@substrat-run/kernel 0.141.0 → 0.143.0

package/dist/capability.d.ts

@@ -1,12 +1,12 @@
-import { type BecomeCapabilityInput, type CapabilityExchange, type CapabilityFilter, type CapabilityId, type CapabilityMintInput, type CapabilityPage, type CapabilityRecord, type CheckSubject, type Decision, type DomainEventInput, type EntityRef, type Instant, type MintedCapability, type Node, type PermissionKey, type PlatformActorId, type PrincipalId } from '@substrat-run/contracts';
-import { PermissionDenied } from './permission-checker.js';
+import { type BecomeCapabilityInput, type BecomeLinkState, type BecomeMintRefusal, type BoundedBecomeRevoke, type CapabilityExchange, type CapabilityFilter, type CapabilityId, type CapabilityMintInput, type CapabilityPage, type CapabilityRecord, type CheckSubject, type Decision, type DomainEventInput, type EntityRef, type Instant, type MintedCapability, type Node, type PermissionKey, type PlatformActorId, type PrincipalBecomeCapabilityInput, type PrincipalId } from '@substrat-run/contracts';
+import { PermissionDenied, type Holdings, type PermissionChecker } from './permission-checker.js';
 import type { ScopedSql, SqlValue } from './scope-host.js';
 /**
  * The two spine tables, kernel-owned so no vertical carries a migration for them. Shared by
  * both adapters' `KERNEL_DDL` (interpolated, like `IDEMPOTENCY_DDL`), so the shape
  * self-host builds and the shape production builds cannot part company.
  */
-export declare const CAPABILITY_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_capabilities (\n    id TEXT PRIMARY KEY,\n    -- #1672: SHA-256 hex of the secret. The secret itself is stored NOWHERE \u2014 it leaves\n    -- the kernel once, in the mint's return value, and a lookup is this indexed equality.\n    token_hash TEXT NOT NULL UNIQUE,\n    -- 'act': the holder acts AS the capability ({ capability } on the spine), bounded by\n    -- entity + permissions (+ operations + attachments). 'become': exchanging it yields `principal`.\n    mode TEXT NOT NULL,\n    label TEXT,\n    entity_type TEXT,\n    entity_id TEXT,\n    -- JSON array of permission keys (act). The capability's whole authority: no\n    -- `capability:` tuple is ever written, so none can be forged through the tuple table.\n    permissions TEXT,\n    -- JSON array of operation names, or NULL = any operation the keys allow (act).\n    operations TEXT,\n    -- NULL = no attachment read opt-in; 'read' explicitly allows attachment readers.\n    attachments TEXT,\n    principal TEXT,\n    -- JSON capabilityAuthor: a principal id (a module minted it, and its authority is\n    -- re-checked on every use) or {\"platform\": \u2026} (HostAdmin minted it).\n    minted_by TEXT NOT NULL,\n    minted_at TEXT NOT NULL,\n    expires_at TEXT,\n    -- NULL = unlimited. A use is an EXCHANGE of the secret, never an invocation.\n    max_uses INTEGER,\n    uses INTEGER NOT NULL DEFAULT 0,\n    last_used_at TEXT,\n    -- Tombstone, never a delete: a capability that once admitted someone is evidence\n    -- of why they were admitted (K-4, K-21).\n    revoked_at TEXT,\n    revoked_by TEXT\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capabilities_entity\n    ON _substrat_capabilities (entity_type, entity_id);\n  -- #1672: what an exchange hands out instead of the secret \u2014 a session token, of which\n  -- again only the hash is kept. Each session acts as its capability until the earlier of\n  -- its own expiry and the capability's; the capability is re-read on every invoke, so\n  -- revoking it ends every session at once \u2014 a revoke touches only the capability row,\n  -- and it is that per-invoke read, not a cascade here, that refuses the next call.\n  -- Expired rows are pruned on exchange, at most CAPABILITY_SESSION_PRUNE_BATCH at a time,\n  -- on the only path that adds one \u2014 so an exchange's write is bounded however many expired.\n  CREATE TABLE IF NOT EXISTS _substrat_capability_sessions (\n    token_hash TEXT PRIMARY KEY,\n    capability_id TEXT NOT NULL,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capability_sessions_expiry\n    ON _substrat_capability_sessions (expires_at);\n";
+export declare const CAPABILITY_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_capabilities (\n    id TEXT PRIMARY KEY,\n    -- #1672: SHA-256 hex of the secret. The secret itself is stored NOWHERE \u2014 it leaves\n    -- the kernel once, in the mint's return value, and a lookup is this indexed equality.\n    token_hash TEXT NOT NULL UNIQUE,\n    -- 'act': the holder acts AS the capability ({ capability } on the spine), bounded by\n    -- entity + permissions (+ operations + attachments). 'become': exchanging it yields `principal`.\n    mode TEXT NOT NULL,\n    label TEXT,\n    entity_type TEXT,\n    entity_id TEXT,\n    -- JSON array of permission keys (act). The capability's whole authority: no\n    -- `capability:` tuple is ever written, so none can be forged through the tuple table.\n    permissions TEXT,\n    -- JSON array of operation names, or NULL = any operation the keys allow (act).\n    operations TEXT,\n    -- NULL = no attachment read opt-in; 'read' explicitly allows attachment readers.\n    attachments TEXT,\n    principal TEXT,\n    -- #1686: a principal-minted 'become' only \u2014 the digest of what `principal` held when it was\n    -- minted (`holdingsDigest`). The exchange recomputes it, and a link whose principal's\n    -- holdings have changed since is revoked rather than exchanged. NULL on every other row.\n    target_digest TEXT,\n    -- #1686: why the kernel itself revoked it ('holdings-changed'); NULL for any other revoke.\n    revoked_reason TEXT,\n    -- JSON capabilityAuthor: a principal id (a module minted it, and its authority is\n    -- re-checked on every use) or {\"platform\": \u2026} (HostAdmin minted it).\n    minted_by TEXT NOT NULL,\n    minted_at TEXT NOT NULL,\n    expires_at TEXT,\n    -- NULL = unlimited. A use is an EXCHANGE of the secret, never an invocation.\n    max_uses INTEGER,\n    uses INTEGER NOT NULL DEFAULT 0,\n    last_used_at TEXT,\n    -- Tombstone, never a delete: a capability that once admitted someone is evidence\n    -- of why they were admitted (K-4, K-21).\n    revoked_at TEXT,\n    revoked_by TEXT\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capabilities_entity\n    ON _substrat_capabilities (entity_type, entity_id);\n  -- #1672: what an exchange hands out instead of the secret \u2014 a session token, of which\n  -- again only the hash is kept. Each session acts as its capability until the earlier of\n  -- its own expiry and the capability's; the capability is re-read on every invoke, so\n  -- revoking it ends every session at once \u2014 a revoke touches only the capability row,\n  -- and it is that per-invoke read, not a cascade here, that refuses the next call.\n  -- Expired rows are pruned on exchange, at most CAPABILITY_SESSION_PRUNE_BATCH at a time,\n  -- on the only path that adds one \u2014 so an exchange's write is bounded however many expired.\n  CREATE TABLE IF NOT EXISTS _substrat_capability_sessions (\n    token_hash TEXT PRIMARY KEY,\n    capability_id TEXT NOT NULL,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capability_sessions_expiry\n    ON _substrat_capability_sessions (expires_at);\n";
 /** The tables `CAPABILITY_DDL` builds — what a copy of a scope leaves behind (`capabilitiesForLoad`, #1686). */
 export declare const CAPABILITY_TABLE_NAMES: readonly ['_substrat_capabilities', '_substrat_capability_sessions'];
 /** One capability row as the spine stores it — snake_case, because that is what both adapters `SELECT`. */
@@ -28,9 +28,11 @@ export interface CapabilityRow {
     last_used_at: string | null;
     revoked_at: string | null;
     revoked_by: string | null;
+    /** #1686: a principal-minted `become`'s holdings digest at mint; NULL elsewhere. */
+    target_digest?: string | null;
+    /** #1686: why the kernel itself revoked it; NULL otherwise. */
+    revoked_reason?: string | null;
 }
-/** Every column a read returns — everything but `token_hash`, which no reader has a use for. */
-export declare const CAPABILITY_COLUMNS: string;
 /** The row the permission checker reads for a capability subject (`ScopeTupleReader.capability`). */
 export declare function capabilityByIdQuery(id: string): {
     sql: string;
@@ -55,13 +57,6 @@ export declare function capabilityListQuery(raw?: CapabilityFilter, extra?: numb
 };
 /** A read that names no `limit` gets this many records. */
 export declare const DEFAULT_CAPABILITY_LIMIT = 50;
-/**
- * The directory read, decoded — the ONE function behind `ctx.capabilities.list`, and (as
- * `readCapabilityPage`) `HostAdmin.listCapabilities` on both adapters, so "a reader returns
- * records and never a hash" is held in one place: the query selects no `token_hash`, and the
- * decode keeps only the record schema's fields.
- */
-export declare function readCapabilities(sql: ScopedSql, filter?: CapabilityFilter): CapabilityRecord[];
 /**
  * One page of the operator's read. Reads one row past the page: `nextCursor` is the last
  * returned record's id when that extra row exists, and `null` when the walk is complete — so
@@ -98,8 +93,6 @@ export declare function capabilityGrantOf(row: CapabilityRow): CapabilityGrantVi
 export declare function capabilityRecordOf(row: CapabilityRow): CapabilityRecord;
 /** A fresh capability secret: 256 bits, base64url, prefixed. Only its hash is ever stored. */
 export declare function mintCapabilitySecret(): string;
-/** A fresh session token — the same construction, its own prefix. */
-export declare function mintCapabilitySessionToken(): string;
 /**
  * SHA-256 hex of a secret or session token (Web Crypto — the same call in workerd, node and
  * browsers). Unkeyed on purpose: with 256 bits of entropy there is no dictionary to defend
@@ -221,6 +214,12 @@ export declare function exchangeCapability(deps: {
     sql: ScopedSql;
     now: Instant;
     emit: (capability: CapabilityId, event: DomainEventInput) => void;
+    /**
+     * What a principal holds now (#1686) — the checker's `holdings` at this scope. A
+     * principal-minted `become` is exchanged only while its principal's holdings digest is the
+     * one recorded at mint; absent, such a link is refused.
+     */
+    holdings?: (principal: PrincipalId) => Promise<Holdings>;
 }, secret: unknown, 
 /**
  * The only mode the caller can handle. A secret of the OTHER mode answers `null` without
@@ -281,10 +280,120 @@ export declare const plausibleCapabilitySecret: (secret: unknown) => secret is s
  */
 export declare function checkBecomeInput(raw: BecomeCapabilityInput, now: Instant): BecomeCapabilityInput;
 export declare function mintBecomeCapability(sql: ScopedSql, raw: BecomeCapabilityInput, actor: PlatformActorId, now: Instant): Promise<MintedCapability>;
+/**
+ * Where each named `become` link stands (#1686), in the order asked — what a pending-invite list
+ * shows beside each invite. A capability the scope does not hold reads as `revoked`, never `open`.
+ *
+ * A principal-minted link that would otherwise read `open` is judged as its exchange would judge
+ * it: its principal's holdings are read now (`holdings`) and compared with the digest taken at
+ * mint, and a link whose principal changed since reads `revoked` / `holdings-changed` — before
+ * anybody has tried it. Nothing is written on a read: the exchange is what revokes it. One with no
+ * digest, or with no `holdings` to judge it by, reads `revoked`, as its exchange refuses it.
+ */
+export declare function readBecomeLinkStates(sql: ScopedSql, ids: readonly string[], now: Instant, holdings?: (principal: PrincipalId) => Promise<Holdings>): Promise<BecomeLinkState[]>;
+/**
+ * `becomeLinkStates`' bound on how many links one call names (`BECOME_LINK_STATES_MAX_IDS`):
+ * refused over it, never truncated — a caller asks in pages. Its own function so a host whose
+ * storage sits across an RPC boundary checks on the near side, where the typed refusal survives.
+ */
+export declare function assertBecomeLinkStateIds(ids: readonly string[]): void;
+/**
+ * A canonical digest of what a principal holds (#1686): the role KEYS it holds at the node, as
+ * assigned, the permissions granted to it directly at the node, and its entity-narrowed grants —
+ * at scope and tenant level, through its orgs — each sorted and deduplicated, so two reads of the
+ * same holdings in any order give the same digest. Taken when a principal mints a `become` for it,
+ * and again at the exchange: a role assigned or taken away, a grant added or removed, an org joined
+ * or left, all change it, and the link dies.
+ *
+ * Role KEYS, not their expansions, deliberately: a role's definition is the vertical's code,
+ * re-projected on a push and reviewed at the permission-diff checkpoint — nothing an inviter
+ * controls. Expanding it would revoke every open invite at a role whenever a release adds a key to
+ * that role. The price, by design: a REDEFINITION can make the invitee hold more than the minter
+ * held when it minted — a release that widens the role widens what the link becomes. That is a
+ * change only code or staff make (`defineRole` has no HTTP route), never an inviter.
+ *
+ * What the digest deliberately does not see, so nobody relies on it as a reach check:
+ * - the LEVEL a grant is held at — a key moved between the scope and the tenant node leaves it
+ *   unchanged, as the mint bound compares the same flattened set (`holdingsOf` merges the levels);
+ * - reach that grows under a narrowed grant's entity through `ctx.link` / `ctx.relink` — the
+ *   minter's coverage of that entity was checked through `check`, whose reach grows the same way;
+ * - module authority decided from a principal column (an assignee, an author) rather than a tuple
+ *   — neither the bound nor the digest sees it.
+ * None of these three lets the link yield more than its minter held (a role redefinition can, by
+ * design — see above): the identity a link binds is per
+ * (scope, sub), so what it becomes is this principal in this scope only. The first two are judged
+ * by the same checker, over the same flattened set and the same walk, that bounded the minter;
+ * the third is a row the scope itself points at this principal, as it would for any member it
+ * names — and a member invite's principal is minted fresh, so no row names it when its link is.
+ */
+export declare function holdingsDigest(held: Holdings): Promise<string>;
 /**
  * The platform's revoke (`HostAdmin.revokeCapability`) — of any capability in the scope,
  * the operator's lever for a leaked link. Returns the row as it stood before, for the admin
  * log, or `undefined` when there is no such capability. Idempotent.
  */
 export declare function revokeCapabilityAsPlatform(sql: ScopedSql, rawId: string, actor: PlatformActorId, now: Instant): CapabilityRecord | undefined;
+/** The pseudo-operation a principal's `become` mint names on its spine event. */
+export declare const CAPABILITY_BECOME_MINT_OPERATION = "capabilities.mint-become";
+/**
+ * May `caller` mint a `become` capability for `target` at `node`? (#1686) Becoming someone
+ * acquires everything they hold, so the bound is the assignment bound (K-21) applied to the
+ * whole of it: the caller must already hold, at the node, every permission the target holds
+ * there, and must be able to exercise every entity-narrowed grant the target holds on that same
+ * entity. Anything less mints impersonation upward — a lead inviting a stranger in as the owner.
+ *
+ * The bound is evaluated at mint, against what the target holds then; the exchange does not
+ * re-check the minter. It compares the target's holdings instead: a link whose principal's
+ * holdings have changed since the mint is revoked rather than exchanged (`exchangeCapability`). So a target holding nothing at the node is refused outright: its empty set would
+ * cover trivially, and the link would yield whatever that principal is granted later. A member
+ * invite never meets this — it grants the role before it mints.
+ *
+ * It is also refused for a target some `become` capability has already been exchanged into in
+ * this scope (`target-already-claimed`): a principal-minted `become` is for a seat nobody has
+ * taken, never a second key to someone who already exists. Whether a login is bound to the
+ * target outside the scope (an identity directory) is not visible here; the one caller today,
+ * a member invite, always targets a principal it has just minted.
+ *
+ * When the mint may go ahead, the target's `holdingsDigest` — what the mint records, and what the
+ * exchange compares against. Otherwise the refusal, as the host answers it — a `Coverage` naming
+ * what the caller lacks, as `canAssign`'s does, `target-holds-nothing`, or
+ * `target-already-claimed`. A checker with
+ * no `holdings` cannot say what the target holds, so the bound refuses rather than guess.
+ */
+export declare function becomeMintCheck(deps: {
+    sql: ScopedSql;
+    checker: Pick<PermissionChecker, 'check' | 'covers' | 'holdings'>;
+}, caller: PrincipalId, target: PrincipalId, node: Node): Promise<BecomeMintRefusal | {
+    ok: true;
+    targetDigest: string;
+}>;
+/**
+ * A principal's `become` mint (#1686) — the write a member invite makes once `becomeMintCheck`
+ * has said yes, in the same scope task. Recorded with the principal as its minter, and on the
+ * spine as `capability.become-minted` through `emit`, whose actor the host stamps as `minter`.
+ * No expiry unless one is given, as an invite has never had one; the use limit is required.
+ */
+export declare function mintBecomeCapabilityAsPrincipal(deps: {
+    sql: ScopedSql;
+    now: Instant;
+    emit: (event: DomainEventInput) => void;
+}, minter: PrincipalId, raw: PrincipalBecomeCapabilityInput, 
+/** `becomeMintCheck`'s answer: the target's holdings now, which the exchange compares against. */
+targetDigest: string): Promise<MintedCapability>;
+/**
+ * Revoke a `become` capability a PRINCIPAL minted (#1686) — what withdrawing a member invite
+ * does to its link, recorded with `by` as the revoker. Only such a row: a platform-minted one
+ * (an owner claim link) is the platform's to revoke, and an `act` one is `ctx.capabilities`'.
+ *
+ * Bounded here, not only by the caller: `by` must be the link's minter, or hold everything its
+ * principal holds now — whoever could have minted it, as a module's revoke of an `act` link is
+ * open to whoever could have minted that. A refusal writes nothing. `revoked` is true when this
+ * call revoked it; false when it was already revoked or is not such a row.
+ */
+export declare function revokeBecomeCapabilityAsPrincipal(deps: {
+    sql: ScopedSql;
+    checker: Pick<PermissionChecker, 'check' | 'covers' | 'holdings'>;
+    node: Node;
+    now: Instant;
+}, rawId: string, by: PrincipalId): Promise<BoundedBecomeRevoke>;
 //# sourceMappingURL=capability.d.ts.map

package/dist/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,qBAAqB,EAE1B,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA0C3D;;;;GAIG;AACH,eAAO,MAAM,cAAc,ypFAmD1B,CAAC;AAEF,gHAAgH;AAChH,eAAO,MAAM,sBAAsB,YAAI,wBAAwB,EAAE,+BAA+B,CAAU,CAAC;AAE3G,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,QAEgD,CAAC;AAEhF,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAKnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,gBAAgB,EACtB,KAAK,SAAI,GACR;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAoBrC;AAED,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAG9F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAQ5F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QACpB,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC,OAChD,MAAM,KACV,OAAuF,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAC5B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC,OACtE,MAAM,KACV,OAAyF,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,mBAAmB,GAAG,IAAI,CAehF;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAyBvE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8BlD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjF;AAED,oEAAoE;AACpE,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAS/F;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAWpF;AAMD,+JAA+J;AAC/J,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,GAAG,EAAE,SAAS,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,YAAY,CAAC;IACtB,+BAA+B;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,kFAAkF;IAClF,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACxC,wFAAwF;IACxF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,yDAAyD;IACzD,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAoI/E;AAMD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAGrE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACnE,EACD,MAAM,EAAE,OAAO;AACf;;;;GAIG;AACH,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GACtB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0EpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,cAAc,UAAQ,GACrB,YAAY,CA2Bd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,oBAAoB,GAAG,oBAAoB,EACtD,IAAI,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;CAAE,EAC9D,UAAU,CAAC,EAAE,aAAa,GACzB,gBAAgB,CAMlB;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,KAAK,IAAI,MACnB,CAAC;AAE9C,mGAAmG;AACnG,eAAO,MAAM,yBAAyB,WAAY,OAAO,KAAG,MAAM,IAAI,MACzB,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAShG;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,gBAAgB,CAAC,CAsB3B;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,gBAAgB,GAAG,SAAS,CAY9B"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAoBL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAIxB,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,KAAK,QAAQ,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA0C3D;;;;GAIG;AACH,eAAO,MAAM,cAAc,+kGAyD1B,CAAC;AAEF,gHAAgH;AAChH,eAAO,MAAM,sBAAsB,YAAI,wBAAwB,EAAE,+BAA+B,CAAU,CAAC;AAE3G,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAOD,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAKnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,gBAAgB,EACtB,KAAK,SAAI,GACR;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAoBrC;AAED,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAa3C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAQ5F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QACpB,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC,OAChD,MAAM,KACV,OAAuF,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAC5B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC,OACtE,MAAM,KACV,OAAyF,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,mBAAmB,GAAG,IAAI,CAehF;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CA0BvE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAOD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8BlD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjF;AAED,oEAAoE;AACpE,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAS/F;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAWpF;AAMD,+JAA+J;AAC/J,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,GAAG,EAAE,SAAS,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,YAAY,CAAC;IACtB,+BAA+B;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,kFAAkF;IAClF,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACxC,wFAAwF;IACxF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,yDAAyD;IACzD,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAmI/E;AAMD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAGrE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAClE;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1D,EACD,MAAM,EAAE,OAAO;AACf;;;;GAIG;AACH,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GACtB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsFpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,cAAc,UAAQ,GACrB,YAAY,CA2Bd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,oBAAoB,GAAG,oBAAoB,EACtD,IAAI,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;CAAE,EAC9D,UAAU,CAAC,EAAE,aAAa,GACzB,gBAAgB,CAMlB;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,KAAK,IAAI,MACnB,CAAC;AAE9C,mGAAmG;AACnG,eAAO,MAAM,yBAAyB,WAAY,OAAO,KAAG,MAAM,IAAI,MACzB,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAShG;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AA0DD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,GAAG,EAAE,OAAO,EACZ,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GACvD,OAAO,CAAC,eAAe,EAAE,CAAC,CAS5B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAOrE;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAQpE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,gBAAgB,GAAG,SAAS,CAO9B;AAMD,iFAAiF;AACjF,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAA;CAAE,EAC3F,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAUjE;AAgCD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAA;CAAE,EAC/E,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,8BAA8B;AACnC,kGAAkG;AAClG,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAsB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EACrH,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,WAAW,GACd,OAAO,CAAC,mBAAmB,CAAC,CAe9B"}

package/dist/capability.js

@@ -1,4 +1,4 @@
-import { CAPABILITY_EXERCISED, CAPABILITY_MINTED, CAPABILITY_REVOKED, CAPABILITY_SECRET_PREFIX, CAPABILITY_SESSION_PREFIX, CAPABILITY_SESSION_TTL_MS, becomeCapabilityInput, capabilityAuthor, capabilityFilter, capabilityId as capabilityIdSchema, capabilityMintInput, capabilityRecord, permissionKey, principalId as principalIdSchema, substratError, entityObjectRef, } from '@substrat-run/contracts';
+import { BECOME_LINK_STATES_MAX_IDS, CAPABILITY_BECOME_MINTED, CAPABILITY_EXERCISED, CAPABILITY_MINTED, CAPABILITY_REVOKED, CAPABILITY_SECRET_PREFIX, CAPABILITY_SESSION_PREFIX, CAPABILITY_SESSION_TTL_MS, becomeCapabilityInput, capabilityAuthor, capabilityFilter, capabilityId as capabilityIdSchema, capabilityMintInput, capabilityRecord, permissionKey, principalBecomeCapabilityInput, principalId as principalIdSchema, substratError, entityObjectRef, } from '@substrat-run/contracts';
 import { toBase64url } from './base64url.js';
 import { PermissionDenied } from './permission-checker.js';
 import { ulid } from './ulid.js';
@@ -27,6 +27,12 @@ export const CAPABILITY_DDL = `
     -- NULL = no attachment read opt-in; 'read' explicitly allows attachment readers.
     attachments TEXT,
     principal TEXT,
+    -- #1686: a principal-minted 'become' only — the digest of what \`principal\` held when it was
+    -- minted (\`holdingsDigest\`). The exchange recomputes it, and a link whose principal's
+    -- holdings have changed since is revoked rather than exchanged. NULL on every other row.
+    target_digest TEXT,
+    -- #1686: why the kernel itself revoked it ('holdings-changed'); NULL for any other revoke.
+    revoked_reason TEXT,
     -- JSON capabilityAuthor: a principal id (a module minted it, and its authority is
     -- re-checked on every use) or {"platform": …} (HostAdmin minted it).
     minted_by TEXT NOT NULL,
@@ -62,8 +68,8 @@ export const CAPABILITY_DDL = `
 /** The tables `CAPABILITY_DDL` builds — what a copy of a scope leaves behind (`capabilitiesForLoad`, #1686). */
 export const CAPABILITY_TABLE_NAMES = ['_substrat_capabilities', '_substrat_capability_sessions'];
 /** Every column a read returns — everything but `token_hash`, which no reader has a use for. */
-export const CAPABILITY_COLUMNS = 'id, mode, label, entity_type, entity_id, permissions, operations, attachments, principal, minted_by, ' +
-    'minted_at, expires_at, max_uses, uses, last_used_at, revoked_at, revoked_by';
+const CAPABILITY_COLUMNS = 'id, mode, label, entity_type, entity_id, permissions, operations, attachments, principal, minted_by, ' +
+    'minted_at, expires_at, max_uses, uses, last_used_at, revoked_at, revoked_by, target_digest, revoked_reason';
 /** The row the permission checker reads for a capability subject (`ScopeTupleReader.capability`). */
 export function capabilityByIdQuery(id) {
     return {
@@ -113,7 +119,7 @@ export const DEFAULT_CAPABILITY_LIMIT = 50;
  * records and never a hash" is held in one place: the query selects no `token_hash`, and the
  * decode keeps only the record schema's fields.
  */
-export function readCapabilities(sql, filter) {
+function readCapabilities(sql, filter) {
     const q = capabilityListQuery(filter);
     return sql.query(q.sql, q.params).map(capabilityRecordOf);
 }
@@ -174,6 +180,7 @@ export function capabilityRecordOf(row) {
         lastUsedAt: row.last_used_at,
         revokedAt: row.revoked_at,
         revokedBy: row.revoked_by === null ? null : JSON.parse(row.revoked_by),
+        revokedReason: row.revoked_reason ?? null,
     };
     return capabilityRecord.parse(row.mode === 'become'
         ? { mode: 'become', ...common, principal: row.principal }
@@ -191,7 +198,7 @@ export function mintCapabilitySecret() {
     return CAPABILITY_SECRET_PREFIX + toBase64url(crypto.getRandomValues(new Uint8Array(32)));
 }
 /** A fresh session token — the same construction, its own prefix. */
-export function mintCapabilitySessionToken() {
+function mintCapabilitySessionToken() {
     return CAPABILITY_SESSION_PREFIX + toBase64url(crypto.getRandomValues(new Uint8Array(32)));
 }
 /**
@@ -391,7 +398,11 @@ export function createCapabilityVerbs(deps) {
                 throw substratError('not_found', `no capability ${id} in this scope`);
             const grant = capabilityGrantOf(row);
             if (!grant) {
-                throw substratError('forbidden', `capability ${id} was minted by the platform and is revoked through HostAdmin`, { reason: 'capability_platform_minted' });
+                // A `become` row: the platform's (HostAdmin) or a member invite's (the host's
+                // principal revoke, #1686) — never module code's.
+                throw substratError('forbidden', `capability ${id} is a become capability and is revoked by the host that minted it, not ctx.capabilities`, 
+                // The reason predates principal-minted `become` rows and is kept: a caller may match on it.
+                { reason: 'capability_platform_minted' });
             }
             if (row.revoked_at !== null)
                 return;
@@ -402,8 +413,7 @@ export function createCapabilityVerbs(deps) {
                         `${refToString(grant.entity)} (a revoke is open to whoever could have minted it)`);
                 }
             }
-            deps.sql.exec(`UPDATE _substrat_capabilities SET revoked_at = ?, revoked_by = ?
-         WHERE id = ? AND revoked_at IS NULL`, [deps.now, JSON.stringify(revoker), id]);
+            markRevoked(deps.sql, id, revoker, deps.now);
             const payload = {
                 capabilityId: id,
                 entity: grant.entity,
@@ -455,6 +465,19 @@ mode) {
         return null;
     if (mode !== undefined && row.mode !== mode)
         return null;
+    if (row.mode === 'become' && typeof JSON.parse(row.minted_by) === 'string') {
+        // A principal minted it (#1686): the bound held against what its principal held THEN. If
+        // that has changed in any way since — a role raised or lowered, a grant added, an org joined,
+        // a role redefined — the link is revoked here, with no revoker, and refused: the one answer
+        // a refusal always gets, and nothing written beyond the revoke. Its use is never taken.
+        if (!deps.holdings || !row.target_digest)
+            return null;
+        const held = await deps.holdings(principalIdSchema.parse(row.principal));
+        if ((await holdingsDigest(held)) !== row.target_digest) {
+            markRevoked(deps.sql, capabilityIdSchema.parse(row.id), null, deps.now, 'holdings-changed');
+            return null;
+        }
+    }
     const taken = deps.sql.exec(`UPDATE _substrat_capabilities SET uses = uses + 1, last_used_at = ?
      WHERE id = ? AND uses = ?`, [deps.now, row.id, row.uses]);
     if (taken.changes !== 1)
@@ -591,23 +614,130 @@ export function checkBecomeInput(raw, now) {
 }
 export async function mintBecomeCapability(sql, raw, actor, now) {
     const input = checkBecomeInput(raw, now);
+    return insertBecome(sql, input, { platform: actor }, now);
+}
+/**
+ * The one `become` row write, for the platform's mint and a principal's alike: a fresh id and
+ * secret, the secret's hash stored, the secret returned once.
+ */
+async function insertBecome(sql, input, author, now, 
+/** A principal's mint only: the target's `holdingsDigest` now. */
+targetDigest = null) {
     const id = capabilityIdSchema.parse(ulid());
     const secret = mintCapabilitySecret();
-    const author = { platform: actor };
     sql.exec(`INSERT INTO _substrat_capabilities
        (id, token_hash, mode, label, entity_type, entity_id, permissions, operations, attachments,
-        principal, minted_by, minted_at, expires_at, max_uses, uses)
-     VALUES (?, ?, 'become', ?, NULL, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, 0)`, [
+        principal, minted_by, minted_at, expires_at, max_uses, uses, target_digest)
+     VALUES (?, ?, 'become', ?, NULL, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, 0, ?)`, [
         id,
         await capabilityTokenHash(secret),
         input.label ?? null,
         input.principal,
         JSON.stringify(author),
         now,
-        input.expiresAt,
+        input.expiresAt ?? null,
         input.maxUses,
+        targetDigest,
     ]);
-    return { id, secret, expiresAt: input.expiresAt };
+    return { id, secret, expiresAt: input.expiresAt ?? null };
+}
+/**
+ * The one revoke write: stamps `author` once, on a row not yet revoked. True when this call did.
+ * `null` is the kernel's own revoke — a link whose principal's holdings changed (#1686) — which no
+ * person or platform actor made, and is recorded with no revoker.
+ */
+function markRevoked(sql, id, author, now, 
+/** The kernel's own revoke says why. */
+reason = null) {
+    return (sql.exec(`UPDATE _substrat_capabilities SET revoked_at = ?, revoked_by = ?, revoked_reason = ?
+       WHERE id = ? AND revoked_at IS NULL`, [now, author === null ? null : JSON.stringify(author), reason, id]).changes === 1);
+}
+/**
+ * Where each named `become` link stands (#1686), in the order asked — what a pending-invite list
+ * shows beside each invite. A capability the scope does not hold reads as `revoked`, never `open`.
+ *
+ * A principal-minted link that would otherwise read `open` is judged as its exchange would judge
+ * it: its principal's holdings are read now (`holdings`) and compared with the digest taken at
+ * mint, and a link whose principal changed since reads `revoked` / `holdings-changed` — before
+ * anybody has tried it. Nothing is written on a read: the exchange is what revokes it. One with no
+ * digest, or with no `holdings` to judge it by, reads `revoked`, as its exchange refuses it.
+ */
+export async function readBecomeLinkStates(sql, ids, now, holdings) {
+    assertBecomeLinkStateIds(ids);
+    const states = [];
+    for (const raw of ids) {
+        const q = capabilityByIdQuery(capabilityIdSchema.parse(raw));
+        const row = sql.query(q.sql, q.params)[0];
+        states.push(await becomeLinkStateOf(row, now, holdings));
+    }
+    return states;
+}
+/**
+ * `becomeLinkStates`' bound on how many links one call names (`BECOME_LINK_STATES_MAX_IDS`):
+ * refused over it, never truncated — a caller asks in pages. Its own function so a host whose
+ * storage sits across an RPC boundary checks on the near side, where the typed refusal survives.
+ */
+export function assertBecomeLinkStateIds(ids) {
+    if (ids.length > BECOME_LINK_STATES_MAX_IDS) {
+        throw substratError('validation_failed', `becomeLinkStates: ${ids.length} ids is more than ${BECOME_LINK_STATES_MAX_IDS} — ask in pages`);
+    }
+}
+async function becomeLinkStateOf(row, now, holdings) {
+    if (!row || row.mode !== 'become')
+        return { state: 'revoked', reason: null };
+    if (row.revoked_at !== null) {
+        return { state: 'revoked', reason: row.revoked_reason === 'holdings-changed' ? 'holdings-changed' : null };
+    }
+    if (row.expires_at !== null && row.expires_at <= now)
+        return { state: 'expired', reason: null };
+    if (row.max_uses !== null && row.uses >= row.max_uses)
+        return { state: 'used', reason: null };
+    if (typeof JSON.parse(row.minted_by) === 'string') {
+        if (!holdings || !row.target_digest)
+            return { state: 'revoked', reason: null };
+        const held = await holdings(principalIdSchema.parse(row.principal));
+        if ((await holdingsDigest(held)) !== row.target_digest)
+            return { state: 'revoked', reason: 'holdings-changed' };
+    }
+    return { state: 'open', reason: null };
+}
+/**
+ * A canonical digest of what a principal holds (#1686): the role KEYS it holds at the node, as
+ * assigned, the permissions granted to it directly at the node, and its entity-narrowed grants —
+ * at scope and tenant level, through its orgs — each sorted and deduplicated, so two reads of the
+ * same holdings in any order give the same digest. Taken when a principal mints a `become` for it,
+ * and again at the exchange: a role assigned or taken away, a grant added or removed, an org joined
+ * or left, all change it, and the link dies.
+ *
+ * Role KEYS, not their expansions, deliberately: a role's definition is the vertical's code,
+ * re-projected on a push and reviewed at the permission-diff checkpoint — nothing an inviter
+ * controls. Expanding it would revoke every open invite at a role whenever a release adds a key to
+ * that role. The price, by design: a REDEFINITION can make the invitee hold more than the minter
+ * held when it minted — a release that widens the role widens what the link becomes. That is a
+ * change only code or staff make (`defineRole` has no HTTP route), never an inviter.
+ *
+ * What the digest deliberately does not see, so nobody relies on it as a reach check:
+ * - the LEVEL a grant is held at — a key moved between the scope and the tenant node leaves it
+ *   unchanged, as the mint bound compares the same flattened set (`holdingsOf` merges the levels);
+ * - reach that grows under a narrowed grant's entity through `ctx.link` / `ctx.relink` — the
+ *   minter's coverage of that entity was checked through `check`, whose reach grows the same way;
+ * - module authority decided from a principal column (an assignee, an author) rather than a tuple
+ *   — neither the bound nor the digest sees it.
+ * None of these three lets the link yield more than its minter held (a role redefinition can, by
+ * design — see above): the identity a link binds is per
+ * (scope, sub), so what it becomes is this principal in this scope only. The first two are judged
+ * by the same checker, over the same flattened set and the same walk, that bounded the minter;
+ * the third is a row the scope itself points at this principal, as it would for any member it
+ * names — and a member invite's principal is minted fresh, so no row names it when its link is.
+ */
+export async function holdingsDigest(held) {
+    const sorted = (xs) => [...new Set(xs)].sort();
+    const canonical = JSON.stringify({
+        roles: sorted(held.roles),
+        granted: sorted(held.granted),
+        narrowed: sorted(held.narrowed.map((n) => `${n.permission} ${n.entity.entityType}:${n.entity.entityId}`)),
+    });
+    return capabilityTokenHash(canonical);
 }
 /**
  * The platform's revoke (`HostAdmin.revokeCapability`) — of any capability in the scope,
@@ -620,9 +750,129 @@ export function revokeCapabilityAsPlatform(sql, rawId, actor, now) {
     const row = sql.query(q.sql, q.params)[0];
     if (!row)
         return undefined;
-    const author = { platform: actor };
-    sql.exec(`UPDATE _substrat_capabilities SET revoked_at = ?, revoked_by = ?
-     WHERE id = ? AND revoked_at IS NULL`, [now, JSON.stringify(author), id]);
+    markRevoked(sql, id, { platform: actor }, now);
     return capabilityRecordOf(row);
 }
+// ---------------------------------------------------------------------------
+// A principal's `become` (#1686): the bound, the mint, and the revoke a member invite runs.
+// ---------------------------------------------------------------------------
+/** The pseudo-operation a principal's `become` mint names on its spine event. */
+export const CAPABILITY_BECOME_MINT_OPERATION = 'capabilities.mint-become';
+/**
+ * May `caller` mint a `become` capability for `target` at `node`? (#1686) Becoming someone
+ * acquires everything they hold, so the bound is the assignment bound (K-21) applied to the
+ * whole of it: the caller must already hold, at the node, every permission the target holds
+ * there, and must be able to exercise every entity-narrowed grant the target holds on that same
+ * entity. Anything less mints impersonation upward — a lead inviting a stranger in as the owner.
+ *
+ * The bound is evaluated at mint, against what the target holds then; the exchange does not
+ * re-check the minter. It compares the target's holdings instead: a link whose principal's
+ * holdings have changed since the mint is revoked rather than exchanged (`exchangeCapability`). So a target holding nothing at the node is refused outright: its empty set would
+ * cover trivially, and the link would yield whatever that principal is granted later. A member
+ * invite never meets this — it grants the role before it mints.
+ *
+ * It is also refused for a target some `become` capability has already been exchanged into in
+ * this scope (`target-already-claimed`): a principal-minted `become` is for a seat nobody has
+ * taken, never a second key to someone who already exists. Whether a login is bound to the
+ * target outside the scope (an identity directory) is not visible here; the one caller today,
+ * a member invite, always targets a principal it has just minted.
+ *
+ * When the mint may go ahead, the target's `holdingsDigest` — what the mint records, and what the
+ * exchange compares against. Otherwise the refusal, as the host answers it — a `Coverage` naming
+ * what the caller lacks, as `canAssign`'s does, `target-holds-nothing`, or
+ * `target-already-claimed`. A checker with
+ * no `holdings` cannot say what the target holds, so the bound refuses rather than guess.
+ */
+export async function becomeMintCheck(deps, caller, target, node) {
+    const { checker } = deps;
+    if (becomeClaimed(deps.sql, target))
+        return { ok: false, refused: 'target-already-claimed' };
+    if (!checker.holdings) {
+        throw substratError('unavailable', 'this permission checker cannot read what a principal holds — refusing to mint a become capability');
+    }
+    const held = await checker.holdings({ kind: 'principal', id: target }, node);
+    if (held.permissions.length === 0)
+        return { ok: false, refused: 'target-holds-nothing' };
+    const coverage = await coversHoldings(checker, caller, held, node);
+    return coverage ? { ok: false, coverage } : { ok: true, targetDigest: await holdingsDigest(held) };
+}
+/** Has any `become` capability for `principal` been exchanged in this scope — platform-minted or not? */
+function becomeClaimed(sql, principal) {
+    return (sql.query(`SELECT 1 AS one FROM _substrat_capabilities WHERE mode = 'become' AND principal = ? AND uses > 0 LIMIT 1`, [principal]).length > 0);
+}
+/**
+ * Does `caller` hold everything in `held` at `node`? Node-level keys compared as `covers`
+ * compares, and each entity-narrowed grant re-asked through `check` on its entity. Null when it
+ * does; otherwise the refusal naming what is lacked.
+ */
+async function coversHoldings(checker, caller, held, node) {
+    const nodeLevel = await checker.covers({ kind: 'principal', id: caller }, held.permissions, node);
+    const missing = new Set(nodeLevel.covered ? [] : nodeLevel.missing);
+    for (const { permission, entity } of held.narrowed) {
+        if (missing.has(permission))
+            continue;
+        if (!(await checker.check({ kind: 'principal', id: caller }, permission, node, entity)).allowed)
+            missing.add(permission);
+    }
+    return missing.size === 0 ? null : { covered: false, missing: [...missing] };
+}
+/**
+ * A principal's `become` mint (#1686) — the write a member invite makes once `becomeMintCheck`
+ * has said yes, in the same scope task. Recorded with the principal as its minter, and on the
+ * spine as `capability.become-minted` through `emit`, whose actor the host stamps as `minter`.
+ * No expiry unless one is given, as an invite has never had one; the use limit is required.
+ */
+export async function mintBecomeCapabilityAsPrincipal(deps, minter, raw, 
+/** `becomeMintCheck`'s answer: the target's holdings now, which the exchange compares against. */
+targetDigest) {
+    const input = principalBecomeCapabilityInput.parse(raw);
+    if (input.expiresAt !== undefined && input.expiresAt <= deps.now) {
+        throw substratError('validation_failed', `mintBecomeCapability: expiresAt ${input.expiresAt} is not in the future`);
+    }
+    const minted = await insertBecome(deps.sql, input, minter, deps.now, targetDigest);
+    const payload = {
+        capabilityId: minted.id,
+        principal: input.principal,
+        expiresAt: input.expiresAt ?? null,
+        maxUses: input.maxUses,
+        label: input.label ?? null,
+        mintedBy: minter,
+    };
+    deps.emit({
+        type: CAPABILITY_BECOME_MINTED,
+        schemaVersion: 1,
+        entity: { entityType: 'capability', entityId: minted.id },
+        piiClass: 'none',
+        payload,
+    });
+    return minted;
+}
+/**
+ * Revoke a `become` capability a PRINCIPAL minted (#1686) — what withdrawing a member invite
+ * does to its link, recorded with `by` as the revoker. Only such a row: a platform-minted one
+ * (an owner claim link) is the platform's to revoke, and an `act` one is `ctx.capabilities`'.
+ *
+ * Bounded here, not only by the caller: `by` must be the link's minter, or hold everything its
+ * principal holds now — whoever could have minted it, as a module's revoke of an `act` link is
+ * open to whoever could have minted that. A refusal writes nothing. `revoked` is true when this
+ * call revoked it; false when it was already revoked or is not such a row.
+ */
+export async function revokeBecomeCapabilityAsPrincipal(deps, rawId, by) {
+    const id = capabilityIdSchema.parse(rawId);
+    const q = capabilityByIdQuery(id);
+    const row = deps.sql.query(q.sql, q.params)[0];
+    const minter = row ? JSON.parse(row.minted_by) : null;
+    if (!row || row.mode !== 'become' || typeof minter !== 'string')
+        return { ok: true, revoked: false };
+    if (minter !== by) {
+        if (!deps.checker.holdings) {
+            throw substratError('unavailable', 'this permission checker cannot read what a principal holds — refusing to revoke a become capability');
+        }
+        const held = await deps.checker.holdings({ kind: 'principal', id: principalIdSchema.parse(row.principal) }, deps.node);
+        const coverage = await coversHoldings(deps.checker, by, held, deps.node);
+        if (coverage)
+            return { ok: false, coverage };
+    }
+    return { ok: true, revoked: markRevoked(deps.sql, id, by, deps.now) };
+}
 //# sourceMappingURL=capability.js.map