@substrat-run/contracts 0.116.0 → 0.118.0

package/dist/permission.d.ts

@@ -55,9 +55,15 @@ export declare const checkSubject: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"system">;
     id: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"capability">;
+    id: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
 }, z.core.$strip>]>;
 export type CheckSubject = z.infer<typeof checkSubject>;
-/** The tuple-store ref for a subject: `principal:01J…` / `connection:01J…` / `system:@scope/mod`. */
+/**
+ * The tuple-store ref for a subject: `principal:01J…` / `connection:01J…` /
+ * `system:@scope/mod` / `capability:01J…`.
+ */
 export declare const subjectRef: (subject: CheckSubject) => string;
 /**
  * A capability granted to a CONNECTION rather than a principal (#97).
@@ -136,9 +142,10 @@ export type CapabilityGrant = z.infer<typeof capabilityGrant>;
  * Narrow by construction: it reaches only scopes of the module it names, and only
  * the one permission. It is projected from the module's declared `schedules`
  * (`scheduleSpec.permissions`) at scope provisioning, so what a schedule may do is
- * both readable in the permission diff (code) and revocable per scope (runtime — a
- * revoke fails the operation's own `ctx.check` closed, which is how scheduling is
- * disabled for a tenant without a special "off" code path).
+ * readable in the permission diff (code). Turning a scope's schedules OFF is not a
+ * revoke of one of these but the schedule kill switch, `systemSwitch` below (#1666):
+ * a per-permission revoke would leave the gate open and fail the schedule's own
+ * `ctx.check` on every pass, and a re-grant must not be able to turn it back on.
  */
 export declare const systemGrant: z.ZodObject<{
     moduleId: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
@@ -151,6 +158,63 @@ export declare const systemGrant: z.ZodObject<{
     grantedBy: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
 }, z.core.$strip>;
 export type SystemGrant = z.infer<typeof systemGrant>;
+/**
+ * The schedule kill switch (#1666) — one module's scheduled work on ONE scope, turned
+ * off by `HostAdmin.revokeFromSystem` and back on by `restoreToSystem`.
+ *
+ * **Module-wide, never per permission.** A grant is per permission and schedules share
+ * permissions, so "one schedule" is not expressible as a grant revoke without switching
+ * off its siblings too. And a per-permission revoke is worse than none: the gate would
+ * stay open on the module's other live grant, and the schedule's own `ctx.check` would
+ * then fail it on every pass — noise in place of silence.
+ *
+ * `reason` is required and lands in the admin log beside the actor, because "who turned
+ * a tenant's schedules off, and why" is the question the log exists to answer — a
+ * switch pulled in an incident has no other record of what the incident was.
+ *
+ * The scope is required: the switch is per scope. A tenant-wide form would be a
+ * different decision about blast radius, and it is not this one.
+ */
+export declare const systemSwitch: z.ZodObject<{
+    moduleId: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+    node: z.ZodObject<{
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    }, z.core.$strip>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type SystemSwitch = z.infer<typeof systemSwitch>;
+/**
+ * What the far end of the switch did in the scope's own storage (#1666) — the wire
+ * shape `/internal/system-switch` answers with, and what a local host computes itself.
+ *
+ * `held: false` means the scope holds no `system:<module>` grant and no switch marker
+ * for that module at all — a typo'd module id, or a module this scope never ran. Nothing
+ * was written. It is an answer, not an error, so that a deployment which predates the
+ * route (and answers 404) can never be mistaken for one that simply held nothing.
+ */
+export declare const systemSwitchOutcome: z.ZodObject<{
+    held: z.ZodBoolean;
+    changed: z.ZodBoolean;
+    permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+}, z.core.$strip>;
+export type SystemSwitchOutcome = z.infer<typeof systemSwitchOutcome>;
+/**
+ * What `revokeFromSystem` / `restoreToSystem` answer (#1666) — the position the switch is now
+ * in. `operationId` names this call's rows on the admin log (its intent, then its outcome),
+ * so an operator can tie what the route answered to what the log recorded.
+ */
+export declare const systemSwitchResult: z.ZodObject<{
+    operationId: z.ZodString;
+    moduleId: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+    schedules: z.ZodEnum<{
+        off: "off";
+        on: "on";
+    }>;
+    changed: z.ZodBoolean;
+    permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+}, z.core.$strip>;
+export type SystemSwitchResult = z.infer<typeof systemSwitchResult>;
 export declare const objectRef: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
 export type ObjectRef = z.infer<typeof objectRef>;
 export declare const relationName: z.ZodString;

package/dist/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;mBAUvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,UAAU,YAAa,YAAY,KAAG,MAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAahC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW;;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAgBtD,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAOhD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,QAAQ;;;;;;8BAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,aAAa,EAAE,GAC9B,MAAM,GAAG,SAAS,CAOpB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;mBAgBvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,UAAU,YAAa,YAAY,KAAG,MAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAahC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;iBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAgBpE,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAOhD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,QAAQ;;;;;;8BAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,aAAa,EAAE,GAC9B,MAAM,GAAG,SAAS,CAOpB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/permission.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { instant, moduleId, permissionKey, platformActorId, principalId, scopeId, tenantId, } from './ids.js';
+import { capabilityId, instant, moduleId, permissionKey, platformActorId, principalId, scopeId, tenantId, } from './ids.js';
 import { entityRef } from './events.js';
 // ============================================================================
 // Authored surface — what humans and agents write (design doc §4.1).
@@ -60,8 +60,17 @@ export const checkSubject = z.union([
     // `{ system: <moduleId> }` on events, so scheduled work reads as the schedule, not
     // as a human who happened to sit down at 03:00.
     z.object({ kind: z.literal('system'), id: moduleId }),
+    // WHOEVER HOLDS A CAPABILITY'S SECRET (#1672) — a link share. Resolved against the
+    // capability's own directory row rather than against tuples: the row IS the grant
+    // (one entity and its declared descendants, specific keys), no `capability:` tuple is
+    // ever written, and the minter's own authority is re-checked on every use — so a
+    // capability can never hold more than the principal who minted it holds right now.
+    z.object({ kind: z.literal('capability'), id: capabilityId }),
 ]);
-/** The tuple-store ref for a subject: `principal:01J…` / `connection:01J…` / `system:@scope/mod`. */
+/**
+ * The tuple-store ref for a subject: `principal:01J…` / `connection:01J…` /
+ * `system:@scope/mod` / `capability:01J…`.
+ */
 export const subjectRef = (subject) => `${subject.kind}:${subject.id}`;
 /**
  * A capability granted to a CONNECTION rather than a principal (#97).
@@ -130,9 +139,10 @@ export const capabilityGrant = z.object({
  * Narrow by construction: it reaches only scopes of the module it names, and only
  * the one permission. It is projected from the module's declared `schedules`
  * (`scheduleSpec.permissions`) at scope provisioning, so what a schedule may do is
- * both readable in the permission diff (code) and revocable per scope (runtime — a
- * revoke fails the operation's own `ctx.check` closed, which is how scheduling is
- * disabled for a tenant without a special "off" code path).
+ * readable in the permission diff (code). Turning a scope's schedules OFF is not a
+ * revoke of one of these but the schedule kill switch, `systemSwitch` below (#1666):
+ * a per-permission revoke would leave the gate open and fail the schedule's own
+ * `ctx.check` on every pass, and a re-grant must not be able to turn it back on.
  */
 export const systemGrant = z.object({
     moduleId,
@@ -141,6 +151,56 @@ export const systemGrant = z.object({
     expiresAt: instant.optional(),
     grantedBy: platformActorId,
 });
+/**
+ * The schedule kill switch (#1666) — one module's scheduled work on ONE scope, turned
+ * off by `HostAdmin.revokeFromSystem` and back on by `restoreToSystem`.
+ *
+ * **Module-wide, never per permission.** A grant is per permission and schedules share
+ * permissions, so "one schedule" is not expressible as a grant revoke without switching
+ * off its siblings too. And a per-permission revoke is worse than none: the gate would
+ * stay open on the module's other live grant, and the schedule's own `ctx.check` would
+ * then fail it on every pass — noise in place of silence.
+ *
+ * `reason` is required and lands in the admin log beside the actor, because "who turned
+ * a tenant's schedules off, and why" is the question the log exists to answer — a
+ * switch pulled in an incident has no other record of what the incident was.
+ *
+ * The scope is required: the switch is per scope. A tenant-wide form would be a
+ * different decision about blast radius, and it is not this one.
+ */
+export const systemSwitch = z.object({
+    moduleId,
+    node: z.object({ tenantId, scopeId }),
+    reason: z.string().trim().min(1).max(500),
+});
+/**
+ * What the far end of the switch did in the scope's own storage (#1666) — the wire
+ * shape `/internal/system-switch` answers with, and what a local host computes itself.
+ *
+ * `held: false` means the scope holds no `system:<module>` grant and no switch marker
+ * for that module at all — a typo'd module id, or a module this scope never ran. Nothing
+ * was written. It is an answer, not an error, so that a deployment which predates the
+ * route (and answers 404) can never be mistaken for one that simply held nothing.
+ */
+export const systemSwitchOutcome = z.object({
+    held: z.boolean(),
+    /** False on a repeat — the switch was already in that position (idempotent). */
+    changed: z.boolean(),
+    /** The grants this call tombstoned (off) or restored (on), by permission key. */
+    permissions: z.array(permissionKey),
+});
+/**
+ * What `revokeFromSystem` / `restoreToSystem` answer (#1666) — the position the switch is now
+ * in. `operationId` names this call's rows on the admin log (its intent, then its outcome),
+ * so an operator can tie what the route answered to what the log recorded.
+ */
+export const systemSwitchResult = z.object({
+    operationId: z.string().min(1),
+    moduleId,
+    schedules: z.enum(['on', 'off']),
+    changed: z.boolean(),
+    permissions: z.array(permissionKey),
+});
 // ============================================================================
 // Evaluation representation — relationship tuples (design doc §4.2, plan D-23).
 // Internal to the checker; verticals never author these. The fixed derivation

package/dist/permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,QAAQ,EACR,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,mFAAmF;IACnF,gDAAgD;IAChD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;CACtD,CAAC,CAAC;AAGH,qGAAqG;AACrG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAqB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ;IACR,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,aAAa;IACzB;qFACiF;IACjF,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,gBAAgB;AAChB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,KAA+B;IAE/B,MAAM,GAAG,GAAG,WAAW,UAAU,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,mFAAmF;IACnF,gDAAgD;IAChD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACrD,mFAAmF;IACnF,kFAAkF;IAClF,sFAAsF;IACtF,iFAAiF;IACjF,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;CAC9D,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAqB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ;IACR,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,aAAa;IACzB;qFACiF;IACjF,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ;IACR,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,gFAAgF;IAChF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,iFAAiF;IACjF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACpC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ;IACR,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACpC,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,gBAAgB;AAChB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,KAA+B;IAE/B,MAAM,GAAG,GAAG,WAAW,UAAU,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}

package/dist/places.d.ts

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+/**
+ * A login's PLACES — where it holds a principal, across every app that signs in at one
+ * identity pool (#1670).
+ *
+ * K-22 makes a login a different principal in every scope, and each tenant's directory can
+ * say who a `sub` is *there*. Nothing could say where *else*. The answer lives with the
+ * pool, not with any vertical: the issuer that mints the `sub` keeps an index keyed on it
+ * (K-23, K-25), and shows it only to the login it belongs to, on the issuer's own origin.
+ * Verticals never read it. Three parties write to it, and this module is the vocabulary
+ * they share:
+ *
+ *   - **The platform** says which apps are places at all. The dashboard delivers, per team,
+ *     the whole set of its apps that sign in at this issuer, each with the client id it
+ *     registered there, the hostname it answers on and its name. A vertical never names a
+ *     tenant, a hostname or a display name; those are the platform's facts.
+ *   - **A vertical** says only "this `sub` is, or is no longer, bound in my scope",
+ *     authenticated as the client the platform registered for it. The issuer keeps an
+ *     addition only when it has itself issued to that client for that `sub`.
+ *   - **The issuer** answers the signed-in login with its own entries, each exactly a
+ *     `place`, and nothing about any other login or tenant.
+ */
+/**
+ * The delivered-config key through which the platform tells a team auth-server which of a
+ * team's apps sign in there: `${PLACES_CONFIG_PREFIX}<tenant id>`, whose value is that
+ * team's WHOLE set as a JSON array of `placeRegistration`, or `""` for none. Keyed by team
+ * rather than by app so that an app the team deleted, or moved to another issuer, drops out
+ * of the next delivery by itself; one team's delivery never touches another team's rows.
+ */
+export declare const PLACES_CONFIG_PREFIX = "substrat:places:";
+/** One app, as the platform registers it at the issuer it signs in with. */
+export declare const placeRegistration: z.ZodObject<{
+    appScopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    clientId: z.ZodString;
+    hostname: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type PlaceRegistration = z.infer<typeof placeRegistration>;
+/** More apps than any team signs in at one issuer; a bound on what one delivery writes. */
+export declare const MAX_PLACE_REGISTRATIONS = 500;
+export declare const placeRegistrations: z.ZodArray<z.ZodObject<{
+    appScopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    clientId: z.ZodString;
+    hostname: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strict>>;
+/**
+ * ONE ENTRY of a login's places, and the whole of what the account surface says about it:
+ * enough to deep-link, nothing more about the tenant (#1670's Decision). The issuer
+ * projects to exactly these keys and a test pins the set.
+ */
+export declare const place: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    hostname: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type Place = z.infer<typeof place>;
+/**
+ * Where an issuer says it keeps a places index: `${issuer}${PLACES_DISCOVERY_PATH}`. A
+ * vertical reports only to an issuer that answers it, so an external issuer (Supabase,
+ * Auth0, …) never receives a report: its pool is not one the platform keeps an index for.
+ */
+export declare const PLACES_DISCOVERY_PATH = "/.well-known/substrat-places";
+export declare const placesDiscovery: z.ZodObject<{
+    report_endpoint: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The most subjects one whole-set report may carry. A scope with more is refused and
+ * logged rather than half-reported: a partial replace would REMOVE every entry it left out.
+ */
+export declare const MAX_PLACE_MEMBERS = 10000;
+/**
+ * What a vertical tells the issuer. `present` / `absent` follow one binding as it changes;
+ * `replace` is the repair, the WHOLE set of subjects bound in the scope, which drops every
+ * entry it does not name and so heals a lost `absent` as well as a lost `present`.
+ */
+export declare const placeReport: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope_id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    op: z.ZodLiteral<"present">;
+    sub: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope_id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    op: z.ZodLiteral<"absent">;
+    sub: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope_id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    op: z.ZodLiteral<"replace">;
+    subs: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "op">;
+export type PlaceReport = z.infer<typeof placeReport>;
+//# sourceMappingURL=places.d.ts.map

package/dist/places.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"places.d.ts","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAgBvD,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB;;;;;kBAWnB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,eAAO,MAAM,kBAAkB;;;;;mBAA0D,CAAC;AAE1F;;;;GAIG;AACH,eAAO,MAAM,KAAK;;;;;kBAOP,CAAC;AAEZ,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,eAAO,MAAM,eAAe;;iBAAkD,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAYxC;;;;GAIG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;0BAItB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/places.js

@@ -0,0 +1,103 @@
+import { z } from 'zod';
+import { scopeId, tenantId } from './ids.js';
+/**
+ * A login's PLACES — where it holds a principal, across every app that signs in at one
+ * identity pool (#1670).
+ *
+ * K-22 makes a login a different principal in every scope, and each tenant's directory can
+ * say who a `sub` is *there*. Nothing could say where *else*. The answer lives with the
+ * pool, not with any vertical: the issuer that mints the `sub` keeps an index keyed on it
+ * (K-23, K-25), and shows it only to the login it belongs to, on the issuer's own origin.
+ * Verticals never read it. Three parties write to it, and this module is the vocabulary
+ * they share:
+ *
+ *   - **The platform** says which apps are places at all. The dashboard delivers, per team,
+ *     the whole set of its apps that sign in at this issuer, each with the client id it
+ *     registered there, the hostname it answers on and its name. A vertical never names a
+ *     tenant, a hostname or a display name; those are the platform's facts.
+ *   - **A vertical** says only "this `sub` is, or is no longer, bound in my scope",
+ *     authenticated as the client the platform registered for it. The issuer keeps an
+ *     addition only when it has itself issued to that client for that `sub`.
+ *   - **The issuer** answers the signed-in login with its own entries, each exactly a
+ *     `place`, and nothing about any other login or tenant.
+ */
+/**
+ * The delivered-config key through which the platform tells a team auth-server which of a
+ * team's apps sign in there: `${PLACES_CONFIG_PREFIX}<tenant id>`, whose value is that
+ * team's WHOLE set as a JSON array of `placeRegistration`, or `""` for none. Keyed by team
+ * rather than by app so that an app the team deleted, or moved to another issuer, drops out
+ * of the next delivery by itself; one team's delivery never touches another team's rows.
+ */
+export const PLACES_CONFIG_PREFIX = 'substrat:places:';
+/** A hostname as a deep link names it: lowercase labels, an optional port, no scheme. */
+const placeHostname = z
+    .string()
+    .max(253)
+    .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::\d{1,5})?$/, 'a bare hostname');
+/** A display name: one line of plain text, bounded. */
+const placeName = z
+    .string()
+    .trim()
+    .min(1)
+    .max(120)
+    .refine((s) => !/[\u0000-\u001f\u007f]/.test(s), 'no control characters');
+/** One app, as the platform registers it at the issuer it signs in with. */
+export const placeRegistration = z
+    .object({
+    /** The app's own scope, which is also the scope its entries name. */
+    appScopeId: scopeId,
+    /** The OIDC client the platform registered for this app at this issuer. */
+    clientId: z.string().min(1).max(256),
+    /** Where the app answers — the deep link. */
+    hostname: placeHostname,
+    /** What the app is called, as the team named it. */
+    name: placeName,
+})
+    .strict();
+/** More apps than any team signs in at one issuer; a bound on what one delivery writes. */
+export const MAX_PLACE_REGISTRATIONS = 500;
+export const placeRegistrations = z.array(placeRegistration).max(MAX_PLACE_REGISTRATIONS);
+/**
+ * ONE ENTRY of a login's places, and the whole of what the account surface says about it:
+ * enough to deep-link, nothing more about the tenant (#1670's Decision). The issuer
+ * projects to exactly these keys and a test pins the set.
+ */
+export const place = z
+    .object({
+    tenantId,
+    scopeId,
+    hostname: placeHostname,
+    name: placeName,
+})
+    .strict();
+/**
+ * Where an issuer says it keeps a places index: `${issuer}${PLACES_DISCOVERY_PATH}`. A
+ * vertical reports only to an issuer that answers it, so an external issuer (Supabase,
+ * Auth0, …) never receives a report: its pool is not one the platform keeps an index for.
+ */
+export const PLACES_DISCOVERY_PATH = '/.well-known/substrat-places';
+export const placesDiscovery = z.object({ report_endpoint: z.string().url() });
+/**
+ * The most subjects one whole-set report may carry. A scope with more is refused and
+ * logged rather than half-reported: a partial replace would REMOVE every entry it left out.
+ */
+export const MAX_PLACE_MEMBERS = 10_000;
+const subject = z.string().min(1).max(256);
+const reportAuth = {
+    /** The client the platform registered for this app at the issuer, and its secret. */
+    client_id: z.string().min(1).max(256),
+    client_secret: z.string().min(1).max(512),
+    /** The scope the report is about. It must be the app scope the platform registered. */
+    scope_id: scopeId,
+};
+/**
+ * What a vertical tells the issuer. `present` / `absent` follow one binding as it changes;
+ * `replace` is the repair, the WHOLE set of subjects bound in the scope, which drops every
+ * entry it does not name and so heals a lost `absent` as well as a lost `present`.
+ */
+export const placeReport = z.discriminatedUnion('op', [
+    z.object({ ...reportAuth, op: z.literal('present'), sub: subject }).strict(),
+    z.object({ ...reportAuth, op: z.literal('absent'), sub: subject }).strict(),
+    z.object({ ...reportAuth, op: z.literal('replace'), subs: z.array(subject).max(MAX_PLACE_MEMBERS) }).strict(),
+]);
+//# sourceMappingURL=places.js.map

package/dist/places.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"places.js","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,yFAAyF;AACzF,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,sFAAsF,EAAE,iBAAiB,CAAC,CAAC;AAEpH,uDAAuD;AACvD,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;AAE5E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,qEAAqE;IACrE,UAAU,EAAE,OAAO;IACnB,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,6CAA6C;IAC7C,QAAQ,EAAE,aAAa;IACvB,oDAAoD;IACpD,IAAI,EAAE,SAAS;CAChB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,QAAQ;IACR,OAAO;IACP,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,SAAS;CAChB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAEpE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3C,MAAM,UAAU,GAAG;IACjB,qFAAqF;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,uFAAuF;IACvF,QAAQ,EAAE,OAAO;CAClB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IACpD,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3E,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9G,CAAC,CAAC"}

package/dist/platform-request.d.ts

@@ -90,6 +90,8 @@ export declare const platformRequest: z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
         connection: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     }, z.core.$strip>]>;
     impersonation: z.ZodNullable<z.ZodObject<{
         session: z.core.$ZodBranded<z.ZodString, "ImpersonationSessionId", "out">;
@@ -125,6 +127,7 @@ export declare const platformRequest: z.ZodObject<{
     result: z.ZodNullable<z.ZodUnknown>;
     requestedAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
     settledAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    decodeError: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type PlatformRequest = z.infer<typeof platformRequest>;
 /**
@@ -278,6 +281,8 @@ export declare const connectorDispatchPayload: z.ZodObject<{
             system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
         }, z.core.$strip>, z.ZodObject<{
             connection: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            capability: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
         }, z.core.$strip>]>;
         entity: z.ZodObject<{
             entityType: z.ZodString;

package/dist/platform-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-request.d.ts","sourceRoot":"","sources":["../src/platform-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;GAMG;AAEH,eAAO,MAAM,qBAAqB;;;;EAAwC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,4BAA4B;;;;EAA8C,CAAC;AACxF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,+FAA+F;AAC/F,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;iBAIhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,2FAA2F;AAC3F,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;iBAAwB,CAAC;AACzD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;iBAkBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,eAAe,CAAC;AAE3D,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,aAAc,MAAM,KAAG,MACT,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"platform-request.d.ts","sourceRoot":"","sources":["../src/platform-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;GAMG;AAEH,eAAO,MAAM,qBAAqB;;;;EAAwC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,4BAA4B;;;;EAA8C,CAAC;AACxF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,+FAA+F;AAC/F,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsC1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;iBAIhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,2FAA2F;AAC3F,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;iBAAwB,CAAC;AACzD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;iBAkBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,eAAe,CAAC;AAE3D,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,aAAc,MAAM,KAAG,MACT,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/platform-request.js

@@ -81,6 +81,24 @@ export const platformRequest = z.object({
     result: z.unknown().nullable(),
     requestedAt: instant, // stamped kernel-side
     settledAt: instant.nullable(),
+    /**
+     * Why this row could not be read whole (#1588). ABSENT on every row the kernel wrote, which
+     * is what "decoded whole" looks like, so a healthy list reads exactly as it did before.
+     *
+     * A read returns a list, and a strict decode let one malformed row throw for all of them —
+     * including `listPlatformRequestHistory`, the read that exists to explain a failure (#618),
+     * disabled by the row that failed. So the read is tolerant and SAYS SO: every column that
+     * did not decode is named here, and its field comes back EMPTY (`null`, or a self-naming
+     * marker for `requestedBy`) rather than guessed at. Every other field still satisfies this
+     * schema — a row whose id, kind, status, attempts or `requestedAt` does not is never
+     * returned as one of these at all.
+     *
+     * The drain treats its presence as a refusal and never runs a handler on such a row: a
+     * payload it could not decode is not a payload it may act on with `HostAdmin` authority.
+     *
+     * Reachable without a forge: `importDump` replays a dump's rows verbatim.
+     */
+    decodeError: z.string().min(1).optional(),
 });
 /**
  * How a caller narrows a read of a scope's intent JOURNAL (#618) — every intent, not just the

package/dist/platform-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-request.js","sourceRoot":"","sources":["../src/platform-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAGxF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,4BAA4B;IACpC,2FAA2F;IAC3F,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC1B,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,KAAK,EAAE,kFAAkF;IACtG;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,qBAAqB;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,0FAA0F;IAC1F,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,OAAO,EAAE,sBAAsB;IAC5C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGH,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAGzD,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC;IACF,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC3C,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CAC5C,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CAAC;AAE3D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAChE,GAAG,8BAA8B,GAAG,QAAQ,EAAE,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC"}
+{"version":3,"file":"platform-request.js","sourceRoot":"","sources":["../src/platform-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAGxF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,4BAA4B;IACpC,2FAA2F;IAC3F,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC1B,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,KAAK,EAAE,kFAAkF;IACtG;;;;;OAKG;IACH,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,qBAAqB;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,0FAA0F;IAC1F,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,OAAO,EAAE,sBAAsB;IAC5C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGH,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAGzD,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,oFAAoF;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC;IACF,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC3C,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CAC5C,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CAAC;AAE3D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAChE,GAAG,8BAA8B,GAAG,QAAQ,EAAE,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.116.0",
+  "version": "0.118.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {