@substrat-run/contracts 0.135.0 → 0.137.0

package/dist/refusal.d.ts

@@ -1,8 +1,9 @@
 import { z } from 'zod';
 /**
  * The read side of the refusal log (#1745) — a scope-local record of every lifecycle move
- * `assertTransition` refused and the operation failed with, written on the failure path as
- * a write of its own AFTER the rollback it is evidence of.
+ * `assertTransition` refused, and every manifest-declared guard (K-38) that refused the
+ * operation it stands before, where the operation failed with it. Written on the failure
+ * path as a write of its own AFTER the rollback it is evidence of.
  *
  * The denial log's sibling, and read the same way (`permissionDenial` / `denialFilter`):
  * a denial is the permission model disagreeing with an actor, a refusal is the lifecycle
@@ -14,6 +15,8 @@ import { z } from 'zod';
  * retrying an illegal move mints a row per attempt), and the window is a storage bound,
  * not a retention promise — rows drain rather than expire.
  */
+/** What a refusal row stores for a reason outside the `problemReason` grammar. */
+export declare const UNRECOGNIZED_REFUSAL_REASON = "unrecognized";
 /** How many refusal rows an unbounded read returns — a screenful, newest-first. */
 export declare const DEFAULT_REFUSAL_LIMIT = 50;
 /** The hard ceiling on one page of refusal rows. */
@@ -21,14 +24,15 @@ export declare const REFUSAL_LIMIT_MAX = 200;
 /**
  * One recorded refusal.
  *
- * `kind` is `'transition'` for every row today; a K-38 guard refusal is the next kind,
- * recorded in the same table. It is read as text rather than a closed enum so a reader
- * built now does not reject the row a later kernel writes.
+ * `kind` is `'transition'` for a move the lifecycle refused and `'guard'` for an operation a
+ * manifest-declared guard refused (K-38). It is read as text rather than a closed enum so a
+ * reader built now does not reject a kind a later kernel writes.
  */
 export declare const refusalRecord: z.ZodObject<{
     id: z.ZodString;
     kind: z.ZodString;
     reason: z.ZodNullable<z.ZodString>;
+    guard: z.ZodNullable<z.ZodString>;
     actor: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
@@ -51,7 +55,7 @@ export declare const refusalRecord: z.ZodObject<{
     scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
     entityType: z.ZodNullable<z.ZodString>;
     entityId: z.ZodNullable<z.ZodString>;
-    fromState: z.ZodString;
+    fromState: z.ZodNullable<z.ZodString>;
     attemptedState: z.ZodNullable<z.ZodString>;
     operation: z.ZodString;
     invokedOperation: z.ZodNullable<z.ZodString>;
@@ -74,6 +78,7 @@ export type RefusalRecord = z.infer<typeof refusalRecord>;
  * the object form for any other kind. The stored encoding is the reader's problem.
  */
 export declare const refusalFilter: z.ZodObject<{
+    kind: z.ZodOptional<z.ZodString>;
     entityType: z.ZodOptional<z.ZodString>;
     entityId: z.ZodOptional<z.ZodString>;
     actor: z.ZodOptional<z.ZodString>;
@@ -84,4 +89,42 @@ export declare const refusalFilter: z.ZodObject<{
     limit: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type RefusalFilter = z.infer<typeof refusalFilter>;
+/**
+ * Name the record a refusal is about, on the error that carries it (#1745).
+ *
+ * For a guard predicate (K-38): the kernel records a guard's refusal, but only the predicate
+ * knows which record it judged — its config says where the id is, and the kernel does not
+ * read a predicate's config. A predicate that names it lets the process map count the
+ * refusal against that record; one that does not is still recorded, with the record unknown.
+ *
+ * Carried under a registered symbol for the reason `RefusedTransition` is: the record's id
+ * is the scope's to keep, never part of the problem document the caller is handed. Returns
+ * the error, so a throw site reads `throw nameRefusedRecord(conflict(…), ref)`.
+ */
+export declare function nameRefusedRecord<E>(err: E, ref: {
+    entityType: string;
+    entityId: string;
+}): E;
+/** The record `nameRefusedRecord` put on an error, or null. */
+export declare function refusedRecordOf(err: unknown): {
+    entityType: string;
+    entityId: string;
+} | null;
+/** What a refusal row stores as its entity type when the one it was handed is not one. */
+export declare const UNDECLARED_ENTITY_TYPE = "undeclared";
+/** The longest entity type a refusal row keeps. */
+export declare const REFUSAL_ENTITY_TYPE_MAX = 64;
+/**
+ * The entity type a refusal row keeps (#1745): the one it was handed when that is spelled as
+ * an entity type — the tuple namespace grammar (`OBJECT_NAMESPACE`, which `ctx.link` and every
+ * entity-narrowed grant are held to), not a kernel namespace, at most
+ * `REFUSAL_ENTITY_TYPE_MAX` — and `UNDECLARED_ENTITY_TYPE` otherwise. Null stays null: the
+ * record was not named.
+ *
+ * Needed because the type reaches a row from code that is handed request data — a guard
+ * predicate naming its record with `nameRefusedRecord` — and the ref takes any string. The
+ * grammar refuses an address, a sentence, anything with a space; it cannot tell a bare word
+ * from a type, which no runtime registry of a scope's entity types exists to do.
+ */
+export declare function refusalEntityType(entityType: string | null): string | null;
 //# sourceMappingURL=refusal.d.ts.map

package/dist/refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;;;;;GAcG;AAEH,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwCxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAWxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;;;;;;;GAeG;AAEH,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAE1D,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAaxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,CAAC,CAK7F;AAID,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI7F;AAED,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,eAAe,CAAC;AACnD,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAO1E"}

package/dist/refusal.js

@@ -3,10 +3,12 @@ import { actor } from './events.js';
 import { impersonationStamp } from './impersonation.js';
 import { scopeId, tenantId } from './ids.js';
 import { lifecycleActorKind } from './lifecycle-flow.js';
+import { OBJECT_NAMESPACE, isKernelNamespace } from './object-ref.js';
 /**
  * The read side of the refusal log (#1745) — a scope-local record of every lifecycle move
- * `assertTransition` refused and the operation failed with, written on the failure path as
- * a write of its own AFTER the rollback it is evidence of.
+ * `assertTransition` refused, and every manifest-declared guard (K-38) that refused the
+ * operation it stands before, where the operation failed with it. Written on the failure
+ * path as a write of its own AFTER the rollback it is evidence of.
  *
  * The denial log's sibling, and read the same way (`permissionDenial` / `denialFilter`):
  * a denial is the permission model disagreeing with an actor, a refusal is the lifecycle
@@ -18,6 +20,8 @@ import { lifecycleActorKind } from './lifecycle-flow.js';
  * retrying an illegal move mints a row per attempt), and the window is a storage bound,
  * not a retention promise — rows drain rather than expire.
  */
+/** What a refusal row stores for a reason outside the `problemReason` grammar. */
+export const UNRECOGNIZED_REFUSAL_REASON = 'unrecognized';
 /** How many refusal rows an unbounded read returns — a screenful, newest-first. */
 export const DEFAULT_REFUSAL_LIMIT = 50;
 /** The hard ceiling on one page of refusal rows. */
@@ -25,34 +29,46 @@ export const REFUSAL_LIMIT_MAX = 200;
 /**
  * One recorded refusal.
  *
- * `kind` is `'transition'` for every row today; a K-38 guard refusal is the next kind,
- * recorded in the same table. It is read as text rather than a closed enum so a reader
- * built now does not reject the row a later kernel writes.
+ * `kind` is `'transition'` for a move the lifecycle refused and `'guard'` for an operation a
+ * manifest-declared guard refused (K-38). It is read as text rather than a closed enum so a
+ * reader built now does not reject a kind a later kernel writes.
  */
 export const refusalRecord = z.object({
     /** ULID — chronological, so it is also the sort key. */
     id: z.string().min(1),
     kind: z.string().min(1),
     /**
-     * The problem code the operation failed with — `invalid_transition` for a transition
-     * refusal, which is the `reason` on the 409 the caller received. Null for a kind this
-     * reader does not know the code of.
+     * The problem code the operation failed with — the `reason` on the 409 the caller received:
+     * `invalid_transition` for a transition refusal, the predicate's own (`protocol_required`)
+     * for a guard. Null when the refusal carried none and the kind implies none, and
+     * `UNRECOGNIZED_REFUSAL_REASON` when it carried one outside the `problemReason` grammar —
+     * kept as a code, never as whatever text the thrower put there.
      */
     reason: z.string().nullable(),
+    /** The guard's named predicate (`protocol/all-signed`) on a `'guard'` row; null otherwise. */
+    guard: z.string().nullable(),
     /** WHO attempted the move: a principal, a `{ system }` module, a `{ connection }`, … */
     actor,
     /** The actor's kind, read off its stored shape — what the process map counts by. */
     actorKind: lifecycleActorKind,
     tenantId,
     scopeId: scopeId.nullable(),
-    /** The record the move was refused on. Null when the caller of `assertTransition` did not name it. */
+    /**
+     * The record the refusal was about. Null when the refusing code did not name it — the
+     * caller of `assertTransition`, or a guard predicate that did not `nameRefusedRecord`.
+     * The type is `UNDECLARED_ENTITY_TYPE` when what it was handed is not spelled as one
+     * (`refusalEntityType`).
+     */
     entityType: z.string().nullable(),
     entityId: z.string().nullable(),
-    /** The state the record was in. */
-    fromState: z.string(),
-    /** Where the operation leads where it IS legal; null when that is not one state. */
+    /**
+     * The state the record was in. Null on a `'guard'` row: a guard stands before an operation,
+     * and the kernel that ran it does not know the state of the record behind it.
+     */
+    fromState: z.string().nullable(),
+    /** Where the operation leads where it IS legal; null when that is not one state, and on a guard. */
     attemptedState: z.string().nullable(),
-    /** The lifecycle's operation — what the edge is keyed by. */
+    /** The lifecycle's operation — what the edge is keyed by — or the operation the guard stands before. */
     operation: z.string(),
     /** The `invoke()` string the call ran as. The same as `operation` for every caller today. */
     invokedOperation: z.string().nullable(),
@@ -79,6 +95,8 @@ export const refusalRecord = z.object({
  * the object form for any other kind. The stored encoding is the reader's problem.
  */
 export const refusalFilter = z.object({
+    /** `'transition'` or `'guard'`; every kind when absent. */
+    kind: z.string().min(1).optional(),
     entityType: z.string().min(1).optional(),
     entityId: z.string().min(1).optional(),
     actor: z.string().min(1).optional(),
@@ -90,4 +108,55 @@ export const refusalFilter = z.object({
     until: z.string().min(1).optional(),
     limit: z.number().int().min(1).max(REFUSAL_LIMIT_MAX).optional(),
 });
+/**
+ * Name the record a refusal is about, on the error that carries it (#1745).
+ *
+ * For a guard predicate (K-38): the kernel records a guard's refusal, but only the predicate
+ * knows which record it judged — its config says where the id is, and the kernel does not
+ * read a predicate's config. A predicate that names it lets the process map count the
+ * refusal against that record; one that does not is still recorded, with the record unknown.
+ *
+ * Carried under a registered symbol for the reason `RefusedTransition` is: the record's id
+ * is the scope's to keep, never part of the problem document the caller is handed. Returns
+ * the error, so a throw site reads `throw nameRefusedRecord(conflict(…), ref)`.
+ */
+export function nameRefusedRecord(err, ref) {
+    if (err !== null && typeof err === 'object') {
+        err[REFUSED_RECORD] = { entityType: ref.entityType, entityId: ref.entityId };
+    }
+    return err;
+}
+const REFUSED_RECORD = Symbol.for('substrat.refused-record');
+/** The record `nameRefusedRecord` put on an error, or null. */
+export function refusedRecordOf(err) {
+    if (err === null || typeof err !== 'object')
+        return null;
+    const r = err[REFUSED_RECORD];
+    return r !== null && typeof r === 'object' ? r : null;
+}
+/** What a refusal row stores as its entity type when the one it was handed is not one. */
+export const UNDECLARED_ENTITY_TYPE = 'undeclared';
+/** The longest entity type a refusal row keeps. */
+export const REFUSAL_ENTITY_TYPE_MAX = 64;
+/**
+ * The entity type a refusal row keeps (#1745): the one it was handed when that is spelled as
+ * an entity type — the tuple namespace grammar (`OBJECT_NAMESPACE`, which `ctx.link` and every
+ * entity-narrowed grant are held to), not a kernel namespace, at most
+ * `REFUSAL_ENTITY_TYPE_MAX` — and `UNDECLARED_ENTITY_TYPE` otherwise. Null stays null: the
+ * record was not named.
+ *
+ * Needed because the type reaches a row from code that is handed request data — a guard
+ * predicate naming its record with `nameRefusedRecord` — and the ref takes any string. The
+ * grammar refuses an address, a sentence, anything with a space; it cannot tell a bare word
+ * from a type, which no runtime registry of a scope's entity types exists to do.
+ */
+export function refusalEntityType(entityType) {
+    if (entityType === null)
+        return null;
+    return entityType.length <= REFUSAL_ENTITY_TYPE_MAX &&
+        OBJECT_NAMESPACE.test(entityType) &&
+        !isKernelNamespace(entityType)
+        ? entityType
+        : UNDECLARED_ENTITY_TYPE;
+}
 //# sourceMappingURL=refusal.js.map

package/dist/refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,wDAAwD;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,KAAK;IACL,oFAAoF;IACpF,SAAS,EAAE,kBAAkB;IAC7B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,sGAAsG;IACtG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,mCAAmC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,oFAAoF;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,6DAA6D;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,6FAA6F;IAC7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,4FAA4F;IAC5F,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC"}
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAE1D,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,wDAAwD;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,8FAA8F;IAC9F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,wFAAwF;IACxF,KAAK;IACL,oFAAoF;IACpF,SAAS,EAAE,kBAAkB;IAC7B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,wGAAwG;IACxG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,6FAA6F;IAC7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,4FAA4F;IAC5F,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,2DAA2D;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAI,GAAM,EAAE,GAA6C;IACxF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3C,GAA+B,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAI,GAA+B,CAAC,cAAc,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA8C,CAAC,CAAC,CAAC,IAAI,CAAC;AACtG,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AACnD,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAyB;IACzD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,UAAU,CAAC,MAAM,IAAI,uBAAuB;QACjD,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;QACjC,CAAC,iBAAiB,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,sBAAsB,CAAC;AAC7B,CAAC"}

package/dist/registry.d.ts

@@ -71,7 +71,6 @@ export declare const verticalServingState: z.ZodObject<{
 }, z.core.$strip>;
 export type VerticalServingState = z.infer<typeof verticalServingState>;
 export declare const registerVerticalInput: z.ZodObject<{
-    slug: z.ZodString;
     name: z.ZodString;
     source: z.ZodEnum<{
         builtin: "builtin";
@@ -99,6 +98,7 @@ export declare const registerVerticalInput: z.ZodObject<{
     listed: z.ZodDefault<z.ZodBoolean>;
     provisions: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sendsEmail: z.ZodOptional<z.ZodBoolean>;
+    slug: z.ZodString;
     ownerTenant: z.ZodDefault<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>>;
 }, z.core.$strip>;
 export type RegisterVerticalInput = z.input<typeof registerVerticalInput>;

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuHnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKhC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;iBAmBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAoB5B,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW;;EAAmB,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;iBAe1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;;iBAUnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;kBAAgE,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuHnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAchC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;iBAmBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAoB5B,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW;;EAAmB,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;iBAe1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;;iBAUnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;kBAAgE,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/registry.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { instant, permissionKey, tenantId, verticalSlug } from './ids.js';
 import { envVarSpec, capability } from './manifest.js';
 import { declaredSurface } from './routing.js';
+import { platformScriptCollision, platformScriptRefusal } from './script-names.js';
 /**
  * The vertical + version registry (#31 step 1; D-33's milestone one).
  *
@@ -151,6 +152,16 @@ export const verticalServingState = z.object({
 export const registerVerticalInput = vertical
     .pick({ slug: true, name: true, source: true, envSpec: true, entitlements: true, ownerGrants: true, provides: true, requires: true, provisions: true, sendsEmail: true, surfaces: true, listed: true })
     .extend({
+    /**
+     * #1923: a slug that would deploy under one of the platform's own script names is refused
+     * here, at the claim, because its logs would be indistinguishable from that worker's.
+     * Refused on the INPUT only: a stored record is read back with the plain `vertical` schema.
+     */
+    slug: verticalSlug.superRefine((slug, ctx) => {
+        const collision = platformScriptCollision(slug);
+        if (collision)
+            ctx.addIssue({ code: 'custom', message: platformScriptRefusal(slug, collision) });
+    }),
     // Optional on input — a staff/platform push omits it (⇒ platform-owned).
     ownerTenant: tenantId.nullable().default(null),
 });

package/dist/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,YAAY,EAAE,iFAAiF;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE;IACrC;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ;KAC1C,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACtM,MAAM,CAAC;IACR,yEAAyE;IACzE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;OAUG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,sEAAsE;IACtE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;;OAKG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe;KAC/C,IAAI,CAAC;IACJ,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;IACnB,MAAM,EAAE,IAAI;CACb,CAAC;KACD,MAAM,CAAC;IACN;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACnC,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAG5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CAC9C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;IACpD,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAEnF;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,YAAY,EAAE,iFAAiF;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE;IACrC;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ;KAC1C,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACtM,MAAM,CAAC;IACR;;;;OAIG;IACH,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC;IACF,yEAAyE;IACzE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;OAUG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,sEAAsE;IACtE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;;OAKG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe;KAC/C,IAAI,CAAC;IACJ,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;IACnB,MAAM,EAAE,IAAI;CACb,CAAC;KACD,MAAM,CAAC;IACN;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACnC,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAG5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CAC9C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;IACpD,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/routing.d.ts

@@ -165,6 +165,12 @@ export declare const bindHostnameInput: z.ZodObject<{
     canonical: z.ZodBoolean;
 }, z.core.$strip>;
 export type BindHostnameInput = z.infer<typeof bindHostnameInput>;
+/**
+ * How many of a scope's own hostnames a route read carries (#2005). A scope has one per surface
+ * plus its custom domains, so this is far above any real one; past it, the hostnames beyond the
+ * cap (in name order) count as another scope's — a refused write, never an allowed one.
+ */
+export declare const ROUTE_SCOPE_HOSTNAMES_MAX = 50;
 /**
  * What the router needs to dispatch. Deliberately smaller than the full binding: a
  * per-request hot path should read what it uses and nothing else.
@@ -180,6 +186,8 @@ export declare const routeTarget: z.ZodObject<{
     }>>;
     outboundHosts: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     calls: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    primary: z.ZodDefault<z.ZodBoolean>;
+    hostnames: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type RouteTarget = z.infer<typeof routeTarget>;
 //# sourceMappingURL=routing.d.ts.map

package/dist/routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS;;;;;;;;iBAQpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;iBAgCtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS;;;;;;;;iBAQpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;iBAgDtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/routing.js

@@ -156,6 +156,12 @@ export const bindHostnameInput = hostnameBinding.pick({
     region: true,
     canonical: true,
 });
+/**
+ * How many of a scope's own hostnames a route read carries (#2005). A scope has one per surface
+ * plus its custom domains, so this is far above any real one; past it, the hostnames beyond the
+ * cap (in name order) count as another scope's — a refused write, never an allowed one.
+ */
+export const ROUTE_SCOPE_HOSTNAMES_MAX = 50;
 /**
  * What the router needs to dispatch. Deliberately smaller than the full binding: a
  * per-request hot path should read what it uses and nothing else.
@@ -192,5 +198,21 @@ export const routeTarget = z.object({
      * this field still parses.
      */
     calls: z.array(verticalSlug).nullable().default(null),
+    /**
+     * Whether the scope is the real install (`isPrimaryScope`, #2005) — false for a fork, a
+     * snapshot or a preview of either kind. The router hands it to the egress worker, which
+     * refuses a non-primary scope's third-party subrequests: those scopes cause no outbound
+     * effects. Defaulted to `true` ONLY so a resolver that predates this field still parses —
+     * it fails open for that skew window, exactly as a pre-#303 `outboundHosts: null` does,
+     * and every resolver in this repo sets it.
+     */
+    primary: z.boolean().default(true),
+    /**
+     * Every active hostname of the resolved scope (#2005), bounded by the directory read — the
+     * addresses a non-primary scope may still WRITE to, its sibling surfaces included; to any
+     * other platform host it may only read. Defaulted to `[]` for a resolver that predates it,
+     * which is the conservative answer: only the hostname the request came in on counts as its own.
+     */
+    hostnames: z.array(z.string()).default([]),
 });
 //# sourceMappingURL=routing.js.map

package/dist/routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEpE;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjC,4FAA4F;IAC5F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,gEAAgE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,wFAAwF;IACxF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC5C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP;kFAC8E;IAC9E,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;IAClB;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3D;;;;;;;OAOG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtD,CAAC,CAAC"}
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEpE;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjC,4FAA4F;IAC5F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,gEAAgE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,wFAAwF;IACxF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC5C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP;kFAC8E;IAC9E,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;IAClB;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3D;;;;;;;OAOG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrD;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC"}

package/dist/script-names.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The Cloudflare script names the PLATFORM's own workers deploy under, and the rule that a
+ * vertical's scripts never take one (#1923).
+ *
+ * Workers Logs are account-wide and name a line's writer only by script (`$metadata.service`),
+ * and a dispatch-namespace script logs into the same store as a top-level worker. So a vertical
+ * whose script were named `substrat-router` would write lines a reader cannot tell from the
+ * router's. The field-coverage tally trusts the router's lines as provenance, so the names have
+ * to be the platform's alone: a slug that would deploy under one is refused when it is
+ * registered and again when it is deployed, from this one list.
+ *
+ * `test/script-names.test.ts` holds the list to every `apps/*` wrangler config and the shared
+ * issuer's, so a new platform worker cannot ship without its name being reserved here.
+ */
+/** The router's scripts: the provenance a field-coverage report is joined to. */
+export declare const ROUTER_SCRIPT_NAMES: readonly string[];
+/** Every platform worker's script name, test environments included. */
+export declare const PLATFORM_SCRIPT_NAMES: ReadonlySet<string>;
+/**
+ * A vertical slug as a script-name stem: lowercased, anything outside `[a-z0-9_-]` (the `/` of
+ * `<tenant>/<name>`) flattened to `-`, and no leading or trailing `-`. The stable serving script
+ * is exactly this; a per-version script is this plus `-<ulid>`.
+ */
+export declare function verticalScriptStem(slug: string): string;
+/**
+ * The platform script name a vertical with this slug would deploy under, or `null`. Checks the
+ * stable script and its jurisdictional variants. A per-version script ends in a 26-character
+ * ULID, which no platform name does.
+ */
+export declare function platformScriptCollision(slug: string): string | null;
+/** The refusal a registration or a deploy gives for {@link platformScriptCollision}. */
+export declare function platformScriptRefusal(slug: string, collision: string): string;
+//# sourceMappingURL=script-names.d.ts.map

package/dist/script-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-names.d.ts","sourceRoot":"","sources":["../src/script-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAgD,CAAC;AAElG,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAapD,CAAC;AAKH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMnE;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E"}

package/dist/script-names.js

@@ -0,0 +1,59 @@
+/**
+ * The Cloudflare script names the PLATFORM's own workers deploy under, and the rule that a
+ * vertical's scripts never take one (#1923).
+ *
+ * Workers Logs are account-wide and name a line's writer only by script (`$metadata.service`),
+ * and a dispatch-namespace script logs into the same store as a top-level worker. So a vertical
+ * whose script were named `substrat-router` would write lines a reader cannot tell from the
+ * router's. The field-coverage tally trusts the router's lines as provenance, so the names have
+ * to be the platform's alone: a slug that would deploy under one is refused when it is
+ * registered and again when it is deployed, from this one list.
+ *
+ * `test/script-names.test.ts` holds the list to every `apps/*` wrangler config and the shared
+ * issuer's, so a new platform worker cannot ship without its name being reserved here.
+ */
+/** The router's scripts: the provenance a field-coverage report is joined to. */
+export const ROUTER_SCRIPT_NAMES = ['substrat-router', 'substrat-router-test'];
+/** Every platform worker's script name, test environments included. */
+export const PLATFORM_SCRIPT_NAMES = new Set([
+    ...ROUTER_SCRIPT_NAMES,
+    'substrat-auth-server',
+    'substrat-builder',
+    'substrat-control-plane',
+    'substrat-control-plane-test',
+    'substrat-dashboard',
+    'substrat-dashboard-test',
+    'substrat-docs',
+    'substrat-social-relay',
+    'substrat-social-relay-test',
+    'substrat-vertical-egress',
+    'substrat-vertical-egress-test',
+]);
+/** The jurisdictional serving scripts a vertical's stem may grow (K-30): `<stem>-eu`, `<stem>-us`. */
+const JURISDICTION_SUFFIXES = ['eu', 'us'];
+/**
+ * A vertical slug as a script-name stem: lowercased, anything outside `[a-z0-9_-]` (the `/` of
+ * `<tenant>/<name>`) flattened to `-`, and no leading or trailing `-`. The stable serving script
+ * is exactly this; a per-version script is this plus `-<ulid>`.
+ */
+export function verticalScriptStem(slug) {
+    return slug.toLowerCase().replace(/[^a-z0-9_-]+/g, '-').replace(/^-+|-+$/g, '');
+}
+/**
+ * The platform script name a vertical with this slug would deploy under, or `null`. Checks the
+ * stable script and its jurisdictional variants. A per-version script ends in a 26-character
+ * ULID, which no platform name does.
+ */
+export function platformScriptCollision(slug) {
+    const stem = verticalScriptStem(slug);
+    for (const name of [stem, ...JURISDICTION_SUFFIXES.map((j) => `${stem}-${j}`)]) {
+        if (PLATFORM_SCRIPT_NAMES.has(name))
+            return name;
+    }
+    return null;
+}
+/** The refusal a registration or a deploy gives for {@link platformScriptCollision}. */
+export function platformScriptRefusal(slug, collision) {
+    return `vertical slug '${slug}' would deploy under '${collision}', a script name the platform's own workers use`;
+}
+//# sourceMappingURL=script-names.js.map

package/dist/script-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-names.js","sourceRoot":"","sources":["../src/script-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;AAElG,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,GAAG,mBAAmB;IACtB,sBAAsB;IACtB,kBAAkB;IAClB,wBAAwB;IACxB,6BAA6B;IAC7B,oBAAoB;IACpB,yBAAyB;IACzB,eAAe;IACf,uBAAuB;IACvB,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;CAChC,CAAC,CAAC;AAEH,sGAAsG;AACtG,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IACnE,OAAO,kBAAkB,IAAI,yBAAyB,SAAS,iDAAiD,CAAC;AACnH,CAAC"}