@substrat-run/cli 0.49.7 → 0.51.0

package/dist/published-concept.js

@@ -0,0 +1,28 @@
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { CONCEPT_BYTES_MAX, publishedConcept } from '@substrat-run/contracts';
+/** Publish only an explicitly named file. A design document's mere existence grants no access. */
+export function readPublishedConcept(dir) {
+    const packageFile = resolve(dir, 'package.json');
+    if (!existsSync(packageFile))
+        return undefined;
+    const pkg = JSON.parse(readFileSync(packageFile, 'utf8'));
+    const path = pkg.substrat?.concept;
+    if (path === undefined)
+        return undefined;
+    if (typeof path !== 'string' || !path.trim() || isAbsolute(path)) {
+        throw new Error('substrat.concept must name a file relative to the application directory');
+    }
+    const root = realpathSync(dir);
+    const file = realpathSync(resolve(root, path));
+    const rel = relative(root, file);
+    if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new Error('substrat.concept must stay inside the application directory, including symlinks');
+    }
+    const stat = statSync(file);
+    if (!stat.isFile() || stat.size > CONCEPT_BYTES_MAX) {
+        throw new Error(`substrat.concept must be a file of at most ${CONCEPT_BYTES_MAX} UTF-8 bytes`);
+    }
+    return publishedConcept.parse(readFileSync(file, 'utf8'));
+}
+//# sourceMappingURL=published-concept.js.map

package/dist/published-concept.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"published-concept.js","sourceRoot":"","sources":["../src/published-concept.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE9E,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAyC,CAAC;IAClG,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,iBAAiB,cAAc,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/push.d.ts

@@ -1,4 +1,4 @@
-import { type DeclaredMigration, type AssetEntry, type AssetsNeed, type DeclaredBinding, type DeclaredOperationOutput, type IngressModel, type EnvVarSpec, type PermissionRegistry, type PermissionsInput, type RuntimeNeeds, type VersionOrigin, type DeployManifest } from '@substrat-run/contracts';
+import { type DeclaredMigration, type AssetEntry, type AssetsNeed, type DeclaredBinding, type DeclaredOperationOutput, type IngressModel, type EnvVarSpec, type PermissionRegistry, type PermissionsInput, type RuntimeNeeds, type VersionOrigin, type DeployManifest, type VerticalConnectorDeclaration } from '@substrat-run/contracts';
 import { type DataLossCheck, type ReplayInputs } from './data-loss-check.js';
 import { type ScheduleRef } from './schedule-sweeper.js';
 /**
@@ -130,6 +130,9 @@ export interface DeclaredSurface {
     readonly declaresAttachments: boolean;
     /** What the data-loss check replays (#2321) — see `checkMigrationDataLoss`. */
     readonly replay: ReplayInputs;
+    /** The `substrat.connectors` entry's declarations (vertical-connectors.md §5.1), validated —
+     *  undefined when the vertical declares none, so the manifest field stays absent. */
+    readonly connectors: VerticalConnectorDeclaration[] | undefined;
 }
 export declare function deriveDeclaredSurface(dir: string): Promise<DeclaredSurface>;
 /** The declared permission surface alone — `deriveDeclaredSurface` for the callers that
@@ -553,6 +556,40 @@ export declare function assertAttachmentBindingFree(bindings: readonly {
  * inside one, where `dir` is '.' and joining twice is a no-op.
  */
 export declare function generatedConfigPath(dir: string): string;
+/**
+ * The vertical's own wrangler: the script its `bin` names, and the version that script is.
+ *
+ * Resolved the way Node resolves an import from the vertical (its `node_modules`, then each
+ * parent's, so a workspace that hoists wrangler to its root still finds it), and run as
+ * `node <bin>`. Not through `npx`, for two reasons:
+ *
+ *   - On Windows `npx` is `npx.cmd`. Node will not spawn a batch file without a shell
+ *     (CVE-2024-27980), and through a shell every argument is parsed twice — by cmd.exe and
+ *     again by the batch file's `%*` — so a build path holding a space, `&`, `%` or `^` cannot
+ *     be passed safely. `push` failed there with `spawnSync npx ENOENT` before it built anything.
+ *   - `npx` downloads the newest wrangler when the project has none, without asking when stdin
+ *     is not a TTY. The bundle a deploy ships then depends on the day it was built. The
+ *     project's pinned wrangler is the only one this runs; a project without one is told so.
+ *
+ * Every node_modules directory is checked for `wrangler/package.json` on disk rather than
+ * through `require.resolve('wrangler/package.json')`, so the lookup never depends on which
+ * subpaths a given wrangler release lists in its `exports`.
+ */
+export declare function resolveWrangler(dir: string): {
+    bin: string;
+    version: string;
+};
+/**
+ * The environment wrangler builds in: this process's, with the project's `node_modules/.bin`
+ * directories (its own, then each parent's, nearest first) and Node's own directory put in
+ * front of PATH.
+ *
+ * That is what `npx` used to give it, and the project's build command depends on it. Wrangler
+ * runs `build.command` (`runtimeNeeds.build`) through a shell on the PATH it was handed, so a
+ * build of `vite build` or `tsc` finds the project's own `vite` or `tsc` only when its `.bin`
+ * is there. A CLI installed globally, or started from a repository root, has no such entry.
+ */
+export declare function wranglerEnv(dir: string, env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export interface PreparedWorkerBundle {
     root: string;
     cfg: Record<string, unknown>;

package/dist/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../src/push.ts"],"names":[],"mappings":"AAOA,OAAO,EAsBL,KAAK,iBAAiB,EAMtB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EAIpB,MAAM,yBAAyB,CAAC;AAUjC,OAAO,EAA0B,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKrG,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAqC/B;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,gBAAgB,GAC5B,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAKzC;AAKD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,gBAAgB,GAC5B;IAAE,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CA2B/E;AAED;wFACwF;AACxF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,gBAAgB,GAC5B,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAKzC;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC;AAEpI;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,gBAAgB,EAC7B,gBAAgB,CAAC,EAAE,kBAAkB,GACpC;IACD,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,iBAAiB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;KAAE,EAAE,CAAC;CAChH,CA4DA;AAaD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,GACrD,OAAO,CAAC,MAAM,CAAC,CAMjB;AAWD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAmB,GAAG,cAAc,CAUtH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAC3C;qFACiF;IACjF,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAC5D,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAC5D;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvE,wFAAwF;IACxF,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;IAClE;mFAC+E;IAC/E,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA8JjF;AAED;qCACqC;AACrC,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,EACjC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,EACvC,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,SAAS,OAAO,EAAE,GAAG,SAAS,CAiChC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF;AAED;8EAC8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;gGAC4F;IAC5F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC;4EACwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GACtF,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA2C1F;AAoCD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAgBD,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAwB7F;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB9E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,KAAK,EAAE,YAAY,GAAG,SAAS,GAC9B,UAAU,GAAG,SAAS,CAiBxB;AAED,uGAAuG;AACvG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAWtE;AAwHD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,eAAe,UAAQ,GACtB,IAAI,CAiCN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,QAAQ,UAAQ,EAChB,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,iBAAiB,CAsDnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,SAAS,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,EAC7C,KAAK,UAAQ,EACb,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB;AAC5C,+FAA+F;AAC/F,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,IAAI,CA+CN;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnF,KAAK,UAAQ,EACb,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAKhG;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gGAG4F;IAC5F,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,kGAAkG;IAClG,WAAW,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B;;oFAEgF;IAChF,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAChC;gGAC4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;iEAE6D;IAC7D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;2CAEuC;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;2FACuF;IACvF,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B;;;+EAG2E;IAC3E,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B;;;wEAGoE;IACpE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,mFAAmF;IACnF,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,GACV;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,CA2DnE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKlF;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAC9D,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAcA;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,EACrC,UAAU,EAAE,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,GACzC,IAAI,CAWN;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,qFAAqF;AACrF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ;SAjKA,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;WAAS,YAAY,GAAG,SAAS;CAiK3B,EACrC,KAAK,SAAW,EAChB,MAAM,GAAE,QAAQ,GAAG,QAAmB,GACrC,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAED,wBAAsB,IAAI,CACxB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CA4QvI;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnF,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAc9G;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,iHAAiH;IACjH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,mFAAmF;IACnF,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;8FAC0F;IAC1F,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACxC,iHAAiH;IACjH,WAAW,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IAC5C,YAAY,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IAC7C,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC,mFAAmF;IACnF,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IAC3C,oFAAoF;IACpF,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,4FAA4F;IAC5F,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC;;mFAE+E;IAC/E,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC;oDACgD;IAChD,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAkC1D;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAEjC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAC7E,MAAM,CAeR;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAiBvE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,EAAE,GAAG,SAAS,CAyC5F;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAO3D;AAUD;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAwBjB"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../src/push.ts"],"names":[],"mappings":"AAQA,OAAO,EAsBL,KAAK,iBAAiB,EAMtB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMnB,KAAK,4BAA4B,EAClC,MAAM,yBAAyB,CAAC;AAUjC,OAAO,EAA0B,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAMrG,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAqC/B;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,gBAAgB,GAC5B,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAKzC;AAKD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,gBAAgB,GAC5B;IAAE,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CA2B/E;AAED;wFACwF;AACxF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,gBAAgB,GAC5B,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAKzC;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC;AAEpI;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,gBAAgB,EAC7B,gBAAgB,CAAC,EAAE,kBAAkB,GACpC;IACD,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,iBAAiB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;KAAE,EAAE,CAAC;CAChH,CA4DA;AAaD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,GACrD,OAAO,CAAC,MAAM,CAAC,CAMjB;AAWD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAmB,GAAG,cAAc,CAUtH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAC3C;qFACiF;IACjF,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAC5D,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAC5D;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvE,wFAAwF;IACxF,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;IAClE;mFAC+E;IAC/E,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;yFACqF;IACrF,QAAQ,CAAC,UAAU,EAAE,4BAA4B,EAAE,GAAG,SAAS,CAAC;CACjE;AA4BD,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAyJjF;AA4ED;qCACqC;AACrC,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,EACjC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,EACvC,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,SAAS,OAAO,EAAE,GAAG,SAAS,CAiChC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF;AAED;8EAC8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;gGAC4F;IAC5F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC;4EACwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GACtF,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAkD1F;AAoCD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAgBD,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAwB7F;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB9E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,KAAK,EAAE,YAAY,GAAG,SAAS,GAC9B,UAAU,GAAG,SAAS,CAiBxB;AAED,uGAAuG;AACvG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAWtE;AAwHD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,eAAe,UAAQ,GACtB,IAAI,CAiCN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,QAAQ,UAAQ,EAChB,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,iBAAiB,CAsDnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,SAAS,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,EAC7C,KAAK,UAAQ,EACb,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB;AAC5C,+FAA+F;AAC/F,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,IAAI,CA+CN;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnF,KAAK,UAAQ,EACb,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAC3C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAKhG;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gGAG4F;IAC5F,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,kGAAkG;IAClG,WAAW,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B;;oFAEgF;IAChF,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAChC;gGAC4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;iEAE6D;IAC7D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;2CAEuC;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;2FACuF;IACvF,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B;;;+EAG2E;IAC3E,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC9B;;;wEAGoE;IACpE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,mFAAmF;IACnF,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,GACV;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,CA2DnE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKlF;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAC9D,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAcA;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,EACrC,UAAU,EAAE,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,GACzC,IAAI,CAWN;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAoB7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAWhG;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,qFAAqF;AACrF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ;SAjOA,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;WAAS,YAAY,GAAG,SAAS;CAiO3B,EACrC,KAAK,SAAW,EAChB,MAAM,GAAE,QAAQ,GAAG,QAAmB,GACrC,OAAO,CAAC,oBAAoB,CAAC,CA4B/B;AAED,wBAAsB,IAAI,CACxB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAmRvI;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnF,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAc9G;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,iHAAiH;IACjH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,mFAAmF;IACnF,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;8FAC0F;IAC1F,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACxC,iHAAiH;IACjH,WAAW,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IAC5C,YAAY,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IAC7C,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC,mFAAmF;IACnF,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IAC3C,oFAAoF;IACpF,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,4FAA4F;IAC5F,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC;;mFAE+E;IAC/E,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC;oDACgD;IAChD,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAkC1D;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAEjC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAC7E,MAAM,CAeR;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAiBvE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,EAAE,GAAG,SAAS,CAyC5F;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAO3D;AAUD;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/push.js

@@ -1,15 +1,17 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join, basename, extname, relative, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+import { join, basename, delimiter, dirname, extname, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { webcrypto } from 'node:crypto';
 import { build } from 'esbuild';
-import { migrationDigestOf, DECLARED_OUTPUT_FIELDS_MAX, ASSET_PART_PREFIX, assetHash, assetsNeed, ATTACHMENT_BLOB_BINDING, buildPermissionRegistry, declaredOwnerGrants, ownerGrantSets, reservedKeyMessage, reservedKeyOffences, reservedKeysOf, declaresAttachmentTargets, DECLARED_MIGRATIONS_MAX, DECLARED_MIGRATIONS_SQL_BYTES_MAX, DEPLOY_MANIFEST_BYTES_SAFE, deployManifest, emittedModel, declaredMigrationDeclarations, sqlBytes, utf8Length, envVarSpec, runtimeNeeds, RUNTIME_BASELINE, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, assertDeclaredScopeStores, storeNamesOfBindings, manifestStoresOf, } from '@substrat-run/contracts';
+import { migrationDigestOf, DECLARED_OUTPUT_FIELDS_MAX, ASSET_PART_PREFIX, assetHash, assetsNeed, ATTACHMENT_BLOB_BINDING, buildPermissionRegistry, declaredOwnerGrants, ownerGrantSets, reservedKeyMessage, reservedKeyOffences, reservedKeysOf, declaresAttachmentTargets, DECLARED_MIGRATIONS_MAX, DECLARED_MIGRATIONS_SQL_BYTES_MAX, DEPLOY_MANIFEST_BYTES_SAFE, deployManifest, emittedModel, declaredMigrationDeclarations, sqlBytes, utf8Length, envVarSpec, runtimeNeeds, RUNTIME_BASELINE, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, assertDeclaredScopeStores, storeNamesOfBindings, manifestStoresOf, pushedConnectorProblems, verticalConnectorDeclarations, } from '@substrat-run/contracts';
 import { lint, loadConfig as loadBoundaryLintConfig, resolvePackages, declaredEngines, formatViolations, maskSource, } from '@substrat-run/boundary-lint';
 import { walkPages } from '@substrat-run/control-plane-client';
 import { checkMigrationDataLoss } from './data-loss-check.js';
 import { parseJsonBody } from './http.js';
+import { readPublishedConcept } from './published-concept.js';
 import { planeFor } from './plane.js';
 import { failureMessage } from './problem.js';
 import { assertWorkerNodeImports } from './worker-node-imports.js';
@@ -251,6 +253,32 @@ export function boundManifest(manifest, warn = console.warn) {
     const { migrations: _omitted, ...rest } = manifest;
     return rest;
 }
+/**
+ * Bundle `contents` — an ES module whose imports resolve from `dir` — with every package left
+ * external, write it INTO `dir` so Node resolves those imports (@substrat-run/*, and any node
+ * addon a node-ful entry pulls) from the vertical's own node_modules, import it, and remove it.
+ * The unique name avoids the ESM import cache across pushes.
+ */
+async function importBundledAsData(dir, stem, contents) {
+    const out = join(dir, `.substrat.${stem}.${Date.now()}.mjs`);
+    try {
+        await build({
+            stdin: { contents, resolveDir: resolve(dir), sourcefile: `substrat-${stem}.mjs`, loader: 'js' },
+            bundle: true,
+            platform: 'node',
+            format: 'esm',
+            packages: 'external',
+            outfile: out,
+            logLevel: 'silent',
+        });
+        // @vite-ignore: this is a real filesystem path imported at runtime, never a bundler input —
+        // the comment keeps vitest/vite from trying to resolve it through their transform pipeline.
+        return (await import(/* @vite-ignore */ pathToFileURL(out).href));
+    }
+    finally {
+        rmSync(out, { force: true });
+    }
+}
 export async function deriveDeclaredSurface(dir) {
     const pkgPath = join(dir, 'package.json');
     // Named rather than left as an ENOENT trace: `substrat push --check` (#1205) is run from
@@ -274,121 +302,173 @@ export async function deriveDeclaredSurface(dir) {
     if (!existsSync(entryPath)) {
         throw new Error(`substrat.permissions points at "${entry}", which does not exist under ${dir}.`);
     }
-    // Written INTO the vertical dir so Node resolves the externalised imports (@substrat-run/*,
-    // and any node addon a node-ful entry pulls) from the vertical's own node_modules. Removed
-    // immediately after import. The unique name avoids the ESM import cache across pushes.
-    const out = join(dir, `.substrat.permissions.${Date.now()}.mjs`);
+    let mod;
     try {
-        let mod;
+        // The entry, plus the vertical's OWN kernel (#1677), imported where the vertical
+        // resolves it: `packages: 'external'` keeps the specifier, so it loads from the
+        // vertical's node_modules. Optional — a vertical with none still reads as data.
+        // Both absolute: a CI job names the dir relatively (`substrat push demos/ticket0`), and
+        // a relative path written as an import specifier is a BARE one — `packages: 'external'`
+        // then keeps `demos/…` as a package named `demos`, which Node cannot find. `join` also
+        // strips a leading `./`, so spelling the dir `./demos/…` would not have saved it.
+        // The specifiers are the VERTICAL's packages, resolved from its node_modules, never the CLI's
+        // own dependencies; spelled through `q` so `lint:deps`, which reads text, does not count them.
+        const q = JSON.stringify;
+        mod = await importBundledAsData(dir, 'permissions', `export * from ${q(resolve(entryPath))};\n` +
+            `export const __substratKernel = await import(${q('@substrat-run/kernel')}).catch(() => null);\n` +
+            // The spine the data-loss replay builds first (#2321), from the vertical's own
+            // adapter-sqlite — imported only when a replay runs, since it loads a native driver.
+            `export const __substratSpine = () => import(${q('@substrat-run/adapter-sqlite')}).then((m) => m.SCOPE_SPINE_DDL, () => undefined);\n` +
+            // Where that kernel resolves, for the replay's own process to import (#2321).
+            `export const __substratKernelUrl = (() => { try { return import.meta.resolve(${q('@substrat-run/kernel')}); } catch { return null; } })();\n`);
+    }
+    catch (e) {
+        // The third silent-until-deploy failure (#1205): the entry exists and exports the right
+        // name, but cannot be read OUTSIDE the vertical's runtime — a worker-only import, a
+        // `node:*` on a path the bundler follows, an import-time side effect wanting a live host.
+        // Named as that, rather than as a bare esbuild/ESM stack, because the remedy is specific:
+        // `definePermissions(...)` returns a plain object, so the module holding it must stay
+        // importable as data.
+        throw new Error(`substrat.permissions points at "${entry}", which could not be bundled and imported as data — ` +
+            `the declared surface must be readable without a live host (no worker-only imports on the ` +
+            `path it pulls in, no import-time side effects).\n${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!mod.permissions) {
+        throw new Error(`${entry} exports no \`permissions\`. Export ` +
+            `\`const permissions = definePermissions({ modules, roles, entityGrants })\`.`);
+    }
+    let spec;
+    if (mod.envSpec !== undefined) {
+        if (!Array.isArray(mod.envSpec)) {
+            throw new Error(`${entry} exports \`envSpec\`, but it is not an array of env-var specs.`);
+        }
         try {
-            await build({
-                // The entry, plus the vertical's OWN kernel (#1677), imported where the vertical
-                // resolves it: `packages: 'external'` keeps the specifier, so it loads from the
-                // vertical's node_modules. Optional — a vertical with none still reads as data.
-                // Both absolute: a CI job names the dir relatively (`substrat push demos/ticket0`), and
-                // a relative path written as an import specifier is a BARE one — `packages: 'external'`
-                // then keeps `demos/…` as a package named `demos`, which Node cannot find. `join` also
-                // strips a leading `./`, so spelling the dir `./demos/…` would not have saved it.
-                stdin: {
-                    contents: `export * from ${JSON.stringify(resolve(entryPath))};\n` +
-                        `export const __substratKernel = await import('@substrat-run/kernel').catch(() => null);\n` +
-                        // The spine the data-loss replay builds first (#2321), from the vertical's own
-                        // adapter-sqlite — imported only when a replay runs, since it loads a native driver.
-                        `export const __substratSpine = () => import('@substrat-run/adapter-sqlite').then((m) => m.SCOPE_SPINE_DDL, () => undefined);\n` +
-                        // Where that kernel resolves, for the replay's own process to import (#2321).
-                        `export const __substratKernelUrl = (() => { try { return import.meta.resolve('@substrat-run/kernel'); } catch { return null; } })();\n`,
-                    resolveDir: resolve(dir),
-                    sourcefile: 'substrat-surface.mjs',
-                    loader: 'js',
-                },
-                bundle: true,
-                platform: 'node',
-                format: 'esm',
-                packages: 'external',
-                outfile: out,
-                logLevel: 'silent',
-            });
-            // @vite-ignore: this is a real filesystem path imported at runtime, never a bundler input —
-            // the comment keeps vitest/vite from trying to resolve it through their transform pipeline.
-            mod = (await import(/* @vite-ignore */ pathToFileURL(out).href));
+            spec = mod.envSpec.map((e) => envVarSpec.parse(e));
         }
         catch (e) {
-            // The third silent-until-deploy failure (#1205): the entry exists and exports the right
-            // name, but cannot be read OUTSIDE the vertical's runtime — a worker-only import, a
-            // `node:*` on a path the bundler follows, an import-time side effect wanting a live host.
-            // Named as that, rather than as a bare esbuild/ESM stack, because the remedy is specific:
-            // `definePermissions(...)` returns a plain object, so the module holding it must stay
-            // importable as data.
-            throw new Error(`substrat.permissions points at "${entry}", which could not be bundled and imported as data — ` +
-                `the declared surface must be readable without a live host (no worker-only imports on the ` +
-                `path it pulls in, no import-time side effects).\n${e instanceof Error ? e.message : String(e)}`);
-        }
-        if (!mod.permissions) {
-            throw new Error(`${entry} exports no \`permissions\`. Export ` +
-                `\`const permissions = definePermissions({ modules, roles, entityGrants })\`.`);
+            throw new Error(`${entry} exports an \`envSpec\` that is not a valid env-var spec list.\n` +
+                `${e instanceof Error ? e.message : String(e)}`);
         }
-        let spec;
-        if (mod.envSpec !== undefined) {
-            if (!Array.isArray(mod.envSpec)) {
-                throw new Error(`${entry} exports \`envSpec\`, but it is not an array of env-var specs.`);
-            }
-            try {
-                spec = mod.envSpec.map((e) => envVarSpec.parse(e));
-            }
-            catch (e) {
-                throw new Error(`${entry} exports an \`envSpec\` that is not a valid env-var spec list.\n` +
-                    `${e instanceof Error ? e.message : String(e)}`);
-            }
-        }
-        // #2430: a key a module declares `holder: 'system'` in a role a person can hold, an entity grant
-        // shape or an owner grant (a module's, or this package's `substrat.ownerGrants`, which an install
-        // grants its owner), refused before anything uploads, in `lint:permissions`' own words. The
-        // registry build below refuses most of it too; this is the message that names the remedy.
-        const reserved = reservedKeysOf(mod.permissions.modules);
-        const offences = reservedKeyOffences({
-            roles: mod.permissions.roles,
-            grants: mod.permissions.entityGrants ?? [],
-            personGrants: ownerGrantSets(mod.permissions.modules, ownerGrants.grants),
-        }, reserved);
-        if (offences.length > 0)
-            throw new Error(reservedKeyMessage(basename(resolve(dir)), entry, offences, reserved));
-        // #1234: the declared half of a declared-vs-observed finding — what the modules say
-        // they emit and consume, which exists nowhere off their manifests.
-        const declaredEvents = flattenDeclaredEvents(mod.permissions);
-        return {
-            registry: buildPermissionRegistry(mod.permissions),
-            modules: mod.permissions.modules.map(({ manifest }) => ({
-                id: manifest.id,
-                permissions: manifest.permissions.map(({ key, description, holder }) => ({
-                    key, description, ...(holder ? { holder } : {}),
-                })),
-                ...(manifest.ownerGrants ? { ownerGrants: manifest.ownerGrants } : {}),
+    }
+    // #2430: a key a module declares `holder: 'system'` in a role a person can hold, an entity grant
+    // shape or an owner grant (a module's, or this package's `substrat.ownerGrants`, which an install
+    // grants its owner), refused before anything uploads, in `lint:permissions`' own words. The
+    // registry build below refuses most of it too; this is the message that names the remedy.
+    const reserved = reservedKeysOf(mod.permissions.modules);
+    const offences = reservedKeyOffences({
+        roles: mod.permissions.roles,
+        grants: mod.permissions.entityGrants ?? [],
+        personGrants: ownerGrantSets(mod.permissions.modules, ownerGrants.grants),
+    }, reserved);
+    if (offences.length > 0)
+        throw new Error(reservedKeyMessage(basename(resolve(dir)), entry, offences, reserved));
+    // #1234: the declared half of a declared-vs-observed finding — what the modules say
+    // they emit and consume, which exists nowhere off their manifests.
+    const declaredEvents = flattenDeclaredEvents(mod.permissions);
+    const connectors = await readDeclaredConnectors(dir, pkg.substrat?.connectors);
+    const registry = buildPermissionRegistry(mod.permissions);
+    if (connectors) {
+        // The standing grants join the registry, so widening them moves the permission digest the
+        // promote checkpoint acknowledges. Sorted like the rest of the registry, so the digest is a
+        // function of content. Absent when there are none: a digest must not move for a vertical
+        // without connectors.
+        registry.connectors = connectors
+            .map((c) => ({ provider: c.provider, grants: [...c.grants].sort() }))
+            .sort((a, b) => a.provider.localeCompare(b.provider));
+        assertConnectorsAdmissible(basename(resolve(dir)), pkg.substrat?.connectors, connectors, registry, mod.permissions);
+    }
+    return {
+        registry,
+        modules: mod.permissions.modules.map(({ manifest }) => ({
+            id: manifest.id,
+            permissions: manifest.permissions.map(({ key, description, holder }) => ({
+                key, description, ...(holder ? { holder } : {}),
             })),
-            envSpec: spec,
-            // #1232: the same import that yields the permission surface already holds every
-            // module manifest — the schedules ride out of it with zero extra reads.
-            schedules: flattenDeclaredSchedules(mod.permissions),
-            freshness: flattenDeclaredFreshness(mod.permissions),
-            declaredEvents: declaredEvents.events,
-            declaredEventsTruncated: declaredEvents.truncated,
-            declaresAttachments: declaresAttachmentTargets(mod.permissions.modules.map((m) => m.manifest)),
-            migrations: flattenDeclaredMigrations(mod.permissions, typeof mod.__substratKernel?.moduleMigrations === 'function'
-                ? mod.__substratKernel.moduleMigrations
-                : undefined),
-            replay: {
-                kernel: mod.__substratKernel ?? null,
-                kernelUrl: typeof mod.__substratKernelUrl === 'string' ? mod.__substratKernelUrl : null,
-                modules: mod.permissions.modules,
-                spineDdl: async () => {
-                    const ddl = await mod.__substratSpine?.();
-                    return typeof ddl === 'string' ? ddl : undefined;
-                },
+            ...(manifest.ownerGrants ? { ownerGrants: manifest.ownerGrants } : {}),
+        })),
+        envSpec: spec,
+        // #1232: the same import that yields the permission surface already holds every
+        // module manifest — the schedules ride out of it with zero extra reads.
+        schedules: flattenDeclaredSchedules(mod.permissions),
+        freshness: flattenDeclaredFreshness(mod.permissions),
+        declaredEvents: declaredEvents.events,
+        declaredEventsTruncated: declaredEvents.truncated,
+        declaresAttachments: declaresAttachmentTargets(mod.permissions.modules.map((m) => m.manifest)),
+        migrations: flattenDeclaredMigrations(mod.permissions, typeof mod.__substratKernel?.moduleMigrations === 'function'
+            ? mod.__substratKernel.moduleMigrations
+            : undefined),
+        replay: {
+            kernel: mod.__substratKernel ?? null,
+            kernelUrl: typeof mod.__substratKernelUrl === 'string' ? mod.__substratKernelUrl : null,
+            modules: mod.permissions.modules,
+            spineDdl: async () => {
+                const ddl = await mod.__substratSpine?.();
+                return typeof ddl === 'string' ? ddl : undefined;
             },
-        };
+        },
+        connectors,
+    };
+}
+/**
+ * The vertical's connectors (vertical-connectors.md §5.1): `substrat.connectors` names a module
+ * exporting `connectors`, a `defineConnectors(...)` value whose `declarations()` is the static half
+ * a push carries. Imported as data the way the permission entry is. Undefined when the package
+ * names no such module or its declarations are empty.
+ */
+async function readDeclaredConnectors(dir, entry) {
+    if (entry === undefined)
+        return undefined;
+    if (typeof entry !== 'string' || entry.length === 0) {
+        throw new Error(`${basename(resolve(dir))}/package.json declares \`substrat.connectors\` as ${JSON.stringify(entry)}, ` +
+            `not a path. Point it at the module that exports \`connectors = defineConnectors(...)\`.`);
     }
-    finally {
-        rmSync(out, { force: true });
+    const entryPath = join(dir, entry);
+    if (!existsSync(entryPath))
+        throw new Error(`substrat.connectors points at "${entry}", which does not exist under ${dir}.`);
+    let mod;
+    try {
+        mod = await importBundledAsData(dir, 'connectors', `export * from ${JSON.stringify(resolve(entryPath))};\n`);
+    }
+    catch (e) {
+        throw new Error(`substrat.connectors points at "${entry}", which could not be bundled and imported as data — ` +
+            `the connectors module must be importable without a live host (no worker-only imports on the ` +
+            `path it pulls in, no import-time side effects).\n${e instanceof Error ? e.message : String(e)}`);
+    }
+    const declarations = mod.connectors?.declarations;
+    if (typeof declarations !== 'function') {
+        throw new Error(`${entry} exports no \`connectors\` with a \`declarations()\`. Export ` +
+            `\`const connectors = defineConnectors({ … })\` from @substrat-run/vertical-host/connectors.`);
+    }
+    let raw;
+    try {
+        raw = declarations.call(mod.connectors);
     }
+    catch (e) {
+        throw new Error(`${entry}: \`connectors.declarations()\` threw.\n${e instanceof Error ? e.message : String(e)}`);
+    }
+    const parsed = verticalConnectorDeclarations.safeParse(raw);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => `  - ${i.path.length ? `${i.path.join('.')}: ` : ''}${i.message}`);
+        throw new Error(`${entry} declares connectors a push cannot carry:\n${issues.join('\n')}`);
+    }
+    return parsed.data.length > 0 ? parsed.data : undefined;
+}
+/**
+ * vertical-connectors.md §7.1, the refusals the static half allows: a standing grant the registry
+ * does not declare or reserves to a system principal (`pushedConnectorProblems`, the check the
+ * control plane repeats), and a routed event type no module of the vertical declares it emits.
+ */
+function assertConnectorsAdmissible(vertical, entry, connectors, registry, permissions) {
+    const emitted = new Set(permissions.modules.flatMap((m) => (m.manifest.events?.emits ?? []).map((e) => e.type)));
+    const problems = [
+        ...pushedConnectorProblems({ connectors, registry }),
+        ...connectors.flatMap((c) => c.events.filter((t) => !emitted.has(t)).map((t) => `connector ${c.provider} routes ${t}, which no module of ${vertical} declares it emits`)),
+    ];
+    if (problems.length === 0)
+        return;
+    throw new Error(`${vertical}: ${entry} declares connectors a push cannot carry:\n${problems.map((p) => `  - ${p}`).join('\n')}\n` +
+        `Remedy: a standing grant must be a key a module declares and does not reserve (\`holder: 'system'\`); ` +
+        `a routed event must be one a module's manifest lists under \`events.emits\`.`);
 }
 /** The declared permission surface alone — `deriveDeclaredSurface` for the callers that
  *  want only the registry (D-41). */
@@ -527,6 +607,13 @@ export function formatPermissionSurface(surface, label) {
             lines.push(`  ${l.provider}: ${l.operation} holding ${l.permission}`);
         }
     }
+    // A vertical-defined connector's standing grants, which the digest also covers.
+    if (registry.connectors?.length) {
+        lines.push('', 'connector standing grants:');
+        for (const c of registry.connectors) {
+            lines.push(`  ${c.provider}: ${c.grants.length ? c.grants.join(', ') : '(none)'}`);
+        }
+    }
     if (surface.envSpec) {
         lines.push('', `env keys (code-declared, #1206): ${surface.envSpec.length}`);
         for (const e of surface.envSpec) {
@@ -1206,18 +1293,84 @@ export function assertAttachmentBindingFree(bindings, blobStores) {
 export function generatedConfigPath(dir) {
     return resolve(dir, '.wrangler.substrat.json');
 }
+/**
+ * The vertical's own wrangler: the script its `bin` names, and the version that script is.
+ *
+ * Resolved the way Node resolves an import from the vertical (its `node_modules`, then each
+ * parent's, so a workspace that hoists wrangler to its root still finds it), and run as
+ * `node <bin>`. Not through `npx`, for two reasons:
+ *
+ *   - On Windows `npx` is `npx.cmd`. Node will not spawn a batch file without a shell
+ *     (CVE-2024-27980), and through a shell every argument is parsed twice — by cmd.exe and
+ *     again by the batch file's `%*` — so a build path holding a space, `&`, `%` or `^` cannot
+ *     be passed safely. `push` failed there with `spawnSync npx ENOENT` before it built anything.
+ *   - `npx` downloads the newest wrangler when the project has none, without asking when stdin
+ *     is not a TTY. The bundle a deploy ships then depends on the day it was built. The
+ *     project's pinned wrangler is the only one this runs; a project without one is told so.
+ *
+ * Every node_modules directory is checked for `wrangler/package.json` on disk rather than
+ * through `require.resolve('wrangler/package.json')`, so the lookup never depends on which
+ * subpaths a given wrangler release lists in its `exports`.
+ */
+export function resolveWrangler(dir) {
+    const root = resolve(dir);
+    const candidates = createRequire(join(root, 'package.json')).resolve.paths('wrangler') ?? [];
+    const pkgFile = candidates.map((nm) => join(nm, 'wrangler', 'package.json')).find((f) => existsSync(f));
+    if (!pkgFile) {
+        throw new Error([
+            `wrangler is not installed in this project (${root}).`,
+            '  substrat push builds the Worker with the wrangler your project pins, and never downloads one.',
+            '  Add it as a devDependency, then push again:',
+            '    npm install --save-dev wrangler    (or: pnpm add -D wrangler, yarn add -D wrangler)',
+            '  Yarn Plug\'n\'Play installs no node_modules, which the push reads: set `nodeLinker: node-modules`',
+            '  in .yarnrc.yml and run `yarn install`.',
+        ].join('\n'));
+    }
+    const pkg = JSON.parse(readFileSync(pkgFile, 'utf8'));
+    const rel = typeof pkg.bin === 'string' ? pkg.bin : pkg.bin?.wrangler;
+    if (!rel)
+        throw new Error(`${pkgFile} names no \`wrangler\` bin — reinstall wrangler in this project`);
+    return { bin: resolve(dirname(pkgFile), rel), version: pkg.version ?? 'unknown' };
+}
+/**
+ * The environment wrangler builds in: this process's, with the project's `node_modules/.bin`
+ * directories (its own, then each parent's, nearest first) and Node's own directory put in
+ * front of PATH.
+ *
+ * That is what `npx` used to give it, and the project's build command depends on it. Wrangler
+ * runs `build.command` (`runtimeNeeds.build`) through a shell on the PATH it was handed, so a
+ * build of `vite build` or `tsc` finds the project's own `vite` or `tsc` only when its `.bin`
+ * is there. A CLI installed globally, or started from a repository root, has no such entry.
+ */
+export function wranglerEnv(dir, env = process.env) {
+    const bins = [];
+    for (let at = resolve(dir);; at = dirname(at)) {
+        bins.push(join(at, 'node_modules', '.bin'));
+        if (dirname(at) === at)
+            break;
+    }
+    // Windows names it `Path`, and environment keys are case-insensitive there. A copy is a
+    // plain object, so set the key that is already present instead of adding a second one.
+    const key = Object.keys(env).find((k) => k.toUpperCase() === 'PATH') ?? 'PATH';
+    const path = [...bins, dirname(process.execPath), env[key]].filter(Boolean).join(delimiter);
+    return { ...env, [key]: path };
+}
 const checkedWorkerBundles = new WeakSet();
 /** Run Wrangler's configured build once, then check the source graph it produced. */
 export async function prepareWorkerBundle(dir, resolved = resolveWranglerConfig(dir), label = 'Worker', output = 'stdout') {
     const { cfg, needs } = resolved;
+    // Before anything is written: a project without wrangler leaves no temp dir or config behind.
+    const wrangler = resolveWrangler(dir);
     const out = mkdtempSync(join(tmpdir(), 'substrat-build-'));
     const generated = needs ? generatedConfigPath(dir) : undefined;
-    (output === 'stderr' ? console.error : console.log)(`building ${label} …`);
+    (output === 'stderr' ? console.error : console.log)(`building ${label} with wrangler ${wrangler.version} …`);
     try {
         if (generated)
             writeFileSync(generated, JSON.stringify(cfg, null, 2) + '\n');
         try {
-            execFileSync('npx', ['wrangler', 'deploy', '--dry-run', '--outdir', out, ...(generated ? ['--config', generated] : [])], { cwd: dir, stdio: output === 'stderr' ? ['inherit', 2, 2] : 'inherit' });
+            // `node <wrangler bin>`, no shell: each argument reaches wrangler as one argv entry on
+            // every OS, so `out` and `generated` may hold spaces or non-ASCII (see resolveWrangler).
+            execFileSync(process.execPath, [wrangler.bin, 'deploy', '--dry-run', '--outdir', out, ...(generated ? ['--config', generated] : [])], { cwd: dir, env: wranglerEnv(dir), stdio: output === 'stderr' ? ['inherit', 2, 2] : 'inherit' });
         }
         finally {
             if (generated)
@@ -1234,6 +1387,7 @@ export async function prepareWorkerBundle(dir, resolved = resolveWranglerConfig(
     }
 }
 export async function push(opts) {
+    const concept = readPublishedConcept(opts.dir);
     // The layer rules, before anything is built or uploaded (#955). First, because it reads
     // the source tree and needs nothing else — a violation is refused in a second rather than
     // after a wrangler build whose output was never going to be admissible. Skipped only for
@@ -1286,7 +1440,7 @@ export async function push(opts) {
     // below. Throws if the vertical declares no surface: absence is never a silent empty registry.
     // The same import reads the entry's `envSpec` export (#1206); when it exists it is the copy
     // that ships, and a drifted package.json duplicate refuses the push.
-    const { registry, modules: declaredModules, envSpec: derivedEnvSpec, schedules, freshness, declaredEvents, declaredEventsTruncated, migrations, declaresAttachments, replay, } = await deriveDeclaredSurface(opts.dir);
+    const { registry, modules: declaredModules, envSpec: derivedEnvSpec, schedules, freshness, declaredEvents, declaredEventsTruncated, migrations, declaresAttachments, replay, connectors, } = await deriveDeclaredSurface(opts.dir);
     // #2321: the vertical's migrations, replayed against a populated in-memory scope through its own
     // kernel's data-loss fence — before anything is uploaded, so a migration that would close every
     // populated scope at promote is refused here instead. Throws on a refusal.
@@ -1401,6 +1555,7 @@ export async function push(opts) {
         // The emitted entity model (#1214) — metadata like envSpec/surfaces, not in any digest:
         // it describes what the migrations built, it does not build anything.
         ...(model ? { model } : {}),
+        ...(concept !== undefined ? { concept } : {}),
         // #1321: the declared output surface travels with the version — `openapi.json`
         // is built inside the vertical and never sent, so the platform has no other way
         // to know which declared fields anything is even capable of returning.
@@ -1431,6 +1586,10 @@ export async function push(opts) {
         // `[]` when undeclared, because absence means "pre-#1706 push" (unenforced) and a
         // new-CLI push must not read as that. Enforcement input, versioned with the code.
         calls: opts.calls ?? [],
+        // The vertical's connector declarations (vertical-connectors.md §5.1), absent when none, so a
+        // vertical without connectors pushes the manifest it did before. Their standing grants are
+        // also in `registry.connectors`, which the permission digest covers.
+        ...(connectors ? { connectors } : {}),
         // The declared permission surface travels with the bundle (D-39/D-41): keys+descriptions,
         // role templates, entity-grant shapes. Required — its content hash is digests.permission.
         registry,