@substrat-run/control-plane-api 0.179.0 → 0.180.0

package/dist/store-entry.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-entry.generated.d.ts","sourceRoot":"","sources":["../src/store-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAElE,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,+BAA+B,eAAe,CAAC;AAE5D,6GAA6G;AAC7G,eAAO,MAAM,gCAAgC,UAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,mBAAmB,CAAC;AAE9D,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAmF,CAAC;AAEvH,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,EAAE,MAAgqc,CAAC;AAElsc;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAs1M,CAAC;AAE/3M;;;GAGG;AACH,eAAO,MAAM,kCAAkC,EAAE,MAAg/X,CAAC"}
+{"version":3,"file":"store-entry.generated.d.ts","sourceRoot":"","sources":["../src/store-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAElE,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,+BAA+B,eAAe,CAAC;AAE5D,6GAA6G;AAC7G,eAAO,MAAM,gCAAgC,UAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,mBAAmB,CAAC;AAE9D,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAmF,CAAC;AAEvH,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,EAAE,MAAgqc,CAAC;AAElsc;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAA8wN,CAAC;AAEvzN;;;GAGG;AACH,eAAO,MAAM,kCAAkC,EAAE,MAAg/X,CAAC"}

package/dist/store-entry.generated.js

@@ -53,7 +53,7 @@ export const STORE_ENTRY_SOURCE = "// packages/control-plane-api/store-entry/ent
  * name (a Python module name, no `.py`) replaces `__SUBSTRAT_STORE_DRIVER__` and its class
  * name replaces `__SUBSTRAT_STORE_CLASS__`, as in the JavaScript entry.
  */
-export const STORE_ENTRY_PYTHON_SOURCE = "\"\"\"The platform's Python store entry (#2290), the twin of store-entry/entry.ts.\n\nUploaded as the store script's main module when the driver is Python. The driver's class is\nimported through the two placeholders below, which the upload replaces with the driver's module\nname and class name, as it does for the JavaScript entry. The driver is reached only through\nthis module, after the call is verified.\n\nThere is one verifier. Every call is checked by store-entry/verify.ts, bundled as an ES module\nthe upload ships beside this one and imported through the runtime's JavaScript bridge. It runs\ncontracts' verifyScopeStoreCall (RFC scope-stores section 10.3, checks 1-4) against the script\nname and both audiences' public keys this upload was given. This module parses no envelope, so\nit cannot disagree with the JavaScript entry about one. The default entrypoint addresses\nSubstratStoreObject by idFromName of the signed name. The object checks the call again, and\nrefuses unless its own id is the id of that name (check 5), before the driver is constructed: an\nobject is bound to one name by construction, with nothing stored that the driver could rewrite. It\nthen spends the envelope's nonce through the verifier's spendStoreNonce (K-59), so one envelope is\nadmitted once.\n\nThe body stays in JavaScript (#2811). The verifier module reads it once, bounded by STORE_CALL_MAX_BYTES\n(a declared Content-Length over the limit is refused with 413 before the body is read, and a stream\nthat goes past it is refused at the limit), verifies it as the text those bytes decode to, and hands\nback the bytes as an ArrayBuffer. That buffer is what the default entrypoint forwards to the object\nand what the driver's Request is built over, so this module makes no Python string of the body: the\ndriver reads it as text only if it asks for text. The body used to be read twice and copied to Python\neach time, which failed with exceededMemory from about 6 MB.\nThe driver is constructed once per object instance with the object's ctx and an env with none of\nthe entry's SUBSTRAT_STORE* bindings. The upload sets disallow_importable_env and\ndisable_ctx_exports, and both apply to a Python script: `from workers import env` then reads an\nempty env, and ctx.exports is absent.\n\nWhat this is not: a boundary against a hostile driver, and it is weaker here than in JavaScript.\nPython has no private fields. The driver's module is imported by this one, before this module's\nbody has finished, and runs in the same interpreter: it can reach this module through\nsys.modules and replace its functions, and it can reach the entry's object, its full env and the\nstore namespace in it, through the garbage collector. The env strip and the cached driver keep a\ncareless driver away from the entry's bindings, not a hostile one. A driver written to interfere is\nstopped by the review of its release (D-63), not by this module.\n\"\"\"\n\nfrom workers import DurableObject, Request, Response, WorkerEntrypoint, import_from_javascript\nfrom js import Date, Object\n\nfrom __SUBSTRAT_STORE_DRIVER__ import __SUBSTRAT_STORE_CLASS__ as StoreDriver\n\n# Each of these is a name in store-entry/names.ts; test/python-entry.test.ts holds them equal.\nVERIFIER_MODULE = \"./substrat-store-verify.js\"\nOBJECT_BINDING = \"SUBSTRAT_STORE\"\nRESERVED_BINDING_PREFIX = \"SUBSTRAT_STORE\"\n\n\ndef _raw_env(env):\n    \"\"\"The JavaScript env the runtime handed over. The SDK wraps it, and has no public unwrap.\"\"\"\n    return env._env\n\n\ndef _raw_storage(ctx):\n    \"\"\"The object's JavaScript storage. The SDK wraps ctx and its storage, and has no public unwrap.\"\"\"\n    return ctx._ctx.storage\n\n\ndef _driver_env(env):\n    \"\"\"The env the driver is constructed with: everything but the entry's own bindings.\"\"\"\n    entries = [entry for entry in Object.entries(_raw_env(env)) if not str(entry[0]).startswith(RESERVED_BINDING_PREFIX)]\n    return Object.fromEntries(entries)\n\n\ndef _refusal(verified):\n    \"\"\"The response for a refused call: its status and its plain-text message.\"\"\"\n    return Response(verified.message, status=verified.status)\n\n\nasync def _verified(request, env):\n    \"\"\"The call read once and verified (its envelope and its body as a JavaScript ArrayBuffer), or the refusal.\"\"\"\n    verifier = import_from_javascript(VERIFIER_MODULE)\n    verified = await verifier.verifiedStoreCall(request.js_object, _raw_env(env))\n    return verified if verified.ok else _refusal(verified)\n\n\ndef _driver_request(url, body):\n    return Request(url, method=\"POST\", headers={\"content-type\": \"application/json\"}, body=body)\n\n\nclass SubstratStoreObject(DurableObject):\n    def __init__(self, ctx, env):\n        super().__init__(ctx, env)\n        self._driver = None\n\n    def _driver_object(self):\n        \"\"\"Constructed once per object instance, on first use, so the driver keeps its in-memory state.\"\"\"\n        if self._driver is None:\n            self._driver = StoreDriver(self.ctx, _driver_env(self.env))\n        return self._driver\n\n    async def fetch(self, request):\n        call = await _verified(request, self.env)\n        if isinstance(call, Response):\n            return call\n        namespace = getattr(self.env, OBJECT_BINDING)\n        if not self.ctx.id.equals(namespace.idFromName(call.envelope.name)):\n            return Response(\"unauthorized: object\", status=401)\n        verifier = import_from_javascript(VERIFIER_MODULE)\n        if not verifier.spendStoreNonce(_raw_storage(self.ctx), call.envelope, int(Date.now() // 1000)):\n            return _refusal(verifier.spentNonce)\n        return await self._driver_object().fetch(_driver_request(request.url, call.body))\n\n    async def alarm(self, alarm_info=None):\n        \"\"\"An alarm is the object's own timer, which only the driver sets. It goes to the driver.\"\"\"\n        driver = self._driver_object()\n        if hasattr(driver, \"alarm\"):\n            await driver.alarm(alarm_info)\n\n\nclass Default(WorkerEntrypoint):\n    async def fetch(self, request):\n        call = await _verified(request, self.env)\n        if isinstance(call, Response):\n            return call\n        namespace = getattr(self.env, OBJECT_BINDING)\n        stub = namespace.get(namespace.idFromName(call.envelope.name))\n        return await stub.fetch(request.url, method=\"POST\", headers=request.js_object.headers, body=call.body)\n";
+export const STORE_ENTRY_PYTHON_SOURCE = "\"\"\"The platform's Python store entry (#2290), the twin of store-entry/entry.ts.\n\nUploaded as the store script's main module when the driver is Python. The driver's class is\nimported through the two placeholders below, which the upload replaces with the driver's module\nname and class name, as it does for the JavaScript entry. The driver is reached only through\nthis module, after the call is verified.\n\nThere is one verifier. Every call is checked by store-entry/verify.ts, bundled as an ES module\nthe upload ships beside this one and imported through the runtime's JavaScript bridge. It runs\ncontracts' verifyScopeStoreCall (RFC scope-stores section 10.3, checks 1-4) against the script\nname and both audiences' public keys this upload was given. This module parses no envelope, so\nit cannot disagree with the JavaScript entry about one. The default entrypoint addresses\nSubstratStoreObject by idFromName of the signed name. The object checks the call again, and\nrefuses unless its own id is the id of that name (check 5), before the driver is constructed: an\nobject is bound to one name by construction, with nothing stored that the driver could rewrite. It\nthen spends the envelope's nonce through the verifier's spendStoreNonce (K-59), so one envelope is\nadmitted once.\n\nThe body stays in JavaScript (#2811). The verifier module reads it once, bounded by STORE_CALL_MAX_BYTES\n(a declared Content-Length over the limit is refused with 413 before the body is read, and a stream\nthat goes past it is refused at the limit), verifies it as the text those bytes decode to, and hands\nback the bytes as an ArrayBuffer. That buffer is what the default entrypoint forwards to the object\nand what the driver's Request is built over, so this module makes no Python string of the body: the\ndriver reads it as text only if it asks for text. The body used to be read twice and copied to Python\neach time, which failed with exceededMemory from about 6 MB.\nThe driver is constructed once per object instance with the object's ctx and an env with none of\nthe entry's SUBSTRAT_STORE* bindings. The upload sets disallow_importable_env and\ndisable_ctx_exports, and both apply to a Python script: `from workers import env` then reads an\nempty env, and ctx.exports is absent.\n\nWhat this is not: a boundary against a hostile driver, and it is weaker here than in JavaScript.\nPython has no private fields. The driver's module is imported by this one, before this module's\nbody has finished, and runs in the same interpreter: it can reach this module through\nsys.modules and replace its functions, and it can reach the entry's object, its full env and the\nstore namespace in it, through the garbage collector. The env strip and the cached driver keep a\ncareless driver away from the entry's bindings, not a hostile one. A driver written to interfere is\nstopped by the review of its release (D-63), not by this module.\n\"\"\"\n\nfrom workers import DurableObject, Request, Response, WorkerEntrypoint, import_from_javascript\nfrom js import Date, Object\n\nfrom __SUBSTRAT_STORE_DRIVER__ import __SUBSTRAT_STORE_CLASS__ as StoreDriver\n\n# Each of these is a name in store-entry/names.ts; test/python-entry.test.ts holds them equal.\nVERIFIER_MODULE = \"./substrat-store-verify.js\"\nOBJECT_BINDING = \"SUBSTRAT_STORE\"\nRESERVED_BINDING_PREFIX = \"SUBSTRAT_STORE\"\n\n\ndef _unwrapped(value, attribute):\n    \"\"\"The JavaScript object under the SDK's wrapper, or the value itself when nothing wraps it.\n\n    The SDK pywrangler installs wraps env and ctx, with no public unwrap. An upload does not ship that\n    SDK, and the runtime's own may hand either over unwrapped, so the private attribute can be absent\n    on a deployed object (a deployed ctx has no `_ctx`). Every unwrap in this module goes through here.\n    \"\"\"\n    return getattr(value, attribute, value)\n\n\ndef _raw_env(env):\n    \"\"\"The JavaScript env the runtime handed over.\"\"\"\n    return _unwrapped(env, \"_env\")\n\n\ndef _raw_storage(ctx):\n    \"\"\"The object's JavaScript storage.\"\"\"\n    return _unwrapped(ctx, \"_ctx\").storage\n\n\ndef _driver_env(env):\n    \"\"\"The env the driver is constructed with: everything but the entry's own bindings.\"\"\"\n    entries = [entry for entry in Object.entries(_raw_env(env)) if not str(entry[0]).startswith(RESERVED_BINDING_PREFIX)]\n    return Object.fromEntries(entries)\n\n\ndef _refusal(verified):\n    \"\"\"The response for a refused call: its status and its plain-text message.\"\"\"\n    return Response(verified.message, status=verified.status)\n\n\nasync def _verified(request, env):\n    \"\"\"The call read once and verified (its envelope and its body as a JavaScript ArrayBuffer), or the refusal.\"\"\"\n    verifier = import_from_javascript(VERIFIER_MODULE)\n    verified = await verifier.verifiedStoreCall(request.js_object, _raw_env(env))\n    return verified if verified.ok else _refusal(verified)\n\n\ndef _driver_request(url, body):\n    return Request(url, method=\"POST\", headers={\"content-type\": \"application/json\"}, body=body)\n\n\nclass SubstratStoreObject(DurableObject):\n    def __init__(self, ctx, env):\n        super().__init__(ctx, env)\n        self._driver = None\n\n    def _driver_object(self):\n        \"\"\"Constructed once per object instance, on first use, so the driver keeps its in-memory state.\"\"\"\n        if self._driver is None:\n            self._driver = StoreDriver(self.ctx, _driver_env(self.env))\n        return self._driver\n\n    async def fetch(self, request):\n        call = await _verified(request, self.env)\n        if isinstance(call, Response):\n            return call\n        namespace = getattr(self.env, OBJECT_BINDING)\n        if not self.ctx.id.equals(namespace.idFromName(call.envelope.name)):\n            return Response(\"unauthorized: object\", status=401)\n        verifier = import_from_javascript(VERIFIER_MODULE)\n        if not verifier.spendStoreNonce(_raw_storage(self.ctx), call.envelope, int(Date.now() // 1000)):\n            return _refusal(verifier.spentNonce)\n        return await self._driver_object().fetch(_driver_request(request.url, call.body))\n\n    async def alarm(self, alarm_info=None):\n        \"\"\"An alarm is the object's own timer, which only the driver sets. It goes to the driver.\"\"\"\n        driver = self._driver_object()\n        if hasattr(driver, \"alarm\"):\n            await driver.alarm(alarm_info)\n\n\nclass Default(WorkerEntrypoint):\n    async def fetch(self, request):\n        call = await _verified(request, self.env)\n        if isinstance(call, Response):\n            return call\n        namespace = getattr(self.env, OBJECT_BINDING)\n        stub = namespace.get(namespace.idFromName(call.envelope.name))\n        return await stub.fetch(request.url, method=\"POST\", headers=request.js_object.headers, body=call.body)\n";
 /**
  * The verifier the Python entry imports, uploaded beside it as `substrat-store-verify.js`
  * (an ES module). It is `packages/control-plane-api/store-entry/verify.ts`, the check the JavaScript entry runs — 11756 bytes.

package/dist/store-entry.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-entry.generated.js","sourceRoot":"","sources":["../src/store-entry.generated.ts"],"names":[],"mappings":"AAAA,oOAAoO;AACpO,mEAAmE;AAEnE;;;;;GAKG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,4GAA4G;AAC5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CAAC;AAE5D,6GAA6G;AAC7G,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;AAE9D,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,yBAAyB,EAAC,yBAAyB,EAAC,0BAA0B,CAAC,CAAC;AAEvH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAW,upcAAupc,CAAC;AAElsc;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,60MAA60M,CAAC;AAE/3M;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAW,u+XAAu+X,CAAC"}
+{"version":3,"file":"store-entry.generated.js","sourceRoot":"","sources":["../src/store-entry.generated.ts"],"names":[],"mappings":"AAAA,oOAAoO;AACpO,mEAAmE;AAEnE;;;;;GAKG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,4GAA4G;AAC5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CAAC;AAE5D,6GAA6G;AAC7G,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;AAE9D,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,yBAAyB,EAAC,yBAAyB,EAAC,0BAA0B,CAAC,CAAC;AAEvH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAW,upcAAupc,CAAC;AAElsc;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,qwNAAqwN,CAAC;AAEvzN;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAW,u+XAAu+X,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/control-plane-api",
-  "version": "0.179.0",
+  "version": "0.180.0",
   "description": "HTTP surface over HostAdmin — the audited control-plane transport (control-plane.md §4.5)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -27,10 +27,10 @@
   ],
   "dependencies": {
     "hono": "^4.13.13",
-    "@substrat-run/contracts": "^0.179.0",
-    "@substrat-run/control-plane-client": "^0.6.1",
-    "@substrat-run/kernel": "^0.179.0",
-    "@substrat-run/psl": "^0.2.5"
+    "@substrat-run/contracts": "^0.180.0",
+    "@substrat-run/control-plane-client": "^0.6.2",
+    "@substrat-run/psl": "^0.2.5",
+    "@substrat-run/kernel": "^0.180.0"
   },
   "devDependencies": {
     "@hono/node-server": "^1.13.0",
@@ -43,10 +43,10 @@
     "tsx": "^4.19.0",
     "typescript": "^7.0.0",
     "vitest": "^5.0.5",
-    "@substrat-run/connector-fortnox": "^0.7.2",
-    "@substrat-run/connector-planima": "^0.2.76",
-    "@substrat-run/vertical-host": "^0.179.0",
-    "@substrat-run/adapter-sqlite": "^0.179.0"
+    "@substrat-run/adapter-sqlite": "^0.180.0",
+    "@substrat-run/connector-fortnox": "^0.7.3",
+    "@substrat-run/vertical-host": "^0.180.0",
+    "@substrat-run/connector-planima": "^0.2.77"
   },
   "publishConfig": {
     "access": "public"