@substrat-run/contracts 0.67.0 → 0.69.0

package/dist/index.d.ts

@@ -35,4 +35,5 @@ export * from './ci.js';
 export * from './money.js';
 export * from './attachments.js';
 export * from './model.js';
+export * from './operations.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -35,4 +35,5 @@ export * from './ci.js';
 export * from './money.js';
 export * from './attachments.js';
 export * from './model.js';
+export * from './operations.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/model.d.ts

@@ -32,11 +32,18 @@ export interface EntityDef<Names extends string = string> {
     /** The row shape. Field names are what `key`, `searchables` and events check against. */
     readonly fields: z.ZodObject<z.ZodRawShape>;
     /**
-     * The parent entity permission flows along (design doc §4.2 rule 3).
-     * Checked against the declared entities — a typo is a compile error, where
-     * today it is a silently dead edge.
+     * The parent entity types permission may flow along (design doc §4.2 rule 3).
+     * Checked against the declared entities — a typo is a compile error, where it
+     * used to be a silently dead edge.
+     *
+     * **Plural, and an array even for one.** `entityRelations` is an ALLOWLIST,
+     * not an assertion: the kernel accumulates permitted parents into a *set* per
+     * entity type and `ctx.link` checks membership. `reservation` already hangs
+     * off both `resource` and `member`; `protocol` off both `workorder` and
+     * `employee`. Singular `parent` said "the parent", which is not what the
+     * kernel means and cannot express the real cases.
      */
-    readonly parent?: Names;
+    readonly parents?: readonly Names[];
     /** Natural key, if any. Must name fields that exist. */
     readonly key?: readonly string[];
     /** Fields an erasure must be able to reach (§12). Must name fields that exist. */
@@ -79,7 +86,8 @@ export type EntityName<T> = keyof T & string;
 export interface EmittedEntity {
     readonly table: string;
     readonly fields: Record<string, unknown>;
-    readonly parent?: string;
+    /** The permitted parent types, sorted. One shape, always. */
+    readonly parents?: readonly string[];
     readonly key?: readonly string[];
     readonly erasable?: readonly string[];
 }
@@ -140,50 +148,37 @@ type EntityRefs<T extends Record<string, EntityDef>, M> = {
         readonly view: string;
     }[];
     /**
-     * Parent edges whose CHILD this module does not own.
+     * The engine registries this module composes, so relation edges naming their
+     * entities can be checked.
+     */
+    readonly engines?: readonly Record<string, EntityDef>[];
+    /**
+     * Parent edges involving an entity this module does not own.
      *
      * A vertical legitimately declares these: an engine is entity-agnostic, so
      * only the vertical knows that a work order hangs off a bike, or a protocol
-     * off a work order. The child name belongs to an engine and cannot be checked
-     * here — but the PARENT often can be, and throwing that away would be giving
-     * up a check we hold.
+     * off a work order. **Both sides are checked** against the local entities plus
+     * every entity of every registry in `engines`.
      *
-     * So the parent is checked whenever it is one of this module's own entities:
+     * Local-to-local edges do not belong here — they are DERIVED from the
+     * entities' own `parents`, and declaring one twice is how two descriptions of
+     * a fact come to disagree.
      *
-     * ```ts
-     * foreignChildren: [
-     *   { entityType: 'workorder', parentType: 'bike' },      // parent CHECKED
-     *   { entityType: 'protocol', parentType: 'workorder' },  // parent foreign too
-     * ]
-     * ```
-     *
-     * `parentType` accepts a declared entity name or an arbitrary string, and a
-     * typo that happens to look like neither is still accepted — TypeScript cannot
-     * express "one of these, or any other string, but tell me which". What it does
-     * buy is autocomplete on the local names and a compile error on the mixed edge
-     * once `foreignParents` (below) is used instead.
-     *
-     * Both become fully checkable when engines export their entity-type constants
-     * (#696 item 3), at which point these two fields collapse back into `parent`.
+     * This replaces the `foreignChildOf` / `foreignChildren` pair, which existed
+     * only because foreign names were uncheckable. They are now, so the split has
+     * nothing left to say.
      */
-    readonly foreignChildren?: readonly {
-        readonly entityType: string;
-        readonly parentType: (keyof T & string) | (string & {});
-    }[];
-    /**
-     * The mixed edge, stated so the checkable half IS checked: a child this module
-     * does not own, hanging off a parent it does. `parentType` here is strictly a
-     * declared entity — a typo is a compile error.
-     *
-     * `bike_shop`'s `workorder → bike` is the case: `workorder` is the engine's,
-     * `bike` is the vertical's, and the vertical is the only place that knows the
-     * edge exists.
-     */
-    readonly foreignChildOf?: readonly {
-        readonly entityType: string;
-        readonly parentType: keyof T & string;
+    readonly relations?: readonly {
+        readonly entityType: (keyof T & string) | (M extends {
+            engines: readonly (infer R)[];
+        } ? NamesOf<R> : never);
+        readonly parentType: (keyof T & string) | (M extends {
+            engines: readonly (infer R)[];
+        } ? NamesOf<R> : never);
     }[];
 };
+/** Every entity name in one registry. */
+type NamesOf<R> = R extends Record<string, EntityDef> ? keyof R & string : never;
 /**
  * Compose the entity-referencing manifest fragments against the registry.
  *
@@ -217,5 +212,38 @@ export declare function manifestEntities<const T extends Record<string, EntityDe
         entityViews: M['entityViews'];
     };
 };
+/**
+ * The row type of a declared entity — what `ctx.sql.query` returns for it.
+ *
+ * `ctx.sql.query` leaves `T` to the vertical, so every handler writes its own
+ * row interface and the schema ends up described three times: the DDL, the
+ * registry, and a hand-written `interface CustomerRow`. This collapses the
+ * third into the second.
+ *
+ * ```ts
+ * export type CustomerRow = EntityRow<typeof calloutEntities, 'customer'>;
+ * ```
+ */
+export type EntityRow<T extends Record<string, EntityDef>, K extends keyof T> = T[K] extends {
+    fields: infer F;
+} ? F extends z.ZodObject<z.ZodRawShape> ? z.infer<F> : never : never;
+/**
+ * Column names per table, read out of a migration journal's SQL.
+ *
+ * **Test tooling**, exported because three engines had hand-rolled a copy and
+ * the copies had already drifted — none followed `RENAME TO`, so a journal that
+ * rebuilds a table under a temporary name would report the pre-rebuild columns
+ * forever.
+ *
+ * It exists because a registry and a journal are two descriptions of one schema
+ * until migrations are derived from the registry. Holding them to each other is
+ * what keeps that duplication safe in the meantime.
+ *
+ * Handles what real journals do: multi-line `CHECK (...)` constraints (tracked
+ * by paren depth, so a continuation line is not read as a column), `ADD COLUMN`,
+ * `DROP TABLE`, and `RENAME TO` — append-only journals rebuild a table by
+ * creating a `_new`, copying, dropping the original and renaming onto its name.
+ */
+export declare function journalColumns(sql: string): Map<string, Set<string>>;
 export {};
 //# sourceMappingURL=model.d.ts.map

package/dist/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IACtD,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,uEAAuE;AACvE,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACvD,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAClC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GACzB,KAAK,GACP,KAAK,CAAC;AAEV;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,CAAC,SAAS;IACR,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG;QACrD,GAAG,CAAC,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C;CACF,EACD,QAAQ,EAAE,CAAC,GAAG,CAAC,CAEhB;AAED,iCAAiC;AACjC,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,YAAY,CAkBxF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EACnE,QAAQ,EAAE,CAAC,GACV;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,CAO9C;AAMD;;;;;;;;;GASG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,IAAI;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS;QACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;KACnC,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS;QAAE,WAAW,EAAE,MAAM,CAAC,CAAA;KAAE,GACrD;QACE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YAAE,UAAU,EAAE,MAAM,CAAC,CAAA;SAAE,GACzD,CAAC,SAAS,MAAM,CAAC,GAAG,MAAM,GACxB;YAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;SAAE,GAC1E,KAAK,GACP,KAAK;KACV,GACD,KAAK,CAAC;IACV,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnG;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS;QAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KACzD,EAAE,CAAC;IACJ;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS;QACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAI5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;KACvC,EAAE,CAAC;CACL,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EACzC,KAAK,CAAC,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAEhC,QAAQ,EAAE,CAAC,EACX,IAAI,EAAE,CAAC,GACN;IACD,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAC9B,eAAe,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9D,EAAE,EAAE;QAAE,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAA;KAAE,CAAC;CACvC,CAcA"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IACtD,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IACpC,wDAAwD;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,uEAAuE;AACvE,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACvD,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAClC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GACzB,KAAK,GACP,KAAK,CAAC;AAEV;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,CAAC,SAAS;IACR,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG;QACrD,GAAG,CAAC,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C;CACF,EACD,QAAQ,EAAE,CAAC,GAAG,CAAC,CAEhB;AAED,iCAAiC;AACjC,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,YAAY,CAkBxF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EACnE,QAAQ,EAAE,CAAC,GACV;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,CAQ9C;AAMD;;;;;;;;;GASG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,IAAI;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS;QACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;KACnC,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS;QAAE,WAAW,EAAE,MAAM,CAAC,CAAA;KAAE,GACrD;QACE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YAAE,UAAU,EAAE,MAAM,CAAC,CAAA;SAAE,GACzD,CAAC,SAAS,MAAM,CAAC,GAAG,MAAM,GACxB;YAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;SAAE,GAC1E,KAAK,GACP,KAAK;KACV,GACD,KAAK,CAAC;IACV,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnG;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;IACxD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;QAI5B,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC7G,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;KAC9G,EAAE,CAAC;CACL,CAAC;AAEF,yCAAyC;AACzC,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC;AAGjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EACzC,KAAK,CAAC,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAEhC,QAAQ,EAAE,CAAC,EACX,IAAI,EAAE,CAAC,GACN;IACD,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAC9B,eAAe,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9D,EAAE,EAAE;QAAE,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAA;KAAE,CAAC;CACvC,CAUA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;IAC3F,MAAM,EAAE,MAAM,CAAC,CAAC;CACjB,GACG,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAClC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GACV,KAAK,GACP,KAAK,CAAC;AAEV;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAsCpE"}

package/dist/model.js

@@ -50,7 +50,7 @@ export function emitModel(entities) {
         out[name] = {
             table: e.table,
             fields,
-            ...(e.parent ? { parent: e.parent } : {}),
+            ...(e.parents?.length ? { parents: [...e.parents].sort() } : {}),
             ...(e.key ? { key: [...e.key].sort() } : {}),
             ...(e.erasable ? { erasable: [...e.erasable].sort() } : {}),
         };
@@ -69,8 +69,10 @@ export function entityRelationsOf(entities) {
     return Object.keys(entities)
         .sort()
         .flatMap((name) => {
-        const parent = entities[name]?.parent;
-        return parent ? [{ entityType: name, parentType: parent }] : [];
+        const parents = entities[name]?.parents;
+        if (!parents?.length)
+            return [];
+        return [...parents].sort().map((parentType) => ({ entityType: name, parentType }));
     });
 }
 /**
@@ -100,14 +102,66 @@ export function manifestEntities(entities, refs) {
         attachmentTargets: (refs.attachmentTargets ?? []),
         searchables: refs.searchables,
         // Derived edges first, then the ones this module cannot check.
-        entityRelations: [
-            ...entityRelationsOf(entities),
-            // Checked parent, foreign child — the mixed edge.
-            ...(refs.foreignChildOf ?? []),
-            // Neither side checkable here.
-            ...(refs.foreignChildren ?? []),
-        ],
+        // Local edges are derived from the entities' own `parents`; edges involving
+        // a composed engine's entity are declared, and both sides are checked.
+        entityRelations: [...entityRelationsOf(entities), ...(refs.relations ?? [])],
         ui: { entityViews: refs.entityViews },
     };
 }
+/**
+ * Column names per table, read out of a migration journal's SQL.
+ *
+ * **Test tooling**, exported because three engines had hand-rolled a copy and
+ * the copies had already drifted — none followed `RENAME TO`, so a journal that
+ * rebuilds a table under a temporary name would report the pre-rebuild columns
+ * forever.
+ *
+ * It exists because a registry and a journal are two descriptions of one schema
+ * until migrations are derived from the registry. Holding them to each other is
+ * what keeps that duplication safe in the meantime.
+ *
+ * Handles what real journals do: multi-line `CHECK (...)` constraints (tracked
+ * by paren depth, so a continuation line is not read as a column), `ADD COLUMN`,
+ * `DROP TABLE`, and `RENAME TO` — append-only journals rebuild a table by
+ * creating a `_new`, copying, dropping the original and renaming onto its name.
+ */
+export function journalColumns(sql) {
+    const tables = new Map();
+    for (const [, table, body] of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?([a-z_][a-z0-9_]*)\s*\(([\s\S]*?)\n\s*\);/gi)) {
+        if (!table || !body)
+            continue;
+        const cols = new Set();
+        let depth = 0;
+        for (const raw of body.split('\n')) {
+            const line = raw.trim();
+            const atTop = depth === 0;
+            depth += (line.match(/\(/g) ?? []).length - (line.match(/\)/g) ?? []).length;
+            if (!atTop)
+                continue;
+            if (!line || line.startsWith('--') || /^(PRIMARY|FOREIGN|UNIQUE|CHECK|CONSTRAINT)\b/i.test(line))
+                continue;
+            const name = /^([a-z_][a-z0-9_]*)\b/i.exec(line)?.[1];
+            if (name)
+                cols.add(name);
+        }
+        tables.set(table, cols);
+    }
+    // Replayed in statement order: a journal may add a column and later rename the
+    // table, or rename onto a name it has just dropped.
+    for (const m of sql.matchAll(/(?:ALTER TABLE ([a-z_][a-z0-9_]*)\s+ADD COLUMN\s+([a-z_][a-z0-9_]*))|(?:ALTER TABLE ([a-z_][a-z0-9_]*)\s+RENAME TO\s+([a-z_][a-z0-9_]*))|(?:DROP TABLE (?:IF EXISTS )?([a-z_][a-z0-9_]*))/gi)) {
+        const [, addTable, addCol, fromTable, toTable, dropped] = m;
+        if (addTable && addCol)
+            tables.get(addTable)?.add(addCol);
+        else if (dropped)
+            tables.delete(dropped);
+        else if (fromTable && toTable) {
+            const cols = tables.get(fromTable);
+            if (cols) {
+                tables.delete(fromTable);
+                tables.set(toTable, cols);
+            }
+        }
+    }
+    return tables;
+}
 //# sourceMappingURL=model.js.map

package/dist/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAO5B,QAAW;IACX,OAAO,QAAQ,CAAC;AAClB,CAAC;AA6BD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAsC,QAAW;IACxE,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAGvG,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAW;IAEX,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,IAAI,EAAE;SACN,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACtC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC;AAsFD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAI9B,QAAW,EACX,IAAO;IAOP,OAAO;QACL,iBAAiB,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAA6C;QAC7F,WAAW,EAAE,IAAI,CAAC,WAA+B;QACjD,+DAA+D;QAC/D,eAAe,EAAE;YACf,GAAG,iBAAiB,CAAC,QAAQ,CAAC;YAC9B,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC9B,+BAA+B;YAC/B,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;SAChC;QACD,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAA+B,EAAE;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqCxB;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAO5B,QAAW;IACX,OAAO,QAAQ,CAAC;AAClB,CAAC;AA8BD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAsC,QAAW;IACxE,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAGvG,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAW;IAEX,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,IAAI,EAAE;SACN,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACP,CAAC;AAuED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAI9B,QAAW,EACX,IAAO;IAOP,OAAO;QACL,iBAAiB,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAA6C;QAC7F,WAAW,EAAE,IAAI,CAAC,WAA+B;QACjD,+DAA+D;QAC/D,4EAA4E;QAC5E,uEAAuE;QACvE,eAAe,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC5E,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAA+B,EAAE;KAC1D,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,KAAK,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CACxC,6EAA6E,CAC9E,EAAE,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;YAAE,SAAS;QAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC;YAC1B,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC7E,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3G,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,oDAAoD;IACpD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAC1B,6LAA6L,CAC9L,EAAE,CAAC;QACF,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,QAAQ,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;aACrD,IAAI,OAAO;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;aACpC,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/operations.d.ts

@@ -0,0 +1,223 @@
+/**
+ * The operation surface of the model (#707).
+ *
+ * #697 declared the entities. This declares what can be *done* to them, and
+ * checks the joins that today are unchecked strings: which permission an
+ * operation requires, which output field an event takes its subject from,
+ * whether a payload carries something an erasure must be able to reach.
+ *
+ * ## A composer, not a second `defineModel`
+ *
+ * `defineOperations` sits beside `defineEntities` rather than swallowing it.
+ * Each half stays independently adoptable — which is what let the entity half
+ * ship and be taken up by two verticals before this existed. A vertical adopts
+ * operations when it is ready, not as the price of adopting entities.
+ *
+ * ## `input`, and the transcription that is not here
+ *
+ * `input` is the Zod object the handler already parses — the same object, not a
+ * description of it. That is the whole reason the model is TypeScript (#680): a
+ * schema language would need the shape written twice, and transcription is what
+ * produced 40 wrong argument names in the one app where this was measured.
+ */
+import { z } from 'zod';
+import type { EntityDef } from './model.js';
+/** `{var}` names in a literal path. */
+type PathParams<S extends string> = S extends `${string}{${infer P}}${infer Rest}` ? P | PathParams<Rest> : never;
+type InputKeys<O> = O extends {
+    input: infer I;
+} ? (I extends z.ZodType ? keyof z.infer<I> & string : never) : never;
+type OutputKeys<O> = O extends {
+    output: infer R;
+} ? (R extends z.ZodType ? keyof z.infer<R> & string : never) : never;
+/** Every `{var}` must name an input field, or the path type collapses. */
+type CheckedPath<O> = O extends {
+    http: {
+        path: infer P;
+    };
+} ? P extends string ? [PathParams<P>] extends [InputKeys<O>] ? P : never : never : string;
+/**
+ * The erasable fields OF THE ENTITY THIS EVENT IS ABOUT.
+ *
+ * Resolving through `emits.entity` rather than matching field names across all
+ * entities is what makes the §12 check exact. A `contactPerson.email` marked
+ * erasable must not stop an event about an `office` carrying its own `email` —
+ * a rule that refuses correct code trains people to route around it, which is
+ * how a PII rule stops being obeyed.
+ */
+type ErasableOf<Entities, O> = O extends {
+    emits: {
+        entity: infer N;
+    };
+} ? N extends keyof Entities ? Entities[N] extends {
+    erasable: readonly (infer F)[];
+} ? F & string : never : never : never;
+/**
+ * The platform's own event invariant, moved from runtime to compile time.
+ * `contracts/events.ts` enforces it with a `superRefine`: *"subjectId is
+ * required when piiClass is 'direct' — crypto-shredding must be able to key the
+ * erasure"*. Classification is mandatory here for the same reason it is there:
+ * an unclassified event type cannot be declared.
+ */
+type PiiShape<O, OutKeys extends string> = O extends {
+    emits: {
+        piiClass: 'none';
+    };
+} ? {
+    readonly piiClass: 'none';
+    readonly subjectId?: never;
+} : {
+    readonly piiClass: 'pseudonymous' | 'direct';
+    readonly subjectId: OutKeys;
+};
+/**
+ * An operation carries a leading `permission` OR `narrows` with a reason, never
+ * both and never neither (rule 5 / CRM-EFF's check 14). `narrows` is the
+ * per-row proof walk: a salesperson listing their own customers must get their
+ * list, not a denial.
+ */
+type OpAuthority<O, PermKey extends string> = O extends {
+    narrows: unknown;
+} ? {
+    readonly narrows: {
+        readonly reason: string;
+    };
+    readonly permission?: never;
+} : {
+    readonly permission: PermKey;
+    readonly narrows?: never;
+};
+/**
+ * The per-operation constraint, self-referential in `O`.
+ *
+ * Each operation is checked against ITS OWN declared input and output rather
+ * than an erased supertype. Written the obvious way every check below compiles
+ * clean and enforces nothing — see `test/operations.test.ts`, which exists to
+ * prove they still bite.
+ */
+type OperationShape<O, Entities, PermKey extends string> = {
+    /** One line, imperative — what invoking this does. Feeds the API document. */
+    readonly summary: string;
+    /**
+     * The request body — the SAME Zod object the handler parses.
+     *
+     * **Omitted means no body at all**, and the handler then takes `undefined`.
+     * Found by the first adopter: three of Callout's six operations take no input,
+     * and a required `z.object({})` cannot say so — a handler accepting only
+     * `undefined` is not assignable to one accepting `{}`.
+     *
+     * This mirrors `ApiOperationDoc.input` ("Omit = no body") rather than
+     * inventing a second vocabulary for the same fact.
+     */
+    readonly input?: z.ZodObject<z.ZodRawShape>;
+    /** True when the handler accepts a body but also accepts none (filter-style reads). */
+    readonly inputOptional?: boolean;
+    /**
+     * Declared, not inferred (#695 Ask 2). Inference documents accidents: one
+     * inferred return carried `contacts?: undefined`, an artefact of an early
+     * return, which generation would have cemented into the published API.
+     *
+     * Declare a return where a caller branches on it — a UI lane is a caller that
+     * branches, which is why #682/#683 depend on this.
+     */
+    readonly output: z.ZodType;
+    readonly http?: {
+        readonly method: 'GET' | 'POST' | 'PATCH' | 'DELETE';
+        readonly path: CheckedPath<O>;
+    };
+    readonly emits?: {
+        /** The entity the event is about — a declared entity. */
+        readonly entity: keyof Entities & string;
+        /**
+         * Which OUTPUT field carries that entity's id.
+         *
+         * The #695 defect: 18 operations emitted `entityId: String(result.id)` on
+         * objects that answer with `contractId` / `runId` / `instanceId`. For a
+         * mutation writing a child the event is about the PARENT, so the two differ
+         * and nothing downstream would ever have flagged it.
+         */
+        readonly entityIdFrom: OutputKeys<O>;
+        readonly type: string;
+        readonly schemaVersion: number;
+        /**
+         * Fat payload, drawn from the output — minus anything the entity marks
+         * `erasable`. Immutable events are the one place in a scope an erasure
+         * cannot reach.
+         */
+        readonly payload?: readonly Exclude<OutputKeys<O>, ErasableOf<Entities, O>>[];
+    } & PiiShape<O, OutputKeys<O>>;
+    /**
+     * Per-field permission on the projection: omission, not denial. The caller
+     * still gets the row, without the fields they may not see.
+     */
+    readonly gates?: {
+        readonly [F in OutputKeys<O>]?: PermKey;
+    };
+} & OpAuthority<O, PermKey>;
+/**
+ * Declare a module's operations against its entities and permission keys.
+ *
+ * Curried so the entities and permissions are given explicitly while each
+ * operation still infers its own input and output — a callback parameter cannot
+ * be contextually typed by a generic being inferred from the object containing
+ * it.
+ *
+ * ```ts
+ * export const ops = defineOperations(calloutEntities, PERMISSIONS)({
+ *   'customer/create': {
+ *     summary: 'Register a customer',
+ *     permission: 'customer:manage',
+ *     input: z.object({ name: z.string() }),
+ *     output: z.object({ id: z.string(), number: z.string() }),
+ *     http: { method: 'POST', path: '/customers' },
+ *     emits: {
+ *       entity: 'customer', entityIdFrom: 'id',
+ *       type: 'callout.customer-created', schemaVersion: 1, piiClass: 'none',
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export declare function defineOperations<const Entities extends Record<string, EntityDef>, const Perms extends readonly string[]>(_entities: Entities, _permissions: Perms): <const Ops extends { readonly [K in keyof Ops]: OperationShape<Ops[K], Entities, Perms[number]>; }>(operations: Ops) => Ops;
+/**
+ * The permission keys an operation set actually requires, for the manifest.
+ *
+ * Read structurally rather than through a `{ permission?: string }` parameter:
+ * a `narrows` operation has neither `permission` nor `emits`, and TypeScript's
+ * weak-type rule rejects an object sharing no properties with the parameter.
+ */
+export declare function permissionsUsedBy(operations: Readonly<Record<string, object>>): string[];
+/** The event types an operation set emits, for `manifest.events.emits`. */
+export declare function eventsEmittedBy(operations: Readonly<Record<string, object>>): {
+    type: string;
+    schemaVersion: number;
+}[];
+/**
+ * The handler map a declared operation set requires — CRM-EFF's `satisfies Impl`
+ * seam, which is what makes the declaration BINDING rather than decorative.
+ *
+ * ```ts
+ * export const operations = { … } satisfies OperationImpl<typeof calloutOps, OperationContext>;
+ * ```
+ *
+ * Four things become compile errors at the exact method: a handler whose input
+ * disagrees with the declared `input`, one whose return disagrees with the
+ * declared `output`, an operation declared and not implemented, and one
+ * implemented and not declared.
+ *
+ * `Ctx` is a parameter rather than `OperationContext` because contracts is below
+ * the kernel and must not import it. The vertical supplies it.
+ */
+export type OperationImpl<Ops, Ctx> = {
+    [K in keyof Ops]: Ops[K] extends {
+        output: infer O;
+    } ? O extends z.ZodType ? (ctx: Ctx, input: ImplInput<Ops[K]>) => z.infer<O> | Promise<z.infer<O>> : never : never;
+};
+/** No declared `input` means the handler takes `undefined`. */
+type ImplInput<O> = O extends {
+    input: infer I;
+} ? I extends z.ZodType ? O extends {
+    inputOptional: true;
+} ? z.infer<I> | undefined : z.infer<I> : undefined : undefined;
+export {};
+//# sourceMappingURL=operations.d.ts.map

package/dist/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../src/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C,uCAAuC;AACvC,KAAK,UAAU,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,GAC9E,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GACpB,KAAK,CAAC;AAEV,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAErH,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAEvH,0EAA0E;AAC1E,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GACvD,CAAC,SAAS,MAAM,GACd,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GACpC,CAAC,GACD,KAAK,GACP,KAAK,GACP,MAAM,CAAC;AAEX;;;;;;;;GAQG;AACH,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GACnE,CAAC,SAAS,MAAM,QAAQ,GACtB,QAAQ,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;CAAE,GACpD,CAAC,GAAG,MAAM,GACV,KAAK,GACP,KAAK,GACP,KAAK,CAAC;AAEV;;;;;;GAMG;AACH,KAAK,QAAQ,CAAC,CAAC,EAAE,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChF;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC;AAElF;;;;;GAKG;AACH,KAAK,WAAW,CAAC,CAAC,EAAE,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAA;CAAE,GAC9E;IAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAE/D;;;;;;;GAOG;AACH,KAAK,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,SAAS,MAAM,IAAI;IACzD,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QACrD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,yDAAyD;QACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,QAAQ,GAAG,MAAM,CAAC;QACzC;;;;;;;WAOG;QACH,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B;;;;WAIG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO;KAAE,CAAC;CAC9D,GAAG,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAM5B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAChD,KAAK,CAAC,KAAK,SAAS,SAAS,MAAM,EAAE,EACrC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,IAEtC,KAAK,CAAC,GAAG,SAAS,EAChB,QAAQ,EAAE,CAAC,IAAI,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAC3E,cAEW,GAAG,KACd,GAAG,CACP;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,EAAE,CAMxF;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAC7B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC3C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EAAE,CAW3C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI;KACnC,CAAC,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAChD,CAAC,SAAS,CAAC,CAAC,OAAO,GACjB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GACxE,KAAK,GACP,KAAK;CACV,CAAC;AAEF,+DAA+D;AAC/D,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5C,CAAC,SAAS,CAAC,CAAC,OAAO,GACjB,CAAC,SAAS;IAAE,aAAa,EAAE,IAAI,CAAA;CAAE,GAC/B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,GACtB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GACZ,SAAS,GACX,SAAS,CAAC"}

package/dist/operations.js

@@ -0,0 +1,81 @@
+/**
+ * The operation surface of the model (#707).
+ *
+ * #697 declared the entities. This declares what can be *done* to them, and
+ * checks the joins that today are unchecked strings: which permission an
+ * operation requires, which output field an event takes its subject from,
+ * whether a payload carries something an erasure must be able to reach.
+ *
+ * ## A composer, not a second `defineModel`
+ *
+ * `defineOperations` sits beside `defineEntities` rather than swallowing it.
+ * Each half stays independently adoptable — which is what let the entity half
+ * ship and be taken up by two verticals before this existed. A vertical adopts
+ * operations when it is ready, not as the price of adopting entities.
+ *
+ * ## `input`, and the transcription that is not here
+ *
+ * `input` is the Zod object the handler already parses — the same object, not a
+ * description of it. That is the whole reason the model is TypeScript (#680): a
+ * schema language would need the shape written twice, and transcription is what
+ * produced 40 wrong argument names in the one app where this was measured.
+ */
+import { z } from 'zod';
+// ---------------------------------------------------------------------------
+// The composer.
+// ---------------------------------------------------------------------------
+/**
+ * Declare a module's operations against its entities and permission keys.
+ *
+ * Curried so the entities and permissions are given explicitly while each
+ * operation still infers its own input and output — a callback parameter cannot
+ * be contextually typed by a generic being inferred from the object containing
+ * it.
+ *
+ * ```ts
+ * export const ops = defineOperations(calloutEntities, PERMISSIONS)({
+ *   'customer/create': {
+ *     summary: 'Register a customer',
+ *     permission: 'customer:manage',
+ *     input: z.object({ name: z.string() }),
+ *     output: z.object({ id: z.string(), number: z.string() }),
+ *     http: { method: 'POST', path: '/customers' },
+ *     emits: {
+ *       entity: 'customer', entityIdFrom: 'id',
+ *       type: 'callout.customer-created', schemaVersion: 1, piiClass: 'none',
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export function defineOperations(_entities, _permissions) {
+    return (operations) => operations;
+}
+/**
+ * The permission keys an operation set actually requires, for the manifest.
+ *
+ * Read structurally rather than through a `{ permission?: string }` parameter:
+ * a `narrows` operation has neither `permission` nor `emits`, and TypeScript's
+ * weak-type rule rejects an object sharing no properties with the parameter.
+ */
+export function permissionsUsedBy(operations) {
+    const keys = Object.values(operations).flatMap((op) => {
+        const permission = op.permission;
+        return typeof permission === 'string' ? [permission] : [];
+    });
+    return [...new Set(keys)].sort();
+}
+/** The event types an operation set emits, for `manifest.events.emits`. */
+export function eventsEmittedBy(operations) {
+    const seen = new Map();
+    for (const op of Object.values(operations)) {
+        const emits = op.emits;
+        if (typeof emits?.type === 'string' && typeof emits.schemaVersion === 'number') {
+            seen.set(emits.type, emits.schemaVersion);
+        }
+    }
+    return [...seen.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([type, schemaVersion]) => ({ type, schemaVersion }));
+}
+//# sourceMappingURL=operations.js.map

package/dist/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../src/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiIxB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,gBAAgB,CAG9B,SAAmB,EAAE,YAAmB;IACxC,OAAO,CAKL,UAAe,EACV,EAAE,CAAC,UAAU,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA4C;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACpD,MAAM,UAAU,GAAI,EAA+B,CAAC,UAAU,CAAC;QAC/D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAC7B,UAA4C;IAE5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAI,EAA8D,CAAC,KAAK,CAAC;QACpF,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;SACvB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.67.0",
+  "version": "0.69.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {