@substrat-run/kernel 0.9.0 → 0.11.0

package/dist/index.d.ts

@@ -1,10 +1,16 @@
-export type { AccessLogFilter, AuditLogFilter, ConsumerHandler, ExecutorHandler, GuardPredicate, HostAdmin, ModuleRegistration, OperationContext, OperationHandler, ProvisionScopeInput, RoleFilter, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, SqlMigration, SqlValue, } from './scope-host.js';
+export type { AccessLogFilter, AuditLogFilter, ConsumerHandler, ExecutorDeadLetter, ExecutorDrainReport, ExecutorHandler, ExecutorRetryPolicy, ConnectorConnection, ConnectorContext, ConnectorHandler, ConnectorOptions, ConnectorRequestInit, ConnectorResponse, FetchLike, GuardPredicate, HostAdmin, ModuleRegistration, OperationContext, OperationHandler, ProvisionScopeInput, RoleFilter, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, SqlMigration, SqlValue, } from './scope-host.js';
+export { backoffAt, resolveRetryPolicy } from './scope-host.js';
+export { unconfiguredSecretBox, webCryptoSecretBox } from './secret-box.js';
+export type { SealedSecret, SecretBox } from './secret-box.js';
 export { resolveScopeRecord } from './scope-record.js';
 export type { ResolvedScopeRecord } from './scope-record.js';
 export { assertAllowed, denyAllChecker, PermissionDenied, UNSAFE_allowAllChecker, } from './permission-checker.js';
+export { asPrincipal } from './permission-checker.js';
 export type { PermissionChecker } from './permission-checker.js';
 export { ulid } from './ulid.js';
 export { readRoutedNode, RouterAssertionError } from './routed-node.js';
 export type { RoutedNode, HeaderReader } from './routed-node.js';
 export { assertPlatformCall, PlatformCallError, PLATFORM_SECRET_HEADER, } from './platform-call.js';
+export { runPlatformSweep, startPlatformSweeper } from './platform-sweep.js';
+export type { ConnectorSweeper, PlatformSweepOptions, PlatformSweepReport, PlatformSweeperHandle, StartPlatformSweeperOptions, } from './platform-sweep.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,WAAW,EACX,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,WAAW,EACX,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,6 +1,10 @@
+export { backoffAt, resolveRetryPolicy } from './scope-host.js';
+export { unconfiguredSecretBox, webCryptoSecretBox } from './secret-box.js';
 export { resolveScopeRecord } from './scope-record.js';
 export { assertAllowed, denyAllChecker, PermissionDenied, UNSAFE_allowAllChecker, } from './permission-checker.js';
+export { asPrincipal } from './permission-checker.js';
 export { ulid } from './ulid.js';
 export { readRoutedNode, RouterAssertionError } from './routed-node.js';
 export { assertPlatformCall, PlatformCallError, PLATFORM_SECRET_HEADER, } from './platform-call.js';
+export { runPlatformSweep, startPlatformSweeper } from './platform-sweep.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/permission-checker.d.ts

@@ -1,4 +1,4 @@
-import { type Decision, type EntityRef, type Node, type PermissionKey, type PrincipalId } from '@substrat-run/contracts';
+import { type Decision, type EntityRef, type Node, type PermissionKey, type CheckSubject, type PrincipalId } from '@substrat-run/contracts';
 /**
  * The evaluation seam (D-16): the MODEL is kernel-owned, the evaluation engine
  * is an adapter — the built-in default is a constrained relationship-tuple
@@ -10,8 +10,15 @@ import { type Decision, type EntityRef, type Node, type PermissionKey, type Prin
  * against entity-narrowed grants (§4.2 rule 3).
  */
 export interface PermissionChecker {
-    check(principal: PrincipalId, permission: PermissionKey, node: Node, entity?: EntityRef): Promise<Decision>;
+    /**
+     * `subject` rather than `principal` since #97: a connection can hold a grant,
+     * and must not be laundered through a principal to do it. Every existing
+     * caller passes `{ kind: 'principal', id }` and behaves exactly as before.
+     */
+    check(subject: CheckSubject, permission: PermissionKey, node: Node, entity?: EntityRef): Promise<Decision>;
 }
+/** Convenience for the overwhelmingly common case. */
+export declare const asPrincipal: (id: PrincipalId) => CheckSubject;
 export declare class PermissionDenied extends Error {
     constructor(message: string);
 }

package/dist/permission-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checker.d.ts","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CACH,SAAS,EAAE,WAAW,EACtB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5E,QAAQ,EACR;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAIA;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,EAAE,iBAM5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAapC,CAAC"}
+{"version":3,"file":"permission-checker.d.ts","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAED,sDAAsD;AACtD,eAAO,MAAM,WAAW,GAAI,IAAI,WAAW,KAAG,YAA2C,CAAC;AAE1F,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5E,QAAQ,EACR;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAIA;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,EAAE,iBAM5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAapC,CAAC"}

package/dist/permission-checker.js

@@ -1,4 +1,6 @@
 import { objectRef, } from '@substrat-run/contracts';
+/** Convenience for the overwhelmingly common case. */
+export const asPrincipal = (id) => ({ kind: 'principal', id });
 export class PermissionDenied extends Error {
     constructor(message) {
         super(message);

package/dist/permission-checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checker.js","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAMV,MAAM,yBAAyB,CAAC;AAqBjC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,QAAkB;IAI9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,UAAU;QACnB,IAAI;KACL,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL;gBACE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa,SAAS,EAAE,CAAC;gBAClD,QAAQ,EAAE,WAAW,UAAU,EAAE;gBACjC,MAAM,EAAE,SAAS,CAAC,KAAK,CACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CACnE;aACF;SACF;KACF,CAAC;CACH,CAAC"}
+{"version":3,"file":"permission-checker.js","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAOV,MAAM,yBAAyB,CAAC;AA0BjC,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AAE1F,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,QAAkB;IAI9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,UAAU;QACnB,IAAI;KACL,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL;gBACE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa,SAAS,EAAE,CAAC;gBAClD,QAAQ,EAAE,WAAW,UAAU,EAAE;gBACjC,MAAM,EAAE,SAAS,CAAC,KAAK,CACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CACnE;aACF;SACF;KACF,CAAC;CACH,CAAC"}

package/dist/platform-sweep.d.ts

@@ -0,0 +1,96 @@
+import type { ConnectionId, PlatformActorId } from '@substrat-run/contracts';
+import type { ExecutorDrainReport, FetchLike, ScopeHost } from './scope-host.js';
+/**
+ * A connector's reconcile sweep — the unit `runPlatformSweep` calls per live
+ * connection of a given provider (`sweepScriveReconciliations` is one).
+ *
+ * INJECTED, never imported: the driver — and the deployment that runs it —
+ * depends on no specific connector. A connector contributes `{ [provider]: its
+ * sweeper }` to the registry, and a provider with no entry is simply skipped.
+ */
+export interface ConnectorSweeper {
+    (host: ScopeHost, connectionId: ConnectionId, opts: {
+        fetch: FetchLike;
+    }): Promise<unknown>;
+}
+export interface PlatformSweepOptions {
+    /** The platform actor the enumeration reads run as (`listScopes`/`listConnections`). */
+    actor: PlatformActorId;
+    /** Sanctioned egress handed to each connector sweeper. */
+    fetch: FetchLike;
+    /** provider slug → its reconcile sweeper. A connection whose provider is absent is skipped. */
+    sweepers: Record<string, ConnectorSweeper>;
+    /** Max scope drains / connection sweeps in flight at once. Default 8. */
+    concurrency?: number;
+    /**
+     * Also drain each active scope's due executor deliveries — the retry driver
+     * (connections.md §2.1), which has been landed and equally lacks a caller.
+     * Default `true`; set `false` to sweep only connectors.
+     */
+    drainRetries?: boolean;
+}
+export interface PlatformSweepReport {
+    /** Active scopes `drainDue` ran on. */
+    scopesDrained: number;
+    /** Drain outcomes summed across scopes. */
+    drainTotals: ExecutorDrainReport;
+    /** Connections a sweeper ran for. */
+    connectionsSwept: number;
+    /** Connections skipped — revoked, or their provider has no registered sweeper. */
+    connectionsSkipped: number;
+    /** Per-unit failures; the pass records and steps over each rather than aborting. */
+    errors: {
+        kind: 'drain' | 'sweep';
+        id: string;
+        error: string;
+    }[];
+}
+/**
+ * One pass of the platform's scheduled work: drain every active scope's due
+ * executor deliveries, then reconcile every live connection against its provider.
+ *
+ * This is the SCHEDULER'S UNIT OF WORK — a Cloudflare cron, a Durable Object
+ * alarm, or a node timer calls it; it holds no timer itself (see
+ * `startPlatformSweeper`, and docs/design/scheduler.md). Both halves are code
+ * that landed but had no caller: `drainDue` (the retry driver) and the
+ * connectors' reconcile sweeps.
+ *
+ * Robust because a scheduled pass must be: bounded concurrency, so one slow
+ * provider cannot delay the fleet, and a failure on any one scope or connection
+ * is recorded in the report and stepped over — never allowed to sink the pass.
+ *
+ * Provider-agnostic: connections are discovered via `listConnections` and
+ * dispatched to `sweepers[provider]`, so this imports no connector. A connection
+ * whose provider has no sweeper, or that is revoked, is skipped (and counted),
+ * not an error.
+ */
+export declare function runPlatformSweep(host: ScopeHost, options: PlatformSweepOptions): Promise<PlatformSweepReport>;
+/** A running sweeper; `stop()` prevents the next pass and cancels the pending timer. */
+export interface PlatformSweeperHandle {
+    stop(): void;
+}
+export interface StartPlatformSweeperOptions extends PlatformSweepOptions {
+    /**
+     * Milliseconds between the END of one pass and the START of the next — a gap,
+     * not a fixed rate. Rescheduling only after a pass settles means two passes can
+     * never overlap, even when a pass runs longer than the interval.
+     */
+    intervalMs: number;
+    /** Observe each pass — for logging or a health metric. Never throws into the loop. */
+    onPass?: (outcome: PlatformSweepReport | {
+        error: string;
+    }) => void;
+    /** Injected for tests; default to the runtime's timer. */
+    setTimer?: (cb: () => void, ms: number) => unknown;
+    clearTimer?: (handle: unknown) => void;
+}
+/**
+ * Drive `runPlatformSweep` on a self-rescheduling timer — the node/long-lived
+ * runtime's trigger. (A Cloudflare deployment uses `scheduled()`/an alarm instead
+ * and calls `runPlatformSweep` directly; both share the one unit of work.)
+ *
+ * Non-overlapping by construction: the next pass is scheduled only once the
+ * current one settles, so a slow pass delays the next rather than stacking on it.
+ */
+export declare function startPlatformSweeper(host: ScopeHost, options: StartPlatformSweeperOptions): PlatformSweeperHandle;
+//# sourceMappingURL=platform-sweep.d.ts.map

package/dist/platform-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../src/platform-sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAQjF;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7F;AAED,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,KAAK,EAAE,eAAe,CAAC;IACvB,0DAA0D;IAC1D,KAAK,EAAE,SAAS,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,WAAW,EAAE,mBAAmB,CAAC;IACjC,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAClE;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA8C9B;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CAuBvB"}

package/dist/platform-sweep.js

@@ -0,0 +1,114 @@
+const message = (err) => (err instanceof Error ? err.message : String(err));
+/**
+ * Run `fn` over `items` with at most `limit` in flight. `fn` owns its errors —
+ * this never rejects, so one unit's failure cannot abort the pass.
+ */
+async function mapBounded(items, limit, fn) {
+    let next = 0;
+    const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+        while (next < items.length) {
+            await fn(items[next++]);
+        }
+    });
+    await Promise.all(workers);
+}
+/**
+ * One pass of the platform's scheduled work: drain every active scope's due
+ * executor deliveries, then reconcile every live connection against its provider.
+ *
+ * This is the SCHEDULER'S UNIT OF WORK — a Cloudflare cron, a Durable Object
+ * alarm, or a node timer calls it; it holds no timer itself (see
+ * `startPlatformSweeper`, and docs/design/scheduler.md). Both halves are code
+ * that landed but had no caller: `drainDue` (the retry driver) and the
+ * connectors' reconcile sweeps.
+ *
+ * Robust because a scheduled pass must be: bounded concurrency, so one slow
+ * provider cannot delay the fleet, and a failure on any one scope or connection
+ * is recorded in the report and stepped over — never allowed to sink the pass.
+ *
+ * Provider-agnostic: connections are discovered via `listConnections` and
+ * dispatched to `sweepers[provider]`, so this imports no connector. A connection
+ * whose provider has no sweeper, or that is revoked, is skipped (and counted),
+ * not an error.
+ */
+export async function runPlatformSweep(host, options) {
+    const concurrency = options.concurrency ?? 8;
+    const report = {
+        scopesDrained: 0,
+        drainTotals: { attempted: 0, delivered: 0, retrying: 0, deadLettered: 0 },
+        connectionsSwept: 0,
+        connectionsSkipped: 0,
+        errors: [],
+    };
+    if (options.drainRetries !== false) {
+        const scopes = await host.admin.listScopes(options.actor, { status: 'active' });
+        await mapBounded(scopes, concurrency, async (s) => {
+            try {
+                const r = await host.drainDue(s.tenantId, s.id);
+                report.scopesDrained += 1;
+                report.drainTotals.attempted += r.attempted;
+                report.drainTotals.delivered += r.delivered;
+                report.drainTotals.retrying += r.retrying;
+                report.drainTotals.deadLettered += r.deadLettered;
+            }
+            catch (err) {
+                report.errors.push({ kind: 'drain', id: s.id, error: message(err) });
+            }
+        });
+    }
+    const connections = await host.admin.listConnections(options.actor, {});
+    await mapBounded(connections, concurrency, async (c) => {
+        if (c.revokedAt !== null) {
+            report.connectionsSkipped += 1; // terminal — nothing to reconcile through it
+            return;
+        }
+        const sweeper = options.sweepers[c.provider];
+        if (!sweeper) {
+            report.connectionsSkipped += 1;
+            return;
+        }
+        try {
+            await sweeper(host, c.id, { fetch: options.fetch });
+            report.connectionsSwept += 1;
+        }
+        catch (err) {
+            report.errors.push({ kind: 'sweep', id: c.id, error: message(err) });
+        }
+    });
+    return report;
+}
+/**
+ * Drive `runPlatformSweep` on a self-rescheduling timer — the node/long-lived
+ * runtime's trigger. (A Cloudflare deployment uses `scheduled()`/an alarm instead
+ * and calls `runPlatformSweep` directly; both share the one unit of work.)
+ *
+ * Non-overlapping by construction: the next pass is scheduled only once the
+ * current one settles, so a slow pass delays the next rather than stacking on it.
+ */
+export function startPlatformSweeper(host, options) {
+    const setTimer = options.setTimer ?? ((cb, ms) => setTimeout(cb, ms));
+    const clearTimer = options.clearTimer ?? ((h) => clearTimeout(h));
+    let stopped = false;
+    let handle;
+    const tick = async () => {
+        if (stopped)
+            return;
+        try {
+            options.onPass?.(await runPlatformSweep(host, options));
+        }
+        catch (err) {
+            options.onPass?.({ error: message(err) });
+        }
+        if (!stopped)
+            handle = setTimer(() => void tick(), options.intervalMs);
+    };
+    handle = setTimer(() => void tick(), options.intervalMs);
+    return {
+        stop() {
+            stopped = true;
+            if (handle !== undefined)
+                clearTimer(handle);
+        },
+    };
+}
+//# sourceMappingURL=platform-sweep.js.map

package/dist/platform-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-sweep.js","sourceRoot":"","sources":["../src/platform-sweep.ts"],"names":[],"mappings":"AAmDA,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,KAAmB,EACnB,KAAa,EACb,EAA8B;IAE9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC5F,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAe,EACf,OAA6B;IAE7B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAwB;QAClC,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACzE,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,EAAE,CAAC;QACrB,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,MAAM,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAChD,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChD,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;gBAC1B,MAAM,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;gBAC5C,MAAM,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;gBAC5C,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;gBAC1C,MAAM,CAAC,WAAW,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,6CAA6C;YAC7E,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAqBD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAe,EACf,OAAoC;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAe,CAAC;IAEpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO;QACL,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,MAAM,KAAK,SAAS;gBAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/scope-host.d.ts

@@ -1,4 +1,4 @@
-import type { AdminAction, AccessLogEntry, BindHostnameInput, AdminLogEntry, CapabilityGrant, CreateTenantInput, Decision, DomainEvent, DomainEventInput, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleManifest, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, HostnameBinding, HostnameStatus, PromotionAcknowledgement, PublishVersionInput, RegisterVerticalInput, RouteTarget, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, Scope, ScopeId, ScopeStatus, StorageShape, Tenant, TenantId, TenantRole, Vertical, VerticalChannel, VerticalVersion, TenantStatus } from '@substrat-run/contracts';
+import type { AdminAction, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionSecret, CreateConnectionInput, OpenConnection, AccessLogEntry, BindHostnameInput, AdminLogEntry, CapabilityGrant, CreateTenantInput, Decision, DomainEvent, DomainEventInput, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleManifest, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, HostnameBinding, HostnameStatus, PromotionAcknowledgement, PublishVersionInput, RegisterVerticalInput, RouteTarget, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, Scope, ScopeId, ScopeStatus, StorageShape, Tenant, TenantId, TenantRole, Vertical, VerticalChannel, VerticalVersion, TenantStatus } from '@substrat-run/contracts';
 /**
  * The scope-host contract — the adapter seam (§5.1 of the design doc).
  *
@@ -86,6 +86,138 @@ export type ConsumerHandler = (ctx: OperationContext, event: DomainEvent) => voi
  * the causing event's id (`causedBy`), so the split trail joins.
  */
 export type ExecutorHandler = (admin: HostAdmin, event: DomainEvent) => void | Promise<void>;
+/**
+ * How hard the host tries before it gives up on one delivery (#100).
+ *
+ * Defaults suit a directory write. A connector making an outbound HTTP call
+ * wants a longer tail — that is the whole reason this is per-executor rather
+ * than a host-wide constant.
+ */
+export interface ExecutorRetryPolicy {
+    /** Total attempts including the first. Reaching it dead-letters. Default 5. */
+    maxAttempts?: number;
+    /** First backoff step; doubles per attempt. Default 1000ms. `0` retries at once. */
+    baseDelayMs?: number;
+    /** Ceiling on the doubling. Default 300_000ms (5 min). */
+    maxDelayMs?: number;
+}
+/**
+ * What one drain pass did. `retrying` and `deadLettered` are the numbers a
+ * health surface reports; a caller that ignores them learns nothing, which is
+ * the failure mode the old silent path had.
+ */
+export interface ExecutorDrainReport {
+    attempted: number;
+    delivered: number;
+    /** Failed, still under `maxAttempts` — scheduled for a later pass. */
+    retrying: number;
+    /** Failed at `maxAttempts` — terminal, and the row keeps the last error. */
+    deadLettered: number;
+}
+/**
+ * The web-standard fetch surface, structurally typed.
+ *
+ * Declared rather than imported: the kernel depends on no platform typings, and
+ * `RequestInit`/`Response` come from DOM lib in Node and from workers-types in
+ * Workers. Structural typing means both satisfy this without either being
+ * required — the same reason `crypto` and `TextEncoder` are declared locally.
+ */
+export interface FetchLike {
+    (input: string, init?: ConnectorRequestInit): Promise<ConnectorResponse>;
+}
+export interface ConnectorRequestInit {
+    method?: string;
+    headers?: Record<string, string>;
+    /**
+     * `Uint8Array` as well as `string` because a real provider upload is binary:
+     * Scrive's `setfile` is `multipart/form-data`, whose body is a byte sequence a
+     * string cannot carry without corrupting the file. Web `fetch` accepts both, so
+     * this only widens the declared surface — the adapter passes it straight
+     * through.
+     */
+    body?: string | Uint8Array;
+    signal?: unknown;
+}
+export interface ConnectorResponse {
+    readonly ok: boolean;
+    readonly status: number;
+    text(): Promise<string>;
+    json(): Promise<unknown>;
+}
+/**
+ * A connection with its credential opened, plus egress bound to it.
+ *
+ * `fetch` is bound to the connection rather than sitting on the context because
+ * health has to land on the right row by construction. An ambient
+ * `ctx.fetch` would need the runtime to guess which connection a call belonged
+ * to, and it would guess wrong the first time a connector talked to two.
+ */
+export interface ConnectorConnection extends OpenConnection {
+    /**
+     * Sanctioned egress: a timeout, and success/failure recorded against THIS
+     * connection.
+     *
+     * The connector is handed its `fetch` rather than importing one — the same
+     * move `ctx.sql` makes for module code, and for the same reason. Egress
+     * policy, timeouts and health become properties of the seam instead of
+     * conventions a connector author has to remember. Module code still cannot
+     * reach any of this: boundary-lint R3 bans `fetch` outright, and a connector
+     * is host code.
+     */
+    fetch(input: string, init?: ConnectorRequestInit): Promise<ConnectorResponse>;
+}
+/**
+ * What a connector sees. Strictly more than an executor: an executor effects
+ * something in the DIRECTORY, a connector effects something in the OUTSIDE
+ * WORLD, and only the second needs a per-tenant credential and egress.
+ */
+export interface ConnectorContext {
+    readonly admin: HostAdmin;
+    readonly tenantId: TenantId;
+    readonly scopeId: ScopeId;
+    /** The scope's vertical — half the key a connection is stored under. */
+    readonly vertical: string;
+    /**
+     * The live connection for this provider, opened.
+     *
+     * Resolved as (this event's tenant, this scope's vertical, provider), so a
+     * connector cannot reach a credential another vertical connected even by
+     * accident — the tenant and vertical are ambient, not arguments. Throws when
+     * there is none: a connector that runs without a credential would otherwise
+     * fail later, further from the cause.
+     */
+    connection(provider: string): Promise<ConnectorConnection>;
+}
+export type ConnectorHandler = (ctx: ConnectorContext, event: DomainEvent) => void | Promise<void>;
+/** Tuning for one connector's egress. */
+export interface ConnectorOptions extends ExecutorRetryPolicy {
+    /** Per-request timeout. Default 30s. */
+    timeoutMs?: number;
+}
+/** A delivery that exhausted its attempts. The evidence, not a silent drop. */
+export interface ExecutorDeadLetter {
+    eventId: string;
+    executorId: string;
+    eventType: string;
+    attempts: number;
+    error: string;
+    lastAttemptAt: string;
+}
+/**
+ * Retry defaults (#100). Tuned for the directory write the first executor does;
+ * a connector making an outbound call should raise `maxAttempts` explicitly,
+ * which is why the policy is per-executor rather than a host constant.
+ */
+export declare function resolveRetryPolicy(retry?: ExecutorRetryPolicy): Required<ExecutorRetryPolicy>;
+/**
+ * When attempt `attempts` should next be tried: exponential, capped, jittered.
+ *
+ * Jitter is ±20% and is skipped entirely at zero delay, so a test setting
+ * `baseDelayMs: 0` gets deterministic immediate retries rather than a race. It
+ * matters at real delays because every scope in a fleet retries a downed
+ * provider on the same schedule otherwise.
+ */
+export declare function backoffAt(attempts: number, retry: Required<ExecutorRetryPolicy>, from: Date): string;
 /**
  * A named, manifest-wired pre-condition on an operation (K-17; engine-protocol
  * §6, open question 11). One module CONTRIBUTES a predicate under a name; a
@@ -157,6 +289,17 @@ export interface HostAdmin {
     assignRole(actor: PlatformActorId, assignment: RoleAssignment): Promise<void>;
     grant(actor: PlatformActorId, grant: CapabilityGrant): Promise<void>;
     /** Grant to an organization (portal customers); members reach it via membership tuples. */
+    /**
+     * Grant a permission to a CONNECTION (#97) — how a connector is allowed to
+     * write back into a scope.
+     *
+     * Deliberately the same shape as every other grant: tuples, tombstoned on
+     * revoke (K-21), visible to `listRoles`-style reads and to the permission
+     * diff. A separate "allowed operations" list on the connection was the
+     * alternative and was rejected — two mechanisms for one gate is worse than
+     * either, and only one of them would have shown up in a review.
+     */
+    grantToConnection(actor: PlatformActorId, grant: ConnectionGrant): Promise<void>;
     grantToOrg(actor: PlatformActorId, orgId: OrgId, permission: PermissionKey, node: Node, entity?: EntityRef): Promise<void>;
     addMember(actor: PlatformActorId, tenantId: TenantId, principal: PrincipalId, orgId: OrgId): Promise<void>;
     /**
@@ -337,6 +480,92 @@ export interface HostAdmin {
      * DIFFERENT principal **throws** — it means two subjects collided, and silently
      * ignoring it would resolve the second person as the first.
      */
+    /**
+     * Store a tenant's authorization for one provider, held by one vertical.
+     *
+     * The credential is sealed by the host's `SecretBox` before it touches the
+     * directory, and the admin-log row carries **metadata only** — provider,
+     * label, scopes. That is structural, not careful: `_substrat_admin_log` is
+     * append-only, so a secret written into it could never be removed.
+     *
+     * Takes a `PlatformActorId` today. Connecting a provider is really a tenant
+     * admin's act, and routing it through a platform actor is the same defect
+     * D-31 named for `addMember` — so this is a deliberate deferral, recorded in
+     * connections.md §3.5, not an answer. No console flow should be built on this
+     * signature until the question is settled together with membership's.
+     */
+    createConnection(actor: PlatformActorId, input: CreateConnectionInput): Promise<void>;
+    /** Metadata only — never the credential, at any privilege level. */
+    listConnections(actor: PlatformActorId, filter?: ConnectionFilter): Promise<Connection[]>;
+    /** Replace the sealed credential — the OAuth refresh path. */
+    updateConnectionSecret(actor: PlatformActorId, id: ConnectionId, secret: ConnectionSecret, expiresAt?: string): Promise<void>;
+    /**
+     * Withdraw a connection. Tombstones like K-21 rather than deleting: a
+     * credential that once had access is evidence of why an access was allowed.
+     * Terminal — a replacement is a new connection, which is why the uniqueness
+     * constraint ignores revoked rows.
+     */
+    revokeConnection(actor: PlatformActorId, id: ConnectionId): Promise<void>;
+    /**
+     * Open the credential for one (tenant, vertical, provider) — the connector's
+     * read, and the only path in the system that yields plaintext.
+     *
+     * **Takes no actor and is not audited**, the same exemption `resolveHostname`
+     * and `resolveIdentity` hold and for the same reason: it is a machine read on
+     * the request path, and an audit row per outbound HTTP call would drown the
+     * log that matters. What *is* recorded is health — `recordConnectionUse` below
+     * — which is the signal an operator can actually act on.
+     */
+    openConnection(tenantId: TenantId, vertical: string, provider: string): Promise<OpenConnection | undefined>;
+    /**
+     * Record that a connection worked, or did not (§3.7). Written by the connector
+     * runtime; read by a console. Not audited — it is telemetry about a machine
+     * read, not a control-plane mutation.
+     */
+    recordConnectionUse(id: ConnectionId, outcome: {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    }): Promise<void>;
+    /**
+     * Durable, connection-scoped state a connector keeps for itself — the home a
+     * connector's bookkeeping never had.
+     *
+     * The load-bearing use is **dispatch idempotency**. A connector runs from the
+     * outbox at-least-once, so a redelivery must not repeat an outward effect —
+     * and it cannot record "already did this" in the scope, because a connector
+     * runs *inside* the scope's dispatch and re-entering the scope actor
+     * deadlocks. This lives in the DIRECTORY instead, which the connector reaches
+     * through `ctx.admin` without touching the scope: before it creates a document
+     * at the provider it checks for prior state under a deterministic key, and
+     * skips if it is there.
+     *
+     * `value` is arbitrary JSON, opaque to the kernel — a `{ documentId, … }` map
+     * the connector interprets. NOT audited: this is high-frequency machine state,
+     * one write per dispatch, the same class as `recordConnectionUse`. Rows die
+     * with the connection (revoke cascades).
+     */
+    putConnectorState(id: ConnectionId, key: string, value: unknown): Promise<void>;
+    getConnectorState(id: ConnectionId, key: string): Promise<unknown | undefined>;
+    /**
+     * Every state row for a connection, optionally narrowed to keys under a
+     * `prefix`, ordered by key.
+     *
+     * `getConnectorState` answers "did I already do THIS one" from a deterministic
+     * key — the dispatch path. This answers "what is still outstanding" without
+     * knowing the keys up front, which is what a **poll driver** needs: a connector
+     * records one row per dispatch under `<provider>:dispatch:<id>`, and a
+     * scheduled sweep enumerates them (`prefix = '<provider>:dispatch:'`) to
+     * reconcile each against the provider. Without it a sweep would have to be told
+     * every id it might reconcile — which defeats the point of a sweep.
+     *
+     * A read of directory-local machine state, like get/put; not audited.
+     */
+    listConnectorState(id: ConnectionId, prefix?: string): Promise<{
+        key: string;
+        value: unknown;
+    }[]>;
     linkIdentity(actor: PlatformActorId, input: IdentityLink): Promise<void>;
     /**
      * Register an identity pool and its topology (K-23). A provider must be registered
@@ -498,8 +727,65 @@ export interface ScopeHost {
      * is what makes it correct under crash — but the common case completes inside the
      * originating request, so "requested but not yet effected" is a rare-case fallback
      * rather than the normal experience.
+     *
+     * **A failing handler never fails the operation** (#100). The operation already
+     * committed; the delivery did not. Those are different facts, and reporting the
+     * second as the first told a caller their work had been rolled back when it had
+     * not. A failure is retried with backoff, dead-lettered at `maxAttempts`, and
+     * surfaced through `drainDue`/`executorDeadLetters` — never thrown at whoever happened
+     * to be holding the request.
+     */
+    registerExecutor(id: string, eventType: string, handler: ExecutorHandler, retry?: ExecutorRetryPolicy): void;
+    /**
+     * A scope stub whose authority is a CONNECTION rather than a person (#97).
+     *
+     * This is the inbound half of the connector seam: the path by which a
+     * provider's callback, or a poll of a provider's state, writes back into a
+     * scope. `getScope` demands a `PrincipalId` and a provider is not one, which
+     * is why a connector could dispatch a document and then not record that it
+     * had — and why an at-least-once retry would send a second copy.
+     *
+     * **Authority is inherited, not re-declared.** A connection is keyed
+     * (tenant, vertical, provider), so this refuses any scope outside that
+     * tenant, and any scope not running that vertical. What the connection may
+     * then DO is an ordinary permission check against `connection:<id>` grants —
+     * one enforcement path, one place to read, one way to revoke.
+     *
+     * `ctx.principal` on the resulting stub carries the connection id so the type
+     * holds, but it is **not a person**: an operation invoked this way should read
+     * the event actor (`{ connection }`), and a module that attributes domain
+     * data to `ctx.principal` will be recording a connector.
+     */
+    getConnectorScope(connectionId: ConnectionId, scopeId: ScopeId): Promise<ScopeStub>;
+    /**
+     * Register a connector — an executor that also gets a per-tenant credential
+     * and sanctioned egress (#101, design/connections.md §4.1).
+     *
+     * Rides the same hardened dispatch, journal and retry policy as
+     * `registerExecutor`; the difference is only what the handler is handed. Kept
+     * as a second registration rather than widening `ExecutorHandler` because the
+     * two really are different capabilities, and a membership executor should not
+     * be handed the machinery to call the internet.
+     */
+    registerConnector(id: string, eventType: string, handler: ConnectorHandler, options?: ConnectorOptions): void;
+    /**
+     * Run every executor delivery that is due for this scope — the retry driver.
+     *
+     * Inline dispatch after an operation covers the common case, but a delivery
+     * that failed has no way back on its own: before this existed, retry happened
+     * only if someone happened to invoke another operation on the same scope, so a
+     * quiet scope could hold a failed effect forever with nothing reporting it.
+     *
+     * Call it from whatever scheduling the deployment has — a cron trigger, a
+     * Durable Object alarm, a dev-server timer. Idempotent and safe to call when
+     * nothing is due.
+     */
+    drainDue(tenantId: TenantId, scopeId: ScopeId): Promise<ExecutorDrainReport>;
+    /**
+     * Executor deliveries that exhausted their attempts, oldest first — the evidence a
+     * dead-letter is a decision rather than a disappearance.
      */
-    registerExecutor(id: string, eventType: string, handler: ExecutorHandler): void;
+    executorDeadLetters(tenantId: TenantId, scopeId: ScopeId): Promise<ExecutorDeadLetter[]>;
     /** Bare operation registration (tests, glue). Names are module-namespaced: 'workorder/create'. */
     defineOperation<I, O>(name: string, handler: OperationHandler<I, O>): void;
     close(): Promise<void>;

package/dist/scope-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host.d.ts","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,IAAI,EACJ,GAAG,EACH,KAAK,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,KAAK,EACL,OAAO,EACP,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,eAAe,EACf,eAAe,EACf,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AAEpE,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,kGAAkG;IAClG,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,0FAA0F;IAC1F,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI,CACvD,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,CAAC,KACL,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7F;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,OAAO,KACX,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,2FAA2F;IAC3F,UAAU,CACR,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,WAAW,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,YAAY,CACV,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,WAAW,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;OAMG;IACH,WAAW,CACT,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GACrC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAI5B;;;;;;;;;OASG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAI3F;;;OAGG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3D;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvF,yFAAyF;IACzF,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,0FAA0F;IAC1F,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF;;;;;;;;;;;;OAYG;IACH,cAAc,CACZ,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvF;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,iBAAiB,CACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CACX,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAIpE;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;OAIG;IACH,eAAe,CACb,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8FAA8F;IAC9F,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAmBnF,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3E;;;;;;;;OAQG;IACH,cAAc,CACZ,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IAQ9B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,0BAA0B;IAC1B,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQ5F,4DAA4D;IAC5D,gBAAgB,CACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8EAA8E;IAC9E,iBAAiB,CACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,iEAAiE;IACjE,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAShF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;;;;;OAMG;IACH,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAE7F;;;;;;;;OAQG;IACH,mBAAmB,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvB;;;;;;;OAOG;IACH,eAAe,CACb,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEpF;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEvF;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,oCAAoC;IACpC,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAE1B,sFAAsF;IACtF,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAEhF,kGAAkG;IAClG,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAE3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}
+{"version":3,"file":"scope-host.d.ts","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,IAAI,EACJ,GAAG,EACH,KAAK,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,KAAK,EACL,OAAO,EACP,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,eAAe,EACf,eAAe,EACf,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AAEpE,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,kGAAkG;IAClG,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,0FAA0F;IAC1F,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI,CACvD,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,CAAC,KACL,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC1E;AACD,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AACD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/E;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC5D;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnG,yCAAyC;AACzC,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAM7F;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACpC,IAAI,EAAE,IAAI,GACT,MAAM,CAIR;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,OAAO,KACX,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,2FAA2F;IAC3F;;;;;;;;;OASG;IACH,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjF,UAAU,CACR,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,WAAW,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,YAAY,CACV,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,WAAW,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;OAMG;IACH,WAAW,CACT,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GACrC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAI5B;;;;;;;;;OASG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAI3F;;;OAGG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3D;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvF,yFAAyF;IACzF,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,0FAA0F;IAC1F,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF;;;;;;;;;;;;OAYG;IACH,cAAc,CACZ,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvF;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,iBAAiB,CACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CACX,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAIpE;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;OAIG;IACH,eAAe,CACb,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8FAA8F;IAC9F,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAmBnF,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3E;;;;;;;;OAQG;IACH,cAAc,CACZ,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IAQ9B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,0BAA0B;IAC1B,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,sEAAsE;IACtE,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQ5F,4DAA4D;IAC5D,gBAAgB,CACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8EAA8E;IAC9E,iBAAiB,CACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,iEAAiE;IACjE,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAShF;;;;;;;;;;;;OAYG;IAGH;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,oEAAoE;IACpE,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAE1F,8DAA8D;IAC9D,sBAAsB,CACpB,KAAK,EAAE,eAAe,EACtB,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,gBAAgB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1E;;;;;;;;;OASG;IACH,cAAc,CACZ,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEvC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3G;;;;;;;;;;;;;;;;;OAiBG;IACH,iBAAiB,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,iBAAiB,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC/E;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAChB,EAAE,EAAE,YAAY,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC,CAAC;IAE9C,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;;;;;OAMG;IACH,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAE7F;;;;;;;;OAQG;IACH,mBAAmB,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvB;;;;;;;OAOG;IACH,eAAe,CACb,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEpF;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEvF;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,oCAAoC;IACpC,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACrC,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAE1B,sFAAsF;IACtF,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAEvD;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAAC;IAER;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpF;;;;;;;;;OASG;IACH,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CAAC;IAER;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAE7E;;;OAGG;IACH,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEzF,kGAAkG;IAClG,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAE3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/scope-host.js

@@ -1,2 +1,26 @@
-export {};
+/**
+ * Retry defaults (#100). Tuned for the directory write the first executor does;
+ * a connector making an outbound call should raise `maxAttempts` explicitly,
+ * which is why the policy is per-executor rather than a host constant.
+ */
+export function resolveRetryPolicy(retry) {
+    return {
+        maxAttempts: retry?.maxAttempts ?? 5,
+        baseDelayMs: retry?.baseDelayMs ?? 1_000,
+        maxDelayMs: retry?.maxDelayMs ?? 300_000,
+    };
+}
+/**
+ * When attempt `attempts` should next be tried: exponential, capped, jittered.
+ *
+ * Jitter is ±20% and is skipped entirely at zero delay, so a test setting
+ * `baseDelayMs: 0` gets deterministic immediate retries rather than a race. It
+ * matters at real delays because every scope in a fleet retries a downed
+ * provider on the same schedule otherwise.
+ */
+export function backoffAt(attempts, retry, from) {
+    const raw = Math.min(retry.baseDelayMs * 2 ** (attempts - 1), retry.maxDelayMs);
+    const jittered = raw === 0 ? 0 : raw * (0.8 + Math.random() * 0.4);
+    return new Date(from.getTime() + jittered).toISOString();
+}
 //# sourceMappingURL=scope-host.js.map

package/dist/scope-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host.js","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":""}
+{"version":3,"file":"scope-host.js","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":"AAmRA;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA2B;IAC5D,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;QACpC,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,KAAK;QACxC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,QAAgB,EAChB,KAAoC,EACpC,IAAU;IAEV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACnE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC"}

package/dist/scope-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-record.d.ts","sourceRoot":"","sources":["../src/scope-record.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,mBAAmB,CAYlF"}
+{"version":3,"file":"scope-record.d.ts","sourceRoot":"","sources":["../src/scope-record.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,mBAAmB,CAgBlF"}

package/dist/scope-record.js

@@ -23,7 +23,11 @@ export function resolveScopeRecord(input) {
         name: input.name ?? slug,
         vertical: input.vertical ?? null,
         storageShape: input.storageShape ?? 'A',
-        jurisdiction: input.jurisdiction ?? null,
+        // No jurisdiction stated means `global` — unconstrained, the honest name for
+        // what an un-pinned scope already is (K-32). The old default was `null`, which
+        // also meant "nobody decided"; `global` is a decision, and the only one the
+        // provisioning boundary accepts until `eu`/`us` enforcement exists.
+        jurisdiction: input.jurisdiction ?? 'global',
     };
 }
 //# sourceMappingURL=scope-record.js.map

package/dist/scope-record.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-record.js","sourceRoot":"","sources":["../src/scope-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAc7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,GAAG;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;KACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scope-record.js","sourceRoot":"","sources":["../src/scope-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAc7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,GAAG;QACvC,6EAA6E;QAC7E,+EAA+E;QAC/E,4EAA4E;QAC5E,oEAAoE;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ;KAC7C,CAAC;AACJ,CAAC"}

package/dist/secret-box.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `SecretBox` — the seal/open adapter the connection store rests on (#101,
+ * design/connections.md §3.3).
+ *
+ * **Bucket 2 in D-18's triage**, which names the KMS as an adapter explicitly.
+ * The kernel decides that per-tenant credentials are encrypted at rest and that
+ * plaintext never touches the directory; *what* does the encrypting is swappable
+ * — Web Crypto locally, a Cloudflare Secrets Store binding or an external KMS
+ * when hosted.
+ *
+ * Before this existed there was no encryption primitive in the codebase at all:
+ * every `crypto.subtle` call was a one-way digest, and every secret was a
+ * plaintext Worker binding. Nothing was per-tenant, nothing was rotatable.
+ */
+/**
+ * Sealed bytes plus the id of the key that sealed them.
+ *
+ * `keyId` is what makes rotation possible: a new key seals new writes while old
+ * blobs stay openable, so re-sealing is a background sweep rather than a
+ * flag-day. A `SecretBox` that cannot name its key can only ever have one.
+ */
+export interface SealedSecret {
+    keyId: string;
+    /** Opaque to everything above this interface. Base64 for the Web Crypto impl. */
+    ciphertext: string;
+}
+export interface SecretBox {
+    seal(plaintext: string): Promise<SealedSecret>;
+    /** Throws if the blob was sealed by a key this box does not hold. */
+    open(sealed: SealedSecret): Promise<string>;
+}
+/**
+ * AES-256-GCM over Web Crypto — the default for dev, CI and self-hosting.
+ *
+ * `key` is 32 raw bytes. A fresh 96-bit IV per seal is prepended to the
+ * ciphertext, which is what makes it safe to seal the same credential twice;
+ * GCM with a reused IV is catastrophic rather than merely weak.
+ *
+ * **Fails closed when unconfigured.** A host built without a `SecretBox` cannot
+ * store a credential at all, rather than storing one in the clear. That is the
+ * rule `assertPlatformCall` already states — *"an unset secret is a failure, not
+ * a bypass"* — applied to the thing it most obviously protects. Note the router
+ * secret does the opposite; it is not a precedent to copy here.
+ */
+export declare function webCryptoSecretBox(keyId: string, key: Uint8Array): SecretBox;
+/**
+ * The box a host gets when none was configured: every call throws.
+ *
+ * Deliberately not "store it in the clear" and not "silently disable
+ * connections" — either would make a misconfiguration invisible until a
+ * credential leaked. Reading the error tells an operator exactly what to set.
+ */
+export declare const unconfiguredSecretBox: SecretBox;
+//# sourceMappingURL=secret-box.d.ts.map

package/dist/secret-box.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.d.ts","sourceRoot":"","sources":["../src/secret-box.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,qEAAqE;IACrE,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAkDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,SAAS,CAqC5E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAanC,CAAC"}

package/dist/secret-box.js

@@ -0,0 +1,84 @@
+/**
+ * `SecretBox` — the seal/open adapter the connection store rests on (#101,
+ * design/connections.md §3.3).
+ *
+ * **Bucket 2 in D-18's triage**, which names the KMS as an adapter explicitly.
+ * The kernel decides that per-tenant credentials are encrypted at rest and that
+ * plaintext never touches the directory; *what* does the encrypting is swappable
+ * — Web Crypto locally, a Cloudflare Secrets Store binding or an external KMS
+ * when hosted.
+ *
+ * Before this existed there was no encryption primitive in the codebase at all:
+ * every `crypto.subtle` call was a one-way digest, and every secret was a
+ * plaintext Worker binding. Nothing was per-tenant, nothing was rotatable.
+ */
+const toBase64 = (bytes) => {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s);
+};
+const fromBase64 = (b64) => {
+    const s = atob(b64);
+    const out = new Uint8Array(s.length);
+    for (let i = 0; i < s.length; i += 1)
+        out[i] = s.charCodeAt(i);
+    return out;
+};
+/**
+ * AES-256-GCM over Web Crypto — the default for dev, CI and self-hosting.
+ *
+ * `key` is 32 raw bytes. A fresh 96-bit IV per seal is prepended to the
+ * ciphertext, which is what makes it safe to seal the same credential twice;
+ * GCM with a reused IV is catastrophic rather than merely weak.
+ *
+ * **Fails closed when unconfigured.** A host built without a `SecretBox` cannot
+ * store a credential at all, rather than storing one in the clear. That is the
+ * rule `assertPlatformCall` already states — *"an unset secret is a failure, not
+ * a bypass"* — applied to the thing it most obviously protects. Note the router
+ * secret does the opposite; it is not a precedent to copy here.
+ */
+export function webCryptoSecretBox(keyId, key) {
+    if (key.length !== 32) {
+        throw new Error(`SecretBox key must be 32 bytes (AES-256), got ${key.length}`);
+    }
+    const imported = crypto.subtle.importKey('raw', key, 'AES-GCM', false, ['encrypt', 'decrypt']);
+    return {
+        async seal(plaintext) {
+            const iv = crypto.getRandomValues(new Uint8Array(12));
+            const body = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await imported, new TextEncoder().encode(plaintext)));
+            const joined = new Uint8Array(iv.length + body.length);
+            joined.set(iv, 0);
+            joined.set(body, iv.length);
+            return { keyId, ciphertext: toBase64(joined) };
+        },
+        async open(sealed) {
+            if (sealed.keyId !== keyId) {
+                // Naming the ids is safe and is the only way an operator can tell
+                // "wrong key configured" from "corrupt blob".
+                throw new Error(`SecretBox cannot open a secret sealed by key '${sealed.keyId}' (holding '${keyId}')`);
+            }
+            const joined = fromBase64(sealed.ciphertext);
+            const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: joined.slice(0, 12) }, await imported, joined.slice(12));
+            return new TextDecoder().decode(new Uint8Array(plain));
+        },
+    };
+}
+/**
+ * The box a host gets when none was configured: every call throws.
+ *
+ * Deliberately not "store it in the clear" and not "silently disable
+ * connections" — either would make a misconfiguration invisible until a
+ * credential leaked. Reading the error tells an operator exactly what to set.
+ */
+export const unconfiguredSecretBox = {
+    seal() {
+        return Promise.reject(new Error('no SecretBox configured: this host cannot store credentials. ' +
+            'Pass one to the host (webCryptoSecretBox with a 32-byte key) — ' +
+            'storing a credential unsealed is not an option.'));
+    },
+    open() {
+        return Promise.reject(new Error('no SecretBox configured: cannot open a stored credential'));
+    },
+};
+//# sourceMappingURL=secret-box.js.map

package/dist/secret-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.js","sourceRoot":"","sources":["../src/secret-box.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwDH,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAc,EAAE;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAe;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/F,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,MAAM,QAAQ,EACd,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CACF,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3B,kEAAkE;gBAClE,8CAA8C;gBAC9C,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,KAAK,eAAe,KAAK,IAAI,CACtF,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACvC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAC5C,MAAM,QAAQ,EACd,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CACjB,CAAC;YACF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAc;IAC9C,IAAI;QACF,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,+DAA+D;YAC7D,iEAAiE;YACjE,iDAAiD,CACpD,CACF,CAAC;IACJ,CAAC;IACD,IAAI;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC,CAAC;IAC/F,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/kernel",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Substrat kernel contracts and services — pure TypeScript, no platform imports (D-14)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -22,7 +22,7 @@
     "dist"
   ],
   "dependencies": {
-    "@substrat-run/contracts": "^0.9.0"
+    "@substrat-run/contracts": "^0.11.0"
   },
   "devDependencies": {
     "typescript": "^5.6.0",