chore(spec): regenerate api-surface, export-origins and the permission reference for the owner-binding judge

Claude-Session: https://claude.ai/code/session_01YRp5z4kK6vgYkrdH97ztsy
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/references/security/permission.mdx

@@ -117,7 +117,7 @@ const result = AdminScopeSchema.parse(data);
 | **name** | `string` | ✅ | Permission set name, unique per organization (lowercase snake_case) |
 | **label** | `string` | optional | Display label |
 | **description** | `string` | optional | Human-readable description shown in Setup |
-| **packageId** | `string` | optional | [ADR-0086 D3] Owning package id for a package-shipped set (absent = env-authored); the metadata save, restore and publish doors refuse a value that disagrees with the package the set is saved into |
+| **packageId** | `string` | optional | [ADR-0086 D3] Owning package id for a package-shipped set (absent = env-authored); a value that disagrees with the package that ships the set, or that it is saved into, is refused by the stack schema (defineStack, os validate, os build), the package registration, and the metadata save, restore and publish doors |
 | **managedBy** | `Enum<'package' \| 'platform' \| 'user'>` | optional | [ADR-0086 D3] Record provenance: package (upgrade-owned metadata) vs platform/user (env config) |
 | **isDefault** | `boolean` | optional (default: `false`) | [ADR-0090 D5] App baseline for the everyone position: app-level sets are auto-bound at boot (guarded, idempotent); package-level sets become install-time suggestions an admin confirms |
 | **objects** | `Record<string, { allowCreate?: boolean; allowRead?: boolean; allowEdit?: boolean; allowDelete?: boolean; … }>` | ✅ | Entity permissions |

packages/spec/api-surface/security.json

@@ -56,6 +56,8 @@
     "PLATFORM_CAPABILITY_NAMES (const)",
     "PUBLIC_FORM_SERVER_MANAGED_FIELDS (const)",
     "PermissionSet (type)",
+    "PermissionSetOwnerBindingDoor (type)",
+    "PermissionSetOwnerBindingRefusal (interface)",
     "PermissionSetParsed (type)",
     "PermissionSetSchema (const)",
     "PlatformCapability (interface)",
@@ -90,6 +92,7 @@
     "defineSharingRule (function)",
     "describeAnchorForbiddenBits (function)",
     "describeHighPrivilegeBits (function)",
+    "judgePermissionSetOwnerBinding (function)",
     "normalizeTenancyPosture (function)",
     "objectPermissionGrants (function)",
     "permissionForm (const)",

packages/spec/export-origins/security.json

@@ -55,6 +55,8 @@
     "PLATFORM_CAPABILITY_NAMES": "src/security/capabilities.ts#PLATFORM_CAPABILITY_NAMES (const)",
     "PUBLIC_FORM_SERVER_MANAGED_FIELDS": "src/security/public-form.ts#PUBLIC_FORM_SERVER_MANAGED_FIELDS (const)",
     "PermissionSet": "src/security/permission.zod.ts#PermissionSet (type)",
+    "PermissionSetOwnerBindingDoor": "src/security/permission-set-owner-binding.ts#PermissionSetOwnerBindingDoor (type)",
+    "PermissionSetOwnerBindingRefusal": "src/security/permission-set-owner-binding.ts#PermissionSetOwnerBindingRefusal (interface)",
     "PermissionSetParsed": "src/security/permission.zod.ts#PermissionSetParsed (type)",
     "PermissionSetSchema": "src/security/permission.zod.ts#PermissionSetSchema (const)",
     "PlatformCapability": "src/security/capabilities.ts#PlatformCapability (interface)",
@@ -85,6 +87,7 @@
     "defineSharingRule": "src/security/sharing.zod.ts#defineSharingRule (function)",
     "describeAnchorForbiddenBits": "src/security/high-privilege.ts#describeAnchorForbiddenBits (function)",
     "describeHighPrivilegeBits": "src/security/high-privilege.ts#describeHighPrivilegeBits (function)",
+    "judgePermissionSetOwnerBinding": "src/security/permission-set-owner-binding.ts#judgePermissionSetOwnerBinding (function)",
     "normalizeTenancyPosture": "src/security/tenancy-posture.ts#normalizeTenancyPosture (function)",
     "objectPermissionGrants": "src/security/permission.zod.ts#objectPermissionGrants (function)",
     "permissionForm": "src/security/permission.form.ts#permissionForm (const)",

packages/spec/src/stack-permission-set-owner-binding.test.ts

@@ -93,7 +93,11 @@ describe('[ADR-0086 D3] a release artifact\'s sets are judged against the packag
   const twoPackages = (coreKey?: string) => composeStacks([
     defineStack({ manifest: manifest(CRM), permissions: [set('crm_member', coreKey)] } as never, { strict: false }),
     defineStack({ manifest: manifest('com.acme.orders', { type: 'module' }), permissions: [set('orders_member')] } as never),
-  ], { manifest: 'preserve' }) as unknown as Record<string, unknown> & { packages: Array<{ manifest: Record<string, unknown> }> };
+  ], { manifest: 'preserve' }) as unknown as {
+    manifest: { id: string };
+    packages: Array<{ manifest: Record<string, unknown> }>;
+    [key: string]: unknown;
+  };
 
   it('a body\'s set is judged against that body\'s own id', () => {
     const artifact = twoPackages(OTHER);
@@ -106,7 +110,7 @@ describe('[ADR-0086 D3] a release artifact\'s sets are judged against the packag
 
   it('a top-level set no body declares is the residual, judged against the artifact\'s `manifest.id`', () => {
     const artifact = { ...twoPackages(), permissions: [set('stray_member', OTHER)] };
-    const owner = String((artifact.manifest as { id: string }).id);
+    const owner = artifact.manifest.id;
     expect(ownerIssues(artifact)).toEqual([['permissions.0.packageId', expect.stringContaining(`from package '${owner}'`)]]);
     // CONTROL: the residual declaring the artifact's own id.
     expect(ownerIssues({ ...twoPackages(), permissions: [set('stray_member', owner)] })).toEqual([]);
@@ -119,7 +123,7 @@ describe('[ADR-0086 D3] a release artifact\'s sets are judged against the packag
     // names the body that ships it — is no disagreement.
     const artifact = twoPackages(CRM);
     const flattened = { ...artifact, permissions: [set('crm_member', CRM), set('orders_member')] };
-    expect(String((flattened.manifest as { id: string }).id)).not.toBe(CRM);
+    expect(flattened.manifest.id).not.toBe(CRM);
     expect(ownerIssues(flattened)).toEqual([]);
   });
 });