@substrat-run/contracts 0.114.0 → 0.117.0

package/dist/denial.js

@@ -53,9 +53,36 @@ export const permissionDenial = z.object({
      * this log exists to answer — and `actor` alone would answer it wrongly.
      */
     impersonation: impersonationStamp.nullable(),
+    /**
+     * The invocation this refusal happened during (#1525), or null.
+     *
+     * The same id #1237 stamps on every event of a call, and the only thing that joins a
+     * denial to the rest of its request. `operation` names *what* was attempted, never
+     * *which attempt* — so without this a refusal is reachable only by actor and time,
+     * and "what else did this call do" stops at the events that succeeded.
+     *
+     * Null is two facts, as ever: the transport carried no id (a seed, a test, an
+     * internal call, an attachment RPC), or the row predates the column.
+     */
+    invocationId: z.string().nullable(),
     /** ISO 8601. */
     at: z.string().min(1),
     drainedAt: z.string().nullable(),
+    /**
+     * Why this row could not be read whole (#1636). ABSENT on every row the kernel wrote,
+     * so a healthy page reads exactly as it did before.
+     *
+     * This log is the only witness to a refused check, and one row whose `actor` or
+     * `impersonation` would not parse used to make the whole read throw. So the read is
+     * tolerant and says so: each column that did not decode is named here and its field
+     * comes back EMPTY — `actor` as the self-naming `{ system: 'undecodable' }` marker,
+     * `impersonation` as `null` beside this reason, which is what keeps it from reading as
+     * "nobody was impersonating". A stored `permission` that is not a permission key reads as
+     * the self-naming `undecodable:permission`, and this QUOTES the stored key: a module that
+     * casts a malformed key is refused with it, and the key is the evidence of why. A row
+     * whose id, tenant or time does not decode is never returned as one of these at all.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /**
  * What narrows a denial read. Every field is an exact match except the `since`/`until`
@@ -155,6 +182,14 @@ export const denialBucket = z.object({
     /** ISO 8601 — the first occurrence still in the window (see `windowOldestAt`). */
     firstAt: z.string().min(1),
     lastAt: z.string().min(1),
+    /**
+     * Why this bucket's key could not be read (#1636), absent otherwise. The buckets are
+     * `GROUP BY actor`, so one stored actor that would not parse used to throw the whole
+     * summary — "the read a console opens first". It now reads as the self-naming
+     * `{ system: 'undecodable' }` marker, with the count still counted and this saying why.
+     * A malformed permission key reads as `undecodable:permission`, the stored key quoted here.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /**
  * One per-operation bucket (#1456) — "which operation keeps getting refused", the
@@ -170,6 +205,13 @@ export const denialOperationBucket = z.object({
     /** ISO 8601 — the first occurrence still in the window (see `windowOldestAt`). */
     firstAt: z.string().min(1),
     lastAt: z.string().min(1),
+    /**
+     * Why this bucket's key could not be read (#1643), absent otherwise. `operation` is the
+     * only column a bucket can fall back on: one that is not text reads as `null` — the
+     * bucket for a refusal outside an operation — beside this reason, which is what keeps it
+     * from reading as one. A bucket whose count or times do not decode is never returned.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /**
  * The facts every summary carries beside its buckets — what keeps the bucket list

package/dist/denial.js.map

@@ -1 +1 @@
-{"version":3,"file":"denial.js","sourceRoot":"","sources":["../src/denial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,wDAAwD;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,kFAAkF;IAClF,KAAK;IACL,mDAAmD;IACnD,UAAU,EAAE,aAAa;IACzB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;AAGvE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC/D;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,UAAU;QAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,MAAM,EAAE,SAAS;QAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,MAAM,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK;IACL,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG;IACzB,sFAAsF;IACtF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACtC;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,2CAA2C;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,oFAAoF;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC9B,GAAG,kBAAkB;CACtB,CAAC,CAAC;AAGH,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACvC,GAAG,kBAAkB;CACtB,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC3D,kBAAkB;IAClB,sBAAsB;CACvB,CAAC,CAAC"}
+{"version":3,"file":"denial.js","sourceRoot":"","sources":["../src/denial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,wDAAwD;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,kFAAkF;IAClF,KAAK;IACL,mDAAmD;IACnD,UAAU,EAAE,aAAa;IACzB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C;;;;;;;;;;OAUG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;;;;;;;;;;OAaG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;AAGvE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC/D;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,UAAU;QAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,MAAM,EAAE,SAAS;QAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,MAAM,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK;IACL,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG;IACzB,sFAAsF;IACtF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACtC;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,2CAA2C;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,oFAAoF;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC9B,GAAG,kBAAkB;CACtB,CAAC,CAAC;AAGH,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACvC,GAAG,kBAAkB;CACtB,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC3D,kBAAkB;IAClB,sBAAsB;CACvB,CAAC,CAAC"}

package/dist/events.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import { type EventId, type Instant, type ModuleId } from './ids.js';
 export declare const entityRef: z.ZodObject<{
     entityType: z.ZodString;
     entityId: z.ZodString;
@@ -28,10 +27,24 @@ export declare const systemActor: z.ZodObject<{
 export declare const connectorActor: z.ZodObject<{
     connection: z.ZodString;
 }, z.core.$strip>;
+/**
+ * WHOEVER HELD A CAPABILITY acted — a link share, a claim link (#1672).
+ *
+ * The fourth member, and a member rather than a principal for #97's reason: the
+ * person holding a link is nobody the checker knows, and recording them as a
+ * principal would put a person in the trail who does not exist. The id names the
+ * capability's directory row, which says who minted it, for what, and until when —
+ * so the trail can answer "reached through Anna's link" without inventing a guest.
+ */
+export declare const capabilityActor: z.ZodObject<{
+    capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+}, z.core.$strip>;
 export declare const actor: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
     system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
 }, z.core.$strip>, z.ZodObject<{
     connection: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
 }, z.core.$strip>]>;
 export type Actor = z.infer<typeof actor>;
 /**
@@ -78,6 +91,8 @@ export declare const domainEvent: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
     entity: z.ZodObject<{
         entityType: z.ZodString;
@@ -132,7 +147,10 @@ export declare const timelineEntry: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
+    decodeError: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type TimelineEntry = z.infer<typeof timelineEntry>;
 /**
@@ -165,7 +183,10 @@ export declare const historyEntry: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
+    decodeError: z.ZodOptional<z.ZodString>;
     payload: z.ZodUnknown;
     authorization: z.ZodNullable<z.ZodArray<z.ZodObject<{
         permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
@@ -216,7 +237,10 @@ export declare const causeChain: z.ZodObject<{
             system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
         }, z.core.$strip>, z.ZodObject<{
             connection: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
         }, z.core.$strip>]>;
+        decodeError: z.ZodOptional<z.ZodString>;
         payload: z.ZodUnknown;
         authorization: z.ZodNullable<z.ZodArray<z.ZodObject<{
             permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
@@ -261,8 +285,25 @@ export declare const deliveryState: z.ZodEnum<{
     retrying: "retrying";
 }>;
 export type DeliveryState = z.infer<typeof deliveryState>;
+/**
+ * Who a delivery row belongs to (#1643): a module id, or `executor:<id>` for an executor.
+ *
+ * `_substrat_deliveries.consumer_module` holds both, and the contract typed it as a bare
+ * `ModuleId` — which a decode cannot honour, since `executor:mailer` is not one (the colon).
+ * The cast hid that; a decode against `moduleId` would have thrown on every healthy executor
+ * row. So the schema names the two shapes the column holds. The inferred type is unchanged
+ * (`ModuleId`), and every value the old one accepted is still accepted.
+ *
+ * The `executor:` branch matches the WRITER, not a tidier id. `registerExecutor` and
+ * `registerConnector` accept any string (`scope-host.ts`) and both adapters persist
+ * `executor:${id}`, so the kernel can itself write `executor:` with an empty id, or one with a
+ * newline. A reader that refused those would throw the whole dead-letter page or effects walk on
+ * a healthy delivery. It accepts whatever registration could have produced; tightening
+ * registration is a contract change, and #1645 carries it.
+ */
+export declare const deliveryConsumer: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.core.$ZodBranded<z.ZodString, "ModuleId", "out">]>;
 export declare const eventDelivery: z.ZodObject<{
-    consumer: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+    consumer: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.core.$ZodBranded<z.ZodString, "ModuleId", "out">]>;
     state: z.ZodEnum<{
         dead: "dead";
         delivered: "delivered";
@@ -271,6 +312,8 @@ export declare const eventDelivery: z.ZodObject<{
     at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
     error: z.ZodNullable<z.ZodString>;
     attempts: z.ZodNumber;
+    invocationId: z.ZodNullable<z.ZodString>;
+    decodeError: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type EventDelivery = z.infer<typeof eventDelivery>;
 /**
@@ -337,25 +380,23 @@ export interface InvocationEvents {
  * No payload, deliberately. The envelope is enough to open the event's own reads, and a
  * list that decoded every payload would be a disclosure decision per row.
  */
-export interface DeadLetter {
-    eventId: EventId;
-    eventType: string;
-    occurredAt: Instant;
-    /** The entity the event was about — what a reader opens next. */
-    entity: EntityRef;
-    /**
-     * The call the event came from (#1237), which is how a delivery joins its request:
-     * dispatch runs in the same post-commit tail, so the event's id is the delivery's.
-     * Null for a seed or internal call, or an event older than the column.
-     */
-    invocationId: string | null;
-    /** The consumer that gave up — a module id, or `executor:<id>` for an executor. */
-    consumer: ModuleId;
-    /** When it was last attempted, which for a dead row is when it gave up. */
-    at: Instant;
-    error: string;
-    attempts: number;
-}
+export declare const deadLetter: z.ZodObject<{
+    eventId: z.core.$ZodBranded<z.ZodString, "EventId", "out">;
+    eventType: z.ZodString;
+    occurredAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    entity: z.ZodObject<{
+        entityType: z.ZodString;
+        entityId: z.ZodString;
+    }, z.core.$strip>;
+    invocationId: z.ZodNullable<z.ZodString>;
+    attemptInvocationId: z.ZodNullable<z.ZodString>;
+    consumer: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.core.$ZodBranded<z.ZodString, "ModuleId", "out">]>;
+    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    error: z.ZodString;
+    attempts: z.ZodNumber;
+    decodeError: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DeadLetter = z.infer<typeof deadLetter>;
 /**
  * One event as it leaves the scope for Tier 2 (#1334) — the exact-history lake
  * the master plan commits to (§5.3: "domain events → Pipelines → Iceberg on R2").
@@ -392,6 +433,8 @@ export declare const drainedEvent: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
     entity: z.ZodObject<{
         entityType: z.ZodString;
@@ -440,8 +483,23 @@ export type DrainedEvent = z.infer<typeof drainedEvent>;
  * not, and the final 0 is the only proof the window is exhausted.
  */
 export declare const REDRAIN_BATCH = 5000;
+/**
+ * `countOnly` (#1545): answer how many rows the window holds and reopen NOTHING.
+ *
+ * Optional, and absent means the reopen this verb has always performed — so every caller
+ * written before it keeps its behaviour. It exists because a dry run had no way to ask the
+ * one question it is run to answer: `redrainEvents` only ever reopened, so a caller could
+ * either learn the number by changing the rows or learn nothing. `pnpm lake:redrain
+ * --dry-run` was the honest version of the second.
+ *
+ * A count is UNBOUNDED where the reopen is batched at `REDRAIN_BATCH`: an aggregate
+ * materialises no rows, so the Durable-Object request budget that forces the batch does not
+ * apply. It therefore answers for the WHOLE window in one call — which is also why it is not
+ * comparable to a single reopen call's return value, only to the sum of the loop.
+ */
 export declare const redrainEventsInput: z.ZodObject<{
     drainedBefore: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    countOnly: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type RedrainEventsInput = z.infer<typeof redrainEventsInput>;
 //# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EASL,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,UAAU,CAAC;AAIlB,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD,eAAO,MAAM,QAAQ;;;;EAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,SAAS,aAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW;;iBAAiC,CAAC;AAC1D;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;;iBAA8C,CAAC;AAC1E,eAAO,MAAM,KAAK;;;;mBAAsD,CAAC;AACzE,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;iBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAiBpE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBASD,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AA+ChE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA6C,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiEvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;EA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;EAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,aAAa;;;;;;;;;;iBASxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;EAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,EAAE,QAAQ,CAAC;IACnB,2EAA2E;IAC3E,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CG,CAAC;AAC7B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,OAAQ,CAAC;AAEnC,eAAO,MAAM,kBAAkB;;iBAAuC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD,eAAO,MAAM,QAAQ;;;;EAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,SAAS,aAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW;;iBAAiC,CAAC;AAC1D;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;;iBAA8C,CAAC;AAC1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;iBAAyC,CAAC;AACtE,eAAO,MAAM,KAAK;;;;;;mBAAuE,CAAC;AAC1F,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;iBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAiBpE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBASD,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AA+ChE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA6C,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;iBAwBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiEvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;EAiCxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;EAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,+HAM3B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;iBA+BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;EAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;iBA2CrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CG,CAAC;AAC7B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,OAAQ,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB;;;iBAA0E,CAAC;AAC1G,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/events.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { dataSubjectId, eventId, instant, moduleId, permissionKey, principalId, scopeId, tenantId, } from './ids.js';
+import { capabilityId, dataSubjectId, eventId, instant, moduleId, permissionKey, principalId, scopeId, tenantId, } from './ids.js';
 import { impersonationStamp } from './impersonation.js';
 // Opaque ref — the kernel owns no entities (D-1); attachment contracts bind here.
 export const entityRef = z.object({
@@ -23,7 +23,17 @@ export const systemActor = z.object({ system: moduleId });
  * who did not.
  */
 export const connectorActor = z.object({ connection: z.string().min(1) });
-export const actor = z.union([principalId, systemActor, connectorActor]);
+/**
+ * WHOEVER HELD A CAPABILITY acted — a link share, a claim link (#1672).
+ *
+ * The fourth member, and a member rather than a principal for #97's reason: the
+ * person holding a link is nobody the checker knows, and recording them as a
+ * principal would put a person in the trail who does not exist. The id names the
+ * capability's directory row, which says who minted it, for what, and until when —
+ * so the trail can answer "reached through Anna's link" without inventing a guest.
+ */
+export const capabilityActor = z.object({ capability: capabilityId });
+export const actor = z.union([principalId, systemActor, connectorActor, capabilityActor]);
 /**
  * What authorized a mutation (K-34). Each entry is a permission the emitting operation
  * checked-and-passed; `grant` — present only when the allow resolved through a
@@ -137,6 +147,25 @@ export const timelineEntry = z.object({
     type: eventType,
     occurredAt: instant,
     actor,
+    /**
+     * Why this entry could not be read whole (#1636). ABSENT on every row the kernel
+     * wrote, which is what "decoded whole" looks like, so a healthy page reads exactly
+     * as it did before.
+     *
+     * An entity's history is a LIST, and a strict decode let one row whose JSON would
+     * not parse throw for the whole page — and end a cause walk in an exception rather
+     * than at the link it could not read. So the read is tolerant and SAYS SO: every
+     * column that did not decode is named here, and its field comes back EMPTY rather
+     * than guessed at — `actor` as the self-naming `{ system: 'undecodable' }` marker,
+     * a JSON field as `null`. Every field still satisfies this schema; a row whose id,
+     * type, time or PII class does not is never returned as one of these at all.
+     *
+     * On a history entry this is what separates an undecodable `payload` from an
+     * ERASED one: both read `null`, and only an erasure is a fact about the event.
+     *
+     * Reachable without a forge: `importDump` replays a dump's rows verbatim.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /**
  * A timeline entry plus what a history VIEW needs — the second layer of #800.
@@ -249,6 +278,11 @@ export const causeTerminal = z.enum([
      * A cause named an event this scope's outbox does not hold. Should not happen —
      * the spine is append-only and never pruned — so it is reported rather than
      * smoothed over: silently stopping here would look exactly like a complete chain.
+     *
+     * Also the ending when the last entry's cause could not be DECODED (#1636 — its
+     * `decodeError` names `caused_by` or `operation`): the trail cannot be followed
+     * further, and reading the undecodable cause as a null one would call a fragment
+     * a complete chain.
      */
     'missing',
     /**
@@ -288,15 +322,60 @@ export const deliveryState = z.enum([
     /** Ran, threw, and will not be tried again. The failure stands. */
     'dead',
 ]);
+/**
+ * Who a delivery row belongs to (#1643): a module id, or `executor:<id>` for an executor.
+ *
+ * `_substrat_deliveries.consumer_module` holds both, and the contract typed it as a bare
+ * `ModuleId` — which a decode cannot honour, since `executor:mailer` is not one (the colon).
+ * The cast hid that; a decode against `moduleId` would have thrown on every healthy executor
+ * row. So the schema names the two shapes the column holds. The inferred type is unchanged
+ * (`ModuleId`), and every value the old one accepted is still accepted.
+ *
+ * The `executor:` branch matches the WRITER, not a tidier id. `registerExecutor` and
+ * `registerConnector` accept any string (`scope-host.ts`) and both adapters persist
+ * `executor:${id}`, so the kernel can itself write `executor:` with an empty id, or one with a
+ * newline. A reader that refused those would throw the whole dead-letter page or effects walk on
+ * a healthy delivery. It accepts whatever registration could have produced; tightening
+ * registration is a contract change, and #1645 carries it.
+ */
+export const deliveryConsumer = z.union([
+    moduleId,
+    z
+        .string()
+        .startsWith('executor:')
+        .brand(),
+]);
 export const eventDelivery = z.object({
-    /** The module whose consumer this row is about. */
-    consumer: moduleId,
+    /** The module whose consumer this row is about — or `executor:<id>`, see `deliveryConsumer`. */
+    consumer: deliveryConsumer,
     state: deliveryState,
     /** Delivered: when. Retrying or dead: when it was last attempted. */
     at: instant,
     /** The thrown message, for a row that is not `delivered`. */
     error: z.string().nullable(),
     attempts: z.number().int().nonnegative(),
+    /**
+     * The invocation the attempt `at` dates ran in (#1525), or null.
+     *
+     * NOT the event's — that one is on the outbox, and a delivery already joins to it
+     * through its event id. This is the call that attempted the DELIVERY, which for an
+     * executor is a different fact: attempt one runs in the emitting call's post-commit
+     * tail, and every retry after it in a drain that is another call or none. It moves
+     * with the row, like `at`, `error` and `attempts`, so it describes the latest
+     * attempt rather than the first.
+     *
+     * Null is two facts, as ever: the attempt carried no call (a scheduled drain, an
+     * alarm, a seed, an attachment RPC), or the row predates the column.
+     */
+    invocationId: z.string().nullable(),
+    /**
+     * Why this delivery could not be read whole (#1643). ABSENT on every row the kernel
+     * wrote. A nullable column that broke its schema reads as `null` beside this reason;
+     * `state` is resolved from the stored `next_attempt_at` and `error`, so it stays the
+     * fact even when `error` itself did not decode. A row whose consumer, time or
+     * `attempts` does not decode is never returned as one of these at all.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /** How far the forward walk got, with the same care as `causeTerminal`. */
 export const effectsTerminal = z.enum([
@@ -313,6 +392,62 @@ export const effectsTerminal = z.enum([
      */
     'cycle',
 ]);
+/**
+ * One delivery that gave up (#1525), with enough of its event to find it again —
+ * `readDeadLetters`' entry.
+ *
+ * The scope-wide read `walkEventEffects` could not be: that walk reaches a delivery
+ * only THROUGH its event, so a dead letter was visible only to someone who already knew
+ * which record to open. An in-scope consumer does not retry, so one failure is terminal
+ * and these rows wait for a human.
+ *
+ * No payload, deliberately. The envelope is enough to open the event's own reads, and a
+ * list that decoded every payload would be a disclosure decision per row.
+ */
+export const deadLetter = z.object({
+    eventId,
+    eventType,
+    occurredAt: instant,
+    /** The entity the event was about — what a reader opens next. */
+    entity: entityRef,
+    /**
+     * The call the EVENT came from (#1237). Null for a seed or internal call, or an
+     * event older than the column.
+     *
+     * It is not, in general, the call that attempted the delivery — see
+     * `attemptInvocationId`, which is. This one said it was until #1525 put the
+     * delivery's own id beside it, and the rows in this very list are where the two
+     * come apart most often.
+     */
+    invocationId: z.string().nullable(),
+    /**
+     * The call the LAST attempt ran in (#1525) — the one that gave up, since these rows
+     * are terminal. Pairs with `at`, which is when that attempt happened.
+     *
+     * Usually NOT `invocationId`: an executor's first attempt runs in the emitting
+     * call's post-commit tail, and every retry after it in a drain that is a different
+     * call or none. A row that exhausted its attempts therefore most often names a
+     * later call, or null. An in-scope consumer does not retry, so for those two the
+     * ids do agree — and that agreement is a fact about consumers, not a rule.
+     *
+     * Null is two facts: the attempt carried no call (a drain, an alarm, a seed), or
+     * the row predates the column.
+     */
+    attemptInvocationId: z.string().nullable(),
+    /** The consumer that gave up — a module id, or `executor:<id>` for an executor. */
+    consumer: deliveryConsumer,
+    /** When it was last attempted, which for a dead row is when it gave up. */
+    at: instant,
+    error: z.string(),
+    attempts: z.number().int().nonnegative(),
+    /**
+     * Why this row could not be read whole (#1643). ABSENT on every row the kernel wrote.
+     * Only the two invocation ids are nullable columns, so those are what can come back
+     * `null` beside this reason; a row whose event id, type, time, entity, consumer, error
+     * or `attempts` does not decode is never returned as one of these at all.
+     */
+    decodeError: z.string().min(1).optional(),
+});
 /**
  * One event as it leaves the scope for Tier 2 (#1334) — the exact-history lake
  * the master plan commits to (§5.3: "domain events → Pipelines → Iceberg on R2").
@@ -410,5 +545,19 @@ export const drainedEvent = domainEventShape
  * not, and the final 0 is the only proof the window is exhausted.
  */
 export const REDRAIN_BATCH = 5_000;
-export const redrainEventsInput = z.object({ drainedBefore: instant });
+/**
+ * `countOnly` (#1545): answer how many rows the window holds and reopen NOTHING.
+ *
+ * Optional, and absent means the reopen this verb has always performed — so every caller
+ * written before it keeps its behaviour. It exists because a dry run had no way to ask the
+ * one question it is run to answer: `redrainEvents` only ever reopened, so a caller could
+ * either learn the number by changing the rows or learn nothing. `pnpm lake:redrain
+ * --dry-run` was the honest version of the second.
+ *
+ * A count is UNBOUNDED where the reopen is batched at `REDRAIN_BATCH`: an aggregate
+ * materialises no rows, so the Durable-Object request budget that forces the batch does not
+ * apply. It therefore answers for the WHOLE window in one call — which is also why it is not
+ * comparable to a single reopen call's return value, only to the sum of the loop.
+ */
+export const redrainEventsInput = z.object({ drainedBefore: instant, countOnly: z.boolean().optional() });
 //# sourceMappingURL=events.js.map

package/dist/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,OAAO,EACP,OAAO,EACP,QAAQ,EACR,aAAa,EACb,WAAW,EACX,OAAO,EACP,QAAQ,GAIT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAGH,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAGzE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,sBAAsB,CAAC;SAC7B,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,CACnB,GAAgD,EAChD,GAAoB,EACd,EAAE;IACR,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,2CAA2C,GAAG,CAAC,QAAQ,sDAAsD;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,EAAE,EAAE,OAAO,EAAE,uEAAuE;IACpF,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,OAAO,EAAE,oBAAoB;IACzC,QAAQ,EAAE,mEAAmE;IAC7E,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,kFAAkF;IAClF,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,2EAA2E;IAC3E,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,0EAA0E;IAC1E,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,qEAAqE;IACrE,uEAAuE;IACvE,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEL,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;AAGtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,SAAS;IACf,UAAU,EAAE,OAAO;IACnB,KAAK;CACN,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC;;;OAGG;IACH,WAAW;IACX;;;;;OAKG;IACH,YAAY;IACZ,oFAAoF;IACpF,OAAO;IACP;;;;OAIG;IACH,SAAS;IACT;;;;;OAKG;IACH,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC5B,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,8BAA8B;IAC9B,WAAW;IACX,kFAAkF;IAClF,UAAU;IACV,mEAAmE;IACnE,MAAM;CACP,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,mDAAmD;IACnD,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,aAAa;IACpB,qEAAqE;IACrE,EAAE,EAAE,OAAO;IACX,6DAA6D;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC;AA2BH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,0DAA0D;IAC1D,UAAU;IACV,8CAA8C;IAC9C,OAAO;IACP,2DAA2D;IAC3D,SAAS;IACT;;;;OAIG;IACH,OAAO;CACR,CAAC,CAAC;AA0DH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,4EAA4E;AAC5E,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB;KACzC,MAAM,CAAC;IACN;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC"}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,OAAO,EACP,OAAO,EACP,QAAQ,EACR,aAAa,EACb,WAAW,EACX,OAAO,EACP,QAAQ,GAIT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAGH,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAG1F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,sBAAsB,CAAC;SAC7B,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,CACnB,GAAgD,EAChD,GAAoB,EACd,EAAE;IACR,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,2CAA2C,GAAG,CAAC,QAAQ,sDAAsD;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,EAAE,EAAE,OAAO,EAAE,uEAAuE;IACpF,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,OAAO,EAAE,oBAAoB;IACzC,QAAQ,EAAE,mEAAmE;IAC7E,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,kFAAkF;IAClF,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,2EAA2E;IAC3E,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,0EAA0E;IAC1E,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,qEAAqE;IACrE,uEAAuE;IACvE,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEL,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;AAGtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,SAAS;IACf,UAAU,EAAE,OAAO;IACnB,KAAK;IACL;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC;;;OAGG;IACH,WAAW;IACX;;;;;OAKG;IACH,YAAY;IACZ,oFAAoF;IACpF,OAAO;IACP;;;;;;;;;OASG;IACH,SAAS;IACT;;;;;OAKG;IACH,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC5B,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,8BAA8B;IAC9B,WAAW;IACX,kFAAkF;IAClF,UAAU;IACV,mEAAmE;IACnE,MAAM;CACP,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC;IACtC,QAAQ;IACR,CAAC;SACE,MAAM,EAAE;SACR,UAAU,CAAC,WAAW,CAAC;SACvB,KAAK,EAAc;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,gGAAgG;IAChG,QAAQ,EAAE,gBAAgB;IAC1B,KAAK,EAAE,aAAa;IACpB,qEAAqE;IACrE,EAAE,EAAE,OAAO;IACX,6DAA6D;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AA2BH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,0DAA0D;IAC1D,UAAU;IACV,8CAA8C;IAC9C,OAAO;IACP,2DAA2D;IAC3D,SAAS;IACT;;;;OAIG;IACH,OAAO;CACR,CAAC,CAAC;AA0BH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO;IACP,SAAS;IACT,UAAU,EAAE,OAAO;IACnB,iEAAiE;IACjE,MAAM,EAAE,SAAS;IACjB;;;;;;;;OAQG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,mFAAmF;IACnF,QAAQ,EAAE,gBAAgB;IAC1B,2EAA2E;IAC3E,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,4EAA4E;AAC5E,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB;KACzC,MAAM,CAAC;IACN;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC"}

package/dist/ids.d.ts

@@ -15,6 +15,8 @@ export declare const platformRequestId: z.core.$ZodBranded<z.ZodString, "Platfor
 export type PlatformRequestId = z.infer<typeof platformRequestId>;
 export declare const dataSubjectId: z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">;
 export type DataSubjectId = z.infer<typeof dataSubjectId>;
+export declare const capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+export type CapabilityId = z.infer<typeof capabilityId>;
 export declare const moduleId: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
 export type ModuleId = z.infer<typeof moduleId>;
 /**
@@ -57,6 +59,16 @@ export type Instant = z.infer<typeof instant>;
  */
 export declare const calendarDate: z.ZodISODate;
 export type CalendarDate = z.infer<typeof calendarDate>;
+/**
+ * The longest permission key, in bytes (#1655). Not a style choice: the checker finds
+ * a subject's grants with `relation LIKE 'granted:<key>%'`, and a Durable Object's
+ * SQLite refuses any LIKE pattern over 50 bytes — node's allows 50 000, so no node
+ * suite can see it. `granted:` is 8 bytes and `%` is 1, leaving 41. A longer key would
+ * parse, deploy, and then make every check of it throw on a hosted scope. The key
+ * alphabet is ASCII, so characters are bytes; it has no `_` or `%`, so it needs no
+ * escaping inside the pattern either.
+ */
+export declare const PERMISSION_KEY_MAX_LENGTH = 41;
 export declare const permissionKey: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
 export type PermissionKey = z.infer<typeof permissionKey>;
 export declare const slug: z.ZodString;

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMtD,eAAO,MAAM,KAAK,iDAA0C,CAAC;AAC7D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAK1C,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAK9C,eAAO,MAAM,iBAAiB,6DAAsD,CAAC;AACrF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,mDAOC,CAAC;AACtB,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,cAAe,CAAC;AACzC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,aAAa,yDAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,aAEwD,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMtD,eAAO,MAAM,KAAK,iDAA0C,CAAC;AAC7D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAK1C,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAK9C,eAAO,MAAM,iBAAiB,6DAAsD,CAAC;AACrF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAO1D,eAAO,MAAM,YAAY,wDAAiD,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,mDAOC,CAAC;AACtB,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,cAAe,CAAC;AACzC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAG5C,eAAO,MAAM,aAAa,yDAIC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,aAEwD,CAAC"}

package/dist/ids.js

@@ -21,6 +21,12 @@ export const eventId = z.string().regex(ULID).brand();
 // other id so a request id can't be confused with an event or scope id.
 export const platformRequestId = z.string().regex(ULID).brand();
 export const dataSubjectId = z.string().regex(ULID).brand();
+// A capability (#1672) — authority carried by a secret rather than held by a principal:
+// "anyone with this link may read this folder until Friday". Branded distinctly from
+// PrincipalId for the reason PlatformActorId is: whoever holds the link is not a person
+// the checker knows, and an audit view that showed one as a principal would be lying.
+// The id names the directory row; the SECRET is a separate value only its hash is kept of.
+export const capabilityId = z.string().regex(ULID).brand();
 // npm-package-shaped, e.g. '@substrat-run/engine-workorder'
 export const moduleId = z
     .string()
@@ -71,10 +77,21 @@ export const instant = z
  * field it already exposes without changing any caller's type.
  */
 export const calendarDate = z.iso.date();
+/**
+ * The longest permission key, in bytes (#1655). Not a style choice: the checker finds
+ * a subject's grants with `relation LIKE 'granted:<key>%'`, and a Durable Object's
+ * SQLite refuses any LIKE pattern over 50 bytes — node's allows 50 000, so no node
+ * suite can see it. `granted:` is 8 bytes and `%` is 1, leaving 41. A longer key would
+ * parse, deploy, and then make every check of it throw on a hosted scope. The key
+ * alphabet is ASCII, so characters are bytes; it has no `_` or `%`, so it needs no
+ * escaping inside the pattern either.
+ */
+export const PERMISSION_KEY_MAX_LENGTH = 41;
 // Module-namespaced permission key, e.g. 'workorder:create'
 export const permissionKey = z
     .string()
     .regex(/^[a-z0-9-]+:[a-z0-9-]+$/)
+    .max(PERMISSION_KEY_MAX_LENGTH)
     .brand();
 export const slug = z.string().regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
 /**

package/dist/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;AAG7D,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,sGAAsG;AACtG,sGAAsG;AACtG,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAuB,CAAC;AAGrF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAC1B,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACf,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC,CAAC;KACD,KAAK,EAAa,CAAC;AAGtB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAGzC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CAAC,uEAAuE,CAAC,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;AAG7D,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,sGAAsG;AACtG,sGAAsG;AACtG,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAuB,CAAC;AAGrF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,wFAAwF;AACxF,qFAAqF;AACrF,wFAAwF;AACxF,sFAAsF;AACtF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAkB,CAAC;AAG3E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAC1B,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACf,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC,CAAC;KACD,KAAK,EAAa,CAAC;AAGtB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAGzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,GAAG,CAAC,yBAAyB,CAAC;KAC9B,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CAAC,uEAAuE,CAAC,CAAC"}

package/dist/index.d.ts

@@ -31,6 +31,7 @@ export * from './control-plane.js';
 export * from './permission.js';
 export * from './impersonation.js';
 export * from './events.js';
+export * from './capability.js';
 export * from './errors.js';
 export * from './platform-request.js';
 export * from './denial.js';
@@ -47,4 +48,5 @@ export * from './client-context.js';
 export * from './model-usage.js';
 export * from './seam.js';
 export * from './signals.js';
+export * from './mcp.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}