@company-semantics/contracts 9.1.0 → 10.0.0

package/src/ralph/progress.ts

@@ -45,7 +45,7 @@ export type RalphIteration = {
 /**
  * Ralph operation mode.
  */
-export type RalphMode = 'hitl' | 'afk';
+export type RalphMode = "hitl" | "afk";
 
 /**
  * Complete progress state for a Ralph session.

package/src/rate-limit/README.md

@@ -18,8 +18,8 @@ Configuration for rate limit windows:
 
 ```typescript
 interface RateLimitConfig {
-  maxRequests: number;  // Maximum requests allowed in window
-  windowMs: number;     // Window duration in milliseconds
+  maxRequests: number; // Maximum requests allowed in window
+  windowMs: number; // Window duration in milliseconds
 }
 ```
 
@@ -29,9 +29,9 @@ Result of a rate limit check:
 
 ```typescript
 interface RateLimitResult {
-  allowed: boolean;  // true = permitted, false = rate limited
+  allowed: boolean; // true = permitted, false = rate limited
   remaining: number; // Requests remaining in current window
-  resetAt: number;   // Unix timestamp when window resets
+  resetAt: number; // Unix timestamp when window resets
 }
 ```
 

package/src/rate-limit/index.ts

@@ -5,9 +5,9 @@
  */
 
 export enum RateLimitTier {
-  FREE = 'free',
-  PRO = 'pro',
-  ENTERPRISE = 'enterprise',
+  FREE = "free",
+  PRO = "pro",
+  ENTERPRISE = "enterprise",
 }
 
 export interface RateLimitConfig {

package/src/requests.ts

@@ -1,6 +1,6 @@
-export type Tier = 'P0' | 'P1' | 'P2' | 'P3';
+export type Tier = "P0" | "P1" | "P2" | "P3";
 
-export type MutationBehavior = 'collapse' | 'queue' | 'parallel';
+export type MutationBehavior = "collapse" | "queue" | "parallel";
 
 export type SchedulerResourceKey = {
   type: string;
@@ -9,7 +9,7 @@ export type SchedulerResourceKey = {
 };
 
 export type RequestDescriptor = {
-  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+  method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
   path: string;
   params?: Record<string, unknown>;
   tier: Tier;
@@ -21,8 +21,36 @@ export type RequestDescriptor = {
 };
 
 export type SchedulerEvent =
-  | { type: 'enqueued'; id: string; descriptor: RequestDescriptor; queuedAt: number }
-  | { type: 'started'; id: string; descriptor: RequestDescriptor; startedAt: number; waitedMs: number }
-  | { type: 'settled'; id: string; descriptor: RequestDescriptor; durationMs: number; ok: boolean; status?: number }
-  | { type: 'aborted'; id: string; descriptor: RequestDescriptor; reason: 'superseded' | 'invalidated' | 'unmounted' | 'external' }
-  | { type: 'deduped'; id: string; descriptor: RequestDescriptor; sharedWith: string };
+  | {
+      type: "enqueued";
+      id: string;
+      descriptor: RequestDescriptor;
+      queuedAt: number;
+    }
+  | {
+      type: "started";
+      id: string;
+      descriptor: RequestDescriptor;
+      startedAt: number;
+      waitedMs: number;
+    }
+  | {
+      type: "settled";
+      id: string;
+      descriptor: RequestDescriptor;
+      durationMs: number;
+      ok: boolean;
+      status?: number;
+    }
+  | {
+      type: "aborted";
+      id: string;
+      descriptor: RequestDescriptor;
+      reason: "superseded" | "invalidated" | "unmounted" | "external";
+    }
+  | {
+      type: "deduped";
+      id: string;
+      descriptor: RequestDescriptor;
+      sharedWith: string;
+    };

package/src/resource-keys.ts

@@ -5,52 +5,56 @@
  */
 export type ResourceKey =
   // Collections (plural) — lists of entities
-  | { type: 'members'; orgId: string }
-  | { type: 'departments'; orgId: string }
-  | { type: 'chats'; orgId: string }
-  | { type: 'teams'; orgId: string }
-  | { type: 'integrations'; orgId: string }
-  | { type: 'invites'; orgId: string }
-  | { type: 'auditEvents'; orgId: string }
-  | { type: 'timeline'; orgId: string }
+  | { type: "members"; orgId: string }
+  | { type: "departments"; orgId: string }
+  | { type: "chats"; orgId: string }
+  | { type: "teams"; orgId: string }
+  | { type: "integrations"; orgId: string }
+  | { type: "invites"; orgId: string }
+  | { type: "auditEvents"; orgId: string }
+  | { type: "timeline"; orgId: string }
   // Identities (singular) — single entities
-  | { type: 'member'; orgId: string; memberId: string }
-  | { type: 'team'; orgId: string; teamId: string }
-  | { type: 'department'; orgId: string; departmentId: string }
-  | { type: 'chat'; orgId: string; chatId: string }
-  | { type: 'companyMdDoc'; orgId: string; slug: string }
-  | { type: 'companyMdContextBank'; orgId: string; slug: string }
-  | { type: 'workspace'; orgId: string }
-  | { type: 'workspaceDomains'; orgId: string }
-  | { type: 'authSettings'; orgId: string }
-  | { type: 'billing'; orgId: string }
-  | { type: 'aiUsage'; orgId: string }
-  | { type: 'deletionEligibility'; orgId: string }
-  | { type: 'transferOwnership'; orgId: string }
-  | { type: 'companyMdDocs'; orgId: string }
+  | { type: "member"; orgId: string; memberId: string }
+  | { type: "team"; orgId: string; teamId: string }
+  | { type: "department"; orgId: string; departmentId: string }
+  | { type: "chat"; orgId: string; chatId: string }
+  | { type: "companyMdDoc"; orgId: string; slug: string }
+  | { type: "companyMdContextBank"; orgId: string; slug: string }
+  | { type: "workspace"; orgId: string }
+  | { type: "workspaceDomains"; orgId: string }
+  | { type: "authSettings"; orgId: string }
+  | { type: "billing"; orgId: string }
+  | { type: "aiUsage"; orgId: string }
+  | { type: "deletionEligibility"; orgId: string }
+  | { type: "transferOwnership"; orgId: string }
+  | { type: "companyMdDocs"; orgId: string }
   // OrgUnit canonical model (ADR-BE-120) — Phase 2 Wave 4
-  | { type: 'orgTree'; orgId: string }
-  | { type: 'orgLevelConfig'; orgId: string }
-  | { type: 'orgUnit'; orgId: string; unitId: string }
-  | { type: 'orgUnitChildren'; orgId: string; unitId: string }
-  | { type: 'orgUnitAncestors'; orgId: string; unitId: string }
-  | { type: 'orgUnitMemberships'; orgId: string; unitId: string }
-  | { type: 'orgUnitPermissions'; orgId: string; unitId: string }
+  | { type: "orgTree"; orgId: string }
+  | { type: "orgLevelConfig"; orgId: string }
+  | { type: "orgUnit"; orgId: string; unitId: string }
+  | { type: "orgUnitChildren"; orgId: string; unitId: string }
+  | { type: "orgUnitAncestors"; orgId: string; unitId: string }
+  | { type: "orgUnitMemberships"; orgId: string; unitId: string }
+  | { type: "orgUnitPermissions"; orgId: string; unitId: string }
   // Org-unit owners list (ADR-CONTRACTS-052) — owners are an org-wide
   // projection, not a per-unit collection, so unitId is intentionally excluded.
-  | { type: 'orgUnitOwners'; orgId: string }
+  | { type: "orgUnitOwners"; orgId: string }
   // People reporting (ADR-BE-166) — drives the settings Org chart drill-down
-  | { type: 'peopleOrgChart'; orgId: string }
+  | { type: "peopleOrgChart"; orgId: string }
   // System-scoped (ADR-CONTRACTS-052) — tenant-less super-admin resources.
   // No orgId/userId: these live above any single org. scope is the literal 'system'.
-  | { type: 'internalAdminAiProviders'; scope: 'system' }
-  | { type: 'internalAdminPrompts'; scope: 'system' }
-  | { type: 'internalAdminAiRuntimeDefaults'; scope: 'system' }
+  | { type: "internalAdminAiProviders"; scope: "system" }
+  | { type: "internalAdminPrompts"; scope: "system" }
+  | { type: "internalAdminAiRuntimeDefaults"; scope: "system" }
+  // Software-factory surfaces (ADR-BE-239 / ADR-BE-243) — internal-admin
+  // dashboard reads over Global-infra factory tables; tenant-less, scope 'system'.
+  | { type: "factoryFloor"; scope: "system" }
+  | { type: "factorySnapshot"; scope: "system" }
   // User-scoped
-  | { type: 'dismissedBanners'; userId: string }
-  | { type: 'userOrgs'; userId: string }
-  | { type: 'sessions'; userId: string }
-  | { type: 'viewer'; userId: string };
+  | { type: "dismissedBanners"; userId: string }
+  | { type: "userOrgs"; userId: string }
+  | { type: "sessions"; userId: string }
+  | { type: "viewer"; userId: string };
 
 /**
  * Action — structured mutation key used across execution system, audit, permissions.
@@ -69,13 +73,34 @@ export function resolveScope(context: {
 
 /** All ResourceKey type literals for exhaustive checking. */
 const ORG_SCOPED_TYPES = [
-  'members', 'departments', 'chats', 'teams', 'integrations', 'invites',
-  'auditEvents', 'timeline', 'workspace', 'workspaceDomains', 'authSettings',
-  'billing', 'aiUsage', 'deletionEligibility', 'transferOwnership', 'companyMdDocs',
-  'orgTree', 'orgLevelConfig', 'peopleOrgChart', 'orgUnitOwners',
+  "members",
+  "departments",
+  "chats",
+  "teams",
+  "integrations",
+  "invites",
+  "auditEvents",
+  "timeline",
+  "workspace",
+  "workspaceDomains",
+  "authSettings",
+  "billing",
+  "aiUsage",
+  "deletionEligibility",
+  "transferOwnership",
+  "companyMdDocs",
+  "orgTree",
+  "orgLevelConfig",
+  "peopleOrgChart",
+  "orgUnitOwners",
 ] as const;
 
-const USER_SCOPED_TYPES = ['dismissedBanners', 'userOrgs', 'sessions', 'viewer'] as const;
+const USER_SCOPED_TYPES = [
+  "dismissedBanners",
+  "userOrgs",
+  "sessions",
+  "viewer",
+] as const;
 
 /**
  * System-scoped types (ADR-CONTRACTS-052) — tenant-less super-admin resources.
@@ -83,7 +108,11 @@ const USER_SCOPED_TYPES = ['dismissedBanners', 'userOrgs', 'sessions', 'viewer']
  * Intentionally NOT exported — internal to the parser like the other scope arrays.
  */
 const SYSTEM_SCOPED_TYPES = [
-  'internalAdminAiProviders', 'internalAdminPrompts', 'internalAdminAiRuntimeDefaults',
+  "internalAdminAiProviders",
+  "internalAdminPrompts",
+  "internalAdminAiRuntimeDefaults",
+  "factoryFloor",
+  "factorySnapshot",
 ] as const;
 
 /**
@@ -98,60 +127,62 @@ const SYSTEM_SCOPED_TYPES = [
 export function toQueryKey(key: ResourceKey): readonly string[] {
   switch (key.type) {
     // Identities with extra field
-    case 'member':
+    case "member":
       return [key.type, key.orgId, key.memberId] as const;
-    case 'team':
+    case "team":
       return [key.type, key.orgId, key.teamId] as const;
-    case 'department':
+    case "department":
       return [key.type, key.orgId, key.departmentId] as const;
-    case 'chat':
+    case "chat":
       return [key.type, key.orgId, key.chatId] as const;
-    case 'companyMdDoc':
-    case 'companyMdContextBank':
+    case "companyMdDoc":
+    case "companyMdContextBank":
       return [key.type, key.orgId, key.slug] as const;
 
     // OrgUnit identity keys (ADR-BE-120)
-    case 'orgUnit':
-    case 'orgUnitChildren':
-    case 'orgUnitAncestors':
-    case 'orgUnitMemberships':
-    case 'orgUnitPermissions':
+    case "orgUnit":
+    case "orgUnitChildren":
+    case "orgUnitAncestors":
+    case "orgUnitMemberships":
+    case "orgUnitPermissions":
       return [key.type, key.orgId, key.unitId] as const;
 
     // User-scoped
-    case 'dismissedBanners':
-    case 'userOrgs':
-    case 'sessions':
-    case 'viewer':
+    case "dismissedBanners":
+    case "userOrgs":
+    case "sessions":
+    case "viewer":
       return [key.type, key.userId] as const;
 
     // Org-scoped collections and identities
-    case 'members':
-    case 'departments':
-    case 'chats':
-    case 'teams':
-    case 'integrations':
-    case 'invites':
-    case 'auditEvents':
-    case 'timeline':
-    case 'workspace':
-    case 'workspaceDomains':
-    case 'authSettings':
-    case 'billing':
-    case 'aiUsage':
-    case 'deletionEligibility':
-    case 'transferOwnership':
-    case 'companyMdDocs':
-    case 'orgTree':
-    case 'orgLevelConfig':
-    case 'peopleOrgChart':
-    case 'orgUnitOwners':
+    case "members":
+    case "departments":
+    case "chats":
+    case "teams":
+    case "integrations":
+    case "invites":
+    case "auditEvents":
+    case "timeline":
+    case "workspace":
+    case "workspaceDomains":
+    case "authSettings":
+    case "billing":
+    case "aiUsage":
+    case "deletionEligibility":
+    case "transferOwnership":
+    case "companyMdDocs":
+    case "orgTree":
+    case "orgLevelConfig":
+    case "peopleOrgChart":
+    case "orgUnitOwners":
       return [key.type, key.orgId] as const;
 
     // System-scoped (ADR-CONTRACTS-052) — tenant-less super-admin resources
-    case 'internalAdminAiProviders':
-    case 'internalAdminPrompts':
-    case 'internalAdminAiRuntimeDefaults':
+    case "internalAdminAiProviders":
+    case "internalAdminPrompts":
+    case "internalAdminAiRuntimeDefaults":
+    case "factoryFloor":
+    case "factorySnapshot":
       return [key.type, key.scope] as const;
 
     default: {
@@ -169,34 +200,42 @@ export function fromQueryKey(queryKey: readonly string[]): ResourceKey {
   const [type, ...rest] = queryKey;
 
   if (!type || rest.length === 0) {
-    throw new Error(`Invalid query key: expected at least [type, scope], got ${JSON.stringify(queryKey)}`);
+    throw new Error(
+      `Invalid query key: expected at least [type, scope], got ${JSON.stringify(queryKey)}`,
+    );
   }
 
   // Identities with extra field
   const identityFields: Record<string, string> = {
-    member: 'memberId',
-    team: 'teamId',
-    department: 'departmentId',
-    chat: 'chatId',
-    companyMdDoc: 'slug',
-    companyMdContextBank: 'slug',
-    orgUnit: 'unitId',
-    orgUnitChildren: 'unitId',
-    orgUnitAncestors: 'unitId',
-    orgUnitMemberships: 'unitId',
-    orgUnitPermissions: 'unitId',
+    member: "memberId",
+    team: "teamId",
+    department: "departmentId",
+    chat: "chatId",
+    companyMdDoc: "slug",
+    companyMdContextBank: "slug",
+    orgUnit: "unitId",
+    orgUnitChildren: "unitId",
+    orgUnitAncestors: "unitId",
+    orgUnitMemberships: "unitId",
+    orgUnitPermissions: "unitId",
   };
 
   if (type in identityFields) {
     if (rest.length !== 2) {
-      throw new Error(`Invalid query key for '${type}': expected [type, orgId, ${identityFields[type]}], got ${JSON.stringify(queryKey)}`);
+      throw new Error(
+        `Invalid query key for '${type}': expected [type, orgId, ${identityFields[type]}], got ${JSON.stringify(queryKey)}`,
+      );
     }
-    return { type, orgId: rest[0], [identityFields[type]]: rest[1] } as ResourceKey;
+    return {
+      type,
+      orgId: rest[0],
+      [identityFields[type]]: rest[1],
+    } as ResourceKey;
   }
 
   // System-scoped types (ADR-CONTRACTS-052) — query key is [type, 'system']
   if ((SYSTEM_SCOPED_TYPES as readonly string[]).includes(type)) {
-    return { type, scope: 'system' } as ResourceKey;
+    return { type, scope: "system" } as ResourceKey;
   }
 
   // User-scoped types
@@ -212,42 +251,17 @@ export function fromQueryKey(queryKey: readonly string[]): ResourceKey {
   throw new Error(`Unknown resource type in query key: '${type}'`);
 }
 
-/**
- * Bidirectional resource relationships.
- * TanStack does NOT support prefix matching across different key shapes.
- * When invalidating a collection, we must also invalidate related identity entries (and vice versa).
- */
-export const resourceRelationships: Record<string, string[]> = {
-  members: ['member'],
-  member: ['members'],
-  departments: ['department'],
-  department: ['departments'],
-  chats: ['chat'],
-  chat: ['chats'],
-  teams: ['team'],
-  team: ['teams'],
-  companyMdDocs: ['companyMdDoc'],
-  companyMdDoc: ['companyMdDocs'],
-  // OrgUnit: reparent/create/archive invalidates the tree view of the whole org;
-  // membership mutations invalidate the unit + its memberships list.
-  orgTree: ['orgUnit', 'orgUnitChildren', 'orgUnitAncestors'],
-  orgUnit: ['orgTree'],
-  orgUnitChildren: ['orgTree'],
-  orgUnitAncestors: ['orgTree'],
-  // Subtree manage is driven by memberships (ADR-BE-151); mutating memberships
-  // invalidates both the direct roster and the effective-managers read.
-  orgUnitMemberships: ['orgUnit', 'orgUnitPermissions'],
-  orgUnitPermissions: ['orgUnitMemberships'],
-};
-
 /**
  * Strict predicate for matching resource keys.
  * Compares type + scope fields exactly. No partial matching. No loose comparisons.
  * Used by invalidateResource with TanStack's predicate-based invalidation.
  */
-export function matchesResourceKey(queryKey: readonly unknown[], targetKey: ResourceKey): boolean {
+export function matchesResourceKey(
+  queryKey: readonly unknown[],
+  targetKey: ResourceKey,
+): boolean {
   if (!Array.isArray(queryKey) && !isReadonlyArray(queryKey)) return false;
-  const stringKey = queryKey.filter((v): v is string => typeof v === 'string');
+  const stringKey = queryKey.filter((v): v is string => typeof v === "string");
   if (stringKey.length !== queryKey.length) return false;
 
   let parsed: ResourceKey;
@@ -259,15 +273,56 @@ export function matchesResourceKey(queryKey: readonly unknown[], targetKey: Reso
 
   if (parsed.type !== targetKey.type) return false;
 
-  if ('orgId' in parsed && 'orgId' in targetKey && parsed.orgId !== targetKey.orgId) return false;
-  if ('userId' in parsed && 'userId' in targetKey && parsed.userId !== targetKey.userId) return false;
-  if ('memberId' in parsed && 'memberId' in targetKey && parsed.memberId !== targetKey.memberId) return false;
-  if ('teamId' in parsed && 'teamId' in targetKey && parsed.teamId !== targetKey.teamId) return false;
-  if ('departmentId' in parsed && 'departmentId' in targetKey && parsed.departmentId !== targetKey.departmentId) return false;
-  if ('chatId' in parsed && 'chatId' in targetKey && parsed.chatId !== targetKey.chatId) return false;
-  if ('slug' in parsed && 'slug' in targetKey && parsed.slug !== targetKey.slug) return false;
-  if ('unitId' in parsed && 'unitId' in targetKey && parsed.unitId !== targetKey.unitId) return false;
-  if ('scope' in parsed && 'scope' in targetKey && parsed.scope !== targetKey.scope) return false;
+  if (
+    "orgId" in parsed &&
+    "orgId" in targetKey &&
+    parsed.orgId !== targetKey.orgId
+  )
+    return false;
+  if (
+    "userId" in parsed &&
+    "userId" in targetKey &&
+    parsed.userId !== targetKey.userId
+  )
+    return false;
+  if (
+    "memberId" in parsed &&
+    "memberId" in targetKey &&
+    parsed.memberId !== targetKey.memberId
+  )
+    return false;
+  if (
+    "teamId" in parsed &&
+    "teamId" in targetKey &&
+    parsed.teamId !== targetKey.teamId
+  )
+    return false;
+  if (
+    "departmentId" in parsed &&
+    "departmentId" in targetKey &&
+    parsed.departmentId !== targetKey.departmentId
+  )
+    return false;
+  if (
+    "chatId" in parsed &&
+    "chatId" in targetKey &&
+    parsed.chatId !== targetKey.chatId
+  )
+    return false;
+  if ("slug" in parsed && "slug" in targetKey && parsed.slug !== targetKey.slug)
+    return false;
+  if (
+    "unitId" in parsed &&
+    "unitId" in targetKey &&
+    parsed.unitId !== targetKey.unitId
+  )
+    return false;
+  if (
+    "scope" in parsed &&
+    "scope" in targetKey &&
+    parsed.scope !== targetKey.scope
+  )
+    return false;
 
   return true;
 }

package/src/resource-registry.ts

@@ -1,5 +1,5 @@
-import { z } from 'zod';
-import type { Tier } from './requests';
+import { z } from "zod";
+import type { Tier } from "./requests";
 
 declare const ResourceKeyBrand: unique symbol;
 declare const SectionKeyBrand: unique symbol;
@@ -9,15 +9,15 @@ export type ResourceKey = string & { readonly [ResourceKeyBrand]: true };
 export type SectionKey = string & { readonly [SectionKeyBrand]: true };
 export type Duration = number & { readonly [DurationBrand]: true };
 
-const TIERS = ['P0', 'P1', 'P2', 'P3'] as const satisfies readonly Tier[];
+const TIERS = ["P0", "P1", "P2", "P3"] as const satisfies readonly Tier[];
 
 export const ResourceEntrySchema = z
   .object({
     resource: z.string().transform((s) => s as ResourceKey),
     priority: z.enum(TIERS),
-    hydrationPhase: z.enum(['critical', 'interactive', 'background']),
+    hydrationPhase: z.enum(["critical", "interactive", "background"]),
     hydrationDepends: z.array(z.string().transform((s) => s as ResourceKey)),
-    mutationBehavior: z.enum(['collapse', 'queue', 'serial']),
+    mutationBehavior: z.enum(["collapse", "queue", "serial"]),
     staleTimeMs: z
       .number()
       .int()

package/src/route-builder.ts

@@ -11,10 +11,10 @@
  * backend call site to the appropriate FastifyRequest/FastifyReply
  * signature.
  */
-import type { Tier } from './requests';
-import type { ResourceKey } from './resource-keys';
+import type { Tier } from "./requests";
+import type { ResourceKey } from "./resource-keys";
 
-export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 
 export type RouteDefinition<Handler = unknown> = {
   readonly tier: Tier;

package/src/safe-mode.ts

@@ -19,14 +19,14 @@
  * Canonical response header signalling safe-mode state to clients.
  * Frontend imports this to avoid stringly-typed header lookups.
  */
-export const SYSTEM_SAFE_MODE_HEADER = 'X-System-Safe-Mode';
+export const SYSTEM_SAFE_MODE_HEADER = "X-System-Safe-Mode";
 
 /**
  * Values carried on the `X-System-Safe-Mode` header.
  * `on` indicates the backend has entered safe-mode and is rejecting all
  * non-P0 traffic with 503. `off` is the normal quiescent state.
  */
-export type SafeModeValue = 'on' | 'off';
+export type SafeModeValue = "on" | "off";
 
 /**
  * Observable safe-mode state. Shared verbatim between backend (source of

package/src/security/index.ts

@@ -1,5 +1,5 @@
-export type { Secret } from './secret';
-export { wrapSecret, unwrapSecret } from './secret';
+export type { Secret } from "./secret";
+export { wrapSecret, unwrapSecret } from "./secret";
 
 export {
   UsageClassSchema,
@@ -9,7 +9,7 @@ export {
   CreateSecretRequestSchema,
   RotateSecretRequestSchema,
   DisableSecretRequestSchema,
-} from './org-secrets';
+} from "./org-secrets";
 export type {
   UsageClass,
   OrgSecretsAction,
@@ -18,4 +18,4 @@ export type {
   CreateSecretRequest,
   RotateSecretRequest,
   DisableSecretRequest,
-} from './org-secrets';
+} from "./org-secrets";

package/src/security/org-secrets.ts

@@ -12,13 +12,17 @@
  * Server is expected to wrap incoming `plaintext` in `Secret<T>` (see
  * `./secret.ts`) before storage / encryption.
  */
-import { z } from 'zod';
+import { z } from "zod";
 
 /**
  * Usage class of an org secret. Drives which resolver layer is allowed to read
  * the value (AI provider keys, webhook signing secrets, generic credentials).
  */
-export const UsageClassSchema = z.enum(['AI_PROVIDER', 'WEBHOOK_SIGNING', 'GENERIC']);
+export const UsageClassSchema = z.enum([
+  "AI_PROVIDER",
+  "WEBHOOK_SIGNING",
+  "GENERIC",
+]);
 export type UsageClass = z.infer<typeof UsageClassSchema>;
 
 /**
@@ -27,13 +31,13 @@ export type UsageClass = z.infer<typeof UsageClassSchema>;
  * signals (`access_denied`, `explicit_export`, `unusual_access`).
  */
 export const OrgSecretsActionSchema = z.enum([
-  'created',
-  'rotated',
-  'disabled',
-  'enabled',
-  'access_denied',
-  'explicit_export',
-  'unusual_access',
+  "created",
+  "rotated",
+  "disabled",
+  "enabled",
+  "access_denied",
+  "explicit_export",
+  "unusual_access",
 ]);
 export type OrgSecretsAction = z.infer<typeof OrgSecretsActionSchema>;