@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.0

package/packages/public-runtime/schemas/managed-analytics/v1/set-integration-install-status-request.schema.json

@@ -0,0 +1,92 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://tokenoftrust.com/schemas/managed-analytics/v1/set-integration-install-status-request.schema.json",
+  "title": "SetIntegrationInstallStatusRequest",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "apiVersion",
+    "idempotencyKey",
+    "expectedRevision",
+    "body"
+  ],
+  "properties": {
+    "apiVersion": {
+      "type": "string",
+      "const": "v1"
+    },
+    "idempotencyKey": {
+      "type": "string",
+      "not": {
+        "anyOf": [
+          {
+            "type": "string",
+            "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+          },
+          {
+            "type": "string",
+            "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+          },
+          {
+            "type": "string",
+            "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+          },
+          {
+            "type": "string",
+            "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+          }
+        ]
+      },
+      "minLength": 8,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+    },
+    "expectedRevision": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "body": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "installId",
+        "status"
+      ],
+      "properties": {
+        "installId": {
+          "type": "string",
+          "not": {
+            "anyOf": [
+              {
+                "type": "string",
+                "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+              }
+            ]
+          },
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+        },
+        "status": {
+          "type": "string",
+          "enum": [
+            "disabled",
+            "enabled"
+          ]
+        }
+      }
+    }
+  }
+}

package/packages/public-runtime/schemas/managed-analytics/v1/update-migration-draft-request.schema.json

@@ -0,0 +1,184 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://tokenoftrust.com/schemas/managed-analytics/v1/update-migration-draft-request.schema.json",
+  "title": "UpdateMigrationDraftRequest",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "apiVersion",
+    "idempotencyKey",
+    "expectedRevision",
+    "body"
+  ],
+  "properties": {
+    "apiVersion": {
+      "type": "string",
+      "const": "v1"
+    },
+    "idempotencyKey": {
+      "type": "string",
+      "not": {
+        "anyOf": [
+          {
+            "type": "string",
+            "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+          },
+          {
+            "type": "string",
+            "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+          },
+          {
+            "type": "string",
+            "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+          },
+          {
+            "type": "string",
+            "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+          }
+        ]
+      },
+      "minLength": 8,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+    },
+    "expectedRevision": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "body": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "draftId",
+        "proposedAdapterId",
+        "proposedConfiguration",
+        "findings"
+      ],
+      "properties": {
+        "draftId": {
+          "type": "string",
+          "not": {
+            "anyOf": [
+              {
+                "type": "string",
+                "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+              }
+            ]
+          },
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+        },
+        "proposedAdapterId": {
+          "type": "string",
+          "not": {
+            "anyOf": [
+              {
+                "type": "string",
+                "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+              },
+              {
+                "type": "string",
+                "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+              }
+            ]
+          },
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+        },
+        "proposedConfiguration": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string",
+            "pattern": "^[a-z][a-zA-Z0-9]{0,63}$",
+            "not": {
+              "type": "string",
+              "pattern": "^(?:(?:nonce|token|secret|credential|bearer|password|passwd|passphrase|signature|tenant|html|javascript|js|script|template|eval|selector|storage|cookie|gtm)(?:$|[A-Z].*)|.*(?:Nonce|Token|Secret|Credential|Bearer|Password|Passwd|Passphrase|Signature|Tenant|Html|JavaScript|Javascript|Js|Script|Template|Eval|Selector|Storage|Cookie|Gtm|GTM)(?:$|[A-Z].*)|.*(?:signedUrl|SignedUrl|signedURL|SignedURL|apiKey|ApiKey|privateKey|PrivateKey|sessionKey|SessionKey|accessKey|AccessKey|clientSecret|ClientSecret|accessToken|AccessToken|refreshToken|RefreshToken).*|tenantId|liveAuthority|publishAuthority|uaId|localStorage|sessionStorage)$"
+            }
+          },
+          "additionalProperties": {
+            "oneOf": [
+              {
+                "type": "string",
+                "not": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                    }
+                  ]
+                }
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "integer"
+              }
+            ]
+          }
+        },
+        "findings": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "not": {
+              "anyOf": [
+                {
+                  "type": "string",
+                  "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                },
+                {
+                  "type": "string",
+                  "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                },
+                {
+                  "type": "string",
+                  "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                },
+                {
+                  "type": "string",
+                  "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                }
+              ]
+            },
+            "pattern": "^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$"
+          }
+        }
+      }
+    }
+  }
+}

package/packages/public-runtime/scripts/generate-managed-analytics-api-v1-schemas.mjs

@@ -0,0 +1,13 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+import { MANAGED_ANALYTICS_API_V1_JSON_SCHEMAS } from "../src/integration/managed-analytics-api-v1.schemas.ts";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const output = resolve(here, "../schemas/managed-analytics/v1");
+await mkdir(output, { recursive: true });
+
+for (const schema of Object.values(MANAGED_ANALYTICS_API_V1_JSON_SCHEMAS)) {
+  const name = new URL(schema.$id).pathname.split("/").at(-1);
+  await writeFile(resolve(output, name), `${JSON.stringify(schema, null, 2)}\n`, "utf8");
+}

package/packages/public-runtime/src/activity/catalog.ts

@@ -1,5 +1,5 @@
 // ─────────────────────────────────────────────────────────────────────────────
-// Action catalog — the ALLOWLISTED registry of actionKeys (card D0).
+// Action catalog — the ALLOWLISTED registry of actionKeys.
 //
 // The `action` field of an ActivityEvent is NEVER a free string. It is one of
 // the keys below, and each key ships a spec: which actor kinds may emit it,
@@ -7,22 +7,22 @@
 // default-DENY allowlist of payload fields that survive redaction for it.
 //
 // WHY A FIXED CATALOG. Free-string actions make the downstream query/alert
-// surface (D5/D6/D7) intractable: you cannot build a dashboard, an alert rule,
+// surface intractable: you cannot build a dashboard, an alert rule,
 // or a redaction allowlist against an open vocabulary. Adding a NEW action is a
 // deliberate edit HERE (plus, for the CLI, the JS mirror + its keep-in-step
 // test — see the module README), not an ad-hoc string at a call site.
 //
 // GROUNDING. These keys were reverse-engineered from the activity surfaces that
-// already exist informally in this repo, so D1–D3 map onto them 1:1 rather than
-// inventing new vocab:
+// already exist informally in this repo, so those surfaces map onto them 1:1
+// rather than inventing new vocab:
 //   • CLI command dispatch + ~/.tot/activity.log  → cli.command.*
 //   • obstacle beacon (obstacle-beacon.cjs)       → cli.obstacle.reported
 //   • local→hosted dev bridge (dev/activityStore, runtimeStore, obstacleStore)
 //                                                 → dev.*
 //   • preview serve / reconcile / Gitea webhook   → preview.* / reconcile.* / webhook.*
-//   • deploy version observed (provenance, D2)    → deploy.version_observed
+//   • deploy version observed (provenance)         → deploy.version_observed
 //   • ShipLoop CHANGE_STATES + admin routes
-//     (accept/reject/ship/revert/rollback/integrate/publish/invite/retire)
+//     (accept/reject/ship/revert/rollback/integrate/publish/invite)
 //                                                 → change.* / content.* / grant.* / preview.*
 //   • app installs (STOREFRONT_APPS_DB)           → app.*
 //   • agent cohort (later)                         → agent.*
@@ -154,7 +154,7 @@ export const ACTION_CATALOG = {
     desc: "A preview build finished (result: ok|failed).",
   },
   "preview.override": {
-    // D9: an AUTHENTICATED operator accepted the risk of a blocking-safety finding for a
+    // An AUTHENTICATED operator accepted the risk of a blocking-safety finding for a
     // specific commit (/api/preview/override), letting the reconcile materialize past it.
     // Cockpit-gated (signed-in real developer capability + session tenant), so the acting
     // cohort is owner→merchant, staff→admin, or a signed-in developer→dev. The required
@@ -166,7 +166,7 @@ export const ACTION_CATALOG = {
   "webhook.reconcile.received": {
     // Gitea candidate-reconcile webhook (api/changes/candidate-reconcile.ts). Low
     // volume (one per PR push, NOT per request) and the lifecycle PARTNER of
-    // `reconcile.terminal` — timelined so D7's reconcile-hang watchdog can correlate
+    // `reconcile.terminal` — timelined so the reconcile-hang watchdog can correlate
     // "received" against "terminal" for the same changeId and detect an ABSENCE.
     actors: ["system"], source: "server", sinks: LIFECYCLE,
     argsAllow: ["repo", "action", "branch", "changeId"], renderedAllow: [],
@@ -174,9 +174,9 @@ export const ACTION_CATALOG = {
   },
   "reconcile.terminal": {
     // A reconcile reached a terminal state (reconciled|blocked|failed). Low
-    // volume, high value → timelined for the ops UI (D5).
+    // volume, high value → timelined for the ops UI.
     actors: ["system"], source: "server", sinks: LIFECYCLE,
-    argsAllow: ["changeId", "result", "evidenceStatus"], renderedAllow: [],
+    argsAllow: ["changeId", "result", "evidenceStatus", "evidencePushError"], renderedAllow: [],
     desc: "A candidate reconcile reached a terminal state.",
   },
   "candidate.closed": {
@@ -189,7 +189,7 @@ export const ACTION_CATALOG = {
     desc: "A merged/closed PR webhook transitioned a candidate to a terminal state.",
   },
   "prebuild.dispatched": {
-    // T1 background pre-build (docs/epics/proposed/storefront-instant-static-rollback.md
+    // Background pre-build (docs/epics/proposed/storefront-instant-static-rollback.md
     // Addendum §B): a successful candidate reconcile fired (or failed to fire) the
     // materialize+validate+STAGE-ONLY repository_dispatch for a static-publish
     // tenant (candidate-reconcile.ts). Fail-open by design — this never gates the
@@ -200,7 +200,7 @@ export const ACTION_CATALOG = {
     desc: "A candidate's background static-prebuild dispatch (stage-only) succeeded or failed.",
   },
 
-  // ── Deploy provenance (source: server or cli) — card D2 ────────────────────
+  // ── Deploy provenance (source: server or cli) ────────────────────
   "deploy.version_observed": {
     actors: ["system", "dev"], source: "server", sinks: PROVENANCE,
     argsAllow: ["version", "commit", "env", "observedFrom"], renderedAllow: [],
@@ -234,7 +234,7 @@ export const ACTION_CATALOG = {
     desc: "A change was rejected (reason required).",
   },
   "change.resolve": {
-    // u3 (tot-merge-conflict-resolution-ux): one-click conflict resolution via
+    // One-click conflict resolution via
     // candidate_refresh. Same admission ladder as change.reject (resolveShipSession
     // → ship-on-behalf floor), so the same actor cohort. `strategy` is a
     // low-cardinality enum (ours|theirs|merge), safe to render.
@@ -243,7 +243,7 @@ export const ACTION_CATALOG = {
     desc: "A not-mergeable change was resolved by rebuilding it from the base tip under a strategy.",
   },
   "change.ship": {
-    // D6: the admin/cockpit "Publish" (go-live) handler admits the store OWNER
+    // The admin/cockpit "Publish" (go-live) handler admits the store OWNER
     // (merchant), ToT staff (admin), a ship-on-behalf developer (dev), AND the
     // headless Bearer/CLI operator (agent) — the actor list reflects who actually
     // reaches POST /api/changes/ship, not a placeholder subset.
@@ -252,7 +252,7 @@ export const ACTION_CATALOG = {
     desc: "A change was shipped to the live channel.",
   },
   "change.revert": {
-    // D9: same admission ladder as change.ship/rollback (resolveShipSession) — owner
+    // Same admission ladder as change.ship/rollback (resolveShipSession) — owner
     // (merchant), staff (admin), ship-on-behalf dev, headless operator (agent). The
     // `/api/changes/revert` route gates on the SAME seam, so the emitter cohort matches.
     actors: ["admin", "merchant", "dev", "agent"], source: "ui", sinks: LIFECYCLE,
@@ -260,7 +260,7 @@ export const ACTION_CATALOG = {
     desc: "A change was reverted.",
   },
   "change.hotfix": {
-    // D9: the owner-only emergency HOTFIX lane (/api/changes/hotfix) — a DISTINCT verb
+    // The owner-only emergency HOTFIX lane (/api/changes/hotfix) — a DISTINCT verb
     // from change.ship (never a `--base main` flag): a bypass-normal-flow live promote
     // from `main` while `preview` holds other unshipped work. Same resolveShipSession
     // ladder as ship/rollback (owner ⊇ ship-on-behalf), so the same cohort set.
@@ -269,20 +269,20 @@ export const ACTION_CATALOG = {
     desc: "An emergency hotfix was released to the live channel (bypassing unshipped preview work).",
   },
   "change.rollback": {
-    // D6: same admission ladder as change.ship (resolveShipSession) — owner
+    // Same admission ladder as change.ship (resolveShipSession) — owner
     // (merchant), staff (admin), ship-on-behalf dev, headless operator (agent).
     actors: ["admin", "merchant", "dev", "agent"], source: "ui", sinks: LIFECYCLE,
     argsAllow: ["changeId", "toVersion"], renderedAllow: ["reason"],
     desc: "The live channel was rolled back to a prior version.",
   },
   "change.integrate": {
-    // D6: accept/integrate (resolveShipSession) admits the same cohort set.
+    // Accept/integrate (resolveShipSession) admits the same cohort set.
     actors: ["admin", "merchant", "dev", "agent"], source: "ui", sinks: LIFECYCLE,
     argsAllow: ["changeId"], renderedAllow: [],
     desc: "A change was integrated into the shared preview.",
   },
   "change.rebuild": {
-    // u15: retry a dead aggregate rebuild without a new merge (/api/changes/rebuild).
+    // Retry a dead aggregate rebuild without a new merge (/api/changes/rebuild).
     // Same admission ladder as change.integrate/revert (resolveShipSession) — the
     // route gates on the SAME seam, so the emitter cohort matches. No changeId: a
     // rebuild retries the tenant's most recent integration attempt, not one candidate.
@@ -291,7 +291,7 @@ export const ACTION_CATALOG = {
     desc: "A dead aggregate rebuild was retried without a new merge.",
   },
   "change.resync": {
-    // u12: advance the shared preview aggregate to an out-of-band branch tip
+    // Advance the shared preview aggregate to an out-of-band branch tip
     // without a candidate/<changeId> PR (/api/changes/resync). Same admission
     // ladder as change.integrate/rebuild (resolveShipSession). No changeId: a
     // resync pins an operator-supplied branch/sha, not one candidate.
@@ -314,7 +314,7 @@ export const ACTION_CATALOG = {
     desc: "Tenant customization/content was published to a version.",
   },
   "content.checkout_style.saved": {
-    // NEW (D10): a tenant's checkout styling was saved to a versioned test artifact
+    // NEW: a tenant's checkout styling was saved to a versioned test artifact
     // (Settings → Checkout styling → publishToTest spine). A persistent tenant
     // customization — low volume, high value → timelined. Actor cohort mirrors the
     // route's own auth (resolveOwnerSession): a merchant saving their own tenant, or
@@ -324,7 +324,7 @@ export const ACTION_CATALOG = {
     desc: "A tenant's checkout styling was saved to a version.",
   },
   "change.go_live": {
-    // D9: renamed from the orphaned, un-namespaced `go_live` (the ONE key that broke the
+    // Renamed from the orphaned, un-namespaced `go_live` (the ONE key that broke the
     // domain-prefix rule). The snake_case suffix is kept (the `deploy.version_observed`
     // precedent) — only the missing `change.` domain prefix is added. Wired into
     // /api/preview/promote (promote the current preview snapshot to live).
@@ -337,9 +337,9 @@ export const ACTION_CATALOG = {
   // Invitee identity is PII → DROPPED by allowlist; only the role/resource +
   // an opaque hashed invitee ref (rendered) survive.
   "grant.invite": {
-    // D6: the self-serve "Invite a Developer" handler admits an owner (merchant) or
+    // The self-serve "Invite a Developer" handler admits an owner (merchant) or
     // staff (admin) session, and the headless operator (agent) via the Bearer seam.
-    // D11: the SECOND invite path (grants/team-invite.ts) is session-authed by vendor
+    // The SECOND invite path (grants/team-invite.ts) is session-authed by vendor
     // MEMBERSHIP — a signed-in team member who is neither owner nor staff classifies as
     // "dev" (see uiActor.classifyActorKind), so `dev` joins the admission set.
     actors: ["admin", "merchant", "dev", "agent"], source: "ui", sinks: LIFECYCLE,
@@ -347,14 +347,14 @@ export const ACTION_CATALOG = {
     desc: "A developer/team invite was issued.",
   },
   "grant.approve": {
-    // D6: the browserless CLI sign-in approval is taken by whoever is signed in
+    // The browserless CLI sign-in approval is taken by whoever is signed in
     // (owner→merchant, staff→admin, or a signed-in developer→dev).
     actors: ["admin", "merchant", "dev"], source: "ui", sinks: LIFECYCLE,
     argsAllow: ["role", "resource"], renderedAllow: [],
     desc: "A pending access request / CLI sign-in was approved.",
   },
   "grant.revoke": {
-    // D9: the self-serve "remove a developer from my team" handler (/api/grants/revoke),
+    // The self-serve "remove a developer from my team" handler (/api/grants/revoke),
     // the inverse of grant.invite — same resolveOwnerSession seam, so the same cohort
     // (owner→merchant, staff→admin, headless operator→agent). The revoked developer's
     // identity is PII → DROPPED by the allowlist; only an opaque hashed ref survives.
@@ -372,10 +372,14 @@ export const ACTION_CATALOG = {
     argsAllow: ["changeId"], renderedAllow: ["inviteeRef"],
     desc: "A reviewer/developer was invited to a preview.",
   },
-  "preview.retire": {
-    actors: ["admin", "merchant"], source: "ui", sinks: LIFECYCLE,
-    argsAllow: ["changeId"], renderedAllow: [],
-    desc: "A preview environment was retired.",
+  "preview.evidence.retry": {
+    // An operator retried the change_report_evidence push for an already-`ready`
+    // candidate whose evidence.pushFailed was set (candidate-evidence-retry.ts) —
+    // the manual recovery for fb-1787938036559-ppmu4e when the automatic retry in
+    // reportPreviewEvidence still didn't land.
+    actors: ["admin", "merchant", "dev", "system"], source: "server", sinks: LIFECYCLE,
+    argsAllow: ["changeId", "versionId", "pushed"], renderedAllow: [],
+    desc: "An operator retried a candidate's evidence push to MCP after it failed.",
   },
   "store.connect": {
     actors: ["merchant", "admin"], source: "ui", sinks: LIFECYCLE,
@@ -429,8 +433,8 @@ export const ACTION_CATALOG = {
 
   // ── Agent cohort (source: server/cli) — later ──────────────────────────────
   // Placeholder spine so the agent cohort (a later card) has stable keys to emit
-  // against without reopening D0. Args are deliberately empty until that card
-  // defines what an agent action is allowed to record.
+  // against without reopening the action catalog. Args are deliberately empty until
+  // that card defines what an agent action is allowed to record.
   "agent.action.invoked": {
     actors: ["agent"], source: "server", sinks: HIGH_VOLUME,
     argsAllow: ["tool"], renderedAllow: [],
@@ -442,9 +446,9 @@ export const ACTION_CATALOG = {
     desc: "An automated agent action finished.",
   },
 
-  // ── D11: remaining grant/staff-ops gaps + machine/agent-driven mutations ─────
-  // Follow-on to D0–D8: wires the invite/grant paths, staff-impersonation, cache,
-  // and machine-authed (signature/idempotency/app-JWT) mutations that D6 left out.
+  // ── Remaining grant/staff-ops gaps + machine/agent-driven mutations ─────
+  // Wires the invite/grant paths, staff-impersonation, cache,
+  // and machine-authed (signature/idempotency/app-JWT) mutations the earlier catalog entries left out.
   // Grant/staff actions are low-volume lifecycle → timelined; the machine cohort's
   // high-volume streams (order-forward, attribution) are analytics-only.
   "grant.issue": {
@@ -485,7 +489,7 @@ export const ACTION_CATALOG = {
   },
   "store.connect.completed": {
     // domain/callback.ts — the CI completion callback for the www-domain job, the
-    // machine-side terminal PARTNER of D6's `store.connect`. Signature-authed, one per
+    // machine-side terminal PARTNER of `store.connect`. Signature-authed, one per
     // connect run (rare) → low-volume lifecycle terminal, timelined like reconcile.terminal.
     actors: ["system"], source: "server", sinks: LIFECYCLE,
     argsAllow: ["status", "state", "action"], renderedAllow: [],
@@ -521,7 +525,7 @@ export const ACTION_CATALOG = {
 
   // ── Meta (source: server) ──────────────────────────────────────────────────
   "system.ingest.rejected": {
-    // The ingest endpoint (D4) rejected an event (unknown action, actor
+    // The ingest endpoint rejected an event (unknown action, actor
     // mismatch, canary tripped). Self-telemetry so a leak attempt is visible.
     actors: ["system"], source: "server", sinks: HIGH_VOLUME,
     argsAllow: ["reason", "attemptedAction"], renderedAllow: [],

package/packages/public-runtime/src/activity/event.ts

@@ -1,12 +1,12 @@
 // ─────────────────────────────────────────────────────────────────────────────
-// ActivityEvent — the versioned actor×action telemetry envelope (card D0).
+// ActivityEvent — the versioned actor×action telemetry envelope.
 //
 // One event = "an ACTOR performed an ACTION, here is the OUTCOME." It is the
 // single shape every operational-activity emitter produces and every sink
 // stores, across the whole storefront platform (dev/CLI first, then merchant/
-// admin/agent). Downstream cards import this directly:
-//   D1 server recordActivity() · D2 deploy provenance · D3 CLI emitActivity
-//   D4 ingest+store · D5 query/timeline UI · D6/D7 alerts.
+// admin/agent). Downstream consumers import this directly: server
+// recordActivity() · deploy provenance · CLI emitActivity · ingest+store ·
+// the query/timeline UI · alerts.
 //
 // TWO ZONES, and the split is load-bearing:
 //   1. CORE fields (everything except `payload`) — always safe to store. They
@@ -86,9 +86,9 @@ export interface ActivityScope {
    */
   traceId?: string;
   /**
-   * BUILD PROVENANCE (card D2). The git commit SHA the running server/edge build
+   * BUILD PROVENANCE. The git commit SHA the running server/edge build
    * was cut from — stamped by the emitter onto every SERVER-sourced event so the
-   * query surface (D5) can derive **deploy skew**: is the build that produced this
+   * query surface can derive **deploy skew**: is the build that produced this
    * event == the pushed umbrella tip, or is a stale worker still serving? Core,
    * non-secret by construction (a 40-hex git sha, never PII/free-text), so it is
    * never redacted. Absent on `cli`/`ui`-sourced events and on any build with no

package/packages/public-runtime/src/activity/index.ts

@@ -1,7 +1,7 @@
 // ─────────────────────────────────────────────────────────────────────────────
 // @tot/public-runtime/activity — the operational activity telemetry contract.
 //
-// Card D0: the actor×action ActivityEvent envelope, the allowlisted action
+// The actor×action ActivityEvent envelope, the allowlisted action
 // catalog, and the default-deny redaction contract. This is the FOUNDATION the
 // downstream cards import directly — nothing here does I/O or picks a store; it
 // is pure types + pure functions so server, edge, and the CLI's JS mirror can
@@ -9,7 +9,7 @@
 // DECISIONS.md §8; the per-action routing lives on each catalog entry (sinks).
 //
 // See ./README.md for the envelope shape, catalog rules, redaction contract,
-// and the CLI-mirror keep-in-step obligation for card D3.
+// and the CLI-mirror keep-in-step obligation.
 // ─────────────────────────────────────────────────────────────────────────────
 export * from "./event.js";
 export * from "./catalog.js";

package/packages/public-runtime/src/activity/redaction.ts

@@ -1,7 +1,7 @@
 // ─────────────────────────────────────────────────────────────────────────────
-// Redaction contract for the activity payload zone (card D0).
+// Redaction contract for the activity payload zone.
 //
-// This is the surface card D8 (adversarial PII/secret-leak review) will attack,
+// This is the surface the adversarial PII/secret-leak review will attack,
 // so the posture is deliberately conservative. Three layers, in order:
 //
 //   1. DEFAULT-DENY ALLOWLIST. For a given action, ONLY the top-level payload
@@ -20,12 +20,12 @@
 //      shapes (JWTs, bearer tokens, API keys, private keys, emails, card/phone
 //      numbers) AND secret-looking KEY NAMES. A hit replaces the value with a
 //      redaction marker and is REPORTED (the fact of the hit, never the value) so
-//      D6/D7 can alert and D8 can audit. A secret-named key is dropped outright.
+//      alerting can flag it and auditing can review it. A secret-named key is dropped outright.
 //
 // The safe constructor createActivityEvent() runs all three before an event is
 // ever returned — you cannot build an event whose payload skipped redaction.
 //
-// OPEN QUESTION (owned by D1/D4): the canonical actor-id pseudonymization salt.
+// OPEN QUESTION: the canonical actor-id pseudonymization salt.
 // This module scrubs PII that leaks into the PAYLOAD, but actor.id in the CORE
 // zone is the emitter's responsibility to pseudonymize. A shared, salted,
 // non-reversible hash helper (with the salt as a Worker secret) should land with