@substrat-run/contracts 0.116.0 → 0.118.0

package/dist/events.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import { type EventId, type Instant, type ModuleId } from './ids.js';
 export declare const entityRef: z.ZodObject<{
     entityType: z.ZodString;
     entityId: z.ZodString;
@@ -28,10 +27,24 @@ export declare const systemActor: z.ZodObject<{
 export declare const connectorActor: z.ZodObject<{
     connection: z.ZodString;
 }, z.core.$strip>;
+/**
+ * WHOEVER HELD A CAPABILITY acted — a link share, a claim link (#1672).
+ *
+ * The fourth member, and a member rather than a principal for #97's reason: the
+ * person holding a link is nobody the checker knows, and recording them as a
+ * principal would put a person in the trail who does not exist. The id names the
+ * capability's directory row, which says who minted it, for what, and until when —
+ * so the trail can answer "reached through Anna's link" without inventing a guest.
+ */
+export declare const capabilityActor: z.ZodObject<{
+    capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+}, z.core.$strip>;
 export declare const actor: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
     system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
 }, z.core.$strip>, z.ZodObject<{
     connection: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
 }, z.core.$strip>]>;
 export type Actor = z.infer<typeof actor>;
 /**
@@ -78,6 +91,8 @@ export declare const domainEvent: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
     entity: z.ZodObject<{
         entityType: z.ZodString;
@@ -132,7 +147,10 @@ export declare const timelineEntry: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
+    decodeError: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type TimelineEntry = z.infer<typeof timelineEntry>;
 /**
@@ -165,7 +183,10 @@ export declare const historyEntry: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
+    decodeError: z.ZodOptional<z.ZodString>;
     payload: z.ZodUnknown;
     authorization: z.ZodNullable<z.ZodArray<z.ZodObject<{
         permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
@@ -216,7 +237,10 @@ export declare const causeChain: z.ZodObject<{
             system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
         }, z.core.$strip>, z.ZodObject<{
             connection: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
         }, z.core.$strip>]>;
+        decodeError: z.ZodOptional<z.ZodString>;
         payload: z.ZodUnknown;
         authorization: z.ZodNullable<z.ZodArray<z.ZodObject<{
             permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
@@ -261,8 +285,25 @@ export declare const deliveryState: z.ZodEnum<{
     retrying: "retrying";
 }>;
 export type DeliveryState = z.infer<typeof deliveryState>;
+/**
+ * Who a delivery row belongs to (#1643): a module id, or `executor:<id>` for an executor.
+ *
+ * `_substrat_deliveries.consumer_module` holds both, and the contract typed it as a bare
+ * `ModuleId` — which a decode cannot honour, since `executor:mailer` is not one (the colon).
+ * The cast hid that; a decode against `moduleId` would have thrown on every healthy executor
+ * row. So the schema names the two shapes the column holds. The inferred type is unchanged
+ * (`ModuleId`), and every value the old one accepted is still accepted.
+ *
+ * The `executor:` branch matches the WRITER, not a tidier id. `registerExecutor` and
+ * `registerConnector` accept any string (`scope-host.ts`) and both adapters persist
+ * `executor:${id}`, so the kernel can itself write `executor:` with an empty id, or one with a
+ * newline. A reader that refused those would throw the whole dead-letter page or effects walk on
+ * a healthy delivery. It accepts whatever registration could have produced; tightening
+ * registration is a contract change, and #1645 carries it.
+ */
+export declare const deliveryConsumer: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.core.$ZodBranded<z.ZodString, "ModuleId", "out">]>;
 export declare const eventDelivery: z.ZodObject<{
-    consumer: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+    consumer: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.core.$ZodBranded<z.ZodString, "ModuleId", "out">]>;
     state: z.ZodEnum<{
         dead: "dead";
         delivered: "delivered";
@@ -272,6 +313,7 @@ export declare const eventDelivery: z.ZodObject<{
     error: z.ZodNullable<z.ZodString>;
     attempts: z.ZodNumber;
     invocationId: z.ZodNullable<z.ZodString>;
+    decodeError: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type EventDelivery = z.infer<typeof eventDelivery>;
 /**
@@ -338,43 +380,23 @@ export interface InvocationEvents {
  * No payload, deliberately. The envelope is enough to open the event's own reads, and a
  * list that decoded every payload would be a disclosure decision per row.
  */
-export interface DeadLetter {
-    eventId: EventId;
-    eventType: string;
-    occurredAt: Instant;
-    /** The entity the event was about — what a reader opens next. */
-    entity: EntityRef;
-    /**
-     * The call the EVENT came from (#1237). Null for a seed or internal call, or an
-     * event older than the column.
-     *
-     * It is not, in general, the call that attempted the delivery — see
-     * `attemptInvocationId`, which is. This one said it was until #1525 put the
-     * delivery's own id beside it, and the rows in this very list are where the two
-     * come apart most often.
-     */
-    invocationId: string | null;
-    /**
-     * The call the LAST attempt ran in (#1525) — the one that gave up, since these rows
-     * are terminal. Pairs with `at`, which is when that attempt happened.
-     *
-     * Usually NOT `invocationId`: an executor's first attempt runs in the emitting
-     * call's post-commit tail, and every retry after it in a drain that is a different
-     * call or none. A row that exhausted its attempts therefore most often names a
-     * later call, or null. An in-scope consumer does not retry, so for those two the
-     * ids do agree — and that agreement is a fact about consumers, not a rule.
-     *
-     * Null is two facts: the attempt carried no call (a drain, an alarm, a seed), or
-     * the row predates the column.
-     */
-    attemptInvocationId: string | null;
-    /** The consumer that gave up — a module id, or `executor:<id>` for an executor. */
-    consumer: ModuleId;
-    /** When it was last attempted, which for a dead row is when it gave up. */
-    at: Instant;
-    error: string;
-    attempts: number;
-}
+export declare const deadLetter: z.ZodObject<{
+    eventId: z.core.$ZodBranded<z.ZodString, "EventId", "out">;
+    eventType: z.ZodString;
+    occurredAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    entity: z.ZodObject<{
+        entityType: z.ZodString;
+        entityId: z.ZodString;
+    }, z.core.$strip>;
+    invocationId: z.ZodNullable<z.ZodString>;
+    attemptInvocationId: z.ZodNullable<z.ZodString>;
+    consumer: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.core.$ZodBranded<z.ZodString, "ModuleId", "out">]>;
+    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    error: z.ZodString;
+    attempts: z.ZodNumber;
+    decodeError: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DeadLetter = z.infer<typeof deadLetter>;
 /**
  * One event as it leaves the scope for Tier 2 (#1334) — the exact-history lake
  * the master plan commits to (§5.3: "domain events → Pipelines → Iceberg on R2").
@@ -411,6 +433,8 @@ export declare const drainedEvent: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
     entity: z.ZodObject<{
         entityType: z.ZodString;

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EASL,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,UAAU,CAAC;AAIlB,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD,eAAO,MAAM,QAAQ;;;;EAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,SAAS,aAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW;;iBAAiC,CAAC;AAC1D;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;;iBAA8C,CAAC;AAC1E,eAAO,MAAM,KAAK;;;;mBAAsD,CAAC;AACzE,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;iBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAiBpE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBASD,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AA+ChE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA6C,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiEvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;EA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;EAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,aAAa;;;;;;;;;;;iBAuBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;EAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,MAAM,EAAE,SAAS,CAAC;IAClB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,mFAAmF;IACnF,QAAQ,EAAE,QAAQ,CAAC;IACnB,2EAA2E;IAC3E,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CG,CAAC;AAC7B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,OAAQ,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB;;;iBAA0E,CAAC;AAC1G,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD,eAAO,MAAM,QAAQ;;;;EAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,SAAS,aAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW;;iBAAiC,CAAC;AAC1D;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;;iBAA8C,CAAC;AAC1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;iBAAyC,CAAC;AACtE,eAAO,MAAM,KAAK;;;;;;mBAAuE,CAAC;AAC1F,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;iBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAiBpE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBASD,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AA+ChE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA6C,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;iBAwBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiEvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;EAiCxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;EAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,+HAM3B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;iBA+BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;EAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;iBA2CrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CG,CAAC;AAC7B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,OAAQ,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB;;;iBAA0E,CAAC;AAC1G,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/events.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { dataSubjectId, eventId, instant, moduleId, permissionKey, principalId, scopeId, tenantId, } from './ids.js';
+import { capabilityId, dataSubjectId, eventId, instant, moduleId, permissionKey, principalId, scopeId, tenantId, } from './ids.js';
 import { impersonationStamp } from './impersonation.js';
 // Opaque ref — the kernel owns no entities (D-1); attachment contracts bind here.
 export const entityRef = z.object({
@@ -23,7 +23,17 @@ export const systemActor = z.object({ system: moduleId });
  * who did not.
  */
 export const connectorActor = z.object({ connection: z.string().min(1) });
-export const actor = z.union([principalId, systemActor, connectorActor]);
+/**
+ * WHOEVER HELD A CAPABILITY acted — a link share, a claim link (#1672).
+ *
+ * The fourth member, and a member rather than a principal for #97's reason: the
+ * person holding a link is nobody the checker knows, and recording them as a
+ * principal would put a person in the trail who does not exist. The id names the
+ * capability's directory row, which says who minted it, for what, and until when —
+ * so the trail can answer "reached through Anna's link" without inventing a guest.
+ */
+export const capabilityActor = z.object({ capability: capabilityId });
+export const actor = z.union([principalId, systemActor, connectorActor, capabilityActor]);
 /**
  * What authorized a mutation (K-34). Each entry is a permission the emitting operation
  * checked-and-passed; `grant` — present only when the allow resolved through a
@@ -137,6 +147,25 @@ export const timelineEntry = z.object({
     type: eventType,
     occurredAt: instant,
     actor,
+    /**
+     * Why this entry could not be read whole (#1636). ABSENT on every row the kernel
+     * wrote, which is what "decoded whole" looks like, so a healthy page reads exactly
+     * as it did before.
+     *
+     * An entity's history is a LIST, and a strict decode let one row whose JSON would
+     * not parse throw for the whole page — and end a cause walk in an exception rather
+     * than at the link it could not read. So the read is tolerant and SAYS SO: every
+     * column that did not decode is named here, and its field comes back EMPTY rather
+     * than guessed at — `actor` as the self-naming `{ system: 'undecodable' }` marker,
+     * a JSON field as `null`. Every field still satisfies this schema; a row whose id,
+     * type, time or PII class does not is never returned as one of these at all.
+     *
+     * On a history entry this is what separates an undecodable `payload` from an
+     * ERASED one: both read `null`, and only an erasure is a fact about the event.
+     *
+     * Reachable without a forge: `importDump` replays a dump's rows verbatim.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /**
  * A timeline entry plus what a history VIEW needs — the second layer of #800.
@@ -249,6 +278,11 @@ export const causeTerminal = z.enum([
      * A cause named an event this scope's outbox does not hold. Should not happen —
      * the spine is append-only and never pruned — so it is reported rather than
      * smoothed over: silently stopping here would look exactly like a complete chain.
+     *
+     * Also the ending when the last entry's cause could not be DECODED (#1636 — its
+     * `decodeError` names `caused_by` or `operation`): the trail cannot be followed
+     * further, and reading the undecodable cause as a null one would call a fragment
+     * a complete chain.
      */
     'missing',
     /**
@@ -288,9 +322,32 @@ export const deliveryState = z.enum([
     /** Ran, threw, and will not be tried again. The failure stands. */
     'dead',
 ]);
+/**
+ * Who a delivery row belongs to (#1643): a module id, or `executor:<id>` for an executor.
+ *
+ * `_substrat_deliveries.consumer_module` holds both, and the contract typed it as a bare
+ * `ModuleId` — which a decode cannot honour, since `executor:mailer` is not one (the colon).
+ * The cast hid that; a decode against `moduleId` would have thrown on every healthy executor
+ * row. So the schema names the two shapes the column holds. The inferred type is unchanged
+ * (`ModuleId`), and every value the old one accepted is still accepted.
+ *
+ * The `executor:` branch matches the WRITER, not a tidier id. `registerExecutor` and
+ * `registerConnector` accept any string (`scope-host.ts`) and both adapters persist
+ * `executor:${id}`, so the kernel can itself write `executor:` with an empty id, or one with a
+ * newline. A reader that refused those would throw the whole dead-letter page or effects walk on
+ * a healthy delivery. It accepts whatever registration could have produced; tightening
+ * registration is a contract change, and #1645 carries it.
+ */
+export const deliveryConsumer = z.union([
+    moduleId,
+    z
+        .string()
+        .startsWith('executor:')
+        .brand(),
+]);
 export const eventDelivery = z.object({
-    /** The module whose consumer this row is about. */
-    consumer: moduleId,
+    /** The module whose consumer this row is about — or `executor:<id>`, see `deliveryConsumer`. */
+    consumer: deliveryConsumer,
     state: deliveryState,
     /** Delivered: when. Retrying or dead: when it was last attempted. */
     at: instant,
@@ -311,6 +368,14 @@ export const eventDelivery = z.object({
      * alarm, a seed, an attachment RPC), or the row predates the column.
      */
     invocationId: z.string().nullable(),
+    /**
+     * Why this delivery could not be read whole (#1643). ABSENT on every row the kernel
+     * wrote. A nullable column that broke its schema reads as `null` beside this reason;
+     * `state` is resolved from the stored `next_attempt_at` and `error`, so it stays the
+     * fact even when `error` itself did not decode. A row whose consumer, time or
+     * `attempts` does not decode is never returned as one of these at all.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /** How far the forward walk got, with the same care as `causeTerminal`. */
 export const effectsTerminal = z.enum([
@@ -327,6 +392,62 @@ export const effectsTerminal = z.enum([
      */
     'cycle',
 ]);
+/**
+ * One delivery that gave up (#1525), with enough of its event to find it again —
+ * `readDeadLetters`' entry.
+ *
+ * The scope-wide read `walkEventEffects` could not be: that walk reaches a delivery
+ * only THROUGH its event, so a dead letter was visible only to someone who already knew
+ * which record to open. An in-scope consumer does not retry, so one failure is terminal
+ * and these rows wait for a human.
+ *
+ * No payload, deliberately. The envelope is enough to open the event's own reads, and a
+ * list that decoded every payload would be a disclosure decision per row.
+ */
+export const deadLetter = z.object({
+    eventId,
+    eventType,
+    occurredAt: instant,
+    /** The entity the event was about — what a reader opens next. */
+    entity: entityRef,
+    /**
+     * The call the EVENT came from (#1237). Null for a seed or internal call, or an
+     * event older than the column.
+     *
+     * It is not, in general, the call that attempted the delivery — see
+     * `attemptInvocationId`, which is. This one said it was until #1525 put the
+     * delivery's own id beside it, and the rows in this very list are where the two
+     * come apart most often.
+     */
+    invocationId: z.string().nullable(),
+    /**
+     * The call the LAST attempt ran in (#1525) — the one that gave up, since these rows
+     * are terminal. Pairs with `at`, which is when that attempt happened.
+     *
+     * Usually NOT `invocationId`: an executor's first attempt runs in the emitting
+     * call's post-commit tail, and every retry after it in a drain that is a different
+     * call or none. A row that exhausted its attempts therefore most often names a
+     * later call, or null. An in-scope consumer does not retry, so for those two the
+     * ids do agree — and that agreement is a fact about consumers, not a rule.
+     *
+     * Null is two facts: the attempt carried no call (a drain, an alarm, a seed), or
+     * the row predates the column.
+     */
+    attemptInvocationId: z.string().nullable(),
+    /** The consumer that gave up — a module id, or `executor:<id>` for an executor. */
+    consumer: deliveryConsumer,
+    /** When it was last attempted, which for a dead row is when it gave up. */
+    at: instant,
+    error: z.string(),
+    attempts: z.number().int().nonnegative(),
+    /**
+     * Why this row could not be read whole (#1643). ABSENT on every row the kernel wrote.
+     * Only the two invocation ids are nullable columns, so those are what can come back
+     * `null` beside this reason; a row whose event id, type, time, entity, consumer, error
+     * or `attempts` does not decode is never returned as one of these at all.
+     */
+    decodeError: z.string().min(1).optional(),
+});
 /**
  * One event as it leaves the scope for Tier 2 (#1334) — the exact-history lake
  * the master plan commits to (§5.3: "domain events → Pipelines → Iceberg on R2").

package/dist/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,OAAO,EACP,OAAO,EACP,QAAQ,EACR,aAAa,EACb,WAAW,EACX,OAAO,EACP,QAAQ,GAIT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAGH,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAGzE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,sBAAsB,CAAC;SAC7B,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,CACnB,GAAgD,EAChD,GAAoB,EACd,EAAE;IACR,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,2CAA2C,GAAG,CAAC,QAAQ,sDAAsD;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,EAAE,EAAE,OAAO,EAAE,uEAAuE;IACpF,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,OAAO,EAAE,oBAAoB;IACzC,QAAQ,EAAE,mEAAmE;IAC7E,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,kFAAkF;IAClF,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,2EAA2E;IAC3E,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,0EAA0E;IAC1E,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,qEAAqE;IACrE,uEAAuE;IACvE,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEL,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;AAGtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,SAAS;IACf,UAAU,EAAE,OAAO;IACnB,KAAK;CACN,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC;;;OAGG;IACH,WAAW;IACX;;;;;OAKG;IACH,YAAY;IACZ,oFAAoF;IACpF,OAAO;IACP;;;;OAIG;IACH,SAAS;IACT;;;;;OAKG;IACH,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC5B,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,8BAA8B;IAC9B,WAAW;IACX,kFAAkF;IAClF,UAAU;IACV,mEAAmE;IACnE,MAAM;CACP,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,mDAAmD;IACnD,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,aAAa;IACpB,qEAAqE;IACrE,EAAE,EAAE,OAAO;IACX,6DAA6D;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AA2BH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,0DAA0D;IAC1D,UAAU;IACV,8CAA8C;IAC9C,OAAO;IACP,2DAA2D;IAC3D,SAAS;IACT;;;;OAIG;IACH,OAAO;CACR,CAAC,CAAC;AA4EH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,4EAA4E;AAC5E,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB;KACzC,MAAM,CAAC;IACN;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC"}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,OAAO,EACP,OAAO,EACP,QAAQ,EACR,aAAa,EACb,WAAW,EACX,OAAO,EACP,QAAQ,GAIT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAGH,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAG1F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,sBAAsB,CAAC;SAC7B,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,CACnB,GAAgD,EAChD,GAAoB,EACd,EAAE;IACR,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,2CAA2C,GAAG,CAAC,QAAQ,sDAAsD;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,EAAE,EAAE,OAAO,EAAE,uEAAuE;IACpF,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,OAAO,EAAE,oBAAoB;IACzC,QAAQ,EAAE,mEAAmE;IAC7E,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,kFAAkF;IAClF,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,2EAA2E;IAC3E,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,0EAA0E;IAC1E,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,qEAAqE;IACrE,uEAAuE;IACvE,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEL,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;AAGtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,SAAS;IACf,UAAU,EAAE,OAAO;IACnB,KAAK;IACL;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC;;;OAGG;IACH,WAAW;IACX;;;;;OAKG;IACH,YAAY;IACZ,oFAAoF;IACpF,OAAO;IACP;;;;;;;;;OASG;IACH,SAAS;IACT;;;;;OAKG;IACH,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC5B,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,8BAA8B;IAC9B,WAAW;IACX,kFAAkF;IAClF,UAAU;IACV,mEAAmE;IACnE,MAAM;CACP,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC;IACtC,QAAQ;IACR,CAAC;SACE,MAAM,EAAE;SACR,UAAU,CAAC,WAAW,CAAC;SACvB,KAAK,EAAc;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,gGAAgG;IAChG,QAAQ,EAAE,gBAAgB;IAC1B,KAAK,EAAE,aAAa;IACpB,qEAAqE;IACrE,EAAE,EAAE,OAAO;IACX,6DAA6D;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AA2BH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,0DAA0D;IAC1D,UAAU;IACV,8CAA8C;IAC9C,OAAO;IACP,2DAA2D;IAC3D,SAAS;IACT;;;;OAIG;IACH,OAAO;CACR,CAAC,CAAC;AA0BH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO;IACP,SAAS;IACT,UAAU,EAAE,OAAO;IACnB,iEAAiE;IACjE,MAAM,EAAE,SAAS;IACjB;;;;;;;;OAQG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,mFAAmF;IACnF,QAAQ,EAAE,gBAAgB;IAC1B,2EAA2E;IAC3E,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,4EAA4E;AAC5E,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB;KACzC,MAAM,CAAC;IACN;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC"}

package/dist/ids.d.ts

@@ -15,6 +15,8 @@ export declare const platformRequestId: z.core.$ZodBranded<z.ZodString, "Platfor
 export type PlatformRequestId = z.infer<typeof platformRequestId>;
 export declare const dataSubjectId: z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">;
 export type DataSubjectId = z.infer<typeof dataSubjectId>;
+export declare const capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+export type CapabilityId = z.infer<typeof capabilityId>;
 export declare const moduleId: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
 export type ModuleId = z.infer<typeof moduleId>;
 /**
@@ -57,6 +59,16 @@ export type Instant = z.infer<typeof instant>;
  */
 export declare const calendarDate: z.ZodISODate;
 export type CalendarDate = z.infer<typeof calendarDate>;
+/**
+ * The longest permission key, in bytes (#1655). Not a style choice: the checker finds
+ * a subject's grants with `relation LIKE 'granted:<key>%'`, and a Durable Object's
+ * SQLite refuses any LIKE pattern over 50 bytes — node's allows 50 000, so no node
+ * suite can see it. `granted:` is 8 bytes and `%` is 1, leaving 41. A longer key would
+ * parse, deploy, and then make every check of it throw on a hosted scope. The key
+ * alphabet is ASCII, so characters are bytes; it has no `_` or `%`, so it needs no
+ * escaping inside the pattern either.
+ */
+export declare const PERMISSION_KEY_MAX_LENGTH = 41;
 export declare const permissionKey: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
 export type PermissionKey = z.infer<typeof permissionKey>;
 export declare const slug: z.ZodString;

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMtD,eAAO,MAAM,KAAK,iDAA0C,CAAC;AAC7D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAK1C,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAK9C,eAAO,MAAM,iBAAiB,6DAAsD,CAAC;AACrF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,mDAOC,CAAC;AACtB,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,cAAe,CAAC;AACzC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,aAAa,yDAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,aAEwD,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMtD,eAAO,MAAM,KAAK,iDAA0C,CAAC;AAC7D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAK1C,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAK9C,eAAO,MAAM,iBAAiB,6DAAsD,CAAC;AACrF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAO1D,eAAO,MAAM,YAAY,wDAAiD,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO,mDAOC,CAAC;AACtB,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,cAAe,CAAC;AACzC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAG5C,eAAO,MAAM,aAAa,yDAIC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,aAEwD,CAAC"}

package/dist/ids.js

@@ -21,6 +21,12 @@ export const eventId = z.string().regex(ULID).brand();
 // other id so a request id can't be confused with an event or scope id.
 export const platformRequestId = z.string().regex(ULID).brand();
 export const dataSubjectId = z.string().regex(ULID).brand();
+// A capability (#1672) — authority carried by a secret rather than held by a principal:
+// "anyone with this link may read this folder until Friday". Branded distinctly from
+// PrincipalId for the reason PlatformActorId is: whoever holds the link is not a person
+// the checker knows, and an audit view that showed one as a principal would be lying.
+// The id names the directory row; the SECRET is a separate value only its hash is kept of.
+export const capabilityId = z.string().regex(ULID).brand();
 // npm-package-shaped, e.g. '@substrat-run/engine-workorder'
 export const moduleId = z
     .string()
@@ -71,10 +77,21 @@ export const instant = z
  * field it already exposes without changing any caller's type.
  */
 export const calendarDate = z.iso.date();
+/**
+ * The longest permission key, in bytes (#1655). Not a style choice: the checker finds
+ * a subject's grants with `relation LIKE 'granted:<key>%'`, and a Durable Object's
+ * SQLite refuses any LIKE pattern over 50 bytes — node's allows 50 000, so no node
+ * suite can see it. `granted:` is 8 bytes and `%` is 1, leaving 41. A longer key would
+ * parse, deploy, and then make every check of it throw on a hosted scope. The key
+ * alphabet is ASCII, so characters are bytes; it has no `_` or `%`, so it needs no
+ * escaping inside the pattern either.
+ */
+export const PERMISSION_KEY_MAX_LENGTH = 41;
 // Module-namespaced permission key, e.g. 'workorder:create'
 export const permissionKey = z
     .string()
     .regex(/^[a-z0-9-]+:[a-z0-9-]+$/)
+    .max(PERMISSION_KEY_MAX_LENGTH)
     .brand();
 export const slug = z.string().regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
 /**

package/dist/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;AAG7D,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,sGAAsG;AACtG,sGAAsG;AACtG,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAuB,CAAC;AAGrF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAC1B,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACf,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC,CAAC;KACD,KAAK,EAAa,CAAC;AAGtB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAGzC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CAAC,uEAAuE,CAAC,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;AAG7D,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,sGAAsG;AACtG,sGAAsG;AACtG,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAuB,CAAC;AAGrF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,wFAAwF;AACxF,qFAAqF;AACrF,wFAAwF;AACxF,sFAAsF;AACtF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAkB,CAAC;AAG3E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAC1B,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACf,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC,CAAC;KACD,KAAK,EAAa,CAAC;AAGtB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAGzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,GAAG,CAAC,yBAAyB,CAAC;KAC9B,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CAAC,uEAAuE,CAAC,CAAC"}

package/dist/index.d.ts

@@ -31,6 +31,7 @@ export * from './control-plane.js';
 export * from './permission.js';
 export * from './impersonation.js';
 export * from './events.js';
+export * from './capability.js';
 export * from './errors.js';
 export * from './platform-request.js';
 export * from './denial.js';
@@ -47,4 +48,7 @@ export * from './client-context.js';
 export * from './model-usage.js';
 export * from './seam.js';
 export * from './signals.js';
+export * from './mcp.js';
+export * from './auth-delivery.js';
+export * from './places.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -31,6 +31,7 @@ export * from './control-plane.js';
 export * from './permission.js';
 export * from './impersonation.js';
 export * from './events.js';
+export * from './capability.js';
 export * from './errors.js';
 export * from './platform-request.js';
 export * from './denial.js';
@@ -47,4 +48,7 @@ export * from './client-context.js';
 export * from './model-usage.js';
 export * from './seam.js';
 export * from './signals.js';
+export * from './mcp.js';
+export * from './auth-delivery.js';
+export * from './places.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,39 @@
+/**
+ * A vertical's MCP endpoint, named the ONE way both of its ends name it (#1619).
+ *
+ * The endpoint `mountOperations` mounts is an OAuth protected resource, and its identifier
+ * is a string two parties have to agree on byte for byte. The vertical publishes it in its
+ * RFC 9728 document and holds a presented token to it (`aud`). The platform registers it
+ * at the vertical's issuer, which refuses to mint for any `resource` it has no row for
+ * (RFC 8707). If each side built the string itself, one would eventually add a trailing
+ * slash the other did not, and the only symptom would be `invalid_target` at a login that
+ * never renders.
+ *
+ * So both sides call these. `@substrat-run/vertical-host` uses them for the document and
+ * for the `aud` check. The dashboard uses them for the resources it registers, one per
+ * hostname the app answers on, because the identifier is the URL a client actually
+ * reached.
+ */
+/** Where the MCP endpoint lives under a vertical's API base path: `${basePath}/mcp`. */
+export declare function mcpEndpointPath(basePath?: string): string;
+/**
+ * The fleet's convention, `/api/mcp`, which is `mountOperations`' default. It is the only
+ * path the platform can register without asking the vertical, so a vertical that mounts
+ * the endpoint elsewhere (`mcp.path`) or pins a different `resource` is not covered by
+ * the platform's registration.
+ */
+export declare const MCP_ENDPOINT_PATH: string;
+/**
+ * An MCP endpoint's resource identifier: its own absolute URL on the origin a client
+ * reached it at. `origin` is `scheme://host[:port]` with no trailing slash, which is what
+ * `new URL(…).origin` returns.
+ */
+export declare function mcpResourceOf(origin: string, path?: string): string;
+/**
+ * The delivered-config key through which the platform tells a team auth-server which MCP
+ * endpoints it may mint for: `${MCP_RESOURCES_CONFIG_PREFIX}<app scope id>`, whose value is
+ * that app's whole set as a JSON array of `mcpResourceOf` identifiers, or `""` for none.
+ * The dashboard writes it. `demos/auth-server/src/resources.ts` turns it into rows.
+ */
+export declare const MCP_RESOURCES_CONFIG_PREFIX = "substrat:resources:";
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,QAAQ,SAAS,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,MAA0B,GAAG,MAAM,CAEtF;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,wBAAwB,CAAC"}

package/dist/mcp.js

@@ -0,0 +1,43 @@
+/**
+ * A vertical's MCP endpoint, named the ONE way both of its ends name it (#1619).
+ *
+ * The endpoint `mountOperations` mounts is an OAuth protected resource, and its identifier
+ * is a string two parties have to agree on byte for byte. The vertical publishes it in its
+ * RFC 9728 document and holds a presented token to it (`aud`). The platform registers it
+ * at the vertical's issuer, which refuses to mint for any `resource` it has no row for
+ * (RFC 8707). If each side built the string itself, one would eventually add a trailing
+ * slash the other did not, and the only symptom would be `invalid_target` at a login that
+ * never renders.
+ *
+ * So both sides call these. `@substrat-run/vertical-host` uses them for the document and
+ * for the `aud` check. The dashboard uses them for the resources it registers, one per
+ * hostname the app answers on, because the identifier is the URL a client actually
+ * reached.
+ */
+/** Where the MCP endpoint lives under a vertical's API base path: `${basePath}/mcp`. */
+export function mcpEndpointPath(basePath = '/api') {
+    return `${basePath}/mcp`;
+}
+/**
+ * The fleet's convention, `/api/mcp`, which is `mountOperations`' default. It is the only
+ * path the platform can register without asking the vertical, so a vertical that mounts
+ * the endpoint elsewhere (`mcp.path`) or pins a different `resource` is not covered by
+ * the platform's registration.
+ */
+export const MCP_ENDPOINT_PATH = mcpEndpointPath();
+/**
+ * An MCP endpoint's resource identifier: its own absolute URL on the origin a client
+ * reached it at. `origin` is `scheme://host[:port]` with no trailing slash, which is what
+ * `new URL(…).origin` returns.
+ */
+export function mcpResourceOf(origin, path = MCP_ENDPOINT_PATH) {
+    return `${origin}${path}`;
+}
+/**
+ * The delivered-config key through which the platform tells a team auth-server which MCP
+ * endpoints it may mint for: `${MCP_RESOURCES_CONFIG_PREFIX}<app scope id>`, whose value is
+ * that app's whole set as a JSON array of `mcpResourceOf` identifiers, or `""` for none.
+ * The dashboard writes it. `demos/auth-server/src/resources.ts` turns it into rows.
+ */
+export const MCP_RESOURCES_CONFIG_PREFIX = 'substrat:resources:';
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAG,MAAM;IAC/C,OAAO,GAAG,QAAQ,MAAM,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,EAAE,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,IAAI,GAAW,iBAAiB;IAC5E,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAAqB,CAAC"}