@substrat-run/kernel 0.5.0 → 0.7.0

package/dist/index.d.ts

@@ -1,7 +1,10 @@
-export type { AuditLogFilter, ConsumerHandler, GuardPredicate, HostAdmin, ModuleRegistration, OperationContext, OperationHandler, ProvisionScopeInput, RoleFilter, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, SqlMigration, SqlValue, } from './scope-host.js';
+export type { AccessLogFilter, AuditLogFilter, ConsumerHandler, ExecutorHandler, GuardPredicate, HostAdmin, ModuleRegistration, OperationContext, OperationHandler, ProvisionScopeInput, RoleFilter, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, SqlMigration, SqlValue, } from './scope-host.js';
 export { resolveScopeRecord } from './scope-record.js';
 export type { ResolvedScopeRecord } from './scope-record.js';
 export { assertAllowed, denyAllChecker, PermissionDenied, UNSAFE_allowAllChecker, } from './permission-checker.js';
 export type { PermissionChecker } from './permission-checker.js';
 export { ulid } from './ulid.js';
+export { readRoutedNode, RouterAssertionError } from './routed-node.js';
+export type { RoutedNode, HeaderReader } from './routed-node.js';
+export { assertPlatformCall, PlatformCallError, PLATFORM_SECRET_HEADER, } from './platform-call.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,cAAc,EACd,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,WAAW,EACX,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,WAAW,EACX,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -1,4 +1,6 @@
 export { resolveScopeRecord } from './scope-record.js';
 export { assertAllowed, denyAllChecker, PermissionDenied, UNSAFE_allowAllChecker, } from './permission-checker.js';
 export { ulid } from './ulid.js';
+export { readRoutedNode, RouterAssertionError } from './routed-node.js';
+export { assertPlatformCall, PlatformCallError, PLATFORM_SECRET_HEADER, } from './platform-call.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}

package/dist/platform-call.d.ts

@@ -0,0 +1,38 @@
+import type { HeaderReader } from './routed-node.js';
+/**
+ * Authenticating a call FROM the platform TO a vertical (K-31).
+ *
+ * Provisioning is control-plane-driven: the platform decides an instance should
+ * exist and tells the vertical to create it, because only the vertical can create a
+ * usable scope DO. This is the vertical's side of that call.
+ *
+ * It lives in the kernel for the same reason `readRoutedNode` does — five verticals
+ * each re-deriving how to trust a header is five chances to get it wrong, and the
+ * one that gets it wrong is not obviously broken.
+ *
+ * Note the direction. `readRoutedNode` answers "which tenant is this request for",
+ * and a request with no assertion is legitimate (a standalone deploy). This answers
+ * "is the platform itself calling", and there is no legitimate unauthenticated case:
+ * an open provisioning endpoint lets a stranger mint tenants inside the vertical.
+ * So this one **fails closed with no configuration at all**.
+ */
+/** Thrown when a call does not prove it came from the platform. */
+export declare class PlatformCallError extends Error {
+}
+/** Constant-time compare, so a wrong secret leaks nothing through timing. */
+export declare function secretMatches(presented: string | null, expected: string): boolean;
+/** The header the platform presents. */
+export declare const PLATFORM_SECRET_HEADER = "x-substrat-platform";
+/**
+ * Throw unless this request proves it came from the platform.
+ *
+ * **An unset secret is a failure, not a bypass.** That is the opposite of how the
+ * router secret behaves, and deliberately so: there, an unset secret means "no router
+ * is configured", which a standalone deploy legitimately wants. Here it would mean
+ * "anyone may provision", which nothing legitimately wants. A template copied without
+ * the secret configured must refuse to provision rather than provision for strangers.
+ */
+export declare function assertPlatformCall(headers: HeaderReader, options?: {
+    expectedSecret?: string;
+}): void;
+//# sourceMappingURL=platform-call.d.ts.map

package/dist/platform-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-call.d.ts","sourceRoot":"","sources":["../src/platform-call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AAEH,mEAAmE;AACnE,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOjF;AAED,wCAAwC;AACxC,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,IAAI,CAQN"}

package/dist/platform-call.js

@@ -0,0 +1,51 @@
+/**
+ * Authenticating a call FROM the platform TO a vertical (K-31).
+ *
+ * Provisioning is control-plane-driven: the platform decides an instance should
+ * exist and tells the vertical to create it, because only the vertical can create a
+ * usable scope DO. This is the vertical's side of that call.
+ *
+ * It lives in the kernel for the same reason `readRoutedNode` does — five verticals
+ * each re-deriving how to trust a header is five chances to get it wrong, and the
+ * one that gets it wrong is not obviously broken.
+ *
+ * Note the direction. `readRoutedNode` answers "which tenant is this request for",
+ * and a request with no assertion is legitimate (a standalone deploy). This answers
+ * "is the platform itself calling", and there is no legitimate unauthenticated case:
+ * an open provisioning endpoint lets a stranger mint tenants inside the vertical.
+ * So this one **fails closed with no configuration at all**.
+ */
+/** Thrown when a call does not prove it came from the platform. */
+export class PlatformCallError extends Error {
+}
+/** Constant-time compare, so a wrong secret leaks nothing through timing. */
+export function secretMatches(presented, expected) {
+    if (!presented || presented.length !== expected.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < expected.length; i++) {
+        diff |= presented.charCodeAt(i) ^ expected.charCodeAt(i);
+    }
+    return diff === 0;
+}
+/** The header the platform presents. */
+export const PLATFORM_SECRET_HEADER = 'x-substrat-platform';
+/**
+ * Throw unless this request proves it came from the platform.
+ *
+ * **An unset secret is a failure, not a bypass.** That is the opposite of how the
+ * router secret behaves, and deliberately so: there, an unset secret means "no router
+ * is configured", which a standalone deploy legitimately wants. Here it would mean
+ * "anyone may provision", which nothing legitimately wants. A template copied without
+ * the secret configured must refuse to provision rather than provision for strangers.
+ */
+export function assertPlatformCall(headers, options = {}) {
+    const { expectedSecret } = options;
+    if (!expectedSecret) {
+        throw new PlatformCallError('platform calls are not configured on this deployment');
+    }
+    if (!secretMatches(headers.get(PLATFORM_SECRET_HEADER), expectedSecret)) {
+        throw new PlatformCallError('not a platform call');
+    }
+}
+//# sourceMappingURL=platform-call.js.map

package/dist/platform-call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-call.js","sourceRoot":"","sources":["../src/platform-call.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,mEAAmE;AACnE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,SAAwB,EAAE,QAAgB;IACtE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAqB,EACrB,UAAuC,EAAE;IAEzC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACnC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/routed-node.d.ts

@@ -0,0 +1,51 @@
+import type { ScopeId, TenantId } from '@substrat-run/contracts';
+/**
+ * Reading the node the router asserted (K-26).
+ *
+ * The router resolves `hostname → (tenant, scope, surface)` and forwards over a
+ * service binding with that resolution in headers. This is the vertical's side of
+ * that contract, in the kernel because every vertical needs it and none of them
+ * should be re-deriving how to trust it.
+ *
+ * Web-standard only and structurally typed: the base tsconfig is `ES2023` with no
+ * DOM lib, deliberately, so no package assumes a browser. Taking the one method we
+ * need rather than the whole `Headers` type keeps that true and costs nothing — a
+ * real `Headers` satisfies it, and so does a plain object in a test.
+ */
+/** The one method this needs from a `Headers`. A real `Headers` satisfies it. */
+export interface HeaderReader {
+    get(name: string): string | null;
+}
+export interface RoutedNode {
+    tenantId: TenantId;
+    scopeId: ScopeId;
+    /** Which app answers: `app`, `storefront`, `back-office`, … Vertical vocabulary. */
+    surface: string;
+    verticalSlug: string | null;
+}
+/** Thrown when headers are present but not trustworthy. Never means "no router". */
+export declare class RouterAssertionError extends Error {
+}
+/**
+ * The `(tenant, scope)` this request is for, or `null` when no router fronted it.
+ *
+ * Three outcomes, kept distinct on purpose:
+ *
+ *   - **null** — no assertion at all. The caller decides: a single-tenant standalone
+ *     deploy substitutes its own node, anything else refuses.
+ *   - **throws** — headers are present but wrong: a bad or missing secret, or ids
+ *     that are not ULIDs. Present-but-wrong is a misconfiguration or an attack, and
+ *     collapsing it into `null` would let either one fall through to whatever the
+ *     caller does for "unrouted".
+ *   - **a node** — trustworthy, and the tenant whose data this request may touch.
+ *
+ * `expectedSecret` is what makes the headers trustworthy in code. K-26's real
+ * boundary is that vertical workers have no public route, so the router is the only
+ * possible source — but that is a deployment fact, and `workers.dev` is on by
+ * default. When the secret is configured, a request that did not come from the
+ * router cannot assert a tenant no matter how the routes are configured.
+ */
+export declare function readRoutedNode(headers: HeaderReader, options?: {
+    expectedSecret?: string;
+}): RoutedNode | null;
+//# sourceMappingURL=routed-node.d.ts.map

package/dist/routed-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routed-node.d.ts","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;;;;;;;GAYG;AAEH,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oFAAoF;AACpF,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAIlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,UAAU,GAAG,IAAI,CAyBnB"}

package/dist/routed-node.js

@@ -0,0 +1,49 @@
+import { scopeId as scopeIdSchema, tenantId as tenantIdSchema } from '@substrat-run/contracts';
+import { secretMatches } from './platform-call.js';
+/** Thrown when headers are present but not trustworthy. Never means "no router". */
+export class RouterAssertionError extends Error {
+}
+/**
+ * The `(tenant, scope)` this request is for, or `null` when no router fronted it.
+ *
+ * Three outcomes, kept distinct on purpose:
+ *
+ *   - **null** — no assertion at all. The caller decides: a single-tenant standalone
+ *     deploy substitutes its own node, anything else refuses.
+ *   - **throws** — headers are present but wrong: a bad or missing secret, or ids
+ *     that are not ULIDs. Present-but-wrong is a misconfiguration or an attack, and
+ *     collapsing it into `null` would let either one fall through to whatever the
+ *     caller does for "unrouted".
+ *   - **a node** — trustworthy, and the tenant whose data this request may touch.
+ *
+ * `expectedSecret` is what makes the headers trustworthy in code. K-26's real
+ * boundary is that vertical workers have no public route, so the router is the only
+ * possible source — but that is a deployment fact, and `workers.dev` is on by
+ * default. When the secret is configured, a request that did not come from the
+ * router cannot assert a tenant no matter how the routes are configured.
+ */
+export function readRoutedNode(headers, options = {}) {
+    const rawTenant = headers.get('x-substrat-tenant');
+    const rawScope = headers.get('x-substrat-scope');
+    if (!rawTenant && !rawScope)
+        return null;
+    const { expectedSecret } = options;
+    if (expectedSecret && !secretMatches(headers.get('x-substrat-router'), expectedSecret)) {
+        throw new RouterAssertionError('router assertion is not signed by a known router');
+    }
+    if (!rawTenant || !rawScope) {
+        throw new RouterAssertionError('router assertion is incomplete');
+    }
+    const tenant = tenantIdSchema.safeParse(rawTenant);
+    const scope = scopeIdSchema.safeParse(rawScope);
+    if (!tenant.success || !scope.success) {
+        throw new RouterAssertionError('router assertion carries a malformed id');
+    }
+    return {
+        tenantId: tenant.data,
+        scopeId: scope.data,
+        surface: headers.get('x-substrat-surface') ?? 'app',
+        verticalSlug: headers.get('x-substrat-vertical'),
+    };
+}
+//# sourceMappingURL=routed-node.js.map

package/dist/routed-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routed-node.js","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA8BnD,oFAAoF;AACpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAIlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,UAAuC,EAAE;IAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACnC,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,oBAAoB,CAAC,kDAAkD,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,KAAK;QACnD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/scope-host.d.ts

@@ -1,4 +1,4 @@
-import type { AdminAction, AdminLogEntry, CapabilityGrant, CreateTenantInput, Decision, DomainEvent, DomainEventInput, EntityRef, IdentityLink, Jurisdiction, ModuleManifest, Node, PermissionKey, PlatformActorId, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, Scope, ScopeId, ScopeStatus, StorageShape, Tenant, TenantId, TenantRole, TenantStatus } from '@substrat-run/contracts';
+import type { AdminAction, AccessLogEntry, BindHostnameInput, AdminLogEntry, CapabilityGrant, CreateTenantInput, Decision, DomainEvent, DomainEventInput, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleManifest, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, HostnameBinding, HostnameStatus, PromotionAcknowledgement, PublishVersionInput, RegisterVerticalInput, RouteTarget, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, Scope, ScopeId, ScopeStatus, StorageShape, Tenant, TenantId, TenantRole, Vertical, VerticalChannel, VerticalVersion, TenantStatus } from '@substrat-run/contracts';
 /**
  * The scope-host contract — the adapter seam (§5.1 of the design doc).
  *
@@ -65,6 +65,27 @@ export interface SqlMigration {
  * idempotent. Ordering is guaranteed only within (scope, module) — K-11.
  */
 export type ConsumerHandler = (ctx: OperationContext, event: DomainEvent) => void | Promise<void>;
+/**
+ * An **executor**: out-of-band host code that effects, outside a scope, what a module
+ * asked for inside one (K-22 §4.2; D-18's triage rule — effects on the outside world
+ * are connectors).
+ *
+ * Why this rather than an in-scope capability: some effects are not scope-local.
+ * Membership tuples are tenant-wide and live in the directory, so an in-scope write
+ * would be a cross-DO write inside a scope transaction — two serialization domains,
+ * no coordinator, and an orphaned membership if the scope transaction rolls back
+ * after the directory write lands.
+ *
+ * The connector has no such hazard: the module's `ctx.emit` commits WITH its domain
+ * write, so a rollback leaves no event and nothing to effect. The executor then runs
+ * at-least-once from the outbox — so handlers must be idempotent, exactly as
+ * consumers must.
+ *
+ * It receives `HostAdmin`, not `ctx`: it acts with platform authority, which is
+ * precisely what module code must never hold. Admin writes it makes are stamped with
+ * the causing event's id (`causedBy`), so the split trail joins.
+ */
+export type ExecutorHandler = (admin: HostAdmin, event: DomainEvent) => void | Promise<void>;
 /**
  * A named, manifest-wired pre-condition on an operation (K-17; engine-protocol
  * §6, open question 11). One module CONTRIBUTES a predicate under a name; a
@@ -132,12 +153,119 @@ export interface HostAdmin {
      * registry, so this is a read. A grant is a tuple in the scope's own database
      * and needs §5.4's admin-query RPC — the two are not the same size of problem.
      */
-    listRoles(filter?: RoleFilter): Promise<TenantRole[]>;
+    listRoles(actor: PlatformActorId, filter?: RoleFilter): Promise<TenantRole[]>;
     assignRole(actor: PlatformActorId, assignment: RoleAssignment): Promise<void>;
     grant(actor: PlatformActorId, grant: CapabilityGrant): Promise<void>;
     /** Grant to an organization (portal customers); members reach it via membership tuples. */
-    grantToOrg(actor: PlatformActorId, orgId: string, permission: PermissionKey, node: Node, entity?: EntityRef): Promise<void>;
-    addMember(actor: PlatformActorId, tenantId: TenantId, principal: PrincipalId, orgId: string): Promise<void>;
+    grantToOrg(actor: PlatformActorId, orgId: OrgId, permission: PermissionKey, node: Node, entity?: EntityRef): Promise<void>;
+    addMember(actor: PlatformActorId, tenantId: TenantId, principal: PrincipalId, orgId: OrgId): Promise<void>;
+    /**
+     * Revoke a membership (K-21). **Tombstones, never deletes**: the tuple keeps its
+     * row, gains a `revokedAt`, and the permission walk skips it. Deletion would
+     * destroy the audit property K-4 rests on — a tuple that once granted access is
+     * evidence of why an access was allowed — and D-32's operated compliance product
+     * has to produce exactly that evidence.
+     *
+     * Idempotent: revoking an already-revoked or never-existing membership is a
+     * no-op, and a no-op is not audited. Re-adding via `addMember` clears the
+     * tombstone (they are a member again); the add/revoke history lives in the admin
+     * log, which is append-only.
+     */
+    removeMember(actor: PlatformActorId, tenantId: TenantId, principal: PrincipalId, orgId: OrgId): Promise<void>;
+    /**
+     * The members of an org. Live members only unless `includeRevoked` — the
+     * revoked rows are the evidence view, not the roster.
+     *
+     * Answering "who has access to this org" at all is new: membership was
+     * write-only before this (#34).
+     */
+    listMembers(actor: PlatformActorId, tenantId: TenantId, orgId: OrgId, options?: {
+        includeRevoked?: boolean;
+    }): Promise<OrgMembership[]>;
+    /**
+     * Register an org. Idempotent on the id — re-creating is a no-op, not an error
+     * (as `createTenant`). Slugs are unique within the tenant; a collision from a
+     * DIFFERENT id fails closed rather than silently doing nothing.
+     *
+     * Membership and `grantToOrg` both refuse an org that does not exist here. That
+     * refusal is the point of the record: before it, `addMember(…, 'acme')` and
+     * `addMember(…, 'Acme')` silently addressed two different orgs and a typo in a
+     * grant reached a phantom nothing would ever resolve to.
+     */
+    createOrg(actor: PlatformActorId, input: CreateOrgInput): Promise<void>;
+    listOrgs(actor: PlatformActorId, tenantId: TenantId): Promise<Org[]>;
+    getOrg(actor: PlatformActorId, tenantId: TenantId, orgId: OrgId): Promise<Org | undefined>;
+    /**
+     * Register a vertical. Idempotent on the slug; a conflicting re-registration
+     * (different source) throws rather than silently rebinding what a scope runs.
+     */
+    registerVertical(actor: PlatformActorId, input: RegisterVerticalInput): Promise<void>;
+    listVerticals(actor: PlatformActorId): Promise<Vertical[]>;
+    /**
+     * Publish a version. It lands **pending** — a push is not a deploy.
+     *
+     * The digests are what promotion compares. `boundary-lint` and the migration and
+     * permission diffs are the admission gates, and binding a scope is a separate step
+     * (`bindScopeVersion`), so the two human checkpoints fire where the blast radius is
+     * rather than where the typing was.
+     */
+    publishVersion(actor: PlatformActorId, input: PublishVersionInput): Promise<void>;
+    listVersions(actor: PlatformActorId, verticalSlug: string): Promise<VerticalVersion[]>;
+    /** Admit a pending version — the gates passed. Idempotent on an already-admitted one. */
+    admitVersion(actor: PlatformActorId, versionId: string): Promise<void>;
+    /** Reject a pending version, with the reason. Rejected is terminal: publish a new one. */
+    rejectVersion(actor: PlatformActorId, versionId: string, note: string): Promise<void>;
+    /**
+     * Promote a version to a channel (#31 step 2) — the moment a change reaches
+     * anyone, and therefore where §4's two human checkpoints belong.
+     *
+     * **Refuses when a digest differs and the change is not acknowledged.** The
+     * migration and permission diffs are a merge-time convention today: CI renders
+     * them and a human is expected to look, but nothing ties that looking to the
+     * moment of exposure. Here it is tied — and the acknowledgement is recorded, so
+     * "someone reviewed it" becomes evidence rather than a claim.
+     *
+     * Only admitted versions may be promoted, for the same reason they are the only
+     * ones bindable.
+     */
+    promoteVersion(actor: PlatformActorId, verticalSlug: string, channel: ChannelName, versionId: string, acknowledge?: PromotionAcknowledgement): Promise<void>;
+    listChannels(actor: PlatformActorId, verticalSlug: string): Promise<VerticalChannel[]>;
+    /**
+     * Point a scope at a version.
+     *
+     * **Refuses anything not admitted.** That refusal is the registry's reason to
+     * exist: without it "push lands pending" is a convention, and a convention is what
+     * D-30's lockstep-upgrade argument says we cannot afford to rely on.
+     */
+    bindScopeVersion(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, versionId: string): Promise<void>;
+    /**
+     * Bind a hostname to a scope's surface. Lands `pending` — a custom domain is DNS
+     * validation and certificate issuance, not a string somebody sets, so the states
+     * it passes through are §4.2's business.
+     *
+     * Exactly one hostname per (scope, surface) may be canonical; binding a second
+     * canonical demotes the first, because "which one do certs and redirects use" has
+     * to have one answer.
+     */
+    bindHostname(actor: PlatformActorId, input: BindHostnameInput): Promise<void>;
+    setHostnameStatus(actor: PlatformActorId, hostname: string, status: HostnameStatus, note?: string): Promise<void>;
+    listHostnames(actor: PlatformActorId, filter?: {
+        tenantId?: TenantId;
+        scopeId?: ScopeId;
+    }): Promise<HostnameBinding[]>;
+    /**
+     * Resolve a hostname for the router — the per-request read path.
+     *
+     * Takes NO actor and is not logged, for the same reason `resolveIdentity` does
+     * not: this runs on every request, by a machine, before any staff member is
+     * involved. K-24's access log records who *read the directory*, and a router
+     * dispatching traffic is not that.
+     *
+     * Returns only `active` bindings. It does **not** re-check tenant or scope
+     * suspension: `getScope` already fails closed there (§7), and a second
+     * enforcement point is a second thing that can disagree.
+     */
+    resolveHostname(hostname: string): Promise<RouteTarget | undefined>;
     /**
      * Persist a tenant. Idempotent on the id — re-creating an existing tenant is a
      * no-op, not an error (control-plane.md §4.1). `status` starts `active` and
@@ -152,10 +280,10 @@ export interface HostAdmin {
      */
     setTenantStatus(actor: PlatformActorId, tenantId: TenantId, status: TenantStatus): Promise<void>;
     /** The tenant registry — the directory's inventory (control-plane.md §4.5 console item 1). */
-    listTenants(): Promise<Tenant[]>;
-    getTenant(tenantId: TenantId): Promise<Tenant | undefined>;
+    listTenants(actor: PlatformActorId): Promise<Tenant[]>;
+    getTenant(actor: PlatformActorId, tenantId: TenantId): Promise<Tenant | undefined>;
     /** The scope inventory. Ordered by scope_id (ULID = chronological). */
-    listScopes(filter?: ScopeFilter): Promise<Scope[]>;
+    listScopes(actor: PlatformActorId, filter?: ScopeFilter): Promise<Scope[]>;
     /**
      * One scope's directory record. Cross-checks the (tenantId, scopeId) pair and
      * returns undefined on a mismatch rather than another tenant's scope (K-3) —
@@ -165,7 +293,7 @@ export interface HostAdmin {
      * principal and grants no read of the record. This returns the record and
      * grants no execution.
      */
-    getScopeRecord(tenantId: TenantId, scopeId: ScopeId): Promise<Scope | undefined>;
+    getScopeRecord(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<Scope | undefined>;
     /** active → suspended. Reversible containment (incident, dispute). */
     suspendScope(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<void>;
     /** suspended → active. */
@@ -183,11 +311,49 @@ export interface HostAdmin {
     /** Turn it off. A tenant's scopes lose access to that module's operations. */
     revokeEntitlement(actor: PlatformActorId, tenantId: TenantId, entitlementKey: string): Promise<void>;
     /** The tenant's held SKU flags (control-plane.md §5 meter 2). */
-    listEntitlements(tenantId: TenantId): Promise<string[]>;
-    /** Bind an external identity to a principal + home node. Idempotent on (provider, externalId); audited. */
+    listEntitlements(actor: PlatformActorId, tenantId: TenantId): Promise<string[]>;
+    /**
+     * Bind an external identity to a principal + home node. Audited.
+     *
+     * Keyed `(tenantId, provider, externalId)` — **not** `(provider, externalId)`.
+     * kernel-design §4.3: with one auth pool per white-label tenant, an external subject
+     * id is unique only *within* its pool, so a globally-keyed mapping is a cross-tenant
+     * identity bleed. It is also what lets one staff login belong to several tenants: one
+     * external id, one row per tenant.
+     *
+     * Idempotent when the key already maps to the SAME principal. A key already bound to a
+     * DIFFERENT principal **throws** — it means two subjects collided, and silently
+     * ignoring it would resolve the second person as the first.
+     */
     linkIdentity(actor: PlatformActorId, input: IdentityLink): Promise<void>;
-    /** Resolve an external identity to its principal + home node — the auth adapter's read path. */
-    resolveIdentity(provider: string, externalId: string): Promise<ResolvedIdentity | undefined>;
+    /**
+     * Register an identity pool and its topology (K-23). A provider must be registered
+     * before it may link: an unregistered pool has not said whether the same
+     * `externalId` in two tenants is one human or two, and the kernel will not guess.
+     * Idempotent on an identical registration; a conflicting re-registration throws,
+     * since changing a live pool's topology silently reinterprets every row it owns.
+     */
+    registerIdentityPool(actor: PlatformActorId, pool: IdentityPool): Promise<void>;
+    getIdentityPool(actor: PlatformActorId, provider: string): Promise<IdentityPool | undefined>;
+    /**
+     * Which tenants this login exists in — the cross-tenant question, kept distinct
+     * from resolution because they have different safety conditions.
+     *
+     * **Central pools only.** On a tenant-bound pool the same `externalId` in another
+     * tenant is a different person, so enumerating would hand one person another's
+     * tenant list; this throws there rather than returning the single obvious answer,
+     * because asking at all is a category error the caller should see.
+     */
+    listIdentityTenants(actor: PlatformActorId, provider: string, externalId: string): Promise<TenantId[]>;
+    /**
+     * Resolve an external identity within a tenant — the auth adapter's read path.
+     *
+     * The tenant is an INPUT: the caller knows which pool the credential came from (its
+     * hostname, or the org claim on a pool-scoped token). It is not derived from the
+     * identity, because across per-tenant pools the same `externalId` legitimately names
+     * different people.
+     */
+    resolveIdentity(tenantId: TenantId, provider: string, externalId: string): Promise<ResolvedIdentity | undefined>;
     /**
      * The append-only admin audit trail, oldest first by default (ULID order is
      * chronological). Read path for the console history and the permission-diff
@@ -195,7 +361,22 @@ export interface HostAdmin {
      * `before`/`after`: a redefined role captures its old and new shape there, and
      * that diff IS the checkpoint.
      */
-    auditLog(filter?: AuditLogFilter): Promise<AdminLogEntry[]>;
+    auditLog(actor: PlatformActorId, filter?: AuditLogFilter): Promise<AdminLogEntry[]>;
+    /**
+     * The staff access log (K-24) — who READ the directory, when, and how much came
+     * back. Reading it is itself recorded: who examined the record of who looked is
+     * the question an incident asks second.
+     */
+    accessLog(actor: PlatformActorId, filter?: AccessLogFilter): Promise<AccessLogEntry[]>;
+    /**
+     * Prune access-log rows already shipped to Tier 2, oldest first, up to `limit`.
+     *
+     * **Only drained rows.** Pruning on age alone would destroy evidence while calling
+     * itself a retention policy — the failure K-21 rejected for tuples, one layer up.
+     * Nothing drains yet, so today this prunes nothing and the log grows: a stated
+     * limitation, not a policy, and the reason `drainedAt` ships before the sink.
+     */
+    pruneAccessLog(actor: PlatformActorId, limit: number): Promise<number>;
 }
 export interface ProvisionScopeInput {
     tenantId: TenantId;
@@ -242,6 +423,12 @@ export interface ScopeFilter {
  * conjunctive AND; omitting all of them reads the whole log, which is why `limit`
  * exists — the table is append-only and only grows.
  */
+export interface AccessLogFilter {
+    actor?: PlatformActorId;
+    tenantId?: TenantId;
+    method?: string;
+    limit?: number;
+}
 export interface AuditLogFilter {
     tenantId?: TenantId;
     scopeId?: ScopeId;
@@ -288,6 +475,19 @@ export interface ScopeHost {
     readonly admin: HostAdmin;
     /** Register a module: validates the manifest, applies migrations lazily per scope. */
     registerModule(registration: ModuleRegistration): void;
+    /**
+     * Register an executor for an event type (K-22 §4.2). Host code, not module code:
+     * `id` names the delivery target in the kernel's at-least-once journal, the same
+     * way a module id does for a consumer, so an executor is redelivered until it
+     * succeeds and never runs twice for one event once it has.
+     *
+     * Executors are dispatched **inline after commit**, with the outbox as the
+     * durability and retry backstop. The contract stays eventually consistent — that
+     * is what makes it correct under crash — but the common case completes inside the
+     * originating request, so "requested but not yet effected" is a rare-case fallback
+     * rather than the normal experience.
+     */
+    registerExecutor(id: string, eventType: string, handler: ExecutorHandler): void;
     /** Bare operation registration (tests, glue). Names are module-namespaced: 'workorder/create'. */
     defineOperation<I, O>(name: string, handler: OperationHandler<I, O>): void;
     close(): Promise<void>;

package/dist/scope-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host.d.ts","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,IAAI,EACJ,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,KAAK,EACL,OAAO,EACP,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AAEpE,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,kGAAkG;IAClG,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,0FAA0F;IAC1F,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI,CACvD,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,CAAC,KACL,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,OAAO,KACX,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACtD,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,2FAA2F;IAC3F,UAAU,CACR,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,WAAW,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;OAIG;IACH,eAAe,CACb,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8FAA8F;IAC9F,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAc3D,uEAAuE;IACvE,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD;;;;;;;;OAQG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IAQjF,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,0BAA0B;IAC1B,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQ5F,4DAA4D;IAC5D,gBAAgB,CACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8EAA8E;IAC9E,iBAAiB,CACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,iEAAiE;IACjE,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IASxD,2GAA2G;IAC3G,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,gGAAgG;IAChG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAE7F;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,oCAAoC;IACpC,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAE1B,sFAAsF;IACtF,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAEvD,kGAAkG;IAClG,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAE3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}
+{"version":3,"file":"scope-host.d.ts","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,IAAI,EACJ,GAAG,EACH,KAAK,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,KAAK,EACL,OAAO,EACP,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,eAAe,EACf,eAAe,EACf,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AAEpE,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,kGAAkG;IAClG,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,0FAA0F;IAC1F,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI,CACvD,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,CAAC,KACL,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7F;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,OAAO,KACX,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,2FAA2F;IAC3F,UAAU,CACR,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,WAAW,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,YAAY,CACV,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,WAAW,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;OAMG;IACH,WAAW,CACT,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GACrC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAI5B;;;;;;;;;OASG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAI3F;;;OAGG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3D;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvF,yFAAyF;IACzF,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,0FAA0F;IAC1F,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF;;;;;;;;;;;;OAYG;IACH,cAAc,CACZ,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvF;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,iBAAiB,CACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CACX,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAIpE;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;OAIG;IACH,eAAe,CACb,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8FAA8F;IAC9F,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAmBnF,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3E;;;;;;;;OAQG;IACH,cAAc,CACZ,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IAQ9B,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,0BAA0B;IAC1B,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQ5F,4DAA4D;IAC5D,gBAAgB,CACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8EAA8E;IAC9E,iBAAiB,CACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,iEAAiE;IACjE,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAShF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;;;;;OAMG;IACH,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAE7F;;;;;;;;OAQG;IACH,mBAAmB,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvB;;;;;;;OAOG;IACH,eAAe,CACb,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEpF;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEvF;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,oCAAoC;IACpC,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAE1B,sFAAsF;IACtF,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAEhF,kGAAkG;IAClG,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAE3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/kernel",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Substrat kernel contracts and services — pure TypeScript, no platform imports (D-14)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -22,16 +22,18 @@
     "dist"
   ],
   "dependencies": {
-    "@substrat-run/contracts": "^0.5.0"
+    "@substrat-run/contracts": "^0.7.0"
   },
   "devDependencies": {
-    "typescript": "^5.6.0"
+    "typescript": "^5.6.0",
+    "vitest": "^3.0.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
   }
 }