@owlmeans/viable-common 0.0.46 → 0.0.47

package/README.md

@@ -6,25 +6,155 @@ Viable turns a description into a running full-stack application. Four runtimes
 about every name involved — the platform API services, the agent, the publisher that runs inside a project
 slot, and the connector SDK on a developer's machine — so each of those names is declared here
 once and imported by all of them. There is no runtime in this package: no `@langchain/*`, no
-filesystem, no inference SDK. It is safe to import from a browser bundle.
+filesystem, no inference SDK. It is safe to import from a browser bundle, so it holds names and
+shapes only: data that only the agent library reads (skill bodies, persona prompts, the blueprint
+case table, BA model-answer schemas) belongs in `@owlmeans/viable`, not here. An application outside
+the Viable platform has no use for it. The package's skills are `viable-common` and
+`agent-presentation`.
+
+## Installation
+
+```bash
+bun add @owlmeans/viable-common@^0.0.47
+```
 
 ## What is in it
 
 | Subpath | Contents |
 |---|---|
-| `.` | The shapes a generated project is described by: user stories and entities, the design and scaffold plans, UX/UI specs, the `docs/` metadata paths, the four user areas, the model roles and personas, moderation categories, slot metadata |
-| `@owlmeans/viable-common/slot` | The slot command vocabulary — file, shell and git commands, the sub-project roles, the target's ports and process markers |
+| `.` | The shapes a generated project is described by: the planning module (Viable card types and flows), user stories and entities, the design and scaffold plans, UX/UI specs, the `docs/` metadata paths, the four user areas and the tenancy decision, model roles and personas, blueprint types, moderation categories, slot metadata, the agent-output presentation taxonomy. Re-exports every subpath except `./intent` |
+| `@owlmeans/viable-common/slot` | The slot command vocabulary — file, shell, git and database commands, the sub-project roles and layouts, the target's ports and process markers |
 | `@owlmeans/viable-common/connect` | The connector protocol: sessions, operations, model tasks, questions, domain statuses, capabilities, the error family, and `connectProtocols()` — the one declaration both the platform and the SDK bind |
 | `@owlmeans/viable-common/convert` | Converting an application that already exists: the stages and their transitions, the origin and stack taxonomy, the census classifiers, and the `docs/conversion/` layout |
 | `@owlmeans/viable-common/integrity` | The target-shape manifest — what a slot is allowed to install, build and run — per target layout |
-| `@owlmeans/viable-common/legal` | `OWLMEANS_LEGAL_DATES`, `LegalDocumentDates` and `LegalDocumentKey` — shared ISO dates for the public site's policies and the platform's legal acceptance; no runtime dependencies |
+| `@owlmeans/viable-common/intent` | The intent-first hand-off from the public site: `makeIntentProtocols`, `intentFlow`, the stash/pickup schemas, `IntentDraft`, `IntentExpired` / `IntentThrottled` |
+| `@owlmeans/viable-common/iam-console` | The owner console's IAM contract shared by the browser and the connector: route params, closed bodies, answers, every `Iam*Schema`, `IAM_REFUSED` |
+| `@owlmeans/viable-common/legal` | `OWLMEANS_LEGAL_DATES`, active `LegalDocumentDates`, `PendingLegalDocumentDates`, `LegalDocumentDateMetadata` and `LegalDocumentKey` — shared active ISO dates and explicit pending metadata; no runtime dependencies |
+
+## Concepts
+
+- **Viable card** — a project, user story or specification is an `@owlmeans/planning` workcard of a
+  `VIABLE_*_TYPE`; what is Viable's lives under the card's `fields`, validated by
+  `ViableProjectFieldsSchema` / `ViableStoryFieldsSchema`.
+- **Story code** — `US-` + five uppercase characters; the vocabulary of a target's files. A card id
+  never reaches a target file.
+- **Area** — `ProjectArea`: guest `/`, user `/frontoffice`, admin `/admin`, operator `/backoffice`.
+  There is no fifth area.
+- **Tenancy** — `ProjectTenancy` (`operators`, `users`), recorded on the project card and read only
+  through `tenancyHelper`.
+- **Connector protocol** — the immutable HTTP tree `connectProtocols(opts)` declares; each runtime
+  binds its own materialization and injects only deployment parts (guard, gates, paid gates).
+- **Target layout** — `TargetLayout`; the integrity manifest is per layout, and a legacy layout must
+  still verify clean.
+- **Agent-output presentation** — `agentPresentationHelper.classifyAgentMessage` sorts a model message
+  into code, diff, structured, Markdown or plain, with a specialist role.
+
+## Usage
+
+### Bind the connector protocol tree
+
+The tree is the same everywhere; the deployment supplies its guard and gates.
+
+```typescript
+import { DEFAULT_GUARD } from '@owlmeans/auth-common'
+import { ConnectPaidGate, connectProtocols } from '@owlmeans/viable-common/connect'
+
+const tree = connectProtocols({
+  guard: DEFAULT_GUARD,
+  gate: { alias: 'project-owner', params: ['id'] },
+  accountGate: { alias: 'account-owner', params: [] },
+  paid: { [ConnectPaidGate.LocalLlm]: { alias: 'paid-llm', params: ['cap'] } },
+})
+
+tree.project.status   // a protocol object — bind it in the server, call it from the SDK
+tree.account.base     // `/connect/account`, a root of its own beside `tree.base`
+```
 
-## Installation
+### Read the cards and the tenancy decision
 
-```bash
-bun add @owlmeans/viable-common@^0.0.46
+```typescript
+import { ProjectArea, tenancyHelper, viableCardHelper } from '@owlmeans/viable-common'
+
+if (viableCardHelper.isViableStory(card)) {
+  const { area, primary } = viableCardHelper.storyFieldsOf(card) // absent area reads as guest
+  const story = viableCardHelper.userStoryOf(card, design)
+}
+
+const tenancy = tenancyHelper.tenancyOf(blueprint)              // NO_TENANCY unless a literal `true`
+tenancyHelper.tenantedArea(ProjectArea.User, tenancy)           // follows `users`
+viableCardHelper.isUserChannel(scope.channel)                   // `web` / `connect` only
+```
+
+### Verify a target tree
+
+The verifier does no IO: read every path in `TARGET_INTEGRITY_FILES` (`null` for an unreadable
+one) and hand the map over.
+
+```typescript
+import { TARGET_INTEGRITY_FILES, targetIntegrityHelper } from '@owlmeans/viable-common/integrity'
+
+const files = Object.fromEntries(await Promise.all(
+  TARGET_INTEGRITY_FILES.map(async path => [path, await readOrNull(path)] as const)
+))
+const report = targetIntegrityHelper.verifyTargetShape(files)
+if (!report.ok) {
+  throw new Error(targetIntegrityHelper.formatIntegrityReport(report))
+}
 ```
 
+### Classify agent output
+
+```typescript
+import { AgentMessageCategory, agentPresentationHelper } from '@owlmeans/viable-common'
+
+const input = { agent: 'coder', action: 'plan-scaffold', outputType: 'tool_calls', value: toolCall }
+if (!agentPresentationHelper.isAgentMessageHidden(input)) {
+  const presentation = agentPresentationHelper.classifyAgentMessage(input)
+  if (presentation.category === AgentMessageCategory.Structured) {
+    renderCard(presentation.structure, presentation.role)
+  }
+}
+```
+
+### Legal dates
+
+```typescript
+import { OWLMEANS_LEGAL_DATES } from '@owlmeans/viable-common/legal'
+
+const terms = OWLMEANS_LEGAL_DATES.terms                         // { effective, updated } ISO dates
+const dpa = OWLMEANS_LEGAL_DATES['data-processing-agreement']    // { status: 'pending', effective: null, … }
+```
+
+## API
+
+The full export list is the package's `src/` barrel; the groups an app reaches for:
+
+| Area | Exports |
+|---|---|
+| Planning | `VIABLE_PROJECT_TYPE`, `VIABLE_STORY_TYPE`, `VIABLE_SPEC_TYPE`, `VIABLE_TYPE_SCHEMAS`, `VIABLE_FLOW_SCHEMAS`, `ViableStoryStatus`, `ViableProjectStatus`, `ViableChannel`, `ViableProjectCard`, `ViableStoryCard`, `viableCardHelper`, `viableSpecHelper`, `landingSentenceHelper` |
+| Project refusals | `ProjectNotFound`, `ProjectPermissionError`, `ProjectStoryNotFound`, `ProjectStoryMissconfigured`, `ProjectAgentOccupied` and their bases |
+| Areas and tenancy | `ProjectArea`, `AREA_PATHS`, `AREA_ACCESS`, `AREA_TIER`, `ADMIN_PERMISSION`, `OPERATOR_PERMISSION`, `ProjectTenancy`, `ViableTenancyDecision`, `NO_TENANCY`, `tenancyHelper`, `TENANCY_QUOTE_MAX` |
+| Blueprint and skills | `Blueprint`, `BlueprintRef`, `BlueprintCase`, `GameKind`, `WorkKind`, `landingGatePreferenceOf`, `ViableSkill`, `ViablePersona` |
+| Design and scaffold | `StoryDesign`, `ScaffoldPlan`, `ScaffoldPlanSchema`, `landingPlanHelper`, `StoryDesignPort`, `AccessBlock`, `PermissionDefault` |
+| Slot metadata | `SlotMetadata`, `metadataConfigs`, `metadataLists`, `metadataSecrets`, `BRANDING_ENV_KEYS`, `brandingEnv` |
+| Agent output | `agentPresentationHelper`, `AgentMessageCategory`, `AgentStructuredKind`, `AgentCodeLanguage`, `AgentMarkdownKind`, `AgentMessageRole` |
+| `./slot` | `SlotCommandType`, `slotCommandHelper`, `SubProject`, `LAYOUTS`, `ROLE_DIRS`, `slotLayoutHelper`, `slotOriginHelper`, `DATABASE_READ_LIMITS` |
+| `./connect` | `connectProtocols`, `connect`, `connectRef`, `ConnectEntrypointOptions`, `ConnectPaidGate`, `ModelTier`, `modelTierHelper`, the view and body types with their `*Schema`s, `CONNECT_CALL_*`, the `Connect*` error family |
+| `./convert` | `ConversionStage`, `conversionStageHelper`, `OriginKind`, `StackId`, `censusHelper`, `conversionDocHelper`, `CENSUS_SKIP_DIRS`, `SOURCE_LIST_EXCLUSIONS` |
+| `./integrity` | `TargetLayout`, `TARGET_LAYOUTS`, `targetLayoutHelper`, `targetIntegrityHelper`, `TARGET_INTEGRITY_FILES`, `TARGET_PROTECTED_FILES` |
+| `./intent` | `intent`, `makeIntentProtocols`, `intentFlow`, `IntentStashBodySchema`, `IntentPickupBodySchema`, `IntentDraft`, `IntentExpired`, `IntentThrottled` |
+
+### Error statuses
+
+| Status | Classes |
+|---|---|
+| 402 | `ConnectOutOfCredits` |
+| 428 | `ConnectConsentRequired`, `ConnectConfirmationRequired` |
+| 404 | `ProjectNotFound`, `ProjectStoryNotFound`, `ConnectSessionNotFound`, `ConnectOpUnknown` |
+| 409 | `ProjectAgentOccupied`, `ProjectStoryMissconfigured`, `ConnectSessionGone`, `LocalSlotUnsupported` |
+| 410 | `ConnectCallLost` |
+| 422 | `ConnectOpRefused` |
+
 ## Rules worth knowing before you change something
 
 **A schema is written for the reader that will refuse it.** Model-answer schemas are annotated
@@ -39,18 +169,37 @@ provider's structured output writes an unset optional as `null`, and a wire body
 means "inherit" has no other spelling. `tests/convert.spec.ts` walks every exported schema for
 both faults, and for draft-04 tuple `items`.
 
-**A field that crosses a version skew carries no `enum`.** A connector is installed with
-`npx -y @owlmeans/viable-mcp@^0.1.18-rc.46` and talks to a separately deployed platform, so an executor kind it
-sends must remain an unused capability on an older platform rather than a refused session.
+**A field that crosses a version skew carries no `enum`.** The Viable MCP connector is installed
+from a moving `npx` range and talks to a separately deployed platform, so an executor kind it sends
+must remain an unused capability on an older platform rather than a refused session.
 
 **A ceiling exists once.** The inquiry answer cap here equals `DEFAULT_INQUIRY_ANSWER_CHARS` in
 `@owlmeans/llm-common` and must stay equal; two ceilings mean the larger one truncates silently
 at the smaller.
 
-## Related
-
-- `@owlmeans/viable-sdk` — the connector SDK written against these contracts
-- `@owlmeans/viable-mcp` — the npx MCP server built on that SDK
+**A new connector route is declared here first**, then bound in every runtime that serves or calls
+it — a route declared on one side alone is an unexplained 404.
+
+## Common pitfalls
+
+- Importing `./intent` from the barrel — it is the one subpath the barrel does not re-export.
+- Computing a conversion transition at a call site instead of `conversionStageHelper.stageAfter` /
+  `.canEnter`.
+- Adding a required key to `SlotMetadata` — the publisher refuses a body with a key it does not
+  know, so new keys are optional and omitted while unset.
+- Redeclaring a project refusal downstream — unmarshalling is by type name, last registration wins,
+  and `instanceof` breaks.
+- Passing a card id into a target file instead of the story code.
+- Putting agent-only data (skill bodies, case tables) here — it ships in every browser bundle.
+
+## Related packages
+
+- [`@owlmeans/viable-sdk`](../viable-sdk) — the connector SDK written against these contracts
+- [`@owlmeans/viable-log`](../viable-log) — target-side analytics and error plugins for the preview channel
+- [`@owlmeans/planning`](../planning) — the workcard model the planning module builds on
+- [`@owlmeans/agent-common`](../agent-common) — run and pipeline contracts
+- [`@owlmeans/llm-common`](../llm-common) — `LlmPurpose`, the inquiry ceilings, spectator contracts
+- [`@owlmeans/iam`](../iam) — the IAM vocabulary `./iam-console` re-exports
 
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/viable-common",
-  "version": "0.0.46",
-  "generatedAt": "2026-10-06T11:45:57.674Z",
+  "version": "0.0.47",
+  "generatedAt": "2026-10-08T08:16:20.564Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/agent-presentation/SKILL.md

@@ -6,7 +6,7 @@ description: Shared, runtime-free taxonomy for presenting OwlMeans Viable agent
 
 # Agent output presentation
 
-**Install:** `"@owlmeans/viable-common": "^0.0.46"` in `dependencies`
+**Install:** `"@owlmeans/viable-common": "^0.0.47"` in `dependencies`
 
 `@owlmeans/viable-common`'s `agent/presentation.ts` owns the browser-safe vocabulary for agent
 output. Keep the server and every client on `agentPresentationHelper.classifyAgentMessage()`; consumers may refine a

package/agent-meta/skills/viable-common/SKILL.md

@@ -8,8 +8,8 @@ user-invocable: false
 # @owlmeans/viable-common
 
 **Layer:** Cross-cutting domain (contracts only)
-**Install:** `"@owlmeans/viable-common": "^0.0.46"` in `dependencies`
-**Subpaths:** `.` · `./slot` · `./connect` · `./convert` · `./integrity` · `./intent` · `./legal` — the barrel
+**Install:** `"@owlmeans/viable-common": "^0.0.47"` in `dependencies`
+**Subpaths:** `.` · `./slot` · `./connect` · `./convert` · `./integrity` · `./intent` · `./legal` · `./iam-console` — the barrel
 re-exports every subpath except `./intent`.
 **Runtime-free:** no `@langchain/*`, no filesystem, no Ajv at run time (a devDependency, for the
 tests that compile the schemas); it depends on the packages under Depends On and nothing else.
@@ -33,11 +33,12 @@ execution state and card fields name.
 |---|---|
 | `.` (barrel) | The planning module (`VIABLE_*_TYPE`, `VIABLE_TYPE_SCHEMAS`, `VIABLE_FLOW_SCHEMAS`, `ViableStoryStatus`/`ViableProjectStatus` and their transitions, `ViableSpecCategory`, `ViableRelationship`, `ViableChannel`, `ViableProjectCard`/`ViableStoryCard`, the card helpers, the landing sentence helpers, the `Project*` refusals); `SlotMetadata` and the three metadata vocabularies (`metadataConfigs`, `metadataLists`, `metadataSecrets`), `BRANDING_ENV_KEYS` / `brandingEnv`; `ProjectArea` / `AREA_PATHS` / `AREA_ACCESS` / `AREA_TIER`, `ADMIN_PERMISSION` / `OPERATOR_PERMISSION`; the tenancy contract (`ProjectTenancy`, `ViableTenancyDecision`, `NO_TENANCY`, `tenancyHelper` (`tenancyOf`, `tenantedArea`), `TENANCY_QUOTE_MAX`); `ModelRole` and the viable `ExecutionState`; the `ViableSkill` / `ViablePersona` enums; the `Blueprint` layer types, `BlueprintRef` / `BlueprintPatch`, `BlueprintCase` / `GameKind` / `WorkKind`, `CASE_QUOTE_MAX`, `DEFAULT_BLUEPRINT_ID` / `BLUEPRINT_META_KEY`, `landingGatePreferenceOf`; the target topology (`TopologyDescriptor`, `LAYOUT_TOPOLOGIES`, `topologyHelper` (`resolveTopology`, `packageForRole`) — meaning in `/blueprints`); the BA shapes (`connectingStoryHelper.mergeConnectingStories`), the dev (`AccessBlock`, `AccessLevel`, `PermissionDefault`), UX, design and scaffold shapes and their schemas, `StoryDesignPort`; `ModerationCategory` / `ModerationSubject` / `moderationVerdictHelper.decideModeration`; the `docs/` metadata paths; `PreviewEventType` (error kinds plus `Analytics` — an analytics event a target's web posted through the preview reporter's channel; the target-side plugins live in `@owlmeans/viable-log`) and the `OwlMeansAnalyticsPayload` shape; the agent-output taxonomy (`agentPresentationHelper` — `classifyAgentMessage`, `isAgentMessageHidden`; `/agent-presentation`) and the spectator entry types |
 | `./slot` | `SlotCommandType` and the `SlotFileCommand` / `SlotShellCommand` / `SlotGitCommand` / `SlotDatabaseCommand` sets; `SlotDatabaseInfo`, `SlotDatabaseQueryArgs` / `SlotDatabaseQueryResult`, `DATABASE_READ_LIMITS`; the per-command deadlines and timeouts (`slotCommandHelper` — `commandDeadline`, `commandTimeout`), `SubProject`, `LAYOUTS` / `ROLE_DIRS` / `slotLayoutHelper.subprojectDirOf`, `WorkloadKind`, the target ports and process markers, `slotOriginHelper` (`slotOrigin` / `targetRedirectUrisForOrigin`) |
-| `./connect` | `ConnectTarget`, `ConnectLlm`, `ConnectHarness`, `ConnectExecutor`, `ConnectOpKind`, `ConnectProjectStatus`, `ConnectStoryStatus`, `ConnectPipelineState`, `ConnectWaitReason`, `ConnectProjectBranding` / `ConnectProjectBrandingSave`, the planning-kit views (`PlanningKitView`, `ConnectKitDescribe`, `ConnectKitApplyBody`, `ConnectKitApplyResult` and their `*Schema`s), `ModelTier` + `modelTierHelper` (`tierOfRole`/`clampTier`), `ModelTask*`, `InquiryPayload` + `ConnectInquiryKind`, the session and domain-status views, the convert bodies (`ConnectConvertCreateBody`, `ConnectConvertStartBody`, `ConnectConvertProceedBody`), the `Connect*` error family with `ConnectConfirmation` / `ConnectConfirmationAction`, `connectProtocols(opts)` and every `*Schema` behind them |
+| `./connect` | `ConnectTarget`, `ConnectLlm`, `ConnectHarness`, `ConnectExecutor`, `ConnectOpKind`, `ConnectProjectStatus`, `ConnectStoryStatus`, `ConnectPipelineState`, `ConnectWaitReason`, `ConnectProjectBranding` / `ConnectProjectBrandingSave` / `ConnectProjectBrandingFields` / `ConnectBrandingCredit` / `ConnectBrandingCreditBody`, the configuration contract (`ConnectScopeQuery`, `ConnectConfigScope`, `ConnectProjectConfig`, `ConnectConfigVariable`, `ConnectFrontendVariable`, `ConnectConfigValue`, `ConnectConfigSaveBody`, `CONNECT_CONFIG_*`), the organization's defaults (`ConnectOrganizationBranding(Save)`, `ConnectBrandingBackfill`), the planning-kit views (`PlanningKitView`, `ConnectKitDescribe`, `ConnectKitApplyBody`, `ConnectKitApplyResult` and their `*Schema`s), `ModelTier` + `modelTierHelper` (`tierOfRole`/`clampTier`), `ModelTask*`, `InquiryPayload` + `ConnectInquiryKind`, the session and domain-status views, the convert bodies (`ConnectConvertCreateBody`, `ConnectConvertStartBody`, `ConnectConvertProceedBody` + `ConnectConvertProceedUpdate`), `ConnectAgentLock`, `ConnectPaidGate` + `ConnectGateRef` + `ConnectEntrypointOptions`, the call collection (`CONNECT_CALL_HEADER`, `CONNECT_CALL_ACCEPT_MS`, `CONNECT_CALL_COLLECT_WAIT_SEC`, `CONNECT_CALL_LOST_MS`, `ConnectCallState`, `ConnectCallPending`, `ConnectCallResult`, `ConnectCallCollectParams` / `ConnectCallCollectQuery` and their `*Schema`s), the `Connect*` error family with `ConnectConfirmation` / `ConnectConfirmationAction`, `connectProtocols(opts)` and every `*Schema` behind them |
 | `./convert` | `ConversionStage`/`Status`/`Decision` and the `conversionStageHelper` transitions (`stageAfter`/`decisionFor`/`canEnter`), `OriginKind`/`OriginShape`/`OriginState`, `StackId` + `STACK_FAMILY`, `ArchitectureCase`, `ConvertibilityVerdict`/`ConvertibilityReason`, the census classifiers (`censusHelper` — `fileClassOf`, `sizeClassOf`, `entropyClassOf`, `binaryByExtension`), the `docs/conversion/` paths, `CONVERTED_ORIGIN_DIR`, `SOURCE_LIST_EXCLUSIONS`, `CENSUS_SKIP_DIRS`, `RELOCATE_ALWAYS_KEEP`, and the model-answer schemas the conversion asks with |
 | `./integrity` | `TargetLayout` + `TARGET_LAYOUTS`, `targetLayoutHelper` (`detectTargetLayout`, `isLegacyLayout`, `targetPackageName`), `targetIntegrityHelper.verifyTargetShape`, `TARGET_INTEGRITY_FILES`, `TARGET_PROTECTED_FILES` |
 | `./intent` | `intent` (the four aliases), `makeIntentProtocols(opts?)`, `intentFlow` + `IntentFlowStep` + `INTENT_PAYLOAD_REF`, `IntentStashBodySchema` / `IntentPickupBodySchema`, the `INTENT_*` constants, `IntentDraft`, `IntentExpired` (404) / `IntentThrottled` (429) |
-| `./legal` | `OWLMEANS_LEGAL_DATES`, `LegalDocumentDates`, `LegalDocumentKey` — the public site's legal dates and the platform's legal acceptance dates |
+| `./iam-console` | The owner console's IAM contract both doors share (the browser's `back.iam`, the connector's `connect.iam`): the route params (`IamProjectParams`, `IamProjectUserParams`, `IamOrganizationParams`, `IamMemberParams`, `IamGroupParams`), `IamScoped`, the bodies (`IamDefinitionUpdate`, `IamStaffSync`, `IamAssignGrant` / `IamRevokeGrant`, `IamGrantsQuery`, `IamProjectUserInvite` / `Update`, `IamOrganizationEdit`, `IamProjectMemberInvite` / `Update`, `IamGroupCreate` / `Edit`, `IamGroupMembersChange`), the answers (`IamListResponse` + `external`, `IamUsersResponse`, `IamPermissionsResponse` + `IamTenancy`, …, `IamStaffSyncResponse`), every `Iam*Schema` (with `IamScopedSchema`, `IamGroupRefSchema`), `IAM_REFUSED`, and the `@owlmeans/iam` vocabulary re-exported (`IamDefaultClass`, `IamGrantMode`, `IamGrantOrigin`, `IamRemovalPolicy`, `IAM_AREAS`, `IAM_MEMBERS_GROUP`, the record types). The refusal's CLASS (`IamRefused`, 409) is the platform's |
+| `./legal` | `OWLMEANS_LEGAL_DATES`, `LegalDocumentDates`, `PendingLegalDocumentDates`, `LegalDocumentDateMetadata`, `LegalDocumentKey` — active dates and pending metadata for public legal sources and acceptance |
 
 ## Shared legal dates (`./legal`)
 
@@ -45,15 +46,23 @@ Import `OWLMEANS_LEGAL_DATES` from `@owlmeans/viable-common/legal` for legal-pag
 platform consent configuration. This subpath has no runtime imports; it loads only the date table.
 The package barrel also re-exports it. Never import another repository's sources by path.
 
-`src/legal/consts.ts` owns the ISO `YYYY-MM-DD` effective/updated dates; `src/legal/types.ts`
-declares `LegalDocumentDates` and the complete `LegalDocumentKey` union. A new document must add
-both a key and a table row; `satisfies Record<LegalDocumentKey, LegalDocumentDates>` checks coverage.
+`src/legal/consts.ts` owns active ISO `YYYY-MM-DD` effective/updated dates and pending entries with
+`status: 'pending'`, `effective: null`, `updated: null`. `src/legal/types.ts` declares active and
+pending shapes, their `LegalDocumentDateMetadata` union, and the complete `LegalDocumentKey` union.
+A new document must add both a key and a table row;
+`satisfies Record<LegalDocumentKey, LegalDocumentDateMetadata>` checks coverage.
 Format dates in the consumer's locale, keeping policy text as placeholders rather than copied dates.
 
-Changing a terms/privacy/billing/product updated date changes the platform's terms-acceptance
-digest and requires acceptance again; privacy.updated also revises marketing consent.
-Cookies, services-agreement and platform-license dates are display-only. Rebuild this package
-before the platform and static-site consumers; both must receive the same table revision.
+The Platform accepts `terms` and `platform-license` (combined subscription/billing), with privacy
+disclosed separately; product-use rules live in Terms. `billing` and `product` preserve historical
+acceptance dates as compatibility aliases. DPA (`data-processing-agreement`), subprocessor (`subprocessors`), company-notice
+(`company-information`), acceptable-use (`acceptable-use`), refund (`refund-cancellation`) and
+service-level (`service-level-agreement`) entries remain pending until coordinated release.
+Render an explicit pending notice for a pending entry; never send null to a date formatter or
+substitute a preparation date. Optional purposes carry independent wording revisions in the consuming
+app, so editing privacy alone must not enlarge an existing grant. Legal-date activation is coordinated
+with publication and the configured acceptance digest. Rebuild this package before the platform and
+static-site consumers; both must receive the same table revision.
 
 ## The planning module
 
@@ -115,7 +124,7 @@ the wire and in target files — a parent agent's vocabulary, which never change
 | project `id` / story `id` | `id` (a card id) |
 | project `alias` / `name` / `description` | `code` / `title` / `description` |
 | project `specification` / `vision` / `designSystem` | specification bodies, categories `specification` / `vision` / `design-system` |
-| project `formerAliases`, `language`, `blueprint`, `blueprintCase`, `gameKind`, `workKind`, `caseQuote`, `target`, `origin`, `connectLlmMode`, `converterLlmMode` | `fields.*` |
+| project `formerAliases`, `language`, `blueprint`, `blueprintCase`, `gameKind`, `workKind`, `caseQuote`, `target`, `origin`, `connectLlmMode` | `fields.*` |
 | the landing-gate decision | project `fields.landing` — `{ story: code \| null, at }` |
 | the tenancy decision | project `fields.tenancy` — `ViableTenancyDecision` `{ operators, users, quotes?, by: 'model' \| 'owner', at }` |
 | story narrative (`story`) / `code` / `status` | `title` / `code` / `status` (same strings) |
@@ -264,25 +273,53 @@ refused session. Apply this to what a newer connector may send an older platform
 
 `connectProtocols(opts)` is the connector's whole immutable HTTP tree — aliases, paths, methods,
 contracts, parents. The platform and the SDK bind their own materializations of it; only the
-DEPLOYMENT's parts are injected: the guard alias, the ownership gate, and the paid local-LLM gate
-(on `session.openDelegated` alone). One base (`/connect` unless `path` says otherwise); `connect`
-(aliases) and `connectRef` (typed references) name the same set:
+DEPLOYMENT's parts are injected (`ConnectEntrypointOptions`): the guard alias, the ownership `gate`,
+the `accountGate` and the `paid` map — `Partial<Record<ConnectPaidGate, ConnectGateRef>>`, the gate
+of each kind of spend (`LocalLlm`, `Whitelabel`, `CustomDomain`, `ProductionStandalone`,
+`PublishedSites`). A route declares its KIND (`paidGate(kind)` inside the factory); the deployment
+names the gate service and parameters, so a connector route carries exactly its browser twin's gate.
+`localLlm` is the deprecated alias of `paid[LocalLlm]`, read only when the map names none. Two roots:
+`base` (`/connect` unless `path` says otherwise, the ownership gate) and `account.base`
+(`<path>/account`, the account gate) — a root of its own, never a child of `base`, because
+`getGates()` keeps one gate per service and the two ownership gates share one. `connect` (aliases)
+and `connectRef` (typed references) name the same set, the two bases aside:
 
 | Branch | Routes |
 |---|---|
+| `account` | `base` — the organization's and the person's own records, the account gate inherited; `branding.get` GET / `.save` POST `/branding` (`ConnectOrganizationBranding { organizationName, copyright }`, the save a PATCH `ConnectOrganizationBrandingSave`), `branding.backfill` POST `/branding/backfill` → `ConnectBrandingBackfill { projects }`; `llm.get` GET / `llm.set` POST `/llm` (`ConnectLlmBody` → `ConnectProfileSettingsView { llmMode, canUseLocal }`, the set the `LocalLlm` paid gate); `tokens.list` GET `/access-tokens` → `ConnectAccessTokenList` (`ConnectAccessToken` — no secret, no hash, no owner ids, `oauth`), `tokens.revoke` POST `/access-tokens/:id/revoke` (`ConnectAccessTokenParams` ≤ `CONNECT_TOKEN_ID_MAX`) → `ConnectAccessTokenRevoked` — NO create, and never under `/tokens`; `privacy.status` GET `/privacy` → `ConnectPrivacyChoices { pending, items: ConnectPrivacyChoice[] }` (`granted` = the SAVED answer), `privacy.withdraw` POST `/privacy/withdraw` (`ConnectPrivacyWithdrawBody { keys }`, 1–`CONNECT_PRIVACY_KEYS_MAX` unique keys ≤ `CONNECT_PRIVACY_KEY_MAX`, no field a grant could travel in) — NO grant or terms; `intent.pickup` POST `/intent/pickup` (`ConnectIntentPickupBody { ref }`, the guest pickup's ref shape) → `ConnectIntentPickup { prompt }`; `iam.users` GET `/iam/users` → `IamUsersResponse` — every end user of every app the organization owns, read-only; `notifications` GET `/notifications` (`ConnectFeedQuery`) → `ConnectFeedPage` — the organization's notices |
 | `session` | `open` POST `/session`, `openDelegated` POST `/session/delegated`, `close` POST `/session/:sessionId/close` |
 | `op` | `pull` GET `/session/:sessionId/ops` (the long poll), `submit` POST `/session/:sessionId/ops/:opId` |
-| `project` | `create` POST / `list` GET `/project`, `attach` POST `/project/attach`, `confirm`, `status`, `reinit`, `modify` under `/project/:id/…`, `branding.get` GET / `.save` POST `/project/:id/branding`, `kit.describe` GET / `kit.apply` POST `/project/:id/kits` |
+| `project` | `create` POST / `list` GET `/project`, `attach` POST `/project/attach`, `confirm`, `status`, `reinit`, `modify`, `rename` (`ConnectRenameBody { name, description? }` — the name, brief and code, never the address) under `/project/:id/…`, `branding.get` GET / `.save` POST `/project/:id/branding`, `branding.credit` POST `/project/:id/branding/credit` (`ConnectBrandingCreditBody { hideCredit }`, the `Whitelabel` paid gate), `branding.copyDefaults` POST `/project/:id/branding/copy-defaults` — all four with `?scope=` (`ConnectScopeQuery`), `kit.describe` GET / `kit.apply` POST `/project/:id/kits`, `destroy` DELETE `/project/:id` → `ConnectProjectSummary`, `unlock` POST `/project/:id/unlock` → `ConnectAgentLock { locked, task?, lockedAt? }` (also `ConnectProjectStatus.agent`) — both ownership only, `llm.get` GET / `llm.set` POST `/project/:id/llm` (`ConnectProjectLlmBody { llmMode: ConnectLlm \| null }` — `null` inherits — → `ConnectProjectSettings { llmMode, effective, canUseLocal }`, the set the `LocalLlm` paid gate); `activity` GET `/project/:id/activity` (`ConnectActivityQuery` — a feed query + `detail`) → `ConnectFeedPage` |
+| `config` | `get` GET / `save` POST `/project/:id/config` (`?scope=`; the save `ConnectConfigSaveBody { backend?, frontend? }` — lists of `ConnectConfigValue { name, value }`, a name matching `CONNECT_CONFIG_NAME_PATTERN` ≤ `CONNECT_CONFIG_NAME_MAX`, a value ≤ `CONNECT_CONFIG_VALUE_MAX`, ≤ `CONNECT_CONFIG_SAVE_MAX` per side), `recollect` POST `/project/:id/config/recollect` → `ConnectProjectConfig { scope, backend: ConnectConfigVariable[], frontend: ConnectFrontendVariable[] }` — ownership only |
 | `story` | `status` GET `/project/:id/story/:storyId/status` |
-| `files` | `list` GET `/project/:id/files` |
+| `files` | `list` GET `/project/:id/files`; `get` GET / `save` POST / `remove` DELETE `/project/:id/files/content` (`ConnectFileQuery { path }` ≤ `CONNECT_FILE_PATH_MAX` in the query; the save body `ConnectFileSaveBody { path, content }` — the whole file) → `ConnectFileContent { path, content }` / `ConnectFileWritten { path, buildWarning? }`; `meta` GET `/project/:id/files/meta` (`ConnectFileMetaQuery { kind: MetadataListKind, category?: SpecCategory }`, the category a nullable enum carrying `null`) → `string[]` — ownership only; `changes` GET `/project/:id/files/changes` (`ConnectFeedQuery`) → `ConnectFileChanges` (a feed page + `watching`) |
+| `sandbox` | `run`, `restart`, `stop`, `rebuild` POST `/project/:id/sandbox/<verb>` → `ConnectSlotView` — the PREVIEW workload, ownership only |
+| `slot` | `list` GET `/slot` → `ConnectSlotView[]` — the organization's workloads, ownership only |
+| `git` | `status` GET `/project/:id/git` → `ConnectGitState { connection: ConnectGithubConnection \| null, git: ConnectGitStatus \| null }`; `log` GET `/project/:id/git/log` → `ConnectGitCommit[]`; `commit` POST `…/git/commit` (`ConnectGitCommitBody { message }` ≤ `CONNECT_GIT_MESSAGE_MAX`) → `ConnectGitCommitResult`; `discard` POST `…/git/discard` → `ConnectGitStatus`; `revert` POST `…/git/revert` (`ConnectGitRevertBody { hash }`, `CONNECT_GIT_HASH_PATTERN`) → `ConnectGitRevertResult { commit, dbWarning? }` — ownership only |
+| `github` | `authorize` POST `/project/:id/github/authorize` → `ConnectGithubAuthorize { authorizeUrl }` (the address the PERSON opens — NO completion route exists); `publish` POST `…/github/publish` (`ConnectGithubPublishBody { repoName?, private?, existing?: { owner, repo } }`) → `ConnectGithubConnection`; `push` / `pull` POST → `ConnectGitSyncResult`; `disconnect` POST → `{ connection: null }`; `repos` GET `…/github/repos` (`ConnectGithubRepoQuery { page?, search? }`) → `ConnectGithubRepoList`; `branches` GET `…/github/branches` (`ConnectGithubBranchQuery { owner, repo, page? }`) → `ConnectGithubBranchList`; `link` POST `…/github/link` (`ConnectGithubLinkBody { owner, repo, branch? }`) → `ConnectGithubLinked` — ownership only; names ≤ `CONNECT_GITHUB_NAME_MAX`, branch ≤ `CONNECT_GITHUB_BRANCH_MAX`, page ≤ `CONNECT_GITHUB_PAGE_MAX`, search ≤ `CONNECT_GITHUB_SEARCH_MAX` |
+| `production` | `status` GET `/project/:id/production` → `ConnectProductionStatus { workload: ConnectSlotState \| null, domain: ConnectProductionDomain \| null }`; `publish` (the `PublishedSites` paid gate — a LIMIT gate), `restart`, `stop` POST `…/production/<verb>` → `ConnectProductionStatus`; `domain.attach` POST `…/production/domain/attach` (`ConnectProductionDomainBody { domain }` — `CONNECT_DOMAIN_MIN`…`CONNECT_DOMAIN_MAX`, `CONNECT_DOMAIN_PATTERN`; the `CustomDomain` paid gate), `domain.verify` / `domain.detach` POST → `ConnectProductionDomain \| null`; `auth.get` GET `…/production/auth` → `ConnectProductionAuth { clientId, issuerUrl, secretSet, redirectUris, generatedHost, customDomain? }` and `auth.redirects` POST `…/production/auth/redirects` (`ConnectProductionRedirectsBody { redirects }` — ≤ `CONNECT_REDIRECTS_MAX` addresses of ≤ `CONNECT_REDIRECT_URI_MAX`) → `ConnectProductionRedirects { redirectUris }`, both the `ProductionStandalone` paid gate. The production workload, never the preview; NO `run` verb (a stopped site comes back by `restart`) and NO secret or reveal anywhere |
+| `iam` | The generated app's sign-in, the owner console's twins under `/project/:id/iam` — ownership only, NO paid kind: `permissions` GET `…/permissions` (`ConnectScopeQuery`) → `IamPermissionsResponse`, `defaultUpdate` POST `…/permissions/default` (`IamDefinitionUpdate`); `grants.list` GET `…/grants` (`IamGrantsQuery`), `.assign` POST `…/grants`, `.revoke` POST `…/grants/revoke` (`IamAssignGrant` / `IamRevokeGrant` — one subject); `users.list` GET / `.invite` POST `…/users`, `.update` POST `…/users/:profileId`, `.remove` POST `…/users/:profileId/remove` (`IamScoped` body); `organizations.list` GET `…/organizations`, `.update` POST `…/organizations/:entitySlug`, `.members` GET / `.addMember` POST `…/:entitySlug/members`, `.updateMember` POST `…/members/:profileId`, `.removeMember` POST `…/members/:profileId/remove`; `groups.list` GET / `.ensure` POST `…/:entitySlug/groups`, `.update` POST `…/groups/:group`, `.remove` POST `…/groups/:group/remove`, `.members` GET / `.addMembers` POST `…/groups/:group/members`, `.removeMembers` POST `…/members/remove`. Params `ConnectIam{User,Organization,Member,Group}Params` (`id` = the project). Every write a POST with `scope` in its body; every read `scope` in the query; NO staff-sync twin |
 | `convert` | `create` POST `/convert`, `check` GET `/convert/:id/check`, `start`, `proceed`, `purge` POST `/convert/:id/…`, `status` GET `/convert/:id` |
 | `inquiry` | `answer` POST `/project/:id/inquiry/:inquiryId` |
 | `pipeline` | `state` GET `/pipeline/:id/:runId`, `resume` POST `/pipeline/:id/:runId/resume` |
-
-- No socket, capability view, session read, heartbeat, conversion cancel or inference-settings
-  route exists. A project's inference modes are set by the browser through the platform's own API;
-  `ConnectProjectSettings`, `ConnectProjectLlmBody(Schema)`, `ConverterProjectLlmBody(Schema)` stay
-  here as that API's shapes.
+| `call` | `collect` GET `/call/:callId` (query `wait` ≤ `CONNECT_CALL_COLLECT_WAIT_SEC`) → `ConnectCallResult` — under `base` (guard + ownership gate), never the paid gate |
+
+- No socket, capability view, session read, heartbeat, conversion cancel, token create, consent
+  grant or terms route exists. A project has ONE inference setting — the person's preference
+  (`account.llm`) and a project override (`project.llm`, `null` inherits) — read and written through
+  the same shapes (`ConnectProfileSettings(View)`, `ConnectProjectSettings`, `ConnectLlmBody`,
+  `ConnectProjectLlmBody(Schema)`) by the browser's API and the connector alike; both writes carry
+  the `LocalLlm` paid gate. The setting is a DEFAULT (the browser's, a URL-configured host's): a stdio
+  connector's own `llm` is what its session attached with. A conversion carries no mode of
+  its own: like every run it follows the session that drives it, and `ViableProjectFieldsSchema`
+  refuses any other inference key on a card.
+- Who performs the model calls is the connector's `llm` and nothing else: `ConnectExecutor.Model`
+  is advertised exactly when it is `local` (every model call is then the parent's), never in the
+  cloud mode; `Human` is advertised always.
+- `project.create` (`ConnectCreateBody`) and `convert.create` (`ConnectConvertCreateBody`) carry
+  `sessionId?` — the caller's UNATTACHED delegated session; its pre-card checks are performed by
+  that session's parent, and absent the platform performs them. A nullable id like every other
+  (`{ ...idValue, nullable: true }`), and both bodies stay `additionalProperties: false`.
 - A new route is added here first (alias, declaration, `connectRef` entry), then bound in every
   runtime that serves or calls it — a route declared on one side alone is an unexplained 404. Raw
   aliases stay private to declaration modules; consumers receive protocol objects.
@@ -295,10 +332,60 @@ DEPLOYMENT's parts are injected: the guard alias, the ownership gate, and the pa
   — the start's whole body — and `ConnectConvertProceedBody(Schema)`): a PERSON agreed to what the
   step costs. The platform refuses a step that would use the plan's conversion or spend credits
   without it (`ConnectConfirmationRequired`); a `null` is "not confirmed", never a refused body.
-- Branding routes hang under `base` (guard + ownership gate, no paid gate). The save body
-  (`ConnectProjectBrandingSaveSchema`) is a PATCH of strings with structural bounds only
-  (`CONNECT_BRANDING_*_MAX`, each equal to its platform twin); value acceptability is the
-  platform's rule on the MERGED record. The platform credit is a paid capability with its own route.
+  The proceed body also carries `update?: ConnectConvertProceedUpdate` — `name`, `description`,
+  `specification`, `vision`, `designSystem`, closed, never the alias — the person's edits to what
+  the analysis drafted, which the platform accepts only with the decision that starts the extraction.
+- **A workload crosses the wire as a projection.** `ConnectSlotState` (`id`, `kind`, `status`,
+  `slug`, `host?`, `initialized?`, `lastError?`, `buildWarning?`, `backendWarning?` — `kind` and
+  `status` plain strings for the version skew) is `ConnectProjectStatus.slot`; `ConnectSlotView` adds
+  `projectId?` for the sandbox answers and the workload list. Never a namespace, workload, volume or
+  key: those are the deployment's infrastructure names.
+- Branding routes hang under `base` (guard + ownership gate). The save body
+  (`ConnectProjectBrandingSaveSchema`) is a PATCH of the text fields (`ConnectProjectBrandingFields`)
+  with structural bounds only (`CONNECT_BRANDING_*_MAX`, each equal to its platform twin); value
+  acceptability is the platform's rule on the MERGED record. The platform credit is READ-ONLY on
+  `ConnectProjectBranding.credit` (`ConnectBrandingCredit { hidden, requested, entitled }`, optional
+  for a platform that predates it) and changes only through `branding.credit`, a project route
+  declaring a paid kind (`Whitelabel`), beside `session.openDelegated`, the two preference writes and
+  the production routes.
+- **Git crosses as self-contained mirrors** (`connect/git/types.ts`): the same fields as the
+  platform's `@owlmeans/git/model` and `GithubConnection`, no git dependency here, every status a
+  plain string (version skew). NO shape carries the GitHub token, and no body has a field one could
+  travel in (`additionalProperties: false`).
+- **Production crosses as projections** (`connect/production/types.ts`): the workload as the slot
+  state, the domain with its two DNS records (`customDomain` → `cnameTarget`, `dcvName` → `dcvValue`)
+  and the provider's raw states, every status a plain string. The production sign-in's client secret
+  has NO field: `ConnectProductionAuth.secretSet` says whether one exists. Each paid route declares
+  its kind (`PublishedSites`, `CustomDomain`, `ProductionStandalone`), so every paid kind is in use.
+- **The owner console's IAM is ONE contract for both doors** (`./iam-console`, re-exported by the
+  barrel): the browser's `back.iam` routes and the connector's `connect.iam` twins validate the SAME
+  body schemas, so a field cannot be admitted by one and refused by the other. Every object is closed —
+  an organization travels by `entitySlug`, a group by key, never a record id; a grant names exactly one
+  subject (`OneSubject`); its nullable enums carry `null`. `IamRefused` stays the platform's class; the
+  marker it writes (`IAM_REFUSED`) is declared here.
+- **The browser's sockets are cursor feeds here** (`connect/feed/types.ts`): `ConnectFeedRecord`
+  (`kind: ConnectFeedKind`, `at`, `run?`, `projectId?`, `storyId?`, `slotId?`, `action?`, `agent?`,
+  bounded `text?`, small `data?`) — a projection, never the record behind it; `ConnectFeedEntry` adds its
+  `id`; `ConnectFeedPage { cursor, entries, gap }`. A cursor is a stream id
+  (`CONNECT_FEED_CURSOR_PATTERN`, ≤ `CONNECT_FEED_CURSOR_MAX`; `CONNECT_FEED_START` = `0-0`), a page
+  ≤ `CONNECT_FEED_LIMIT_MAX` (default `CONNECT_FEED_LIMIT_DEFAULT`), a hold ≤ `CONNECT_FEED_WAIT_MAX_SEC`
+  (20 s). `ConnectFeedDetail` (`progress` | `thinking`) is a nullable enum carrying `null`. The three
+  feed routes are GETs with no paid kind — the tree still declares NO socket.
+- `ConnectScopeQuery` (`ConnectScopeQuerySchema`) names `ephemeral` (the default — the preview's set)
+  or `production` (its own set, taken at a Publish) — a nullable enum carrying `null`, never `local`.
+- **A backend variable's VALUE never crosses the connector.** `ConnectConfigVariable` is `{ name, set }`
+  only; a frontend variable (`ConnectFrontendVariable`) adds its public `value` — it is baked into the
+  bundle every visitor loads.
+- **Request now, collect later.** In the delegated mode a write may wait on a model call the
+  connector's own parent performs, longer than an edge holds a response. The connector names every
+  non-GET request with `CONNECT_CALL_HEADER` (`x-viable-call`, a UUID it generated and reuses on a
+  retry); the platform holds a named call `CONNECT_CALL_ACCEPT_MS` (20 s), then answers 202
+  (`EntrypointOutcome.Accepted`) with `ConnectCallPending { pending: <id> }`; `call.collect` holds up
+  to `CONNECT_CALL_COLLECT_WAIT_SEC` (25 s) per poll and answers `ConnectCallResult { state, outcome?,
+  value?, error? }` — `settled` carries the value the call would have answered with (the empty schema
+  `{}`, never `nullable` without a type) or `error`, the call's failure as `ResilientError.marshal`
+  writes it; a pending call whose heartbeat is older than `CONNECT_CALL_LOST_MS` (90 s) is `lost`.
+  The collection is transport, not domain: no `ConnectorApi` member and no generic job endpoint.
 - Long work is read through its domain view — `ConnectProjectStatus`, `ConnectStoryStatus`,
   `ConversionStatusView`, `ConnectPipelineState` — each composing its record, run, pending inquiry
   and `waitingFor` reason; none exposes a generic operation id. A new long-running domain extends
@@ -436,7 +523,8 @@ silently at the smaller; never introduce a local cap.
 ## Errors: declared here, phrased where they are read
 
 `ConnectError` and its family (`ConnectSessionNotFound`, `ConnectSessionGone`, `ConnectOpTimeout`,
-`ConnectOpRefused`, `LocalSlotUnsupported`, `ConnectOpUnknown`, `ConnectOutOfCredits`,
+`ConnectOpRefused`, `LocalSlotUnsupported`, `ConnectOpUnknown`, `ConnectCallLost` (`call-lost:<callId>`
+— a collected call's outcome was never recorded), `ConnectOutOfCredits`,
 `ConnectConsentRequired`, `ConnectConfirmationRequired`) are `ResilientError` classes with
 `viable-connect:` markers. The three refusals a connector phrases for a person pack their fields
 into the message (only `type` and `message` survive a marshal), are built with `static encode(...)`
@@ -475,6 +563,7 @@ refuses an exported class whose status was not decided:
 | 428 | `ConnectConsentRequired`, `ConnectConfirmationRequired` |
 | 404 | `ProjectNotFound`, `ProjectStoryNotFound`, `ConnectSessionNotFound`, `ConnectOpUnknown` |
 | 409 | `ProjectAgentOccupied`, `ProjectStoryMissconfigured`, `ConnectSessionGone` (no connector attached), `LocalSlotUnsupported` |
+| 410 | `ConnectCallLost` (the outcome is gone, not late) |
 | 422 | `ConnectOpRefused` |
 | none (500) | the bases, `ConnectOpTimeout` (a peer's fault), `ProjectPermissionError` (never thrown; a permission refusal extends `AuthForbidden`) |
 
@@ -488,12 +577,13 @@ the manager's `useErrorPhrase` read the same substrings. A marker change changes
 
 | File | Pins |
 |---|---|
-| `planning.spec.ts` | the two flows and transition tables, type declarations, slots, code policies, reserved types outside `cardTypes`, field schemas (null optionals, refused strays and closed-set values), landing fields and sentence, the tenancy decision, the work kind and bounded case quote, card helpers, the `follows` anchor, refusal type names after a marshal |
+| `planning.spec.ts` | the two flows and transition tables, type declarations, slots, code policies, reserved types outside `cardTypes`, field schemas (null optionals, refused strays and closed-set values, no `converterLlmMode`), landing fields and sentence, the tenancy decision, the work kind and bounded case quote, card helpers, the `follows` anchor, refusal type names after a marshal |
 | `tenancy.spec.ts` | `NO_TENANCY` frozen, `tenancyHelper.tenancyOf` defaults and the literal-`true` rule, `.tenantedArea` |
 | `access-schema.spec.ts` | the model-facing access schema: model keys only, byte-identical |
 | `scaffold.spec.ts` | old- and new-shape plans passing the schema and slot, `null` optionals, no `minItems`, closed anchors/slots, the landing helpers |
 | `blueprint.spec.ts` · `branding.spec.ts` | `landingGatePreferenceOf` defaults · the build env and metadata vocabulary |
-| `connect-entrypoints.spec.ts` · `connect-convert.spec.ts` | every route's method and path, aliases = `connectRef`, the paid gate on the delegated session alone, no socket or story route, branding body, the kit routes and their closed shapes · conversion routes, the start's body and both verbs' `confirm`, an unknown executor kind accepted |
+| `connect-entrypoints.spec.ts` · `connect-convert.spec.ts` | every route's method and path, aliases = `connectRef`, the paid kinds on the delegated session, the two preference writes and the credit switch alone, the account inference/token/privacy/intent routes and their closed bodies, the configuration routes and their closed bodies, the git and GitHub routes under the base with no paid gate and no completion route and their closed bodies, the production routes under the base each with its own paid kind, no secret or run verb, and their closed bodies, the IAM routes' count and addresses, the scope query, the account branding routes, no socket or story route, the create body's `sessionId`, branding body, the kit routes and their closed shapes, the collect route under the base and its timing constants, the pending/params/query/result shapes, the three feed routes (owned base / account base, GET, no paid gate, no socket) and the feed query shapes · conversion routes, the create body's `sessionId`, the start's body and both verbs' `confirm`, an unknown executor kind accepted |
+| `iam-console.spec.ts` | the owner-console schemas (one subject, closed bodies, `null` in nullable enums), the 22 `connect.iam` routes under the base with no paid gate, the customer-wide listing under the account base, POST writes with `scope` in the body and reads with it in the query, the connector's IAM params |
 | `convert.spec.ts` | the three structural walks over the barrel, nullable enums under Ajv, census classifiers, stage transitions |
 | `design.spec.ts` | the design aggregate, staleness ranking, schema refusals, `storyDesignHelper.userStoryOfDesign` |
 | `error-status.spec.ts` · `connect-errors.spec.ts` | declared statuses through a marshal · packed refusal fields fresh and after a round trip, the confirmation's `decode` |
@@ -506,6 +596,8 @@ the manager's `useErrorPhrase` read the same substrings. A marker change changes
 - `@owlmeans/resource` — the `ResourceError` base of the project refusals
 - `@owlmeans/entrypoint`, `@owlmeans/route` — the entrypoint declarations
 - `@owlmeans/error` — the `Connect*` error family
+- `@owlmeans/iam` — the owner console's IAM vocabulary `./iam-console` re-exports (public, runtime-light:
+  `auth`, `context`, `entrypoint`, `error`, `oidc`, `route`); `@owlmeans/auth-common` — `ENTITY_SLUG_PATTERN`
 - `@owlmeans/llm-common` — `ExecutionEffort`/`ExecutionLevel`, `LlmPurpose`, the spectator
   contracts, and the inquiry ceilings this package's copies are pinned to
 - `@owlmeans/agent-common` — the run and pipeline contracts (re-exported `AgentRunStatus`)
@@ -514,7 +606,7 @@ the manager's `useErrorPhrase` read the same substrings. A marker change changes
 
 ## Related
 
-- [[viable-sdk]] · [[viable-mcp]] — the connector SDK written against these contracts, and its npx
+- [[viable-sdk]] · `@owlmeans/viable-mcp` (closed-source) — the connector SDK written against these contracts, and its npx
   stdio server
 - [[flow]] · [[client-flow]] — the model `intentFlow` is walked with, and `flowLandingOf(context).suspendFlow`
 - [[inquiry]] · [[llm-common]] — the primitive `InquiryPayload` mirrors; the model runtime's contracts

package/build/connect/account/types.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The organization's branding defaults: the name and copyright line every new project starts with.
+ * A project keeps its own copy after creation; `copyDefaults` replaces a project's two values with
+ * these again.
+ */
+export interface ConnectOrganizationBranding {
+    organizationName: string;
+    copyright: string;
+}
+/** A PATCH of the organization's defaults; a field left out keeps its value. Neither may be empty. */
+export interface ConnectOrganizationBrandingSave extends Partial<ConnectOrganizationBranding> {
+}
+/** What a backfill did: how many projects had blank branding rows filled from the defaults. */
+export interface ConnectBrandingBackfill {
+    projects: number;
+}
+/**
+ * One of the person's access tokens, as a connector sees it — never the secret, never its hash, and
+ * no record ids of the organization or the person: the token is the caller's own by construction.
+ */
+export interface ConnectAccessToken {
+    id: string;
+    /** What the owner called it. */
+    name: string;
+    /** The prefix and the first characters of the secret — useless as a credential. */
+    display: string;
+    scopes: string[];
+    createdAt: string;
+    lastUsedAt?: string;
+    expiresAt?: string;
+    /** Set once a token is revoked; a revoked token stays listed so its name still resolves. */
+    revokedAt?: string;
+    /** Issued through a browser sign-in (an OAuth grant) for one resource, rather than minted by hand. */
+    oauth: boolean;
+}
+export interface ConnectAccessTokenList {
+    items: ConnectAccessToken[];
+}
+/** The token a revoke names — one of the caller's own. */
+export interface ConnectAccessTokenParams {
+    id: string;
+}
+/** What a revoke answers: the id it revoked. Revoking twice is what a retry looks like. */
+export interface ConnectAccessTokenRevoked {
+    id: string;
+}
+/** Whether a consent was ever answered at its current wording. */
+export type ConnectPrivacyStatus = 'new' | 'revised' | 'current';
+/** One marketing consent of the person, as the "Privacy choices" settings show it. */
+export interface ConnectPrivacyChoice {
+    /** The consent's key — `marketing.email`, `data.profiling`, … */
+    key: string;
+    group: string;
+    mode: 'opt-in' | 'opt-out';
+    /**
+     * The person's SAVED, current answer — `false` for anything never answered at this wording,
+     * whatever the settings screen's opt-out display default says.
+     */
+    granted: boolean;
+    status: ConnectPrivacyStatus;
+    /** When the saved answer was given, if there is one. */
+    decidedAt?: string;
+}
+export interface ConnectPrivacyChoices {
+    /** A consent still waits for the person's first or revised answer. */
+    pending: boolean;
+    items: ConnectPrivacyChoice[];
+}
+/** The consents to withdraw — each written `granted: false`; nothing here can grant one. */
+export interface ConnectPrivacyWithdrawBody {
+    keys: string[];
+}
+/** The reference of a stashed prompt — the `ref` of the `/start?ref=…` address the public site opened. */
+export interface ConnectIntentPickupBody {
+    ref: string;
+}
+/** The prompt a visitor typed on the public site. Collected once: the reference is spent. */
+export interface ConnectIntentPickup {
+    prompt: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/connect/account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/connect/account/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,sGAAsG;AACtG,MAAM,WAAW,+BAAgC,SAAQ,OAAO,CAAC,2BAA2B,CAAC;CAAG;AAEhG,+FAA+F;AAC/F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sGAAsG;IACtG,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;CACX;AAED,2FAA2F;AAC3F,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAA;CACX;AAED,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAA;AAEhE,sFAAsF;AACtF,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,oBAAoB,CAAA;IAC5B,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B;AAED,4FAA4F;AAC5F,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,0GAA0G;AAC1G,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;CACf"}

package/build/connect/account/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/connect/account/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/connect/account/types.ts"],"names":[],"mappings":""}