@percayso-community/cayso-contracts 0.29.0 → 1.0.0

package/dist/errors.d.ts

@@ -39,11 +39,13 @@
  * to the unions that own them, so neither can grow a member this union does not
  * carry. The founder claim's refusals are included the same way, and so are the
  * commercial payment's, the citizen market's, the marketplace status read's and the
- * two marketplace settlements', and the Percayso Cloud's two seams'.
+ * two marketplace settlements', the Percayso Cloud's two seams', and the binding of
+ * BizID's authority assertion to Percayso ID's.
  */
+import type { AuthorityBindingRefusal } from './authority.js';
 import type { FounderClaimRefusal } from './citizenship.js';
 import type { BuyBackRefusal, QuotePlacementRefusal, QuoteWithdrawalRefusal } from './citizen-market.js';
-import type { SettlementAssertionRefusal, StandingAuthorisationRefusal } from './cloud-settlement.js';
+import type { SettlementAssertionRefusal, StandingAuthorisationRefusal, StandingAuthorisationRevocationRefusal, NodeBindingQueryRefusal, NodeBindingRefusal } from './cloud-settlement.js';
 import type { CitizenTransferRefusal } from './citizen-transfer.js';
 import type { HandleChangeReceiptReadRefusal, HandleChangeRefusal } from './handle-change.js';
 import type { CommercialPaymentRefusal } from './commercial-payment.js';
@@ -175,6 +177,68 @@ export type CaysoApiErrorCode =
  * start.
  */
  | 'receipt_signing_not_configured'
+/**
+ * This deployment holds no key it may sign an authorisation acknowledgement with,
+ * so it publishes no acknowledgement key and signs no acknowledgement (CAY-0093).
+ * A closed door, never an empty key set: a verifier reading an empty set would
+ * learn nothing true.
+ */
+ | 'acknowledgement_signing_not_configured'
+/**
+ * No standing-authorisation store is wired, so no Instance key can be bound and no
+ * authorisation presented or revoked (CAY-0094).
+ */
+ | 'standing_authorisation_store_not_configured'
+/**
+ * The ceiling on what a holder may delegate to an Instance per period is not
+ * configured on this deployment, so no standing authorisation is acknowledged
+ * (CAY-0094, CAY-0024). The figure is the canon's; unset is a closed door and never
+ * "no limit", and it is not `cap_not_delegable`, which says the cap is too high.
+ */
+ | 'standing_authorisation_cap_ceiling_not_configured'
+/**
+ * The ceiling on how long a standing authorisation may live is not configured on
+ * this deployment, so none is acknowledged (CAY-0094). The figure is the canon's;
+ * unset is a closed door and never "no limit", and it is not
+ * `authorisation_outlives_its_ceiling`, which says the authorisation is too long.
+ */
+ | 'standing_authorisation_life_ceiling_not_configured'
+/**
+ * No Node-binding store is wired, so no Node can be bound and the Contribution
+ * Store's read of a Node's binding is not answered (CAY-0095). Never "unbound": a
+ * read that cannot look must not tell the Store a bound Node's rows are withheld.
+ */
+ | 'node_binding_store_not_configured'
+/**
+ * This deployment has not been told which Node IDs are Core Nodes, so no Node is
+ * bound and the Store's read is not answered (CAY-0095): binding one, or answering for
+ * one, without knowing would let a Core Node, whose owner is the Operator, earn for a
+ * Citizen Wallet. Told "none" is a configuration; untold is a closed door.
+ */
+ | 'core_node_ids_not_configured'
+/**
+ * No Contribution Store issuer is registered on this deployment, so no statement
+ * from the Store is verified and the Store's read of a Node's binding is not
+ * answered (CAY-0095). Not Store Platform's order keys, which
+ * are `marketplace_order_keys_not_configured`'s.
+ */
+ | 'contribution_store_issuer_not_configured'
+/**
+ * No authority issuer is registered on this deployment, so no authority assertion
+ * from Percayso BizID is verified and no act that needs one is performed (CAY-0100).
+ * A closed door, never a refusal of the assertion and never "act as the Citizen
+ * alone". Declared before any route answers it: the binding to the identity
+ * assertion is the first to serve it. Not `authority_assertion_invalid`, which says
+ * the assertion was presented and refused.
+ */
+ | 'authority_issuer_not_configured'
+/**
+ * No settlement store is wired — this deployment has no Treasury configured, so a
+ * contribution has nowhere to be paid from and a consumption nowhere to be paid to
+ * — and no settlement assertion is settled (CAY-0096). Never a refusal: the Store's
+ * period is not wrong, Cayso is not ready to read it.
+ */
+ | 'cloud_settlement_store_not_configured'
 /**
  * This deployment holds no registry of Store Platform order keys, so no signed
  * order can be verified and no marketplace operation is served (CAY-0083 §4).
@@ -201,7 +265,7 @@ export type CaysoApiErrorCode =
 /** There is no such purchase under this caller's wallet. */
  | 'not_found'
 /** Something failed on the way and the refusal discloses nothing further. */
- | 'internal_error' | PurchaseFailureReason | PurchaseCancelRefusalReason | FounderClaimRefusal | CommercialPaymentRefusal | CitizenTransferRefusal | HandleChangeRefusal | HandleChangeReceiptReadRefusal | QuotePlacementRefusal | QuoteWithdrawalRefusal | BuyBackRefusal | MarketplaceReceiptReadRefusal | MarketplaceOrderRefusal | MarketplaceRefundRefusal | StandingAuthorisationRefusal | SettlementAssertionRefusal;
+ | 'internal_error' | PurchaseFailureReason | PurchaseCancelRefusalReason | FounderClaimRefusal | CommercialPaymentRefusal | CitizenTransferRefusal | HandleChangeRefusal | HandleChangeReceiptReadRefusal | QuotePlacementRefusal | QuoteWithdrawalRefusal | BuyBackRefusal | MarketplaceReceiptReadRefusal | MarketplaceOrderRefusal | MarketplaceRefundRefusal | StandingAuthorisationRefusal | StandingAuthorisationRevocationRefusal | NodeBindingRefusal | NodeBindingQueryRefusal | SettlementAssertionRefusal | AuthorityBindingRefusal;
 /**
  * The body of every refusal on this surface: one code, and nothing beside it.
  *

package/dist/index.d.ts

@@ -60,10 +60,10 @@
  * This is the surface of every consumer outside this tree (CAY-0026, Amendment 3):
  * Piper first, and the Percayso Cloud second, whose two seams with Cayso arrive from
  * `cloud-settlement`. Peer types, admin types, holdings and carves are deliberately
- * not exported here; they are not a consumer's business. The three operator reads an
+ * not exported here; they are not a consumer's business. The four operator reads an
  * operator app's server calls are published, but on their own entry point,
- * `@percayso-community/cayso-contracts/operator` (CAY-0026, Amendment 4), and nothing
- * here re-exports them: none of this barrel's consumers is an operator.
+ * `@percayso-community/cayso-contracts/operator` (CAY-0026, Amendments 4 and 5), and
+ * nothing here re-exports them: none of this barrel's consumers is an operator.
  * And it carries **no numbers** — amounts, rates, tiers, schedules and thresholds
  * live in the canon PRD and are read from one place, never restated here.
  */
@@ -76,6 +76,106 @@
  * this money surface gains that Piper's own contracts lack, since theirs share
  * one global version bumped across all twenty-two together (CAY-0026).
  *
+ * From `1.0.0` the version follows ordinary semantic versioning (CAY-0101, amending
+ * CAY-0086). A minor is additive on the wire and drops nothing: Cayso keeps serving
+ * every earlier minor of the same major, so a removal waits for a major. A major is
+ * the only breaking kind, and the only time a consumer has to move. A consumer's
+ * handshake accepts a Cayso if `contractVersion` or any entry of
+ * `supportedContractVersions` is on its own line: from `1.0.0` the same major, below
+ * it the same minor.
+ *
+ * `0.32.0` → `1.0.0` changes nothing but the version. Its content is exactly
+ * `0.32.0`'s, and a deployment of it keeps serving `0.32.0`, `0.31.0`, `0.30.0` and
+ * `0.29.0` as a declared transition from the `0.x` line, which the next major ends. The
+ * entries below are the `0.x` history; "breaking" in them is the package's sense,
+ * under which a minor below `1.0.0` was a breaking line.
+ *
+ * `0.31.0` → `0.32.0` publishes and serves a fourth operator read on the `./operator`
+ * entry point, the economy summary, under
+ * `read-economy-summary-as-operator` (CAY-0026 Amendment 5): whole-number counts of
+ * wallets, movements and purchases, and cent totals of what is minted, cancelled and
+ * held, with its closed not-configured body. Nothing in this barrel changed, so no
+ * closed table grew: `ROUTES`, `ContractOperation` and `CaysoApiErrorCode` are as
+ * `0.31.0` published them. It is additive in the package's sense and on the wire
+ * (CAY-0086).
+ *
+ * `0.30.0` → `0.31.0` publishes BizID's authority assertion (CAY-0100), and serves
+ * nothing new: {@link AuthorityClaims}, its {@link AuthorityEnvelope} under the identity
+ * assertion's own `AssertionHeader`, and the binding's closed
+ * {@link AuthorityBindingRefusal}, which `CaysoApiErrorCode` gains by reference;
+ * {@link AUTHORITY_ASSERTION_HEADER}, the header it travels in; {@link isMandateVersion},
+ * the one check that `mandateVersion` is a JSON integer of at least 1; the seam code
+ * `authority_issuer_not_configured`, which `CaysoApiErrorCode` gains as the authority
+ * issuer's closed door and no route emits yet (#417); an optional
+ * `auth_time` on {@link AssertionClaims}, which the verifier now admits as a
+ * non-negative integer and nothing reads; and an optional per-request authority
+ * assertion provider on the thin client's three Organisation operations,
+ * `provisionOrganisation`, `makeCommercialPayment` and `authorisePurchase`, sent only
+ * when the caller passes one. `organisationAuthority` and `mandateFor` stay, retired
+ * and removed by a later breaking step (#419). BREAKING in the package's sense
+ * because a closed union grew. Additive on the wire (CAY-0086): no route a `0.30.0`
+ * consumer calls changed or answers anything new, because no route reads the header
+ * or produces the new codes yet, and a credential a `0.30.0` issuer mints, which
+ * carries no `auth_time`, verifies exactly as before.
+ *
+ * `0.29.0` → `0.30.0` publishes and SERVES Cayso's authorisation acknowledgement keys
+ * (CAY-0093): {@link ACKNOWLEDGEMENT_KEYS_ROUTE}, `GET /api/acknowledgement-keys`, an
+ * unauthenticated read outside `ROUTES`, described in the schema under `keyRoutes`;
+ * the key set it answers, {@link AcknowledgementKeySet} of
+ * {@link AcknowledgementPublicKey}, Ed25519 public JSON Web Keys and nothing private;
+ * and `CaysoApiErrorCode` gains `acknowledgement_signing_not_configured`, the route's
+ * closed door.
+ *
+ * The same version SERVES the standing authorisation (CAY-0094), published at `0.25.0`
+ * and answered until now by the router's `404`: `ROUTES.standingAuthorisation` answers
+ * {@link StandingAuthorisationResponse} with an acknowledgement signed under that key.
+ * It adds the owner's way to withdraw one: `ROUTES.revokeStandingAuthorisation`,
+ * `POST /api/cloud/standing-authorisation-revocations`, mapped to the new operation
+ * `'revoke-standing-authorisation'`, money-grade in `ASSURANCE_POLICY`; the client
+ * method `revokeStandingAuthorisation`; {@link StandingAuthorisationRevocationRequest},
+ * {@link StandingAuthorisationRevocationResponse} and the closed
+ * {@link StandingAuthorisationRevocationRefusal}, which `CaysoApiErrorCode` gains by
+ * reference; and the seam codes `standing_authorisation_store_not_configured`,
+ * `standing_authorisation_cap_ceiling_not_configured` and
+ * `standing_authorisation_life_ceiling_not_configured`.
+ *
+ * The same version publishes and SERVES binding a Node to a wallet (CMTY-0018 §4,
+ * CAY-0095): `ROUTES.bindNode`, `POST /api/cloud/node-bindings`, mapped to the new
+ * operation `'bind-node'`, money-grade in `ASSURANCE_POLICY`; the client method
+ * `bindNode`; {@link NodePresentationClaims}, {@link NodeBindingRequest},
+ * {@link NodeBindingResponse} and the closed {@link NodeBindingRefusal}. Beside it, the
+ * Contribution Store's read of whether a Node is bound: {@link NODE_BINDING_QUERY_ROUTE},
+ * `POST /api/cloud/node-binding-queries`, outside `ROUTES` and in the schema under
+ * `issuerRoutes`, authenticated by the registered Store issuer; {@link
+ * NodeBindingQueryClaims}, {@link NodeBindingQueryRequest}, the answer
+ * {@link NodeBindingStatus} — `nodeId` and `bound` and nothing else — and the closed
+ * {@link NodeBindingQueryRefusal}. `CaysoApiErrorCode` gains both unions by reference
+ * and the seam codes `node_binding_store_not_configured`, `core_node_ids_not_configured`
+ * and `contribution_store_issuer_not_configured`.
+ *
+ * The same version SERVES the Contribution Store's settlement assertion (CMTY-0018 §2,
+ * CAY-0096) at {@link CLOUD_SETTLEMENT_ROUTE}, published at `0.25.0` and answered until
+ * now by the router's `404`. A settled period writes one `contribution_settlement`
+ * movement per paid contribution row and one `consumption_settlement` per consumption
+ * row, so `MovementKind` and `MOVEMENT_KINDS` gain both. The closed refusal unions gain
+ * the members the write needs: {@link SettlementAssertionLevelRefusal} gains
+ * `settlement_period_not_recognised`, `settlement_period_not_ended` and
+ * `settlement_carve_contended`; {@link ContributionRowRefusal} gains
+ * `contribution_node_is_a_core_node` and `contribution_treasury_short`;
+ * {@link ConsumptionRowRefusal} gains `consumption_authorisation_not_in_force` and
+ * `consumption_wallet_short`. `CaysoApiErrorCode` gains them by reference and the seam
+ * code `cloud_settlement_store_not_configured`.
+ *
+ * BREAKING in the package's sense because closed tables grew: `ROUTES`,
+ * `ContractOperation`, `CaysoApiErrorCode`, `MovementKind` and the settlement's refusal
+ * unions. Additive on the wire (CAY-0086): no route a `0.29.0` consumer could reach
+ * changed, because the only ones that answer differently are the standing
+ * authorisation and the settlement assertion, which no deployment served before, and
+ * they answer the shapes `0.25.0` published, a member those shapes' unions gained, or a
+ * new seam code no served route emits. The operator movement list can now carry the two
+ * new kinds, and it is read only by the admin app in this tree, released with it. The
+ * two Node routes are ones a `0.29.0` consumer cannot name.
+ *
  * `0.28.0` → `0.29.0` publishes and SERVES the Handle change (CAY-0091):
  * `ROUTES.handleChange`, `POST /api/handle-changes`, mapped to the new operation
  * `'change-handle'`, money-grade in `ASSURANCE_POLICY`; `ROUTES.handleChangeReceipt`,
@@ -552,7 +652,7 @@
  * have needed a breaking bump on their own. Under semver below `1.0.0` the minor
  * is where a breaking change goes, so the minor moves and the patch does not.
  */
-export declare const CONTRACT_VERSION: "0.29.0";
+export declare const CONTRACT_VERSION: "1.0.0";
 /** The package's own name, so a consumer can name what it depends on. */
 export declare const packageName = "@percayso-community/cayso-contracts";
 /**
@@ -576,6 +676,18 @@ export { ROUTES } from './routes.js';
  * no operation, no assurance bar and no client method.
  */
 export { CLOUD_SETTLEMENT_ROUTE } from './routes.js';
+/**
+ * Where the Contribution Store asks whether a Node is bound (CAY-0095). A value beside
+ * `ROUTES` and never in it, for the settlement path's reason: it is authenticated by
+ * the registered Store issuer, not by a person.
+ */
+export { NODE_BINDING_QUERY_ROUTE } from './routes.js';
+/**
+ * Where Cayso publishes its authorisation acknowledgement keys (CAY-0093). A value
+ * beside `ROUTES` and never in it: an unauthenticated read of a public key carries no
+ * identity, so it has no operation, no assurance bar and no client method.
+ */
+export { ACKNOWLEDGEMENT_KEYS_ROUTE } from './routes.js';
 /**
  * The purchase lifecycle's runtime half (CAY-0032): which statuses a purchase
  * never leaves, the predicate over them, and the window an authorisation holds its
@@ -617,6 +729,17 @@ export { NOT_PROVISIONED } from './citizenship.js';
  * exception to keeping numbers in the canon PRD; no economic figure is here.
  */
 export { MAX_ASSERTION_LIFETIME_SECONDS, CLOCK_SKEW_TOLERANCE_SECONDS, MINIMUM_ASSERTION_USE_RETENTION_SECONDS, } from './assertion.js';
+/**
+ * The request header BizID's authority assertion travels in, beside the identity
+ * assertion's `Authorization` (CAY-0100 §4). A value so a consumer and the service
+ * spell it from one place; the reasoning behind the name is on the constant.
+ */
+export { AUTHORITY_ASSERTION_HEADER } from './authority.js';
+/**
+ * Whether a value is a well-formed `AuthorityClaims.mandateVersion`: a JSON integer of at
+ * least 1, BizID's mandate version counter (CAY-0100 §5). The one check of the shape.
+ */
+export { isMandateVersion } from './authority.js';
 /**
  * The assurance profile (CAY-0029): what each `VerificationMethod` asserts, which
  * methods each operation accepts, and the version a claim is minted under.
@@ -702,8 +825,9 @@ export type { HandleChangeReceiptStatement, HandleChangeReceipt, HandleChangeCha
 export type { QuoteSide, QuoteRequest, Quote, QuotePlaced, QuoteRefused, QuoteResponse, QuoteEntryRefusal, QuotePlacementRefusal, QuoteWithdrawalRequest, QuoteWithdrawal, QuoteWithdrawn, QuoteWithdrawalRefused, QuoteWithdrawalResponse, QuoteWithdrawalRefusal, BuyBackRequest, BuyBack, BuyBackMade, BuyBackRefused, BuyBackResponse, BuyBackRefusal, BookLevel, QuoteStatus, QuoteWithdrawalReason, OwnQuote, OwnQuoteNotWithdrawn, OwnQuoteWithdrawn, CitizenMarketView, CitizenMarketViewed, CitizenMarketViewRefusal, CitizenMarketViewRefused, CitizenMarketResponse, } from './citizen-market.js';
 export type { MarketplaceReceiptSignatureAlgorithm, MarketplaceReceiptKeyId, MarketplaceSaleKind, MarketplaceReceiptLeg, MarketplaceSettlementReceiptStatement, HousePublisherChargeReceiptStatement, ThirdPartyRefundReceiptStatement, HousePublisherRefundReceiptStatement, MarketplaceReceiptStatement, MarketplaceReceipt, MarketplaceReceiptReadRequest, MarketplaceReceiptFound, MarketplaceNoMovement, MarketplaceReceiptReadRefusal, MarketplaceReceiptReadRefused, MarketplaceReceiptReadResponse, } from './marketplace-receipt.js';
 export type { StoreSignedStatement, MarketplaceOrderRequest, MarketplaceRefundRequest, MarketplaceOrderReceipt, MarketplaceRefundReceipt, MarketplaceOrderSettled, MarketplaceOrderRefused, MarketplaceOrderResponse, MarketplaceOrderRefusal, MarketplaceRefundSettled, MarketplaceRefundRefused, MarketplaceRefundResponse, MarketplaceRefundRefusal, } from './marketplace-settlement.js';
-export type { InstanceKeyId, SettlementPeriodRule, SettlementPeriodId, NodeId, ContributionStoreIssuer, PercaysoCloudAudience, StandingAuthorisationClaims, StandingAuthorisationRequest, AuthorisationAcknowledgementClaims, StandingAuthorisationAcknowledged, StandingAuthorisationRefused, StandingAuthorisationResponse, StandingAuthorisationRefusal, ContributionType, SettlementPeriod, ContributionWithheldReason, ContributionQualified, ContributionWithheld, ContributionQualification, ContributionRow, ConsumptionRow, SettlementTotals, SettlementAssertionClaims, SettlementAssertionRequest, SettlementAssertionSettled, SettlementAssertionRefused, ContributionRowRefused, ConsumptionRowRefused, SettlementAssertionResponse, SettlementAssertionLevelRefusal, ContributionRowRefusal, ConsumptionRowRefusal, SettlementAssertionRefusal, } from './cloud-settlement.js';
+export type { InstanceKeyId, SettlementPeriodRule, SettlementPeriodId, NodeId, ContributionStoreIssuer, PercaysoCloudAudience, StandingAuthorisationClaims, StandingAuthorisationRequest, AuthorisationAcknowledgementClaims, AcknowledgementKeyId, AcknowledgementPublicKey, AcknowledgementKeySet, StandingAuthorisationAcknowledged, StandingAuthorisationRefused, StandingAuthorisationResponse, StandingAuthorisationRefusal, StandingAuthorisationRevocationRequest, StandingAuthorisationRevoked, StandingAuthorisationRevocationRefused, StandingAuthorisationRevocationResponse, StandingAuthorisationRevocationRefusal, NodePresentationClaims, NodeBindingRequest, NodeBound, NodeBindingRefused, NodeBindingResponse, NodeBindingRefusal, NodeBindingQueryClaims, NodeBindingQueryRequest, NodeBindingStatus, NodeBindingQueryRefused, NodeBindingQueryRefusal, ContributionType, SettlementPeriod, ContributionWithheldReason, ContributionQualified, ContributionWithheld, ContributionQualification, ContributionRow, ConsumptionRow, SettlementTotals, SettlementAssertionClaims, SettlementAssertionRequest, SettlementAssertionSettled, SettlementAssertionRefused, ContributionRowRefused, ConsumptionRowRefused, SettlementAssertionResponse, SettlementAssertionLevelRefusal, ContributionRowRefusal, ConsumptionRowRefusal, SettlementAssertionRefusal, } from './cloud-settlement.js';
 export type { PurchaseRequest, PurchaseAuthorised, PurchaseTerminal, PurchaseUnresolved, PurchaseRefused, PurchaseAuthorisationResponse, PurchaseFailureReason, PurchaseStatus, LivePurchaseStatus, TerminalPurchaseStatus, PurchaseCancelRefusalReason, PurchaseCancelled, PurchaseCancelRefused, PurchaseCancelResponse, PurchaseResult, } from './purchase.js';
 export type { VerificationMethod, VerificationStatus, SubjectPersonhood, AssertionClaims, AssertionHeader, AssertionEnvelope, ContractOperation, InternalOperation, ScopeKey, } from './assertion.js';
+export type { AuthorityClaims, AuthorityEnvelope, AuthorityBindingRefusal } from './authority.js';
 export type { VerificationEvidence, EvidenceStatement, MethodDecision, MethodDecisions, AssuranceRequired, AssuranceNotRequired, OperationAssurance, AssuranceRefusalReason, AssuranceAssessment, } from './assurance.js';
 export type { Restriction, HoldingKind, HoldingCapability, PermittedStanding, RefusedStanding, OpenStanding, CapabilityStanding, CapabilityCell, CapabilityCoordinate, CapabilityPolicy, ArrivalAndExpiry, } from './restriction.js';

package/dist/index.js

@@ -75,10 +75,10 @@
  * This is the surface of every consumer outside this tree (CAY-0026, Amendment 3):
  * Piper first, and the Percayso Cloud second, whose two seams with Cayso arrive from
  * `cloud-settlement`. Peer types, admin types, holdings and carves are deliberately
- * not exported here; they are not a consumer's business. The three operator reads an
+ * not exported here; they are not a consumer's business. The four operator reads an
  * operator app's server calls are published, but on their own entry point,
- * `@percayso-community/cayso-contracts/operator` (CAY-0026, Amendment 4), and nothing
- * here re-exports them: none of this barrel's consumers is an operator.
+ * `@percayso-community/cayso-contracts/operator` (CAY-0026, Amendments 4 and 5), and
+ * nothing here re-exports them: none of this barrel's consumers is an operator.
  * And it carries **no numbers** — amounts, rates, tiers, schedules and thresholds
  * live in the canon PRD and are read from one place, never restated here.
  */
@@ -92,6 +92,106 @@
  * this money surface gains that Piper's own contracts lack, since theirs share
  * one global version bumped across all twenty-two together (CAY-0026).
  *
+ * From `1.0.0` the version follows ordinary semantic versioning (CAY-0101, amending
+ * CAY-0086). A minor is additive on the wire and drops nothing: Cayso keeps serving
+ * every earlier minor of the same major, so a removal waits for a major. A major is
+ * the only breaking kind, and the only time a consumer has to move. A consumer's
+ * handshake accepts a Cayso if `contractVersion` or any entry of
+ * `supportedContractVersions` is on its own line: from `1.0.0` the same major, below
+ * it the same minor.
+ *
+ * `0.32.0` → `1.0.0` changes nothing but the version. Its content is exactly
+ * `0.32.0`'s, and a deployment of it keeps serving `0.32.0`, `0.31.0`, `0.30.0` and
+ * `0.29.0` as a declared transition from the `0.x` line, which the next major ends. The
+ * entries below are the `0.x` history; "breaking" in them is the package's sense,
+ * under which a minor below `1.0.0` was a breaking line.
+ *
+ * `0.31.0` → `0.32.0` publishes and serves a fourth operator read on the `./operator`
+ * entry point, the economy summary, under
+ * `read-economy-summary-as-operator` (CAY-0026 Amendment 5): whole-number counts of
+ * wallets, movements and purchases, and cent totals of what is minted, cancelled and
+ * held, with its closed not-configured body. Nothing in this barrel changed, so no
+ * closed table grew: `ROUTES`, `ContractOperation` and `CaysoApiErrorCode` are as
+ * `0.31.0` published them. It is additive in the package's sense and on the wire
+ * (CAY-0086).
+ *
+ * `0.30.0` → `0.31.0` publishes BizID's authority assertion (CAY-0100), and serves
+ * nothing new: {@link AuthorityClaims}, its {@link AuthorityEnvelope} under the identity
+ * assertion's own `AssertionHeader`, and the binding's closed
+ * {@link AuthorityBindingRefusal}, which `CaysoApiErrorCode` gains by reference;
+ * {@link AUTHORITY_ASSERTION_HEADER}, the header it travels in; {@link isMandateVersion},
+ * the one check that `mandateVersion` is a JSON integer of at least 1; the seam code
+ * `authority_issuer_not_configured`, which `CaysoApiErrorCode` gains as the authority
+ * issuer's closed door and no route emits yet (#417); an optional
+ * `auth_time` on {@link AssertionClaims}, which the verifier now admits as a
+ * non-negative integer and nothing reads; and an optional per-request authority
+ * assertion provider on the thin client's three Organisation operations,
+ * `provisionOrganisation`, `makeCommercialPayment` and `authorisePurchase`, sent only
+ * when the caller passes one. `organisationAuthority` and `mandateFor` stay, retired
+ * and removed by a later breaking step (#419). BREAKING in the package's sense
+ * because a closed union grew. Additive on the wire (CAY-0086): no route a `0.30.0`
+ * consumer calls changed or answers anything new, because no route reads the header
+ * or produces the new codes yet, and a credential a `0.30.0` issuer mints, which
+ * carries no `auth_time`, verifies exactly as before.
+ *
+ * `0.29.0` → `0.30.0` publishes and SERVES Cayso's authorisation acknowledgement keys
+ * (CAY-0093): {@link ACKNOWLEDGEMENT_KEYS_ROUTE}, `GET /api/acknowledgement-keys`, an
+ * unauthenticated read outside `ROUTES`, described in the schema under `keyRoutes`;
+ * the key set it answers, {@link AcknowledgementKeySet} of
+ * {@link AcknowledgementPublicKey}, Ed25519 public JSON Web Keys and nothing private;
+ * and `CaysoApiErrorCode` gains `acknowledgement_signing_not_configured`, the route's
+ * closed door.
+ *
+ * The same version SERVES the standing authorisation (CAY-0094), published at `0.25.0`
+ * and answered until now by the router's `404`: `ROUTES.standingAuthorisation` answers
+ * {@link StandingAuthorisationResponse} with an acknowledgement signed under that key.
+ * It adds the owner's way to withdraw one: `ROUTES.revokeStandingAuthorisation`,
+ * `POST /api/cloud/standing-authorisation-revocations`, mapped to the new operation
+ * `'revoke-standing-authorisation'`, money-grade in `ASSURANCE_POLICY`; the client
+ * method `revokeStandingAuthorisation`; {@link StandingAuthorisationRevocationRequest},
+ * {@link StandingAuthorisationRevocationResponse} and the closed
+ * {@link StandingAuthorisationRevocationRefusal}, which `CaysoApiErrorCode` gains by
+ * reference; and the seam codes `standing_authorisation_store_not_configured`,
+ * `standing_authorisation_cap_ceiling_not_configured` and
+ * `standing_authorisation_life_ceiling_not_configured`.
+ *
+ * The same version publishes and SERVES binding a Node to a wallet (CMTY-0018 §4,
+ * CAY-0095): `ROUTES.bindNode`, `POST /api/cloud/node-bindings`, mapped to the new
+ * operation `'bind-node'`, money-grade in `ASSURANCE_POLICY`; the client method
+ * `bindNode`; {@link NodePresentationClaims}, {@link NodeBindingRequest},
+ * {@link NodeBindingResponse} and the closed {@link NodeBindingRefusal}. Beside it, the
+ * Contribution Store's read of whether a Node is bound: {@link NODE_BINDING_QUERY_ROUTE},
+ * `POST /api/cloud/node-binding-queries`, outside `ROUTES` and in the schema under
+ * `issuerRoutes`, authenticated by the registered Store issuer; {@link
+ * NodeBindingQueryClaims}, {@link NodeBindingQueryRequest}, the answer
+ * {@link NodeBindingStatus} — `nodeId` and `bound` and nothing else — and the closed
+ * {@link NodeBindingQueryRefusal}. `CaysoApiErrorCode` gains both unions by reference
+ * and the seam codes `node_binding_store_not_configured`, `core_node_ids_not_configured`
+ * and `contribution_store_issuer_not_configured`.
+ *
+ * The same version SERVES the Contribution Store's settlement assertion (CMTY-0018 §2,
+ * CAY-0096) at {@link CLOUD_SETTLEMENT_ROUTE}, published at `0.25.0` and answered until
+ * now by the router's `404`. A settled period writes one `contribution_settlement`
+ * movement per paid contribution row and one `consumption_settlement` per consumption
+ * row, so `MovementKind` and `MOVEMENT_KINDS` gain both. The closed refusal unions gain
+ * the members the write needs: {@link SettlementAssertionLevelRefusal} gains
+ * `settlement_period_not_recognised`, `settlement_period_not_ended` and
+ * `settlement_carve_contended`; {@link ContributionRowRefusal} gains
+ * `contribution_node_is_a_core_node` and `contribution_treasury_short`;
+ * {@link ConsumptionRowRefusal} gains `consumption_authorisation_not_in_force` and
+ * `consumption_wallet_short`. `CaysoApiErrorCode` gains them by reference and the seam
+ * code `cloud_settlement_store_not_configured`.
+ *
+ * BREAKING in the package's sense because closed tables grew: `ROUTES`,
+ * `ContractOperation`, `CaysoApiErrorCode`, `MovementKind` and the settlement's refusal
+ * unions. Additive on the wire (CAY-0086): no route a `0.29.0` consumer could reach
+ * changed, because the only ones that answer differently are the standing
+ * authorisation and the settlement assertion, which no deployment served before, and
+ * they answer the shapes `0.25.0` published, a member those shapes' unions gained, or a
+ * new seam code no served route emits. The operator movement list can now carry the two
+ * new kinds, and it is read only by the admin app in this tree, released with it. The
+ * two Node routes are ones a `0.29.0` consumer cannot name.
+ *
  * `0.28.0` → `0.29.0` publishes and SERVES the Handle change (CAY-0091):
  * `ROUTES.handleChange`, `POST /api/handle-changes`, mapped to the new operation
  * `'change-handle'`, money-grade in `ASSURANCE_POLICY`; `ROUTES.handleChangeReceipt`,
@@ -568,7 +668,7 @@
  * have needed a breaking bump on their own. Under semver below `1.0.0` the minor
  * is where a breaking change goes, so the minor moves and the patch does not.
  */
-export const CONTRACT_VERSION = '0.29.0';
+export const CONTRACT_VERSION = '1.0.0';
 /** The package's own name, so a consumer can name what it depends on. */
 export const packageName = '@percayso-community/cayso-contracts';
 /**
@@ -592,6 +692,18 @@ export { ROUTES } from './routes.js';
  * no operation, no assurance bar and no client method.
  */
 export { CLOUD_SETTLEMENT_ROUTE } from './routes.js';
+/**
+ * Where the Contribution Store asks whether a Node is bound (CAY-0095). A value beside
+ * `ROUTES` and never in it, for the settlement path's reason: it is authenticated by
+ * the registered Store issuer, not by a person.
+ */
+export { NODE_BINDING_QUERY_ROUTE } from './routes.js';
+/**
+ * Where Cayso publishes its authorisation acknowledgement keys (CAY-0093). A value
+ * beside `ROUTES` and never in it: an unauthenticated read of a public key carries no
+ * identity, so it has no operation, no assurance bar and no client method.
+ */
+export { ACKNOWLEDGEMENT_KEYS_ROUTE } from './routes.js';
 /**
  * The purchase lifecycle's runtime half (CAY-0032): which statuses a purchase
  * never leaves, the predicate over them, and the window an authorisation holds its
@@ -633,6 +745,17 @@ export { NOT_PROVISIONED } from './citizenship.js';
  * exception to keeping numbers in the canon PRD; no economic figure is here.
  */
 export { MAX_ASSERTION_LIFETIME_SECONDS, CLOCK_SKEW_TOLERANCE_SECONDS, MINIMUM_ASSERTION_USE_RETENTION_SECONDS, } from './assertion.js';
+/**
+ * The request header BizID's authority assertion travels in, beside the identity
+ * assertion's `Authorization` (CAY-0100 §4). A value so a consumer and the service
+ * spell it from one place; the reasoning behind the name is on the constant.
+ */
+export { AUTHORITY_ASSERTION_HEADER } from './authority.js';
+/**
+ * Whether a value is a well-formed `AuthorityClaims.mandateVersion`: a JSON integer of at
+ * least 1, BizID's mandate version counter (CAY-0100 §5). The one check of the shape.
+ */
+export { isMandateVersion } from './authority.js';
 /**
  * The assurance profile (CAY-0029): what each `VerificationMethod` asserts, which
  * methods each operation accepts, and the version a claim is minted under.