@substrat-run/contracts 0.141.0 → 0.142.0

package/dist/capability.d.ts

@@ -89,11 +89,11 @@ export type CapabilityMintInput = z.infer<typeof capabilityMintInput>;
  * exchanging it yields a principal instead of a session, the shape an owner claim link and
  * a member invite are ("whoever opens this becomes that seat").
  *
- * Platform-only in this first cut, deliberately. `become` is impersonation by another name
- * — the holder acquires everything the principal holds — so the bound on who may mint one
- * from module code is designed with the invite and claim migrations, not guessed here.
- * Expiry and a use limit are REQUIRED for the same reason: an unbounded `become` is a
- * standing credential for a person.
+ * `become` is impersonation by another name — the holder acquires everything the principal
+ * holds — so module code never mints one. The platform mints this shape (an owner claim link);
+ * a PRINCIPAL mints one only through a host's bounded verb (a member invite,
+ * `principalBecomeCapabilityInput`, #1686). Expiry and a use limit are REQUIRED here: an
+ * unbounded platform `become` is a standing credential for a person.
  */
 export declare const becomeCapabilityInput: z.ZodObject<{
     principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
@@ -102,6 +102,27 @@ export declare const becomeCapabilityInput: z.ZodObject<{
     label: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type BecomeCapabilityInput = z.infer<typeof becomeCapabilityInput>;
+/**
+ * What a PRINCIPAL may mint through a host's bounded verb (#1686) — a `become` capability
+ * whose minter is a person rather than the platform: the shape a member invite is.
+ *
+ * The bound is the host's, checked in the same scope task as the write: the minter must hold,
+ * at this node, every permission the target principal holds there, and every entity-narrowed
+ * grant the target holds must be one the minter can exercise on that entity too. Otherwise
+ * minting a `become` would hand someone more than the minter has — impersonation upward.
+ *
+ * `expiresAt` absent means no expiry, because a member invite has never had one; the use
+ * limit is still required, as on every `become`. The minter is not re-checked when the secret
+ * is exchanged: the target's authority was bounded when it was conferred and when this was
+ * minted, and withdrawing the invite (revoking this) is the lever.
+ */
+export declare const principalBecomeCapabilityInput: z.ZodObject<{
+    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    maxUses: z.ZodNumber;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type PrincipalBecomeCapabilityInput = z.infer<typeof principalBecomeCapabilityInput>;
 /**
  * Who minted or revoked a capability: the principal whose operation did it, or a platform
  * actor through `HostAdmin`. Two members rather than a principal with a flag, because an
@@ -132,6 +153,9 @@ export declare const capabilityRecord: z.ZodDiscriminatedUnion<[z.ZodObject<{
     revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
         platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
     }, z.core.$strip>]>>;
+    revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        "holdings-changed": "holdings-changed";
+    }>>>;
     mode: z.ZodLiteral<"act">;
     entity: z.ZodObject<{
         entityType: z.ZodString;
@@ -155,6 +179,9 @@ export declare const capabilityRecord: z.ZodDiscriminatedUnion<[z.ZodObject<{
     revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
         platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
     }, z.core.$strip>]>>;
+    revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        "holdings-changed": "holdings-changed";
+    }>>>;
     mode: z.ZodLiteral<"become">;
     principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
 }, z.core.$strip>], "mode">;
@@ -169,6 +196,100 @@ export declare const mintedCapability: z.ZodObject<{
     expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
 }, z.core.$strip>;
 export type MintedCapability = z.infer<typeof mintedCapability>;
+/**
+ * Why a host's bounded `become` mint refused (#1686), with nothing written:
+ * - `coverage` — what the minter lacks of what the target holds;
+ * - `target-holds-nothing` — the target holds nothing at the node. Its own answer because a
+ *   `Coverage` refusal must name a missing key and there is none: an empty set would cover
+ *   trivially, and the link would yield whatever that principal is granted later;
+ * - `target-already-claimed` — some `become` capability for the target has already been
+ *   exchanged in this scope: somebody already is that principal, and a second link would let a
+ *   second person become them too. A principal-minted `become` is for a seat nobody has taken.
+ */
+export declare const becomeMintRefusal: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    coverage: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        covered: z.ZodLiteral<true>;
+        missing: z.ZodTuple<[], null>;
+    }, z.core.$strip>, z.ZodObject<{
+        covered: z.ZodLiteral<false>;
+        missing: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+    }, z.core.$strip>], "covered">;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    refused: z.ZodEnum<{
+        "target-already-claimed": "target-already-claimed";
+        "target-holds-nothing": "target-holds-nothing";
+    }>;
+}, z.core.$strip>]>;
+export type BecomeMintRefusal = z.infer<typeof becomeMintRefusal>;
+/** What a host's bounded `become` mint answers (#1686): the minted capability, or the refusal. */
+export declare const boundedBecomeMint: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    minted: z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+        secret: z.ZodString;
+        expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    coverage: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        covered: z.ZodLiteral<true>;
+        missing: z.ZodTuple<[], null>;
+    }, z.core.$strip>, z.ZodObject<{
+        covered: z.ZodLiteral<false>;
+        missing: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+    }, z.core.$strip>], "covered">;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    refused: z.ZodEnum<{
+        "target-already-claimed": "target-already-claimed";
+        "target-holds-nothing": "target-holds-nothing";
+    }>;
+}, z.core.$strip>]>]>;
+export type BoundedBecomeMint = z.infer<typeof boundedBecomeMint>;
+/**
+ * What a host's bounded `become` revoke answers (#1686): whether this call revoked it, or the
+ * coverage that refused the revoker — who must be the link's minter, or hold everything its
+ * principal holds now (whoever could have minted it). A refusal writes nothing.
+ */
+export declare const boundedBecomeRevoke: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    revoked: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    coverage: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        covered: z.ZodLiteral<true>;
+        missing: z.ZodTuple<[], null>;
+    }, z.core.$strip>, z.ZodObject<{
+        covered: z.ZodLiteral<false>;
+        missing: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+    }, z.core.$strip>], "covered">;
+}, z.core.$strip>]>;
+export type BoundedBecomeRevoke = z.infer<typeof boundedBecomeRevoke>;
+/**
+ * Where a `become` link stands (#1686) — what a pending-invite list shows beside each invite, so
+ * a link the kernel revoked is never shown as open. `used`: exchanged up to its limit. A
+ * capability the scope does not hold reads as `revoked`.
+ */
+export declare const becomeLinkState: z.ZodObject<{
+    state: z.ZodEnum<{
+        expired: "expired";
+        open: "open";
+        revoked: "revoked";
+        used: "used";
+    }>;
+    reason: z.ZodNullable<z.ZodEnum<{
+        "holdings-changed": "holdings-changed";
+    }>>;
+}, z.core.$strip>;
+export type BecomeLinkState = z.infer<typeof becomeLinkState>;
+/**
+ * The most links one `becomeLinkStates` call may name — the cap other id-list reads take
+ * (`CONNECT_LINK_LIST_MAX_IDS`, a grant-scoped read's maximum). Over it the read refuses rather
+ * than truncate; a list longer than this asks in pages of it.
+ */
+export declare const BECOME_LINK_STATES_MAX_IDS = 100;
 /**
  * What an exchange yields: a session to act as the capability (`act`), or the principal
  * the holder becomes (`become`). A refused exchange — an unknown, expired, revoked or
@@ -230,6 +351,9 @@ export declare const capabilityPage: z.ZodObject<{
         revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
             platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
         }, z.core.$strip>]>>;
+        revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            "holdings-changed": "holdings-changed";
+        }>>>;
         mode: z.ZodLiteral<"act">;
         entity: z.ZodObject<{
             entityType: z.ZodString;
@@ -253,6 +377,9 @@ export declare const capabilityPage: z.ZodObject<{
         revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
             platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
         }, z.core.$strip>]>>;
+        revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            "holdings-changed": "holdings-changed";
+        }>>>;
         mode: z.ZodLiteral<"become">;
         principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
     }, z.core.$strip>], "mode">>;
@@ -319,6 +446,13 @@ export declare const CAPABILITY_REVOKED = "capability.revoked";
  * capability itself (`capability:<id>`) for `become`; actor: `{ capability }`.
  */
 export declare const CAPABILITY_EXERCISED = "capability.exercised";
+/**
+ * A principal minted a `become` capability through a host's bounded verb (#1686) — a member
+ * invite. Entity: the capability itself (`capability:<id>`), as on a `become`'s
+ * `capability.exercised`; actor: the minter. Its own type rather than `capability.minted`,
+ * whose payload is an `act` capability's (an entity and its keys) and is frozen.
+ */
+export declare const CAPABILITY_BECOME_MINTED = "capability.become-minted";
 export declare const capabilityMintedPayload: z.ZodObject<{
     capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     entity: z.ZodObject<{
@@ -333,6 +467,15 @@ export declare const capabilityMintedPayload: z.ZodObject<{
     mintedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
 }, z.core.$strip>;
 export type CapabilityMintedPayload = z.infer<typeof capabilityMintedPayload>;
+export declare const capabilityBecomeMintedPayload: z.ZodObject<{
+    capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    maxUses: z.ZodNumber;
+    label: z.ZodNullable<z.ZodString>;
+    mintedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+}, z.core.$strip>;
+export type CapabilityBecomeMintedPayload = z.infer<typeof capabilityBecomeMintedPayload>;
 export declare const capabilityRevokedPayload: z.ZodObject<{
     capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
     entity: z.ZodObject<{

package/dist/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,wBAAwB,WAAW,CAAC;AACjD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAC1D,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,gGAAgG;AAChG,eAAO,MAAM,eAAe,aAAoC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;mBAAkE,CAAC;AAChG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAkBhE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAgB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;2BAa7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;iBAK3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC,EAC9E,GAAG,EAAE,MAAM,GACV,gBAAgB,CAKlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAUjF;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAGjE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;GAyB9B,CAAC;AASL,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,eAAO,MAAM,wBAAwB;;;;;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAUrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,wBAAwB,WAAW,CAAC;AACjD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAC1D,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,gGAAgG;AAChG,eAAO,MAAM,eAAe,aAAoC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B;;;;;iBAKzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;mBAAkE,CAAC;AAChG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAwBhE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAgB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;mBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kGAAkG;AAClG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;qBAA4F,CAAC;AAC3H,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;mBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;2BAa7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;iBAK3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC,EAC9E,GAAG,EAAE,MAAM,GACV,gBAAgB,CAKlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAUjF;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAGjE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;GAyB9B,CAAC;AASL,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;iBAQxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,eAAO,MAAM,wBAAwB;;;;;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAUrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/capability.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { entityRef } from './events.js';
 import { capabilityId, instant, permissionKey, platformActorId, principalId } from './ids.js';
+import { coverage } from './permission.js';
 /**
  * Capabilities (#1672) — authority carried by a SECRET rather than held by a principal.
  *
@@ -80,11 +81,11 @@ export const capabilityMintInput = capabilityAuthority.extend({
  * exchanging it yields a principal instead of a session, the shape an owner claim link and
  * a member invite are ("whoever opens this becomes that seat").
  *
- * Platform-only in this first cut, deliberately. `become` is impersonation by another name
- * — the holder acquires everything the principal holds — so the bound on who may mint one
- * from module code is designed with the invite and claim migrations, not guessed here.
- * Expiry and a use limit are REQUIRED for the same reason: an unbounded `become` is a
- * standing credential for a person.
+ * `become` is impersonation by another name — the holder acquires everything the principal
+ * holds — so module code never mints one. The platform mints this shape (an owner claim link);
+ * a PRINCIPAL mints one only through a host's bounded verb (a member invite,
+ * `principalBecomeCapabilityInput`, #1686). Expiry and a use limit are REQUIRED here: an
+ * unbounded platform `become` is a standing credential for a person.
  */
 export const becomeCapabilityInput = z.object({
     principal: principalId,
@@ -92,6 +93,26 @@ export const becomeCapabilityInput = z.object({
     maxUses: z.number().int().positive(),
     label: capabilityLabel.optional(),
 });
+/**
+ * What a PRINCIPAL may mint through a host's bounded verb (#1686) — a `become` capability
+ * whose minter is a person rather than the platform: the shape a member invite is.
+ *
+ * The bound is the host's, checked in the same scope task as the write: the minter must hold,
+ * at this node, every permission the target principal holds there, and every entity-narrowed
+ * grant the target holds must be one the minter can exercise on that entity too. Otherwise
+ * minting a `become` would hand someone more than the minter has — impersonation upward.
+ *
+ * `expiresAt` absent means no expiry, because a member invite has never had one; the use
+ * limit is still required, as on every `become`. The minter is not re-checked when the secret
+ * is exchanged: the target's authority was bounded when it was conferred and when this was
+ * minted, and withdrawing the invite (revoking this) is the lever.
+ */
+export const principalBecomeCapabilityInput = z.object({
+    principal: principalId,
+    expiresAt: instant.optional(),
+    maxUses: z.number().int().positive(),
+    label: capabilityLabel.optional(),
+});
 /**
  * Who minted or revoked a capability: the principal whose operation did it, or a platform
  * actor through `HostAdmin`. Two members rather than a principal with a flag, because an
@@ -113,6 +134,12 @@ const capabilityRecordCommon = {
     lastUsedAt: instant.nullable(),
     revokedAt: instant.nullable(),
     revokedBy: capabilityAuthor.nullable(),
+    /**
+     * Why the kernel itself revoked it, when it did (#1686): `holdings-changed` — a principal-minted
+     * `become` whose principal's holdings changed between mint and exchange. Null for a revoke a
+     * person or the platform made, and for a live capability. Absent from a host that predates it.
+     */
+    revokedReason: z.enum(['holdings-changed']).nullable().optional(),
 };
 /**
  * A capability as the directory holds it — what `ctx.capabilities.list` returns. Carries
@@ -145,6 +172,47 @@ export const mintedCapability = z.object({
     secret: z.string().startsWith(CAPABILITY_SECRET_PREFIX),
     expiresAt: instant.nullable(),
 });
+/**
+ * Why a host's bounded `become` mint refused (#1686), with nothing written:
+ * - `coverage` — what the minter lacks of what the target holds;
+ * - `target-holds-nothing` — the target holds nothing at the node. Its own answer because a
+ *   `Coverage` refusal must name a missing key and there is none: an empty set would cover
+ *   trivially, and the link would yield whatever that principal is granted later;
+ * - `target-already-claimed` — some `become` capability for the target has already been
+ *   exchanged in this scope: somebody already is that principal, and a second link would let a
+ *   second person become them too. A principal-minted `become` is for a seat nobody has taken.
+ */
+export const becomeMintRefusal = z.union([
+    z.object({ ok: z.literal(false), coverage }),
+    z.object({ ok: z.literal(false), refused: z.enum(['target-holds-nothing', 'target-already-claimed']) }),
+]);
+/** What a host's bounded `become` mint answers (#1686): the minted capability, or the refusal. */
+export const boundedBecomeMint = z.union([z.object({ ok: z.literal(true), minted: mintedCapability }), becomeMintRefusal]);
+/**
+ * What a host's bounded `become` revoke answers (#1686): whether this call revoked it, or the
+ * coverage that refused the revoker — who must be the link's minter, or hold everything its
+ * principal holds now (whoever could have minted it). A refusal writes nothing.
+ */
+export const boundedBecomeRevoke = z.union([
+    z.object({ ok: z.literal(true), revoked: z.boolean() }),
+    z.object({ ok: z.literal(false), coverage }),
+]);
+/**
+ * Where a `become` link stands (#1686) — what a pending-invite list shows beside each invite, so
+ * a link the kernel revoked is never shown as open. `used`: exchanged up to its limit. A
+ * capability the scope does not hold reads as `revoked`.
+ */
+export const becomeLinkState = z.object({
+    state: z.enum(['open', 'used', 'revoked', 'expired']),
+    /** Why the kernel revoked it, when it did; null otherwise. */
+    reason: z.enum(['holdings-changed']).nullable(),
+});
+/**
+ * The most links one `becomeLinkStates` call may name — the cap other id-list reads take
+ * (`CONNECT_LINK_LIST_MAX_IDS`, a grant-scoped read's maximum). Over it the read refuses rather
+ * than truncate; a list longer than this asks in pages of it.
+ */
+export const BECOME_LINK_STATES_MAX_IDS = 100;
 /**
  * What an exchange yields: a session to act as the capability (`act`), or the principal
  * the holder becomes (`become`). A refused exchange — an unknown, expired, revoked or
@@ -274,6 +342,13 @@ export const CAPABILITY_REVOKED = 'capability.revoked';
  * capability itself (`capability:<id>`) for `become`; actor: `{ capability }`.
  */
 export const CAPABILITY_EXERCISED = 'capability.exercised';
+/**
+ * A principal minted a `become` capability through a host's bounded verb (#1686) — a member
+ * invite. Entity: the capability itself (`capability:<id>`), as on a `become`'s
+ * `capability.exercised`; actor: the minter. Its own type rather than `capability.minted`,
+ * whose payload is an `act` capability's (an entity and its keys) and is frozen.
+ */
+export const CAPABILITY_BECOME_MINTED = 'capability.become-minted';
 export const capabilityMintedPayload = z.object({
     capabilityId,
     entity: entityRef,
@@ -284,6 +359,15 @@ export const capabilityMintedPayload = z.object({
     label: capabilityLabel.nullable(),
     mintedBy: principalId,
 });
+export const capabilityBecomeMintedPayload = z.object({
+    capabilityId,
+    /** The principal whoever exchanges the secret becomes. */
+    principal: principalId,
+    expiresAt: instant.nullable(),
+    maxUses: z.number().int().positive(),
+    label: capabilityLabel.nullable(),
+    mintedBy: principalId,
+});
 export const capabilityRevokedPayload = z.object({
     capabilityId,
     entity: entityRef,

package/dist/capability.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AACjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAClD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1D,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,gGAAgG;AAChG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IACvF,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;AAGhG,MAAM,sBAAsB,GAAG;IAC7B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,OAAO;IACjB,4BAA4B;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,kCAAkC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,+CAA+C;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACvC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,GAAG,sBAAsB;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,2CAA2C;QAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,qFAAqF;QACrF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,GAAG,sBAAsB;QACzB,SAAS,EAAE,WAAW;KACvB,CAAC;CACH,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC;IACvD,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,YAAY;QACZ,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC;QAC9D,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,SAAS;KAClB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,YAAY;QACZ,SAAS,EAAE,WAAW;KACvB,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAClC,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAaH,MAAM,UAAU,gBAAgB,CAC9B,MAA8E,EAC9E,GAAW;IAEX,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB;IAC9D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,EAAE,cAAc;QAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;IACxG,CAAC;AACH,CAAC,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC;QACxC,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YACxD,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,CAAC,KAAK,CAAC;AACjB,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAC9E,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,oCAAoC;AACpC,8EAA8E;AAE9E,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AACvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY;IACZ,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY;IACZ,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,YAAY;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/B,qCAAqC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,yFAAyF;IACzF,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACpC,iEAAiE;IACjE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AACjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAClD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1D,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,gGAAgG;AAChG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IACvF,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;AAGhG,MAAM,sBAAsB,GAAG;IAC7B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,OAAO;IACjB,4BAA4B;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,kCAAkC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,+CAA+C;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACtC;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClE,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,GAAG,sBAAsB;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,2CAA2C;QAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,qFAAqF;QACrF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,GAAG,sBAAsB;QACzB,SAAS,EAAE,WAAW;KACvB,CAAC;CACH,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC;IACvD,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC;IACvC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5C,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC;CACxG,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAG3H;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACvD,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC7C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACrD,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,YAAY;QACZ,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC;QAC9D,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,SAAS;KAClB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,YAAY;QACZ,SAAS,EAAE,WAAW;KACvB,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAClC,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAaH,MAAM,UAAU,gBAAgB,CAC9B,MAA8E,EAC9E,GAAW;IAEX,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB;IAC9D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,EAAE,cAAc;QAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;IACxG,CAAC;AACH,CAAC,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC;QACxC,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YACxD,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,CAAC,KAAK,CAAC;AACjB,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAC9E,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,oCAAoC;AACpC,8EAA8E;AAE9E,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AACvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAC3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY;IACZ,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY;IACZ,0DAA0D;IAC1D,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY;IACZ,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,YAAY;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/B,qCAAqC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,yFAAyF;IACzF,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACpC,iEAAiE;IACjE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}

package/dist/control-plane.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { type EntityHistoryInput, type EventCauseInput, type EventEffectsInput, type InvocationEventsInput, type DeadLettersInput, type EventFacetInput, type EventFacetResult, type QueryScopeInput, type ReadScopeTableInput } from './introspection.js';
 import type { DenialFilter } from './denial.js';
-import type { CapabilityFilter } from './capability.js';
+import { type CapabilityFilter } from './capability.js';
 import type { LifecycleFlowInput } from './lifecycle-flow.js';
 import type { OperationSeriesInput } from './operation-series.js';
 export declare const adminAction: z.ZodEnum<{
@@ -10,6 +10,7 @@ export declare const adminAction: z.ZodEnum<{
     admitVersion: "admitVersion";
     archiveScope: "archiveScope";
     assignRole: "assignRole";
+    backfillScopeCopy: "backfillScopeCopy";
     beginImpersonation: "beginImpersonation";
     bindHostname: "bindHostname";
     bindScopeVersion: "bindScopeVersion";
@@ -312,6 +313,17 @@ export declare const scopeMemberInvite: z.ZodObject<{
     roles: z.ZodArray<z.ZodString>;
     email: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodNumber;
+    link: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        state: z.ZodEnum<{
+            expired: "expired";
+            open: "open";
+            revoked: "revoked";
+            used: "used";
+        }>;
+        reason: z.ZodNullable<z.ZodEnum<{
+            "holdings-changed": "holdings-changed";
+        }>>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export declare const scopeMembers: z.ZodObject<{
     roles: z.ZodArray<z.ZodString>;
@@ -328,6 +340,17 @@ export declare const scopeMembers: z.ZodObject<{
         roles: z.ZodArray<z.ZodString>;
         email: z.ZodNullable<z.ZodString>;
         createdAt: z.ZodNumber;
+        link: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            state: z.ZodEnum<{
+                expired: "expired";
+                open: "open";
+                revoked: "revoked";
+                used: "used";
+            }>;
+            reason: z.ZodNullable<z.ZodEnum<{
+                "holdings-changed": "holdings-changed";
+            }>>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ScopeMember = z.infer<typeof scopeMember>;
@@ -1121,6 +1144,7 @@ export declare const adminLogEntry: z.ZodObject<{
         admitVersion: "admitVersion";
         archiveScope: "archiveScope";
         assignRole: "assignRole";
+        backfillScopeCopy: "backfillScopeCopy";
         beginImpersonation: "beginImpersonation";
         bindHostname: "bindHostname";
         bindScopeVersion: "bindScopeVersion";
@@ -1572,6 +1596,14 @@ export declare const tenantExport: z.ZodObject<{
         expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
         servingRef: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         archivedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        archivedFromStatus: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            active: "active";
+            archived: "archived";
+            archiving: "archiving";
+            provisioning: "provisioning";
+            reaped: "reaped";
+            suspended: "suspended";
+        }>>>;
         createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
     }, z.core.$strip>>;
     orgs: z.ZodArray<z.ZodObject<{
@@ -1678,6 +1710,7 @@ export declare const tenantExport: z.ZodObject<{
             admitVersion: "admitVersion";
             archiveScope: "archiveScope";
             assignRole: "assignRole";
+            backfillScopeCopy: "backfillScopeCopy";
             beginImpersonation: "beginImpersonation";
             bindHostname: "bindHostname";
             bindScopeVersion: "bindScopeVersion";
@@ -1840,6 +1873,61 @@ export declare const meterScopeCounts: z.ZodObject<{
     reaped: z.ZodNumber;
 }, z.core.$strip>;
 export type MeterScopeCounts = z.infer<typeof meterScopeCounts>;
+/**
+ * What a storage figure deliberately does NOT count, named on every figure so a consumer
+ * cannot mistake the number for the whole bill:
+ * - `attachments`: attachment bytes live in a blob store. The scope holds only their rows.
+ * - `tenant-stores`: per-tenant D1 databases are separate databases.
+ * - `lake`: shipped event history is volume in the lake, not in any scope.
+ */
+export declare const storageExclusion: z.ZodEnum<{
+    attachments: "attachments";
+    lake: "lake";
+    "tenant-stores": "tenant-stores";
+}>;
+export type StorageExclusion = z.infer<typeof storageExclusion>;
+/** Every exclusion, in the order a surface lists them. A reading always carries all three. */
+export declare const STORAGE_EXCLUSIONS: readonly StorageExclusion[];
+/**
+ * The STORED storage gauge (#1524), as `/meters` shows it: the sum of each scope's latest
+ * sampled database size. It is read from the directory, so serving it wakes no scope.
+ *
+ * The scheduled pass samples a scope only when an earlier phase of the same pass already
+ * reached it, at most once a day, so a figure is a set of readings taken at different
+ * instants. `oldestReadAt` is the honest "as of": every scope in the sum was read at or
+ * after it. `sampled < total` means some scopes have never been read (a new scope, or one
+ * no pass reached), and a surface must not call `bytes` the tenant's total then.
+ */
+export declare const storageGauge: z.ZodObject<{
+    basis: z.ZodLiteral<"scope-databases">;
+    excluded: z.ZodArray<z.ZodEnum<{
+        attachments: "attachments";
+        lake: "lake";
+        "tenant-stores": "tenant-stores";
+    }>>;
+    bytes: z.ZodNumber;
+    sampled: z.ZodNumber;
+    total: z.ZodNumber;
+    oldestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    newestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    failing: z.ZodNumber;
+    lastFailedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+}, z.core.$strip>;
+export type StorageGauge = z.infer<typeof storageGauge>;
+/**
+ * One stored storage sample (#1524): a scope's database size as last read on one UTC day.
+ * A later reading on the same day replaces it; the next day starts a new row. That is what
+ * makes byte-days computable later without storing every pass's reading. Kept 13 months
+ * (`STORAGE_GAUGE_RETENTION_MONTHS`).
+ */
+export declare const scopeStorageSample: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    day: z.ZodString;
+    bytes: z.ZodNumber;
+    readAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type ScopeStorageSample = z.infer<typeof scopeStorageSample>;
 /** Meter 1, per tenant: the scopes under it, and how many SKUs it holds. */
 export declare const tenantMeterRow: z.ZodObject<{
     tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
@@ -1863,6 +1951,21 @@ export declare const tenantMeterRow: z.ZodObject<{
         live: z.ZodNumber;
         expired: z.ZodNumber;
     }, z.core.$strip>;
+    storage: z.ZodOptional<z.ZodObject<{
+        basis: z.ZodLiteral<"scope-databases">;
+        excluded: z.ZodArray<z.ZodEnum<{
+            attachments: "attachments";
+            lake: "lake";
+            "tenant-stores": "tenant-stores";
+        }>>;
+        bytes: z.ZodNumber;
+        sampled: z.ZodNumber;
+        total: z.ZodNumber;
+        oldestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        newestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        failing: z.ZodNumber;
+        lastFailedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type TenantMeterRow = z.infer<typeof tenantMeterRow>;
 /**
@@ -1934,32 +2037,49 @@ export declare const meterReading: z.ZodObject<{
             live: z.ZodNumber;
             expired: z.ZodNumber;
         }, z.core.$strip>;
+        storage: z.ZodOptional<z.ZodObject<{
+            basis: z.ZodLiteral<"scope-databases">;
+            excluded: z.ZodArray<z.ZodEnum<{
+                attachments: "attachments";
+                lake: "lake";
+                "tenant-stores": "tenant-stores";
+            }>>;
+            bytes: z.ZodNumber;
+            sampled: z.ZodNumber;
+            total: z.ZodNumber;
+            oldestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+            newestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+            failing: z.ZodNumber;
+            lastFailedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    storage: z.ZodOptional<z.ZodObject<{
+        basis: z.ZodLiteral<"scope-databases">;
+        excluded: z.ZodArray<z.ZodEnum<{
+            attachments: "attachments";
+            lake: "lake";
+            "tenant-stores": "tenant-stores";
+        }>>;
+        bytes: z.ZodNumber;
+        sampled: z.ZodNumber;
+        total: z.ZodNumber;
+        oldestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        newestReadAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        failing: z.ZodNumber;
+        lastFailedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type MeterReading = z.infer<typeof meterReading>;
 /**
- * Storage, read on demand (#1524): the size of each of one tenant's scope DATABASES,
- * and their sum. Read-only first, by decision — nothing is stored, no sweep takes it,
- * and there is no fleet-wide form. Reading a scope's size wakes that scope's Durable
- * Object, so a periodic or fleet-wide reading would bill a DO invocation per idle scope
- * per interval. The reading is taken when a person asks for it and costs what they asked.
+ * Storage, read on demand (#1524): the size of each of one tenant's scope DATABASES, and
+ * their sum, read live when a person asks. Reading a scope's size wakes that scope's Durable
+ * Object, so this reading is paged and has no fleet-wide form. The stored daily figure that
+ * `/meters` serves without a wake is `storageGauge`.
  *
  * What it counts: `SqlStorage.databaseSize` on Cloudflare, `page_count × page_size` on
  * SQLite. That is rows, indexes, the spine, and free pages the database has not given back.
- * What it deliberately does NOT count, named in `excluded` so a consumer cannot mistake
- * the number for the whole bill:
- * - `attachments`: attachment bytes live in a blob store. The scope holds only their rows.
- * - `tenant-stores`: per-tenant D1 databases are separate databases.
- * - `lake`: shipped event history is volume in the lake, not in any scope.
+ * What it does not count is named in `excluded` (`storageExclusion`).
  */
-export declare const storageExclusion: z.ZodEnum<{
-    attachments: "attachments";
-    lake: "lake";
-    "tenant-stores": "tenant-stores";
-}>;
-export type StorageExclusion = z.infer<typeof storageExclusion>;
-/** Every exclusion, in the order a surface lists them. A reading always carries all three. */
-export declare const STORAGE_EXCLUSIONS: readonly StorageExclusion[];
 /** One scope's database size, or why it could not be read. Exactly one of the two is set. */
 export declare const scopeStorageReading: z.ZodUnion<readonly [z.ZodObject<{
     scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;