@pithy-sh/core 0.13.0 → 0.14.0

package/dist/error/payload.js

@@ -107,6 +107,11 @@ const AuthAccountDeletedPublic = z.object({
 	status: z.literal(403).describe("Forbidden — the account exists and may not act. Not 404, because until the purge runs it can come back, and not 401, because signing in again cannot help."),
 	...publicFields
 }).describe("The account is deleted and awaiting its purge (403).");
+const AuthHandoffInvalidPublic = z.object({
+	code: z.literal("auth/handoff_invalid").describe("The one-time code a native app trades for its session after a redirect sign-in is spent, expired, was never issued, or came with the wrong verifier. One code for all four, so the answer says nothing about which codes exist or why a trade failed. The remedy is the same for each: sign in again."),
+	status: z.literal(400).describe("Bad Request — the code presented cannot be traded. Not 401: no credential was presented to refuse."),
+	...publicFields
+}).describe("A sign-in handoff code that is spent, expired, unknown or presented with the wrong verifier (400).");
 const NotFoundPublic = z.object({
 	code: z.literal("core/not_found").describe("The requested resource does not exist."),
 	status: z.literal(404).describe("Not Found."),
@@ -162,6 +167,16 @@ const WebhookUnverifiedPublic = z.object({
 	status: z.literal(401).describe("Unauthorized — the delivery did not prove its origin."),
 	...publicFields
 }).describe("An inbound webhook failed its signature check (401).");
+const PresenceTicketInvalidPublic = z.object({
+	code: z.literal("core/presence_ticket_invalid").describe("A presence socket was opened without a ticket this Worker accepts. Deliberately one code for every failing step — no ticket, a bad signature, an expired one, one already spent, or one minted for another room — so a caller holding a stolen ticket learns nothing about which check it tripped. `detail` names the step for the log, and the codec strips it."),
+	status: z.literal(401).describe("Unauthorized — mint a fresh ticket and open the socket with it."),
+	...publicFields
+}).describe("A presence socket upgrade carried no valid ticket (401).");
+const PresenceRoomFullPublic = z.object({
+	code: z.literal("core/presence_room_full").describe("A presence room already holds as many participants as its room kind allows."),
+	status: z.literal(409).describe("Conflict — the room is at its participant cap. Try again when someone leaves."),
+	...publicFields
+}).describe("A presence room is at its participant cap (409).");
 const CloudflareNotConfiguredPublic = z.object({
 	code: z.literal("cloudflare/not_configured").describe("The CF REST client is missing required configuration (token, account, or a resource id)."),
 	status: z.literal(500).describe("Internal Server Error — a configuration fault, not a client request."),
@@ -397,6 +412,21 @@ const LedgerInvalidAmountPublic = z.object({
 	status: z.literal(400).describe("Bad Request — the amount is not a positive integer."),
 	...publicFields
 }).describe("An amount is not a positive integer (400).");
+const LedgerEntryNotFoundPublic = z.object({
+	code: z.literal("ledger/entry_not_found").describe("No ledger entry with that reference exists on the account named. An entry on another account is answered the same way, so a reversal can never reach past the account its path names."),
+	status: z.literal(404).describe("Not Found."),
+	...publicFields
+}).describe("A referenced ledger entry does not exist on that account (404).");
+const LedgerEntryNotReversiblePublic = z.object({
+	code: z.literal("ledger/entry_not_reversible").describe("Only a credit or a debit reverses, and never one that is itself a reversal. A hold has release; a capture spends escrow and a transfer touches a second account, so both are refused. `params.kind` names the entry's kind, and `params.reverses` the entry a reversal reversed. Nothing was written."),
+	status: z.literal(409).describe("Conflict — the entry's kind does not reverse."),
+	...publicFields
+}).describe("A ledger entry of a kind that does not reverse (409).");
+const LedgerRefConflictPublic = z.object({
+	code: z.literal("ledger/ref_conflict").describe("The ref a control-plane write would be written under is already held by a different entry, so the write cannot be recorded and is not a replay either: a credit's or a debit's key already used for another account, the other act, another amount or a hold, or the derived ref of a reversal or a hold's resolution held by an unrelated entry. Nothing moved; the entry stays unreversed, or the hold stays open."),
+	status: z.literal(409).describe("Conflict — the ref belongs to another entry."),
+	...publicFields
+}).describe("A write whose ref another entry already holds (409).");
 const RatingUnknownAlgorithmPublic = z.object({
 	code: z.literal("rating/unknown_algorithm").describe("A game wires a rating algorithm id that no one registered. Algorithm ids come from the built-ins (`elo`/`glicko`/`trueskill`) or `registerRatingAlgorithm`, not the database."),
 	status: z.literal(400).describe("Bad Request — the adopter's config names an unregistered algorithm."),
@@ -427,6 +457,46 @@ const RatingRecordForbiddenPublic = z.object({
 	status: z.literal(403).describe("Forbidden — the caller may not record outcomes."),
 	...publicFields
 }).describe("The caller lacks the scope to record a rated outcome (403).");
+const ConsentUnknownPurposePublic = z.object({
+	code: z.literal("consent/unknown_purpose").describe("No consent purpose with that id is declared by a composed capability or in `consent({ purposes })`."),
+	status: z.literal(404).describe("Not Found."),
+	...publicFields
+}).describe("A consent purpose that is not declared (404).");
+const ConsentStaleNoticePublic = z.object({
+	code: z.literal("consent/stale_notice").describe("The grant names a notice version that is not the purpose's current one. A person agrees to the notice in force, so the screen showing an older one has to be reloaded."),
+	status: z.literal(409).describe("Conflict — the notice has moved on."),
+	...publicFields
+}).describe("A grant against a notice version that is not current (409).");
+const ConsentMethodBelowMinimumPublic = z.object({
+	code: z.literal("consent/method_below_minimum").describe("The grant was given by a method below the purpose's minimum — a click where the purpose needs a typed name, a drawn signature or a provider's envelope."),
+	status: z.literal(400).describe("Bad Request — the method is below the purpose's minimum."),
+	...publicFields
+}).describe("A grant below the purpose's minimum method (400).");
+const ConsentWithdrawalBelowGrantPublic = z.object({
+	code: z.literal("consent/withdrawal_below_grant").describe("The purpose requires a withdrawal at least at the grade of the grant it withdraws, as a HIPAA revocation must be in writing, and this one is below it."),
+	status: z.literal(400).describe("Bad Request — the withdrawal is below the grant's method."),
+	...publicFields
+}).describe("A withdrawal below the grade its purpose requires (400).");
+const ConsentEvidenceMissingPublic = z.object({
+	code: z.literal("consent/evidence_missing").describe("The method names evidence the request did not carry: a typed name for `typed`, a drawn image for `drawn`, a provider and envelope for `provider`, or the document a signed grant is given against."),
+	status: z.literal(400).describe("Bad Request — the evidence for the method is missing."),
+	...publicFields
+}).describe("A grant or withdrawal missing the evidence its method needs (400).");
+const ConsentExpiryPassedPublic = z.object({
+	code: z.literal("consent/expiry_passed").describe("The grant's expiry is not in the future, so it would answer no from the moment it was recorded."),
+	status: z.literal(400).describe("Bad Request — the expiry has already passed."),
+	...publicFields
+}).describe("A grant whose expiry has already passed (400).");
+const ConsentDocumentNotFoundPublic = z.object({
+	code: z.literal("consent/document_not_found").describe("No signed document with that content hash is kept."),
+	status: z.literal(404).describe("Not Found."),
+	...publicFields
+}).describe("A signed document that is not kept (404).");
+const ConsentEvidenceStoreMissingPublic = z.object({
+	code: z.literal("consent/evidence_store_missing").describe("A drawn signature or a provider's certificate is stored in R2, and the Worker has no `CONSENT_EVIDENCE` bucket bound. A binding we never got, so the answer is in this Worker's wiring."),
+	status: z.literal(500).describe("Internal Server Error — the evidence bucket is not bound."),
+	...publicFields
+}).describe("The evidence bucket is not bound (500).");
 const MatchmakingRoomNotFoundPublic = z.object({
 	code: z.literal("matchmaking/room_not_found").describe("No open room has that code — it never existed, expired, or was already used up."),
 	status: z.literal(404).describe("Not Found."),
@@ -829,6 +899,7 @@ const KitPublicErrorPayload = z.discriminatedUnion("code", [
 	AuthSessionNotFreshPublic,
 	AuthAccountSuspendedPublic,
 	AuthAccountDeletedPublic,
+	AuthHandoffInvalidPublic,
 	NotFoundPublic,
 	ConflictPublic,
 	RateLimitPublic,
@@ -840,6 +911,8 @@ const KitPublicErrorPayload = z.discriminatedUnion("code", [
 	UnknownWorkflowPublic,
 	WorkflowFailedPublic,
 	WebhookUnverifiedPublic,
+	PresenceTicketInvalidPublic,
+	PresenceRoomFullPublic,
 	CloudflareNotConfiguredPublic,
 	CloudflareRequestFailedPublic,
 	CloudflareInvalidResponsePublic,
@@ -887,12 +960,23 @@ const KitPublicErrorPayload = z.discriminatedUnion("code", [
 	LedgerInsufficientFundsPublic,
 	LedgerHoldNotOpenPublic,
 	LedgerInvalidAmountPublic,
+	LedgerEntryNotFoundPublic,
+	LedgerEntryNotReversiblePublic,
+	LedgerRefConflictPublic,
 	RatingUnknownAlgorithmPublic,
 	RatingUnsupportedPlayerCountPublic,
 	RatingInvalidParamsPublic,
 	RatingGameNotFoundPublic,
 	RatingPoolNotFoundPublic,
 	RatingRecordForbiddenPublic,
+	ConsentUnknownPurposePublic,
+	ConsentStaleNoticePublic,
+	ConsentMethodBelowMinimumPublic,
+	ConsentWithdrawalBelowGrantPublic,
+	ConsentEvidenceMissingPublic,
+	ConsentExpiryPassedPublic,
+	ConsentDocumentNotFoundPublic,
+	ConsentEvidenceStoreMissingPublic,
 	MatchmakingRoomNotFoundPublic,
 	MatchmakingRoomFullPublic,
 	MatchmakingInvalidCodePublic,
@@ -981,6 +1065,7 @@ const AuthProviderUnavailable = AuthProviderUnavailablePublic.extend(internalFie
 const AuthSessionNotFresh = AuthSessionNotFreshPublic.extend(internalFields).describe(AuthSessionNotFreshPublic.description ?? "");
 const AuthAccountSuspended = AuthAccountSuspendedPublic.extend(internalFields).describe(AuthAccountSuspendedPublic.description ?? "");
 const AuthAccountDeleted = AuthAccountDeletedPublic.extend(internalFields).describe(AuthAccountDeletedPublic.description ?? "");
+const AuthHandoffInvalid = AuthHandoffInvalidPublic.extend(internalFields).describe(AuthHandoffInvalidPublic.description ?? "");
 const NotFound = NotFoundPublic.extend(internalFields).describe(NotFoundPublic.description ?? "");
 const Conflict = ConflictPublic.extend(internalFields).describe(ConflictPublic.description ?? "");
 const RateLimit = RateLimitPublic.extend(internalFields).describe(RateLimitPublic.description ?? "");
@@ -992,6 +1077,8 @@ const MissingWorkflowBinding = MissingWorkflowBindingPublic.extend(internalField
 const UnknownWorkflow = UnknownWorkflowPublic.extend(internalFields).describe(UnknownWorkflowPublic.description ?? "");
 const WorkflowFailed = WorkflowFailedPublic.extend(internalFields).describe(WorkflowFailedPublic.description ?? "");
 const WebhookUnverified = WebhookUnverifiedPublic.extend(internalFields).describe(WebhookUnverifiedPublic.description ?? "");
+const PresenceTicketInvalid = PresenceTicketInvalidPublic.extend(internalFields).describe(PresenceTicketInvalidPublic.description ?? "");
+const PresenceRoomFull = PresenceRoomFullPublic.extend(internalFields).describe(PresenceRoomFullPublic.description ?? "");
 const CloudflareNotConfigured = CloudflareNotConfiguredPublic.extend(internalFields).describe(CloudflareNotConfiguredPublic.description ?? "");
 const CloudflareRequestFailed = CloudflareRequestFailedPublic.extend(internalFields).describe(CloudflareRequestFailedPublic.description ?? "");
 const CloudflareInvalidResponse = CloudflareInvalidResponsePublic.extend(internalFields).describe(CloudflareInvalidResponsePublic.description ?? "");
@@ -1039,12 +1126,23 @@ const LedgerHoldNotFound = LedgerHoldNotFoundPublic.extend(internalFields).descr
 const LedgerInsufficientFunds = LedgerInsufficientFundsPublic.extend(internalFields).describe(LedgerInsufficientFundsPublic.description ?? "");
 const LedgerHoldNotOpen = LedgerHoldNotOpenPublic.extend(internalFields).describe(LedgerHoldNotOpenPublic.description ?? "");
 const LedgerInvalidAmount = LedgerInvalidAmountPublic.extend(internalFields).describe(LedgerInvalidAmountPublic.description ?? "");
+const LedgerEntryNotFound = LedgerEntryNotFoundPublic.extend(internalFields).describe(LedgerEntryNotFoundPublic.description ?? "");
+const LedgerEntryNotReversible = LedgerEntryNotReversiblePublic.extend(internalFields).describe(LedgerEntryNotReversiblePublic.description ?? "");
+const LedgerRefConflict = LedgerRefConflictPublic.extend(internalFields).describe(LedgerRefConflictPublic.description ?? "");
 const RatingUnknownAlgorithm = RatingUnknownAlgorithmPublic.extend(internalFields).describe(RatingUnknownAlgorithmPublic.description ?? "");
 const RatingUnsupportedPlayerCount = RatingUnsupportedPlayerCountPublic.extend(internalFields).describe(RatingUnsupportedPlayerCountPublic.description ?? "");
 const RatingInvalidParams = RatingInvalidParamsPublic.extend(internalFields).describe(RatingInvalidParamsPublic.description ?? "");
 const RatingGameNotFound = RatingGameNotFoundPublic.extend(internalFields).describe(RatingGameNotFoundPublic.description ?? "");
 const RatingPoolNotFound = RatingPoolNotFoundPublic.extend(internalFields).describe(RatingPoolNotFoundPublic.description ?? "");
 const RatingRecordForbidden = RatingRecordForbiddenPublic.extend(internalFields).describe(RatingRecordForbiddenPublic.description ?? "");
+const ConsentUnknownPurpose = ConsentUnknownPurposePublic.extend(internalFields).describe(ConsentUnknownPurposePublic.description ?? "");
+const ConsentStaleNotice = ConsentStaleNoticePublic.extend(internalFields).describe(ConsentStaleNoticePublic.description ?? "");
+const ConsentMethodBelowMinimum = ConsentMethodBelowMinimumPublic.extend(internalFields).describe(ConsentMethodBelowMinimumPublic.description ?? "");
+const ConsentWithdrawalBelowGrant = ConsentWithdrawalBelowGrantPublic.extend(internalFields).describe(ConsentWithdrawalBelowGrantPublic.description ?? "");
+const ConsentEvidenceMissing = ConsentEvidenceMissingPublic.extend(internalFields).describe(ConsentEvidenceMissingPublic.description ?? "");
+const ConsentExpiryPassed = ConsentExpiryPassedPublic.extend(internalFields).describe(ConsentExpiryPassedPublic.description ?? "");
+const ConsentDocumentNotFound = ConsentDocumentNotFoundPublic.extend(internalFields).describe(ConsentDocumentNotFoundPublic.description ?? "");
+const ConsentEvidenceStoreMissing = ConsentEvidenceStoreMissingPublic.extend(internalFields).describe(ConsentEvidenceStoreMissingPublic.description ?? "");
 const MatchmakingRoomNotFound = MatchmakingRoomNotFoundPublic.extend(internalFields).describe(MatchmakingRoomNotFoundPublic.description ?? "");
 const MatchmakingRoomFull = MatchmakingRoomFullPublic.extend(internalFields).describe(MatchmakingRoomFullPublic.description ?? "");
 const MatchmakingInvalidCode = MatchmakingInvalidCodePublic.extend(internalFields).describe(MatchmakingInvalidCodePublic.description ?? "");
@@ -1138,6 +1236,7 @@ const KitErrorPayload = z.discriminatedUnion("code", [
 	AuthSessionNotFresh,
 	AuthAccountSuspended,
 	AuthAccountDeleted,
+	AuthHandoffInvalid,
 	NotFound,
 	Conflict,
 	RateLimit,
@@ -1149,6 +1248,8 @@ const KitErrorPayload = z.discriminatedUnion("code", [
 	UnknownWorkflow,
 	WorkflowFailed,
 	WebhookUnverified,
+	PresenceTicketInvalid,
+	PresenceRoomFull,
 	CloudflareNotConfigured,
 	CloudflareRequestFailed,
 	CloudflareInvalidResponse,
@@ -1196,12 +1297,23 @@ const KitErrorPayload = z.discriminatedUnion("code", [
 	LedgerInsufficientFunds,
 	LedgerHoldNotOpen,
 	LedgerInvalidAmount,
+	LedgerEntryNotFound,
+	LedgerEntryNotReversible,
+	LedgerRefConflict,
 	RatingUnknownAlgorithm,
 	RatingUnsupportedPlayerCount,
 	RatingInvalidParams,
 	RatingGameNotFound,
 	RatingPoolNotFound,
 	RatingRecordForbidden,
+	ConsentUnknownPurpose,
+	ConsentStaleNotice,
+	ConsentMethodBelowMinimum,
+	ConsentWithdrawalBelowGrant,
+	ConsentEvidenceMissing,
+	ConsentExpiryPassed,
+	ConsentDocumentNotFound,
+	ConsentEvidenceStoreMissing,
 	MatchmakingRoomNotFound,
 	MatchmakingRoomFull,
 	MatchmakingInvalidCode,

package/dist/error/pithyError.d.ts

@@ -120,6 +120,28 @@ export declare class WebhookUnverifiedError extends PithyError {
         cause?: unknown;
     });
 }
+/**
+ * One code for every way a presence socket's ticket fails — missing, forged, expired, spent, or minted for
+ * another room. The step goes in `detail`, which the codec strips: a caller holding somebody else's ticket
+ * learns only that it no longer works.
+ */
+export declare class PresenceTicketInvalidError extends PithyError {
+    readonly payload: Extract<ErrorPayload, {
+        code: "core/presence_ticket_invalid";
+    }>;
+    constructor(args?: ErrorArgs, options?: {
+        cause?: unknown;
+    });
+}
+/** A presence room is at the participant cap its room kind declares. */
+export declare class PresenceRoomFullError extends PithyError {
+    readonly payload: Extract<ErrorPayload, {
+        code: "core/presence_room_full";
+    }>;
+    constructor(args?: ErrorArgs, options?: {
+        cause?: unknown;
+    });
+}
 export declare class ForbiddenError extends PithyError {
     readonly payload: Extract<ErrorPayload, {
         code: "auth/forbidden";

package/dist/error/pithyError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pithyError.d.ts","sourceRoot":"","sources":["../../src/error/pithyError.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;GAQG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAE/B;;;;;OAKG;IACH,YACE,OAAO,EAAE,YAAY,GAAG;QACtB,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;QACpC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;KACrC,EACD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAM9B;CACF;AAED,4FAA4F;AAC5F,UAAU,SAAS;IACjB,iHAAiH;IACjH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,+GAA+G;IAC/G,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;KAAO,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAa/F;CACF;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YACE,IAAI,GAAE,SAAS,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,EAC5E,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAe9B;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAC;IAEhF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;IACpD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC;IAErF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IAEjF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,sGAAsG;AACtG,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAEnF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,GAAE,SAAc,GAAG,eAAe,CAarF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGjD"}
+{"version":3,"file":"pithyError.d.ts","sourceRoot":"","sources":["../../src/error/pithyError.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;GAQG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAE/B;;;;;OAKG;IACH,YACE,OAAO,EAAE,YAAY,GAAG;QACtB,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;QACpC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;KACrC,EACD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAM9B;CACF;AAED,4FAA4F;AAC5F,UAAU,SAAS;IACjB,iHAAiH;IACjH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,+GAA+G;IAC/G,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;KAAO,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAa/F;CACF;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YACE,IAAI,GAAE,SAAS,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,EAC5E,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAe9B;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAC;IAEhF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;IACpD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC;IAErF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,8BAA8B,CAAA;KAAE,CAAC,CAAC;IAE1F,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,wEAAwE;AACxE,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC;IAErF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IAEjF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,sGAAsG;AACtG,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAEnF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,GAAE,SAAc,GAAG,eAAe,CAarF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGjD"}

package/dist/error/pithyError.js

@@ -123,6 +123,36 @@ var WebhookUnverifiedError = class extends PithyError {
 		}, options);
 	}
 };
+/**
+* One code for every way a presence socket's ticket fails — missing, forged, expired, spent, or minted for
+* another room. The step goes in `detail`, which the codec strips: a caller holding somebody else's ticket
+* learns only that it no longer works.
+*/
+var PresenceTicketInvalidError = class extends PithyError {
+	constructor(args = {}, options) {
+		super({
+			code: "core/presence_ticket_invalid",
+			status: 401,
+			message: args.message ?? "That presence ticket is not valid.",
+			action: args.action ?? "Mint a fresh ticket and open the socket within 60 seconds.",
+			detail: args.detail,
+			params: args.params
+		}, options);
+	}
+};
+/** A presence room is at the participant cap its room kind declares. */
+var PresenceRoomFullError = class extends PithyError {
+	constructor(args = {}, options) {
+		super({
+			code: "core/presence_room_full",
+			status: 409,
+			message: args.message ?? "That room is full.",
+			action: args.action,
+			detail: args.detail,
+			params: args.params
+		}, options);
+	}
+};
 var ForbiddenError = class extends PithyError {
 	constructor(args = {}, options) {
 		super({
@@ -257,4 +287,4 @@ function sentenceOf(error) {
 	return action ? `${messageOf(error)} ${action}` : messageOf(error);
 }
 //#endregion
-export { ConflictError, ForbiddenError, InputRequiredError, InternalError, NotFoundError, PersonRequiredError, PithyError, PreconditionFailedError, RateLimitError, UnauthorizedError, UpstreamError, UpstreamTimeoutError, ValidationError, WebhookUnverifiedError, fromZodError, messageOf, sentenceOf };
+export { ConflictError, ForbiddenError, InputRequiredError, InternalError, NotFoundError, PersonRequiredError, PithyError, PreconditionFailedError, PresenceRoomFullError, PresenceTicketInvalidError, RateLimitError, UnauthorizedError, UpstreamError, UpstreamTimeoutError, ValidationError, WebhookUnverifiedError, fromZodError, messageOf, sentenceOf };

package/dist/http/routeSpec.d.ts

@@ -37,6 +37,24 @@ export interface RouteResponse {
 }
 /** The HTTP methods an `app.all` route is documented under. OpenAPI has no "any method". */
 export type DocumentedMethod = "get" | "post" | "put" | "patch" | "delete" | "head" | "options";
+/**
+ * What a tool does beyond reading, which every non-`GET` tool must say (`docs/AGENT-ACCESS.md` §4).
+ *
+ * **A route is a tool only when it says so, and a non-`GET` says so louder.** One that sends mail, charges a card or
+ * deletes something is a tool an agent can call in a loop, so the effect is not inferred from the method: it is
+ * declared, it sets the tool's MCP annotations, it is written into the tool's description, and it is counted on the
+ * consent screen beside its capability.
+ */
+export declare const TOOL_EFFECTS: readonly ["writes", "sends", "charges", "deletes"];
+export type ToolEffect = (typeof TOOL_EFFECTS)[number];
+/**
+ * A route's opt-in to the app's MCP endpoint. `true` is a read, and only a `GET` may say it; anything else declares
+ * its {@link ToolEffect}. `createBackend` refuses a composition where either half is wrong — `describeRoute` cannot
+ * see the method it is mounted under, so the composition is the first place the pair can be checked.
+ */
+export type RouteTool = true | {
+    readonly effect: ToolEffect;
+};
 /** What a route is for, how its caller is verified, and what it returns. */
 export interface RouteSpec {
     /** One sentence, in the brand voice. The operation's title in the contract. */
@@ -58,8 +76,35 @@ export interface RouteSpec {
     readonly responses: Readonly<Record<number, z.ZodType | RouteResponse>>;
     /** For an `app.all` route only: the methods it is documented under. */
     readonly methods?: readonly DocumentedMethod[];
+    /**
+     * The power a caller's role must hold to reach this route at all. **Declaring it installs the gate**: the
+     * same middleware that carries this spec refuses a caller whose acting organization's role does not hold it, so
+     * what the MCP endpoint filters `tools/list` on and what the route enforces are one value and cannot drift.
+     *
+     * A route whose access depends on the record — its owner may, a manager may — declares the power that lets a
+     * member reach it at all, and keeps its in-handler check. Absent, the route is gated by its other guards alone,
+     * and a tool for it is offered to every signed-in user the endpoint admits.
+     */
+    readonly power?: string;
+    /**
+     * The route's permanent name within its capability, e.g. `threads.reply`. Its MCP tool is
+     * `<capability>_<operation>`, through the one normalizer the control-plane server's tools use. Unique within a
+     * capability, and never renamed once published: an agent references a tool by name.
+     */
+    readonly operation?: string;
+    /**
+     * The route's opt-in to the app's MCP endpoint. Absent, the route is not a tool. See {@link RouteTool}.
+     */
+    readonly tool?: RouteTool;
 }
-/** Declare what a route is for, how its caller is verified, and what it returns. See {@link RouteSpec}. */
+/**
+ * Declare what a route is for, how its caller is verified, and what it returns. See {@link RouteSpec}.
+ *
+ * With a {@link RouteSpec.power} it is also the route's power gate, read off the acting-organization seam the way
+ * every capability outside tenancy asks it. It sits first on the route line, so it answers an anonymous caller
+ * itself rather than assuming a guard below it will: a 401, because signing in might help, where a role that does
+ * not hold the power is a 403.
+ */
 export declare function describeRoute(spec: RouteSpec): MiddlewareHandler;
 /** The spec a {@link describeRoute} middleware carries, or `undefined` for any other handler. */
 export declare function routeSpecOf(handler: unknown): RouteSpec | undefined;

package/dist/http/routeSpec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routeSpec.d.ts","sourceRoot":"","sources":["../../src/http/routeSpec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8GAA8G;AAC9G,eAAO,MAAM,UAAU,eAAgC,CAAC;AAExD,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,4FAA4F;AAC5F,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhG,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,oBAAoB,GAAG,SAAS,oBAAoB,EAAE,CAAC;IAC9E,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC;IACxE,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAChD;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAKhE;AAED,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAGnE"}
+{"version":3,"file":"routeSpec.d.ts","sourceRoot":"","sources":["../../src/http/routeSpec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8GAA8G;AAC9G,eAAO,MAAM,UAAU,eAAgC,CAAC;AAExD,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,4FAA4F;AAC5F,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAI,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAC/E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,oBAAoB,GAAG,SAAS,oBAAoB,EAAE,CAAC;IAC9E,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC;IACxE,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CA4BhE;AAED,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAGnE"}

package/dist/http/routeSpec.js

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { ForbiddenError, UnauthorizedError } from "../error/pithyError.js";
 //#region src/http/routeSpec.ts
 /**
 * The third half of a route declaration. `validate` says what a caller may send and the guards say who
@@ -24,12 +25,45 @@
 */
 /** The key a {@link describeRoute} middleware carries its spec under. Global, so two copies of core agree. */
 const ROUTE_SPEC = Symbol.for("pithy.routeSpec");
-/** Declare what a route is for, how its caller is verified, and what it returns. See {@link RouteSpec}. */
+/**
+* What a tool does beyond reading, which every non-`GET` tool must say (`docs/AGENT-ACCESS.md` §4).
+*
+* **A route is a tool only when it says so, and a non-`GET` says so louder.** One that sends mail, charges a card or
+* deletes something is a tool an agent can call in a loop, so the effect is not inferred from the method: it is
+* declared, it sets the tool's MCP annotations, it is written into the tool's description, and it is counted on the
+* consent screen beside its capability.
+*/
+const TOOL_EFFECTS = [
+	"writes",
+	"sends",
+	"charges",
+	"deletes"
+];
+/**
+* Declare what a route is for, how its caller is verified, and what it returns. See {@link RouteSpec}.
+*
+* With a {@link RouteSpec.power} it is also the route's power gate, read off the acting-organization seam the way
+* every capability outside tenancy asks it. It sits first on the route line, so it answers an anonymous caller
+* itself rather than assuming a guard below it will: a 401, because signing in might help, where a role that does
+* not hold the power is a 403.
+*/
 function describeRoute(spec) {
-	const middleware = async (_c, next) => {
+	const { power } = spec;
+	return Object.assign(power === void 0 ? async (_c, next) => {
+		await next();
+	} : async (c, next) => {
+		if (!c.var.auth) throw new UnauthorizedError({
+			message: "Authentication required.",
+			action: "Sign in and retry with a valid session or bearer token.",
+			detail: `describeRoute(power: ${power}) ran with no signed-in caller`
+		});
+		const acting = await c.var.actingOrganization();
+		if (acting === null || !acting.roleAllows(power)) throw new ForbiddenError({
+			message: `Your role does not allow \`${power}\`.`,
+			detail: acting === null ? `no organization is in force for user ${c.var.auth.userId}, so ${power} is not held` : `the role in organization ${acting.organizationId} does not hold ${power}`
+		});
 		await next();
-	};
-	return Object.assign(middleware, { [ROUTE_SPEC]: spec });
+	}, { [ROUTE_SPEC]: spec });
 }
 /** The spec a {@link describeRoute} middleware carries, or `undefined` for any other handler. */
 function routeSpecOf(handler) {
@@ -37,4 +71,4 @@ function routeSpecOf(handler) {
 	return handler[ROUTE_SPEC];
 }
 //#endregion
-export { ROUTE_SPEC, describeRoute, routeSpecOf };
+export { ROUTE_SPEC, TOOL_EFFECTS, describeRoute, routeSpecOf };

package/dist/http/verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/http/verification.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,+JAYiE,CAAC;AACnG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/http/verification.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,+JAciE,CAAC;AACnG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/http/verification.js

@@ -9,7 +9,7 @@ import { z } from "zod";
 * strategy, so it is deliberately not listed here.)
 */
 const VerificationStrategy = z.union([
-	z.literal("bearer").describe("Short-lived access token via Authorization: Bearer; validated by @pithy-sh/auth."),
+	z.literal("bearer").describe("A session token via Authorization: Bearer, rotated before it expires; validated by @pithy-sh/auth."),
 	z.literal("session").describe("Cookie-based web session, CSRF-protected; validated by @pithy-sh/auth."),
 	z.literal("signed-webhook").describe("Inbound webhook, authenticated by the sender's own proof over the exact received bytes — one name over several mechanisms (an HMAC, a signed JWS chain, an OIDC token), because the sender chooses it. `requireSignedWebhook` (./signedWebhook) implements the timestamped-HMAC form; a rail whose sender proves it differently implements its own."),
 	z.literal("control-plane").describe("M2M admin via a customer-issued scoped credential; default-denied."),

package/dist/i18n/translator.d.ts

@@ -83,7 +83,8 @@ export interface TranslatorInput {
     readonly formattingLocale?: string;
     /**
      * The catalogs to walk, most-specific first. `@pithy-sh/i18n` passes adopter-locale, adopter-default,
-     * kit-locale, kit-default; a copied screen passes its own baked English and nothing else.
+     * kit-locale, composed-locale, composed-default, composed English; a copied screen passes its own baked
+     * English and nothing else.
      */
     readonly layers: readonly (MessageCatalog | undefined)[];
 }

package/dist/i18n/translator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"translator.d.ts","sourceRoot":"","sources":["../../src/i18n/translator.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC;;;;;OAKG;IACH,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1D;;;;;;;;;;OAUG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACnE,oDAAoD;IACpD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC;IACxE,mEAAmE;IACnE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC;IAC5F,oGAAoG;IACpG,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC;IAC/E,qGAAqG;IACrG,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC;IAChF,gFAAgF;IAChF,kBAAkB,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,IAAI,CAAC,sBAAsB,EACjC,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,GACvC,MAAM,CAAC;CACX;AAED,+GAA+G;AAC/G,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sFAAsF;IACtF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,EAAE,CAAC;CAC1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAgDnE;AAED,sGAAsG;AACtG,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,GAAE,MAAuB,GAAG,UAAU,CAEpG"}
+{"version":3,"file":"translator.d.ts","sourceRoot":"","sources":["../../src/i18n/translator.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC;;;;;OAKG;IACH,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1D;;;;;;;;;;OAUG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACnE,oDAAoD;IACpD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC;IACxE,mEAAmE;IACnE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC;IAC5F,oGAAoG;IACpG,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC;IAC/E,qGAAqG;IACrG,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC;IAChF,gFAAgF;IAChF,kBAAkB,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,IAAI,CAAC,sBAAsB,EACjC,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,GACvC,MAAM,CAAC;CACX;AAED,+GAA+G;AAC/G,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sFAAsF;IACtF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,EAAE,CAAC;CAC1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAgDnE;AAED,sGAAsG;AACtG,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,GAAE,MAAuB,GAAG,UAAU,CAEpG"}

package/dist/index.d.ts

@@ -28,7 +28,7 @@ export { type AdminRouteDrift, missingAdminRoutes } from "./controlPlane/discove
 export { type CapabilityHealth, type CapabilityHealthInput, type CapabilityHealthSource, capabilityHealthSources, defineCapabilityHealth, readCapabilityHealth, } from "./controlPlane/discovery/health";
 export { CapabilityHealthReport, type CapabilityHealthWire, HealthCountNominal, HealthNominal, type HealthStanding, HealthSummary, HealthSummaryKey, HealthSummaryValue, HealthValueCost, HealthValueKind, healthAttention, healthReport, healthWire, type NamedHealthValue, namedHealthValues, standingOf, } from "./controlPlane/discovery/healthSummary";
 export { requireControlPlane } from "./controlPlane/http/guard";
-export { ANY_VERIFIED_CALLER, type ControlPlaneRequirement, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES, } from "./controlPlane/scope/scope";
+export { ANY_VERIFIED_CALLER, type ControlPlaneRequirement, ControlPlaneScope, ERASURE_READ_SCOPE, EVIDENCE_READ_SCOPE, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES, } from "./controlPlane/scope/scope";
 export { exportPublicJwk, type MintControlPlaneToken, mintControlPlaneToken } from "./controlPlane/token/mint";
 export { CONTROL_PLANE_HEADER, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, type WorkerBuild, workerBuildChanged, } from "./controlPlane/wire";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACtG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,YAAY,EACZ,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,EACL,+BAA+B,EAC/B,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,KAAK,eAAe,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAQ1F,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,aAAa,EACb,KAAK,cAAc,EACnB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,UAAU,GACX,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAI/G,OAAO,EACL,oBAAoB,EACpB,oCAAoC,EACpC,4BAA4B,EAC5B,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACtG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,YAAY,EACZ,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,EACL,+BAA+B,EAC/B,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,KAAK,eAAe,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAQ1F,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,aAAa,EACb,KAAK,cAAc,EACnB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,UAAU,GACX,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAI/G,OAAO,EACL,oBAAoB,EACpB,oCAAoC,EACpC,4BAA4B,EAC5B,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,9 +1,9 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES } from "./controlPlane/scope/scope.js";
-import { ControlPlaneConfig } from "./controlPlane/config/config.js";
+import { ANY_VERIFIED_CALLER, ControlPlaneScope, ERASURE_READ_SCOPE, EVIDENCE_READ_SCOPE, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES } from "./controlPlane/scope/scope.js";
 import { ControlPlaneConnection, Ed25519PublicJwk, RegisteredKey } from "./controlPlane/data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE, controlPlaneDatabase } from "./controlPlane/data/tables.js";
+import { ControlPlaneConfig } from "./controlPlane/config/config.js";
 import { CapabilityHealthReport, HealthCountNominal, HealthNominal, HealthSummary, HealthSummaryKey, HealthSummaryValue, HealthValueCost, HealthValueKind, healthAttention, healthReport, healthWire, namedHealthValues, standingOf } from "./controlPlane/discovery/healthSummary.js";
 import { capabilityHealthSources, defineCapabilityHealth, readCapabilityHealth } from "./controlPlane/discovery/health.js";
 import { ControlPlaneAuditActions } from "./controlPlane/audit/actions.js";
@@ -16,4 +16,4 @@ import { CONTROL_PLANE_KV_BINDING } from "./controlPlane/replay/kvGuard.js";
 import { CONTROLPLANE_MIGRATION_ORDER, controlplane, isControlPlaneCapability } from "./controlPlane/capability.js";
 import { missingAdminRoutes } from "./controlPlane/discovery/drift.js";
 import { exportPublicJwk, mintControlPlaneToken } from "./controlPlane/token/mint.js";
-export { ANY_VERIFIED_CALLER, AdminRoute, CONTROLPLANE_MIGRATION_ORDER, CONTROL_PLANE_CONNECTIONS_TABLE, CONTROL_PLANE_HEADER, CONTROL_PLANE_KV_BINDING, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, CapabilityDeclaration, CapabilityDescriptor, CapabilityHealthReport, ControlPlaneAuditActions, ControlPlaneConfig, ControlPlaneConnection, ControlPlaneContext, ControlPlaneManifest, ControlPlaneScope, Ed25519PublicJwk, HealthCountNominal, HealthNominal, HealthSummary, HealthSummaryKey, HealthSummaryValue, HealthValueCost, HealthValueKind, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, ManifestConfigKey, ManifestConfigValue, ManifestConfigValues, PRIVACY_READ_SCOPE, RegisteredKey, SEAM_SCOPES, capabilityHealthSources, controlPlaneDatabase, controlplane, defineCapabilityHealth, defineManifestConfig, exportPublicJwk, healthAttention, healthReport, healthWire, isControlPlaneCapability, mintControlPlaneToken, missingAdminRoutes, namedConfigValues, namedHealthValues, readCapabilityHealth, requireControlPlane, standingOf, workerBuildChanged };
+export { ANY_VERIFIED_CALLER, AdminRoute, CONTROLPLANE_MIGRATION_ORDER, CONTROL_PLANE_CONNECTIONS_TABLE, CONTROL_PLANE_HEADER, CONTROL_PLANE_KV_BINDING, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, CapabilityDeclaration, CapabilityDescriptor, CapabilityHealthReport, ControlPlaneAuditActions, ControlPlaneConfig, ControlPlaneConnection, ControlPlaneContext, ControlPlaneManifest, ControlPlaneScope, ERASURE_READ_SCOPE, EVIDENCE_READ_SCOPE, Ed25519PublicJwk, HealthCountNominal, HealthNominal, HealthSummary, HealthSummaryKey, HealthSummaryValue, HealthValueCost, HealthValueKind, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, ManifestConfigKey, ManifestConfigValue, ManifestConfigValues, PRIVACY_READ_SCOPE, RegisteredKey, SEAM_SCOPES, capabilityHealthSources, controlPlaneDatabase, controlplane, defineCapabilityHealth, defineManifestConfig, exportPublicJwk, healthAttention, healthReport, healthWire, isControlPlaneCapability, mintControlPlaneToken, missingAdminRoutes, namedConfigValues, namedHealthValues, readCapabilityHealth, requireControlPlane, standingOf, workerBuildChanged };