specifications whose primary parent is it, transitively) with their links, comments,
+  mentions and log. The card's own log stays — its delete row is the tombstone.
+- **It is wrong for more than one process or a restart** — the log, the cards and the commit feed
+  are this process's heap. Use it for tests, tools and single-process demos.
+
+## Writing a durable store
+
+- Implement `PlanningStore` (`transitions`, `cards`, `specs`, `links`, `commits`, `newId`). `newId`
+  answers the id format the host's references need (ObjectId hex for Mongo).
+- `transitions.list` treats `sinceSeq` as `seq > sinceSeq`; `nextSeq` is the CAS against `head` and
+  answers 1 for a card that has no log.
+- The projection body is `foldHelper.foldPending(store, cardId, entityId, { onCommitted, publish, touch, limit })`:
+  it applies pending transitions with `applyHelper.applyTransition` only, marks each committed or failed,
+  publishes, then runs `onCommitted`. The caller owns single flight per card. Strip `record` from
+  the event before a cross-process bus.
+- **A failed transition never blocks the card.** The fold marks it `failed`, publishes a failed
+  event, and goes PAST it: the card's `seq` advances to that transition with every other value as
+  it was, and the next transition folds normally. Without that, every later transition fails as
+  out of order and the card is stuck for good. Only two cases stop short: a failed `create` leaves
+  no card to advance, and a store that refuses the advancing write stops the fold with `followUp`,
+  leaving the rest pending for a retry. `foldHelper.revisionsFromLog` replays past failed transitions the same
+  way.
+- A transactional store passes `FoldOptions.unit` — it wraps each transition's writes (a
+  savepoint), so a write the database refuses is undone whole and the fold marks that transition
+  failed and goes past it. `foldHelper.foldPending` folds PAST a failure it produces; a row that is ALREADY
+  failed at the cursor, or a gap in the seqs, is the store's to step over before calling it
+  (`planning-postgres` does it in a prelude).
+- `foldHelper.failPending` is what a dead projection job must do, or waiters hang to their timeout.
+- `cards.drop(id, entityId)` is the fold of a non-project `delete` and takes the record's own
+  documents with it (the `ProjectionStore.drop` contract): the executor admits a delete whose only
+  descendants are those documents, so a store that leaves them behind orphans them. The
+  conformance case `deletes a card with its own documents and refuses one with a child card` pins it.
+- The data-defined schema port (`schemas`) is optional; `makeCompositeStore` passes the default
+  store's through. A store that has it must purge a project's layer with the project.
+- **Run the conformance suite.** `@owlmeans/server-planning/conformance` exports
+  `planningConformance` — named cases with no test runner inside (each throws
+  `ConformanceFailure`) — and `conformanceCasesFor(store)`, which drops the data-defined cases for a
+  store without the port. Boot a service with `planningConformancePlugin` and `conformanceClock()`
+  and hand each case `{ service, store, facade }`; every case works in its own organization, so one
+  boot serves them all. A case that needs extra declarations `use`s a plugin on `service` and
+  replaces it by name with an empty one when it ends (`CONFORMANCE_APP_PLUGIN`: a stored layer
+  keeps a definition's `app` bag inside `definition` and a card's base fields inside `fields`) —
+  the cases run in order on one service, never concurrently.
+- `makeCommitHub({ status, remember?, ladder? })` is the `CommitSource`: feed `publish` from the bus,
+  answer `status` from transition rows. `wait` subscribes first, polls once, then climbs the ladder.
+- `foldHelper.revisionsFromLog(transitions, limit?)` answers `specs.revisions`.
+- `makeProjectionProcessor(ctx)` + `makePlanningQueueHooks(ctx)` are the store-agnostic job body and
+  `onJobDead`; a store with an admission CAS wraps its own around them.
+
+## A foreign provider
+
+Only `cards` is required. A plugin that `owns` its types and supplies a store without
+`transitions` can be read through the facade; writes to it refuse with `PlanningUnsupported` —
+mapping external records (`mappers`) belongs to that plugin's own store adapter.
+
+## Testing
+
+Category A. Build one real context with `makeBasicContext` + `appendPlanningService({ store:
+makeMemoryPlanningStore({ now }), plugins: [fixtures] })`, and run a handler through
+`handler.bind({ ref: { ctx } })(req, res)` with a request carrying `auth` and `entity`. A monotonic
+`now` keeps log order deterministic; `sync: false` + `flush()` pins pending and hook-count cases.
+`tests/conformance.spec.ts` runs the conformance suite against the memory store with and without
+`schemas: true`; a durable store's own tests run the same cases against a real database.

package/build/actions/apply-schema-request.d.ts

@@ -0,0 +1,8 @@
+import { type PlanningDefinitions, type SchemaDefineReply, type SchemaDefineRequest } from '@owlmeans/planning';
+/**
+ * Apply one `schema.define` request to a facade's definitions: the declarations in the request's
+ * mode (flows before types), then the retirements — answering what was written and the layer as it
+ * resolves afterwards.
+ */
+export declare const applySchemaRequest: (definitions: PlanningDefinitions, request: SchemaDefineRequest) => Promise<SchemaDefineReply>;
+//# sourceMappingURL=apply-schema-request.d.ts.map

package/build/actions/apply-schema-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-schema-request.d.ts","sourceRoot":"","sources":["../../src/actions/apply-schema-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAA2B,MAAM,oBAAoB,CAAA;AAEzJ;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAChB,mBAAmB,WAAW,mBAAmB,KAC7D,OAAO,CAAC,iBAAiB,CA0B3B,CAAA"}

package/build/actions/apply-schema-request.js

@@ -0,0 +1,33 @@
+import { SchemaWriteMode } from '@owlmeans/planning';
+/**
+ * Apply one `schema.define` request to a facade's definitions: the declarations in the request's
+ * mode (flows before types), then the retirements — answering what was written and the layer as it
+ * resolves afterwards.
+ */
+export const applySchemaRequest = async (definitions, request) => {
+    const layer = request.project != null ? { project: request.project } : {};
+    const declarations = { types: request.types ?? [], flows: request.flows ?? [], assigneeTypes: request.assigneeTypes ?? [] };
+    const records = [];
+    switch (request.mode ?? SchemaWriteMode.Define) {
+        case SchemaWriteMode.Put:
+            for (const schema of declarations.assigneeTypes)
+                records.push(await definitions.putAssigneeType(schema));
+            for (const flow of declarations.flows) {
+                records.push(await definitions.putFlow(flow, layer));
+            }
+            for (const type of declarations.types) {
+                records.push(await definitions.putType(type, layer));
+            }
+            break;
+        case SchemaWriteMode.Seed:
+            records.push(...await definitions.seed(declarations, layer));
+            break;
+        default:
+            records.push(...await definitions.define(declarations, layer));
+    }
+    for (const key of request.retire ?? []) {
+        records.push(await definitions.retire(key.kind, key.key, layer));
+    }
+    return { records, bundle: await definitions.bundle(request.project) };
+};
+//# sourceMappingURL=apply-schema-request.js.map

package/build/actions/apply-schema-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-schema-request.js","sourceRoot":"","sources":["../../src/actions/apply-schema-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAuG,MAAM,oBAAoB,CAAA;AAEzJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,WAAgC,EAAE,OAA4B,EAClC,EAAE;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAA;IAC3H,MAAM,OAAO,GAAyB,EAAE,CAAA;IAExC,QAAQ,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;QAC/C,KAAK,eAAe,CAAC,GAAG;YACtB,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,aAAa;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;YACxG,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YACtD,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YACtD,CAAC;YACD,MAAK;QACP,KAAK,eAAe,CAAC,IAAI;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAA;YAC5D,MAAK;QACP;YACE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAA;IAClE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAA;AACvE,CAAC,CAAA"}

package/build/actions/commit.d.ts

@@ -1,6 +1,6 @@
-import { handlers } from '@owlmeans/server-api';
 import type { PlanningProtocols } from '@owlmeans/planning';
-import type { Context, PlanningHandlerOptions } from '../types.js';
+import type { PlanningHandlerOptions } from '../types.js';
+import type { RequestHandler } from './types.js';
 /**
  * The poll tool: a commit's status, held open up to `wait` seconds (clamped to `maxPoll`).
  *
@@ -10,5 +10,5 @@ import type { Context, PlanningHandlerOptions } from '../types.js';
  *
  * @throws {WorkcardNotFound} for another entity's transition
  */
-export declare const getCommit: (protocol: PlanningProtocols['commit']['get'], opts?: PlanningHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['request']>;
+export declare const getCommit: (protocol: PlanningProtocols['commit']['get'], opts?: PlanningHandlerOptions) => RequestHandler;
 //# sourceMappingURL=commit.d.ts.map

package/build/actions/commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.d.ts","sourceRoot":"","sources":["../../src/actions/commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACzE,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,aACV,iBAAiB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,sBAAsB,KAC1E,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAqCxD,CAAA"}
+{"version":3,"file":"commit.d.ts","sourceRoot":"","sources":["../../src/actions/commit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACzE,OAAO,KAAK,EAAW,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,aACV,iBAAiB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,sBAAsB,KAC1E,cAqCE,CAAA"}

package/build/actions/commit.js

@@ -1,6 +1,7 @@
 import { handlers } from '@owlmeans/server-api';
 import { CommitState, MAX_COMMIT_POLL } from '@owlmeans/planning';
-import { clampSeconds, concealed, handlerFacade } from '../utils/index.js';
+import { guardHelper } from '../utils/guard.js';
+import { planningHandlerOf } from '../utils/handler.js';
 /**
  * The poll tool: a commit's status, held open up to `wait` seconds (clamped to `maxPoll`).
  *
@@ -10,11 +11,11 @@ import { clampSeconds, concealed, handlerFacade } from '../utils/index.js';
  *
  * @throws {WorkcardNotFound} for another entity's transition
  */
-export const getCommit = (protocol, opts) => handlers().request(protocol, async (req, ctx) => concealed(async () => {
-    const facade = await handlerFacade(ctx, req, opts);
+export const getCommit = (protocol, opts) => handlers().request(protocol, async (req, ctx) => guardHelper.reply(async () => {
+    const facade = await planningHandlerOf(ctx).handlerFacade(req, opts);
     const transition = `${req.params.transition}`;
     let status = await facade.commits.status(transition);
-    const wait = clampSeconds(req.query?.wait, opts?.maxPoll ?? MAX_COMMIT_POLL);
+    const wait = guardHelper.clampSeconds(req.query?.wait, opts?.maxPoll ?? MAX_COMMIT_POLL);
     if (status.state !== CommitState.Pending || wait <= 0) {
         return status;
     }

package/build/actions/commit.js.map

@@ -1 +1 @@
-{"version":3,"file":"commit.js","sourceRoot":"","sources":["../../src/actions/commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGjE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,QAA4C,EAAE,IAA6B,EACd,EAAE,CAC/D,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAA2B,EAAE;IACpG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;IAE7C,IAAI,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAAA;IAC5E,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,IAAI,GAAe,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAA,CAAC,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YAC3E,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAChC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC,CAAA;oBAC9C,IAAI,GAAG,GAAG,EAAE;wBACV,YAAY,CAAC,KAAK,CAAC,CAAA;wBACnB,OAAO,EAAE,CAAA;oBACX,CAAC,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAA;IACf,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"commit.js","sourceRoot":"","sources":["../../src/actions/commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAGvD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,QAA4C,EAAE,IAA6B,EAC3D,EAAE,CAClB,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,IAA2B,EAAE;IAC5G,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpE,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;IAE7C,IAAI,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAAA;IACxF,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,IAAI,GAAe,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAA,CAAC,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YAC3E,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAChC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC,CAAA;oBAC9C,IAAI,GAAG,GAAG,EAAE;wBACV,YAAY,CAAC,KAAK,CAAC,CAAA;wBACnB,OAAO,EAAE,CAAA;oBACX,CAAC,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAA;IACf,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAC,CAAA"}

package/build/actions/define-schemas.d.ts

@@ -0,0 +1,13 @@
+import { type PlanningProtocols } from '@owlmeans/planning';
+import type { PlanningHandlerOptions } from '../types.js';
+import type { RequestHandler } from './types.js';
+/**
+ * The write of data-defined types and flows. A project layer needs the project in the access's
+ * `writes` when the resolver answers it; then `grants.defineSchemas` gates when the resolver answers
+ * grants (the organization-wide layer needs `true`, a project layer its id).
+ *
+ * @throws {PlanningUnsupported} where the store holds no data-defined schemas
+ * @throws {PlanningForbidden | SchemaConflict | SchemaSealed | SchemaInvalid | SchemaInUse | WorkcardNotFound}
+ */
+export declare const defineSchemas: (protocol: NonNullable<PlanningProtocols['schema']['define']>, opts?: PlanningHandlerOptions) => RequestHandler;
+//# sourceMappingURL=define-schemas.d.ts.map

package/build/actions/define-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-schemas.d.ts","sourceRoot":"","sources":["../../src/actions/define-schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,iBAAiB,EAAoD,MAAM,oBAAoB,CAAA;AAClI,OAAO,KAAK,EAAW,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAKlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,aACd,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,sBAAsB,KAC1F,cAcE,CAAA"}

package/build/actions/define-schemas.js

@@ -0,0 +1,28 @@
+import { handlers } from '@owlmeans/server-api';
+import { PlanningUnsupported } from '@owlmeans/planning';
+import { makePlanningAccessModel } from '../utils/access.js';
+import { guardHelper } from '../utils/guard.js';
+import { planningHandlerOf } from '../utils/handler.js';
+import { applySchemaRequest } from './apply-schema-request.js';
+/**
+ * The write of data-defined types and flows. A project layer needs the project in the access's
+ * `writes` when the resolver answers it; then `grants.defineSchemas` gates when the resolver answers
+ * grants (the organization-wide layer needs `true`, a project layer its id).
+ *
+ * @throws {PlanningUnsupported} where the store holds no data-defined schemas
+ * @throws {PlanningForbidden | SchemaConflict | SchemaSealed | SchemaInvalid | SchemaInUse | WorkcardNotFound}
+ */
+export const defineSchemas = (protocol, opts) => handlers().request(protocol, async (req, ctx) => guardHelper.reply(async () => {
+    const { facade, access } = await planningHandlerOf(ctx).handlerScopeOf(req, opts);
+    const request = (req.body ?? {});
+    if (facade.definitions == null) {
+        throw new PlanningUnsupported('definitions');
+    }
+    const model = makePlanningAccessModel(access);
+    if (request.project != null) {
+        model.assertWrites(request.project);
+    }
+    model.assertGranted('defineSchemas', request.project);
+    return await applySchemaRequest(facade.definitions, request);
+}));
+//# sourceMappingURL=define-schemas.js.map

package/build/actions/define-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-schemas.js","sourceRoot":"","sources":["../../src/actions/define-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAA4E,MAAM,oBAAoB,CAAA;AAElI,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAG9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,QAA4D,EAAE,IAA6B,EAC3E,EAAE,CAClB,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,IAAgC,EAAE;IACjH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACjF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAA;IACvD,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QAC5B,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAErD,OAAO,MAAM,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC,CAAC,CAAC,CAAA"}

package/build/actions/execute.d.ts

@@ -1,13 +1,14 @@
-import { handlers } from '@owlmeans/server-api';
-import type { ExecuteOptions, ExecuteRequest, PlanningProtocols, PlanningScope, TransitionExecution } from '@owlmeans/planning';
-import type { Context, PlanningHandlerOptions } from '../types.js';
-/**
- * What a wire execution may say. `actor` is dropped — the scope names the writer — and a create's
- * `createdBy` is the authenticated subject, whatever the body claimed.
- */
+import type { ExecuteOptions, ExecuteRequest, PlanningFacade, PlanningProtocols, PlanningScope, TransitionExecution } from '@owlmeans/planning';
+import type { PlanningAccess, PlanningHandlerOptions } from '../types.js';
+import type { RequestHandler } from './types.js';
+/** The one write route. */
+export declare const executePlanning: (protocol: PlanningProtocols['execute'], opts?: PlanningHandlerOptions) => RequestHandler;
+/** @deprecated compat:factory-refactor — use `executionHelper.wireExecution(…)` */
 export declare const wireExecution: (body: ExecuteRequest, scope: PlanningScope) => TransitionExecution;
-/** `wait`/`timeout` as a server grants them: the timeout never holds a request past `maxPoll`. */
+/** @deprecated compat:factory-refactor — use `executionHelper.executeOptionsOf(…)` */
 export declare const executeOptionsOf: (body: Pick<ExecuteRequest, 'wait' | 'timeout'>, maxPoll: number) => ExecuteOptions;
-/** The one write route. */
-export declare const executePlanning: (protocol: PlanningProtocols['execute'], opts?: PlanningHandlerOptions) => ReturnType<ReturnType<typeof handlers<Context>>['request']>;
+/** @deprecated compat:factory-refactor — use `executionHelper.assertExecutionWrites(…)` */
+export declare const assertExecutionWrites: (facade: PlanningFacade, exec: TransitionExecution, access?: PlanningAccess) => Promise<void>;
+/** @deprecated compat:factory-refactor — use `executionHelper.assertExecutionGranted(…)` */
+export declare const assertExecutionGranted: (facade: PlanningFacade, exec: TransitionExecution, access?: PlanningAccess) => Promise<void>;
 //# sourceMappingURL=execute.d.ts.map

package/build/actions/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EACV,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EACtF,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGlE;;;GAGG;AACH,eAAO,MAAM,aAAa,SAAU,cAAc,SAAS,aAAa,KAAG,mBAQ1E,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,SAAU,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC,WAAW,MAAM,KAAG,cAOlG,CAAA;AAED,2BAA2B;AAC3B,eAAO,MAAM,eAAe,aAChB,iBAAiB,CAAC,SAAS,CAAC,SAAS,sBAAsB,KACpE,UAAU,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAWxD,CAAA"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAEtG,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAW,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIlF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,2BAA2B;AAC3B,eAAO,MAAM,eAAe,aAChB,iBAAiB,CAAC,SAAS,CAAC,SAAS,sBAAsB,KACpE,cAWE,CAAA;AAEL,mFAAmF;AACnF,eAAO,MAAM,aAAa,SAAU,cAAc,SAAS,aAAa,KAAG,mBAC/B,CAAA;AAE5C,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,SAAU,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC,WAAW,MAAM,KAAG,cAClD,CAAA;AAEjD,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,WACxB,cAAc,QAAQ,mBAAmB,WAAW,cAAc,KACzE,OAAO,CAAC,IAAI,CAAsE,CAAA;AAErF,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,WACzB,cAAc,QAAQ,mBAAmB,WAAW,cAAc,KACzE,OAAO,CAAC,IAAI,CAAuE,CAAA"}

package/build/actions/execute.js

@@ -1,35 +1,25 @@
 import { handlers } from '@owlmeans/server-api';
-import { DEFAULT_COMMIT_TIMEOUT, MAX_COMMIT_POLL, TransitionAction } from '@owlmeans/planning';
-import { concealed, handlerFacade } from '../utils/index.js';
-/**
- * What a wire execution may say. `actor` is dropped — the scope names the writer — and a create's
- * `createdBy` is the authenticated subject, whatever the body claimed.
- */
-export const wireExecution = (body, scope) => {
-    const { wait: _wait, timeout: _timeout, actor: _actor, ...exec } = body;
-    if (exec.action === TransitionAction.Create && exec.card != null && typeof exec.card === 'object') {
-        const { createdBy: _createdBy, ...draft } = exec.card;
-        const subject = scope.profileId ?? scope.userId;
-        exec.card = subject != null ? { ...draft, createdBy: subject } : draft;
-    }
-    return exec;
-};
-/** `wait`/`timeout` as a server grants them: the timeout never holds a request past `maxPoll`. */
-export const executeOptionsOf = (body, maxPoll) => {
-    const ceiling = maxPoll * 1000;
-    if (body.wait !== true) {
-        return {};
-    }
-    const asked = Number(body.timeout ?? DEFAULT_COMMIT_TIMEOUT);
-    return { wait: true, timeout: Math.min(Number.isFinite(asked) && asked > 0 ? asked : DEFAULT_COMMIT_TIMEOUT, ceiling) };
-};
+import { MAX_COMMIT_POLL } from '@owlmeans/planning';
+import { guardHelper } from '../utils/guard.js';
+import { planningHandlerOf } from '../utils/handler.js';
+import { executionHelper } from './execution.js';
 /** The one write route. */
-export const executePlanning = (protocol, opts) => handlers().request(protocol, async (req, ctx) => concealed(async () => {
-    const facade = await handlerFacade(ctx, req, opts);
+export const executePlanning = (protocol, opts) => handlers().request(protocol, async (req, ctx) => guardHelper.reply(async () => {
+    const { facade, access } = await planningHandlerOf(ctx).handlerScopeOf(req, opts);
     const body = (req.body ?? {});
-    const receipt = await facade.execute(wireExecution(body, facade.scope), executeOptionsOf(body, opts?.maxPoll ?? MAX_COMMIT_POLL));
+    const exec = executionHelper.wireExecution(body, facade.scope);
+    await executionHelper.assertExecutionGranted(facade, exec, access);
+    const receipt = await facade.execute(exec, executionHelper.executeOptionsOf(body, opts?.maxPoll ?? MAX_COMMIT_POLL));
     return receipt.card !== undefined
         ? { transition: receipt.transition, card: receipt.card }
         : { transition: receipt.transition };
 }));
+/** @deprecated compat:factory-refactor — use `executionHelper.wireExecution(…)` */
+export const wireExecution = (body, scope) => executionHelper.wireExecution(body, scope);
+/** @deprecated compat:factory-refactor — use `executionHelper.executeOptionsOf(…)` */
+export const executeOptionsOf = (body, maxPoll) => executionHelper.executeOptionsOf(body, maxPoll);
+/** @deprecated compat:factory-refactor — use `executionHelper.assertExecutionWrites(…)` */
+export const assertExecutionWrites = async (facade, exec, access) => await executionHelper.assertExecutionWrites(facade, exec, access);
+/** @deprecated compat:factory-refactor — use `executionHelper.assertExecutionGranted(…)` */
+export const assertExecutionGranted = async (facade, exec, access) => await executionHelper.assertExecutionGranted(facade, exec, access);
 //# sourceMappingURL=execute.js.map

package/build/actions/execute.js.map

@@ -1 +1 @@
-{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAK9F,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAE,KAAoB,EAAuB,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAA;QAC/C,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACxE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA8C,EAAE,OAAe,EAAkB,EAAE;IAClH,MAAM,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAA;AACzH,CAAC,CAAA;AAED,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAsC,EAAE,IAA6B,EACR,EAAE,CAC/D,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAoC,EAAE;IAC7G,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmB,CAAA;IAC/C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAC5F,CAAA;IAED,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACxC,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/actions/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAMpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGhD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAsC,EAAE,IAA6B,EACrD,EAAE,CAClB,QAAQ,EAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,IAAoC,EAAE;IACrH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACjF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmB,CAAA;IAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9D,MAAM,eAAe,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAA;IAEpH,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACxC,CAAC,CAAC,CAAC,CAAA;AAEL,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAE,KAAoB,EAAuB,EAAE,CAC/F,eAAe,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAE5C,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA8C,EAAE,OAAe,EAAkB,EAAE,CAClH,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAEjD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,MAAsB,EAAE,IAAyB,EAAE,MAAuB,EAC3D,EAAE,CAAC,MAAM,eAAe,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAErF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,MAAsB,EAAE,IAAyB,EAAE,MAAuB,EAC3D,EAAE,CAAC,MAAM,eAAe,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA"}

package/build/actions/execution/types.d.ts

@@ -0,0 +1,34 @@
+import type { ExecuteOptions, ExecuteRequest, PlanningFacade, PlanningScope, TransitionExecution } from '@owlmeans/planning';
+import type { PlanningAccess } from '../../types.js';
+/** What a wire execution may say, how long it may hold, and what access it needs. */
+export interface ExecutionHelper {
+    /**
+     * What a wire execution may say. `actor` is dropped — the scope names the writer — and a create's
+     * `createdBy` claim is dropped too: the executor's `creatorHelper.withCreator` stamps the
+     * authenticated subject, the same rule an in-process create follows. Applied here as well, so the
+     * returned execution already carries it. A `createdBy` in `changes` or `unset` is not dropped: the
+     * executor refuses it on every action (`assertCreatorFixed`), so no body moves an owner.
+     */
+    wireExecution: (body: ExecuteRequest, scope: PlanningScope) => TransitionExecution;
+    /** `wait`/`timeout` as a server grants them: the timeout never holds a request past `maxPoll`. */
+    executeOptionsOf: (body: Pick<ExecuteRequest, 'wait' | 'timeout'>, maxPoll: number) => ExecuteOptions;
+    /**
+     * Refuse an execution outside the access's `writes`: the card it acts on (a specification through
+     * its parent card), or every parent a create names, must be one `writableIn` admits. A create
+     * of a project is `grants.createProjects`' alone. A card or parent this scope cannot see is left to
+     * the executor, which answers it as absent.
+     *
+     * @throws {PlanningForbidden}
+     */
+    assertExecutionWrites: (facade: PlanningFacade, exec: TransitionExecution, access?: PlanningAccess) => Promise<void>;
+    /**
+     * The access a wire execution needs. `writes` first ({@link ExecutionHelper.assertExecutionWrites});
+     * then the grants: `createProjects` for a project create (its primary parent, or the root),
+     * `deleteProjects` for the delete of a project card. A card this scope cannot see is left to the
+     * executor, which answers it as absent.
+     *
+     * @throws {PlanningForbidden}
+     */
+    assertExecutionGranted: (facade: PlanningFacade, exec: TransitionExecution, access?: PlanningAccess) => Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/actions/execution/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/actions/execution/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC5H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,KAAK,mBAAmB,CAAA;IAClF,kGAAkG;IAClG,gBAAgB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,KAAK,cAAc,CAAA;IACrG;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpH;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtH"}

package/build/actions/execution/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map