@farthershore/product 0.4.0 → 0.6.0

package/dist/bin.js

@@ -679,7 +679,7 @@ var environmentOverrideBlockSchema = z8.object({
 var environmentsBlockSchema = z8.record(z8.string().min(1).max(64), environmentOverrideBlockSchema);
 
 // ../contracts/dist/plans/spec/product.js
-import { z as z13 } from "zod";
+import { z as z18 } from "zod";
 
 // ../contracts/dist/plans/spec/frontend-layer.js
 import { z as z9 } from "zod";
@@ -924,46 +924,406 @@ var subscriptionAddOnSchema = z12.object({
   stripeSubscriptionItemId: z12.string().optional()
 });
 
-// ../contracts/dist/plans/spec/refinements.js
-function rejectUsagePricing(spec, ctx) {
-  if (spec.usagePricing === void 0)
-    return;
-  ctx.addIssue({
-    code: "custom",
-    path: ["usagePricing"],
-    message: "usagePricing is not supported. Define usage.meters.<key>.rating instead."
-  });
+// ../contracts/dist/plans/spec/backend-layer.js
+import { z as z13 } from "zod";
+var BACKEND_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
+var backendIdSchema = z13.string().min(1).max(64).regex(BACKEND_ID_PATTERN, "backend id must be a lowercase slug ([a-z0-9][a-z0-9_-]*)");
+var backendTransportModeSchema = z13.enum([
+  "public_origin",
+  "mtls",
+  "cloudflare_tunnel"
+]);
+var backendTransportRunnerSchema = z13.enum([
+  "managed_cloudflared",
+  "sidecar"
+]);
+var backendTransportSchema = z13.object({
+  mode: backendTransportModeSchema.default("public_origin"),
+  runner: backendTransportRunnerSchema.optional()
+}).strict();
+var backendVerificationSchema = z13.object({
+  required: z13.boolean().default(false)
+}).strict();
+var backendDefinitionSchema = z13.object({
+  /** Human-friendly label. Defaults to the id when omitted. */
+  name: z13.string().min(1).max(120).optional(),
+  /** Stable slug for the backend (origin-hostname / token scoping). Defaults
+   *  to the id when omitted. */
+  slug: backendIdSchema.optional(),
+  transport: backendTransportSchema.default({ mode: "public_origin" }),
+  verification: backendVerificationSchema.default({ required: false }),
+  /** Meter allow-list. Omitted = all product meters allowed. */
+  meters: z13.array(z13.string().min(1).max(64)).max(100).optional(),
+  /** Marks the default backend when a product declares more than one. At
+   *  most one backend may set this (compiler enforces / AMBIGUOUS_DEFAULT). */
+  default: z13.boolean().optional(),
+  /** Reachable origin for `public_origin` / `mtls`. */
+  originUrl: z13.string().url().optional(),
+  /** Access-protected `*.fs-origin` host for `cloudflare_tunnel`. */
+  originHostname: z13.string().min(1).max(255).optional()
+}).strict();
+var productBackendBlockSchema = z13.record(backendIdSchema, backendDefinitionSchema);
+var routeBackendBindingSchema = backendIdSchema;
+var BACKEND_DIAGNOSTIC_CODES = {
+  unknownBackendInRoute: "UNKNOWN_BACKEND_IN_ROUTE",
+  ambiguousDefaultBackend: "AMBIGUOUS_DEFAULT_BACKEND",
+  routeMeterNotAllowedByBackend: "ROUTE_METER_NOT_ALLOWED_BY_BACKEND",
+  unknownMeterInBackend: "UNKNOWN_METER_IN_BACKEND"
+};
+function resolveDefaultBackendId(backends) {
+  const ids = Object.keys(backends ?? {});
+  if (ids.length === 0)
+    return { defaultId: null, ambiguous: false };
+  if (ids.length === 1)
+    return { defaultId: ids[0], ambiguous: false };
+  const explicit = ids.filter((id) => backends[id]?.default === true);
+  if (explicit.length === 1) {
+    return { defaultId: explicit[0], ambiguous: false };
+  }
+  return { defaultId: null, ambiguous: true };
 }
-function validateFreePlans(plans, ctx) {
-  const freePlans = plans.filter((plan) => plan.free);
-  if (freePlans.length > 1) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["plans"],
-      message: "Only one free plan is allowed per product"
-    });
-  }
-  plans.forEach((plan, index) => {
-    if (!plan.free)
-      return;
-    validateFreePlanPrice(plan, index, ctx);
-    validateFreePlanHardLimit(plan, index, ctx);
-  });
+
+// ../contracts/dist/plans/spec/routes-layer.js
+import { z as z17 } from "zod";
+
+// ../contracts/dist/plans/spec/policies-layer.js
+import { z as z15 } from "zod";
+
+// ../contracts/dist/plans/spec/policy-types.js
+import { z as z14 } from "zod";
+var rateLimitWindowSchema = z14.string().min(2).max(20).regex(/^\d+(ms|s|m|h)$/, "rate_limit window must look like `60s`, `5m`, `1h`");
+var rateLimitConfigSchema = z14.object({
+  strategy: z14.enum(["token_bucket", "sliding_window", "fixed_window"]).default("token_bucket"),
+  /**
+   * Which request dimensions identify the bucket. v0.3.0 supports a
+   * fixed set; extending requires a coordinated gateway/policy-engine
+   * change. The `subscription` dimension is the steady-state default;
+   * `ip` is for unauthenticated probes; `credential` is finer-grained
+   * than subscription (per-key throttling).
+   */
+  dimensions: z14.array(z14.enum(["subscription", "credential", "ip", "route"])).min(1).max(4).default(["subscription"]),
+  limits: z14.array(z14.object({
+    window: rateLimitWindowSchema,
+    max: z14.number().int().positive().max(1e7)
+  })).min(1).max(10),
+  /**
+   * Bounded fail-open behaviour for DO outages. See architecture RFC
+   * "Fail-open guardrails" section. When the policy executor observes
+   * `max_consecutive_failures` DO-call failures within
+   * `max_window_seconds`, it transitions to `degraded_mode` until
+   * `recovery_threshold` consecutive successes restore normal
+   * evaluation.
+   */
+  fail_open: z14.object({
+    max_consecutive_failures: z14.number().int().positive().default(100),
+    max_window_seconds: z14.number().int().positive().default(60),
+    recovery_threshold: z14.number().int().positive().default(50),
+    degraded_mode: z14.enum([
+      "safe_mode_block",
+      "safe_mode_throttle",
+      "runtime_killswitch_trigger"
+    ]).default("safe_mode_throttle")
+  }).default({
+    max_consecutive_failures: 100,
+    max_window_seconds: 60,
+    recovery_threshold: 50,
+    degraded_mode: "safe_mode_throttle"
+  })
+});
+var authConfigSchema = z14.object({
+  header_name: z14.string().min(1).max(100).default("x-api-key"),
+  /**
+   * How the gateway constructs the upstream Authorization header:
+   *   - `none`          → no upstream auth header added
+   *   - `static_bearer` → forward a configured static token
+   *   - `subscriber_jwt` → mint a per-subscriber JWT (out of scope v0.3.0)
+   */
+  upstream_token_source: z14.discriminatedUnion("type", [
+    z14.object({ type: z14.literal("none") }),
+    z14.object({
+      type: z14.literal("static_bearer"),
+      token_secret_ref: z14.string().min(1).max(200).describe("Reference into the secret store (e.g. CF Secret name); not the raw token")
+    })
+  ]).default({ type: "none" }),
+  /**
+   * When `true`, treat the inbound credential's scopes (if any) as
+   * additional gating beyond the entitlement check. v0.3.0 ships with
+   * `strict` as the default.
+   */
+  scope_mode: z14.enum(["strict", "advisory", "off"]).default("strict")
+});
+var concurrencyConfigSchema = z14.object({
+  max_in_flight: z14.number().int().positive().max(1e4),
+  /**
+   * Which dimensions key the lease bucket. Matches the existing
+   * ConcurrencyLease DO `idFromName` pattern (subscription | capability
+   * tuple).
+   */
+  dimensions: z14.array(z14.enum(["subscription", "credential", "capability"])).min(1).max(3).default(["subscription"]),
+  /**
+   * Optional capability scope. When set, the lease bucket is keyed
+   * partly by this capability name — separate buckets per capability.
+   */
+  capability: z14.string().min(1).max(120).optional(),
+  /**
+   * Lease TTL — releases automatically after this many seconds even if
+   * the request never returns (defensive default 30s, mirrors existing
+   * ConcurrencyLease behaviour).
+   */
+  lease_ttl_seconds: z14.number().int().positive().max(600).default(30),
+  fail_open: z14.object({
+    max_consecutive_failures: z14.number().int().positive().default(50),
+    max_window_seconds: z14.number().int().positive().default(60),
+    recovery_threshold: z14.number().int().positive().default(20),
+    degraded_mode: z14.enum([
+      "safe_mode_block",
+      "safe_mode_throttle",
+      "runtime_killswitch_trigger"
+    ]).default("safe_mode_throttle")
+  }).default({
+    max_consecutive_failures: 50,
+    max_window_seconds: 60,
+    recovery_threshold: 20,
+    degraded_mode: "safe_mode_throttle"
+  })
+});
+var retryConfigSchema = z14.object({
+  max_attempts: z14.number().int().min(1).max(5).default(2),
+  /**
+   * HTTP status codes that trigger a retry. 5xx is the default; opt
+   * into 429 retries only when the upstream understands `Retry-After`.
+   */
+  retry_on_status: z14.array(z14.number().int().min(400).max(599)).min(1).max(20).default([502, 503, 504]),
+  /**
+   * Backoff curve. Total wall-clock attempt time is bounded so the
+   * gateway worker cannot block past `total_budget_ms`.
+   */
+  backoff: z14.object({
+    initial_ms: z14.number().int().positive().max(5e3).default(100),
+    multiplier: z14.number().positive().max(10).default(2),
+    jitter: z14.enum(["none", "full", "equal"]).default("equal"),
+    total_budget_ms: z14.number().int().positive().max(3e4).default(5e3)
+  }).default({
+    initial_ms: 100,
+    multiplier: 2,
+    jitter: "equal",
+    total_budget_ms: 5e3
+  })
+});
+var transformConfigSchema = z14.object({
+  /**
+   * When the transform applies. `request` runs before upstream forward;
+   * `response` runs after. Most transforms are one or the other; both
+   * is rare.
+   */
+  applies_to: z14.enum(["request", "response", "both"]).default("request"),
+  /**
+   * List of key rewrites. Source path uses dot notation (`a.b.c`);
+   * `target` may include the same syntax to move keys around. Drops
+   * are expressed as `target: null`.
+   */
+  rewrites: z14.array(z14.object({
+    source: z14.string().min(1).max(200),
+    target: z14.string().min(1).max(200).nullable()
+  })).min(1).max(20)
+});
+var policyBodySchema = z14.discriminatedUnion("type", [
+  z14.object({ type: z14.literal("rate_limit"), config: rateLimitConfigSchema }),
+  z14.object({ type: z14.literal("auth"), config: authConfigSchema }),
+  z14.object({ type: z14.literal("concurrency"), config: concurrencyConfigSchema }),
+  z14.object({ type: z14.literal("retry"), config: retryConfigSchema }),
+  z14.object({ type: z14.literal("transform"), config: transformConfigSchema })
+]);
+
+// ../contracts/dist/plans/spec/policies-layer.js
+var cacheProfileSchema = z15.enum(["long", "short", "blocking"]).default("long");
+var policyCompatibilitySchema = z15.object({
+  route_types: z15.array(z15.enum(["http"])).max(5).optional(),
+  meters: z15.array(z15.string().min(1).max(64)).max(20).optional(),
+  auth_modes: z15.array(z15.enum(["api_key", "oauth2", "anonymous"])).max(5).optional()
+});
+var policyLayerSchema = z15.intersection(z15.object({
+  /**
+   * Policy name. Referenced by routes via `policies: [<name>]`. Must
+   * be unique across the product; the compiler enforces this in the
+   * cross-layer validation pass.
+   */
+  name: z15.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Policy name must be lowercase alphanumeric with hyphens/underscores"),
+  description: z15.string().max(500).optional(),
+  compatible_with: policyCompatibilitySchema.default({}),
+  /**
+   * Mutation class — runtime vs contractual. Policies are operational
+   * by nature so the default is `runtime`. Marking a policy as
+   * `contractual` signals that changes to it require human approval
+   * (invariant #16).
+   */
+  mutation_class: z15.enum(["runtime", "contractual"]).default("runtime"),
+  cacheProfile: cacheProfileSchema
+}), policyBodySchema);
+
+// ../contracts/dist/framework/actions/index.js
+import { z as z16 } from "zod";
+var actionKindSchema = z16.enum(["query", "mutation"]);
+var actionAuditPolicySchema = z16.enum(["none", "metadata", "full"]);
+var actionSubjectBindingSchema = z16.object({
+  type: z16.string().min(1).max(64).regex(/^[a-zA-Z0-9_.:-]+$/),
+  from: z16.enum(["header", "path_param"]),
+  name: z16.string().min(1).max(120)
+});
+var actionResourceEffectSchema = z16.object({
+  resource: z16.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/),
+  effect: z16.enum(["create", "delete"])
+});
+var actionSpecSchema = z16.object({
+  id: z16.string().min(1).max(160).regex(/^[a-z0-9_.:-]+$/),
+  title: z16.string().min(1).max(160).optional(),
+  kind: actionKindSchema,
+  actorType: z16.string().min(1).max(64).regex(/^[a-zA-Z0-9_.:-]+$/).optional(),
+  subject: actionSubjectBindingSchema.optional(),
+  inputSchemaRef: z16.string().min(1).max(240).optional(),
+  audit: actionAuditPolicySchema.default("metadata"),
+  resource: actionResourceEffectSchema.optional()
+});
+
+// ../contracts/dist/plans/spec/routes-layer.js
+var routeMatchSchema = z17.object({
+  method: z17.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"]).default("*"),
+  path: z17.string().min(1).max(500).regex(/^\/[a-zA-Z0-9_/:.{}*-]*$/, "path must start with / and contain only [a-zA-Z0-9_/:.{}*-]")
+});
+function statusPolicyPartIsValid(part) {
+  const trimmed = part.trim();
+  if (!trimmed)
+    return false;
+  const [startRaw, endRaw, extra] = trimmed.split("-");
+  if (extra !== void 0 || !/^\d{3}$/.test(startRaw ?? ""))
+    return false;
+  const start = Number(startRaw);
+  const end = endRaw === void 0 ? start : Number(endRaw);
+  if (endRaw !== void 0 && !/^\d{3}$/.test(endRaw))
+    return false;
+  return start >= 100 && start <= 599 && end >= 100 && end <= 599 && start <= end;
 }
-function validateFreePlanPrice(plan, index, ctx) {
-  const monthly = planMonthlyPrice(plan);
-  if ((monthly ?? 0) === 0)
-    return;
-  ctx.addIssue({
-    code: "custom",
-    path: ["plans", index, "recurring_fee_cents"],
-    message: "Free plans must have zero price"
-  });
+function isRouteStatusCodePolicyString(value) {
+  return value.split(",").every(statusPolicyPartIsValid);
 }
-function validateFreePlanHardLimit(plan, index, ctx) {
-  const hasHardLimit = plan.limits.some((limit) => !limit.enforcement || limit.enforcement === "enforce");
-  if (hasHardLimit)
-    return;
+var routeStatusCodePolicySchema = z17.union([
+  z17.string().min(1).max(100).refine(isRouteStatusCodePolicyString, {
+    message: "onStatusCodes must be comma-separated HTTP status codes or numeric ranges, e.g. 200-299,304"
+  }),
+  z17.array(z17.number().int().min(100).max(599)).min(1).max(100)
+]);
+var routeDefinitionSchema = z17.object({
+  match: routeMatchSchema,
+  metering: z17.object({
+    defaults: z17.record(z17.string().min(1).max(64), z17.number().finite().nonnegative()).optional(),
+    reports: z17.array(z17.string().min(1).max(64)).max(20).optional(),
+    estimates: z17.record(z17.string().min(1).max(64), z17.number().finite().nonnegative()).optional(),
+    onStatusCodes: routeStatusCodePolicySchema.optional()
+  }).optional(),
+  unmetered: z17.boolean().optional(),
+  inheritDefaultMeters: z17.boolean().optional(),
+  /** Optional explicit action id. When absent, the compiler derives an
+   *  implicit action from feature + method + path. */
+  action: z17.string().min(1).max(160).regex(/^[a-z0-9_.:-]+$/).optional(),
+  /** BYO-Backend V1 — optional route→backend binding. Omitted = the sole /
+   *  default backend (single-backend products stay zero-config). The schema
+   *  is `.strict()`, so this key MUST be declared here or `parse` throws on
+   *  it (anti-`.strict()`). */
+  backend: routeBackendBindingSchema.optional()
+}).strict();
+var routeUpstreamSchema = z17.object({
+  override_origin: z17.string().url("override_origin must be a valid URL").nullable().default(null)
+});
+var routeRuntimeSchema = z17.object({
+  rollout_key: z17.string().min(1).max(120).regex(/^[a-z0-9_-]+$/, "rollout_key must be lowercase alphanumeric with hyphens/underscores").optional(),
+  /**
+   * Optional runtime flags this feature depends on. The runtime
+   * evaluator AND's the feature's enablement across all referenced
+   * flags. If any flag is disabled, the route returns the configured
+   * fallback (404 by default — see /runtime failure matrix).
+   */
+  required_flags: z17.array(z17.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(10).optional()
+});
+var routeLayerSchema = z17.object({
+  /**
+   * Feature key — the entitlement unit. Surfaced in dashboards,
+   * subscriptions, and the gateway's matched-route trace.
+   */
+  feature: z17.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/, "feature key must be lowercase alphanumeric with [_.:-]"),
+  description: z17.string().max(500).optional(),
+  /**
+   * Route additions are contractual by default — they expose new API
+   * surface to subscribers. Internal/non-customer-visible routes can
+   * mark themselves `runtime` to allow autonomous agent flips
+   * (invariant #16; see RFC approval matrix).
+   */
+  mutation_class: z17.enum(["runtime", "contractual"]).default("contractual"),
+  cacheProfile: cacheProfileSchema,
+  routes: z17.array(routeDefinitionSchema).min(1).max(50),
+  upstream: routeUpstreamSchema.default({ override_origin: null }),
+  /**
+   * Ordered list of policy names to apply. Executed sequentially by
+   * the gateway policy engine; first-deny wins. Referenced policies
+   * MUST declare compatible `compatible_with` envelopes for this
+   * feature's route/meter shape — the compiler enforces.
+   */
+  policies: z17.array(z17.string().min(1).max(64).regex(/^[a-z0-9_-]+$/)).max(20).default([]),
+  runtime: routeRuntimeSchema.default({}),
+  /**
+   * Plans that grant this feature directly. Shared feature bundles are
+   * expressed in capability layers via `includes_features`; route layers do
+   * not declare capability membership.
+   */
+  plans: z17.array(z17.string().min(1).max(64)).max(20).default([]),
+  /** Explicit actions declared by this feature. Routes reference them by
+   *  `route.action`; routes without a binding receive implicit actions. */
+  actions: z17.array(actionSpecSchema).max(100).optional(),
+  /** BYO-Backend V1 — feature-level default backend binding. Routes in this
+   *  layer with no explicit `route.backend` inherit this; routes may still
+   *  override per-route. Omitted = the product's sole / default backend. */
+  backend: routeBackendBindingSchema.optional()
+}).strict();
+
+// ../contracts/dist/plans/spec/refinements.js
+function rejectUsagePricing(spec, ctx) {
+  if (spec.usagePricing === void 0)
+    return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["usagePricing"],
+    message: "usagePricing is not supported. Define usage.meters.<key>.rating instead."
+  });
+}
+function validateFreePlans(plans, ctx) {
+  const freePlans = plans.filter((plan) => plan.free);
+  if (freePlans.length > 1) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["plans"],
+      message: "Only one free plan is allowed per product"
+    });
+  }
+  plans.forEach((plan, index) => {
+    if (!plan.free)
+      return;
+    validateFreePlanPrice(plan, index, ctx);
+    validateFreePlanHardLimit(plan, index, ctx);
+  });
+}
+function validateFreePlanPrice(plan, index, ctx) {
+  const monthly = planMonthlyPrice(plan);
+  if ((monthly ?? 0) === 0)
+    return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["plans", index, "recurring_fee_cents"],
+    message: "Free plans must have zero price"
+  });
+}
+function validateFreePlanHardLimit(plan, index, ctx) {
+  const hasHardLimit = plan.limits.some((limit) => !limit.enforcement || limit.enforcement === "enforce");
+  if (hasHardLimit)
+    return;
   ctx.addIssue({
     code: "custom",
     path: ["plans", index, "limits"],
@@ -1166,6 +1526,68 @@ function validateLimitMeterReachability(spec, ctx) {
     });
   });
 }
+function validateBackendReferences(spec, ctx) {
+  const backends = spec.backend;
+  if (!backends || Object.keys(backends).length === 0)
+    return;
+  const backendIds = new Set(Object.keys(backends));
+  const productMeterKeys = new Set((spec.metering?.meters ?? []).map((m) => m.key).filter((k) => typeof k === "string" && k.length > 0));
+  for (const [backendId, backend] of Object.entries(backends)) {
+    (backend.meters ?? []).forEach((meter, meterIdx) => {
+      if (productMeterKeys.has(meter))
+        return;
+      ctx.addIssue({
+        code: "custom",
+        path: ["backend", backendId, "meters", meterIdx],
+        message: `${BACKEND_DIAGNOSTIC_CODES.unknownMeterInBackend}: backend "${backendId}" allows meter "${meter}" but no metering.meters[] entry declares it.`
+      });
+    });
+  }
+  const { defaultId, ambiguous } = resolveDefaultBackendId(backends);
+  let anyRouteOmitsBinding = false;
+  for (const feature of Object.values(spec.features ?? {})) {
+    for (const route of feature.routes ?? []) {
+      if (route.backend === void 0)
+        anyRouteOmitsBinding = true;
+    }
+  }
+  if (ambiguous && anyRouteOmitsBinding) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["backend"],
+      message: `${BACKEND_DIAGNOSTIC_CODES.ambiguousDefaultBackend}: product declares ${backendIds.size} backends but no single default \u2014 mark exactly one backend \`default: true\` or bind every route explicitly.`
+    });
+  }
+  for (const [featureKey, feature] of Object.entries(spec.features ?? {})) {
+    (feature.routes ?? []).forEach((route, routeIdx) => {
+      const boundId = route.backend ?? defaultId;
+      if (route.backend !== void 0 && !backendIds.has(route.backend)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["features", featureKey, "routes", routeIdx, "backend"],
+          message: `${BACKEND_DIAGNOSTIC_CODES.unknownBackendInRoute}: route binds backend "${route.backend}" which is not declared in the product \`backend\` block.`
+        });
+        return;
+      }
+      if (!boundId)
+        return;
+      const backend = backends[boundId];
+      const allow = backend?.meters;
+      if (!allow)
+        return;
+      const allowed = new Set(allow);
+      for (const meter of routeMeterKeys(route)) {
+        if (allowed.has(meter))
+          continue;
+        ctx.addIssue({
+          code: "custom",
+          path: ["features", featureKey, "routes", routeIdx, "metering"],
+          message: `${BACKEND_DIAGNOSTIC_CODES.routeMeterNotAllowedByBackend}: route meters "${meter}" but backend "${boundId}" does not allow it (backend.meters[] = [${allow.join(", ")}]).`
+        });
+      }
+    });
+  }
+}
 function planMonthlyPrice(plan) {
   return plan.recurring_fee_cents;
 }
@@ -1175,18 +1597,18 @@ function planPriceKey(plan, monthly) {
 }
 
 // ../contracts/dist/plans/spec/product.js
-var productIdentitySchema = z13.object({
-  subdomain: z13.string().min(1).max(63).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Subdomain must be lowercase alphanumeric with optional hyphens")
+var productIdentitySchema = z18.object({
+  subdomain: z18.string().min(1).max(63).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Subdomain must be lowercase alphanumeric with optional hyphens")
 });
-var meterEnforcementTypeSchema = z13.enum([
+var meterEnforcementTypeSchema = z18.enum([
   "exact_pre_request",
   "estimated_then_settled",
   "postpaid",
   "strict_concurrency"
 ]);
-var meterDefinitionSchema = z13.object({
-  key: z13.string().min(1).max(64).regex(/^[a-z0-9_]+$/, "Meter key must be lowercase alphanumeric with underscores"),
-  display: z13.string().min(1).max(100),
+var meterDefinitionSchema = z18.object({
+  key: z18.string().min(1).max(64).regex(/^[a-z0-9_]+$/, "Meter key must be lowercase alphanumeric with underscores"),
+  display: z18.string().min(1).max(100),
   // v0.42.0 — `type: "built-in" | "custom"` removed. The runtime never
   // read it (gateway estimators key on meter NAME, Stripe meter
   // creation keys on meter KEY); it was schema documentation. Wizard
@@ -1194,11 +1616,11 @@ var meterDefinitionSchema = z13.object({
   // ai_usage → `dollars`); Custom template lets builders define keys
   // freely. Old specs with `type: ...` parse cleanly because Zod
   // strips unknown fields by default.
-  unit: z13.string().max(20).optional(),
+  unit: z18.string().max(20).optional(),
   /** Reusable pre-request estimate for routes that dynamically report this meter. */
-  estimate: z13.number().finite().nonnegative().optional(),
+  estimate: z18.number().finite().nonnegative().optional(),
   /** Fixed per-request default applied by Product SDK helpers. */
-  routeDefault: z13.number().finite().nonnegative().optional(),
+  routeDefault: z18.number().finite().nonnegative().optional(),
   /**
    * Runtime enforcement semantics for this meter. This is compiled into
    * signed gateway artifacts so the edge chooses reservation, settlement,
@@ -1223,7 +1645,7 @@ var meterDefinitionSchema = z13.object({
    * current `window`. Defaults to `COUNT` (one event = one unit) so
    * existing meters that didn't declare aggregation continue to work.
    */
-  aggregation: z13.enum(["SUM", "COUNT", "MAX", "UNIQUE_COUNT", "LATEST"]).default("COUNT"),
+  aggregation: z18.enum(["SUM", "COUNT", "MAX", "UNIQUE_COUNT", "LATEST"]).default("COUNT"),
   /**
    * Aggregation window. `billing_period` (the default) makes the
    * meter accumulate across the subscription's billing period.
@@ -1231,91 +1653,88 @@ var meterDefinitionSchema = z13.object({
    * rate-limit-shaped meters where the period boundary is a fixed
    * wall-clock interval, not the subscription anniversary.
    */
-  window: z13.enum(["minute", "hour", "day", "month", "billing_period"]).default("billing_period"),
+  window: z18.enum(["minute", "hour", "day", "month", "billing_period"]).default("billing_period"),
   /**
    * Property on the event payload to read for `SUM` and `MAX`
    * aggregations. Optional at the schema level; core's `validate.ts`
    * (Phase 1b) enforces "required when aggregation is SUM or MAX".
    */
-  valueProperty: z13.string().optional(),
+  valueProperty: z18.string().optional(),
   /**
    * Property on the event payload to dedupe on for `UNIQUE_COUNT`
    * aggregation. Optional at the schema level; core's validate-pass
    * enforces "required when aggregation is UNIQUE_COUNT".
    */
-  uniqueProperty: z13.string().optional(),
+  uniqueProperty: z18.string().optional(),
   /**
    * Optional grouping dimensions. When set, the aggregation is per
    * unique combination of these properties' values, not a single
    * scalar. Used for per-region or per-model breakdowns.
    */
-  groupBy: z13.array(z13.string()).optional(),
+  groupBy: z18.array(z18.string()).optional(),
   /**
    * Lago-side event code for ingress correlation. Matches Lago's
    * BillableMetric `code` so events sent to Lago land on the right
    * meter without a per-meter translation table.
    */
-  eventCode: z13.string().optional()
+  eventCode: z18.string().optional()
 });
-var usageMeasureSchema = z13.string().min(1).max(64).regex(/^[a-z0-9_]+$/, "Usage measure must be lowercase alphanumeric with underscores");
-var usageRatingPricePolicySchema = z13.enum([
+var usageMeasureSchema = z18.string().min(1).max(64).regex(/^[a-z0-9_]+$/, "Usage measure must be lowercase alphanumeric with underscores");
+var usageRatingPricePolicySchema = z18.enum([
   "pass_through",
   "markup",
   "fixed_margin",
   "customer_rate"
 ]);
-var fixedRatingSchema = z13.object({
-  source: z13.literal("fixed"),
-  rates: z13.record(z13.string().min(1), z13.record(usageMeasureSchema, z13.number().int().nonnegative()))
+var fixedRatingSchema = z18.object({
+  source: z18.literal("fixed"),
+  rates: z18.record(z18.string().min(1), z18.record(usageMeasureSchema, z18.number().int().nonnegative()))
 });
-var providerCatalogRatingSchema = z13.object({
-  source: z13.literal("provider_catalog"),
-  catalog: z13.string().min(1).max(100),
+var providerCatalogRatingSchema = z18.object({
+  source: z18.literal("provider_catalog"),
+  catalog: z18.string().min(1).max(100),
   pricePolicy: usageRatingPricePolicySchema.default("pass_through"),
-  markupPercent: z13.number().nonnegative().max(1e4).optional(),
-  marginMicros: z13.number().int().nonnegative().optional()
+  markupPercent: z18.number().nonnegative().max(1e4).optional(),
+  marginMicros: z18.number().int().nonnegative().optional()
 });
-var upstreamReportedRatingSchema = z13.object({
-  source: z13.literal("upstream_reported"),
-  amountField: z13.string().min(1).max(500),
-  currencyField: z13.string().min(1).max(500).optional()
+var upstreamReportedRatingSchema = z18.object({
+  source: z18.literal("upstream_reported"),
+  amountField: z18.string().min(1).max(500),
+  currencyField: z18.string().min(1).max(500).optional()
 });
-var externalRateApiRatingSchema = z13.object({
-  source: z13.literal("external_rate_api"),
-  resolver: z13.string().min(1).max(100),
-  configRef: z13.string().min(1).max(200).optional()
+var externalRateApiRatingSchema = z18.object({
+  source: z18.literal("external_rate_api"),
+  resolver: z18.string().min(1).max(100),
+  configRef: z18.string().min(1).max(200).optional()
 });
-var customRatingSchema = z13.object({
-  source: z13.literal("custom"),
-  resolver: z13.string().min(1).max(100),
-  configRef: z13.string().min(1).max(200).optional()
+var customRatingSchema = z18.object({
+  source: z18.literal("custom"),
+  resolver: z18.string().min(1).max(100),
+  configRef: z18.string().min(1).max(200).optional()
 });
-var usageRatingSchema = z13.discriminatedUnion("source", [
+var usageRatingSchema = z18.discriminatedUnion("source", [
   fixedRatingSchema,
   providerCatalogRatingSchema,
   upstreamReportedRatingSchema,
   externalRateApiRatingSchema,
   customRatingSchema
 ]);
-var usageMeterSchema = z13.object({
-  selector: z13.string().min(1).max(100).optional(),
-  measures: z13.array(usageMeasureSchema).min(1).max(20),
+var usageMeterSchema = z18.object({
+  selector: z18.string().min(1).max(100).optional(),
+  measures: z18.array(usageMeasureSchema).min(1).max(20),
   rating: usageRatingSchema.optional()
 });
-var usageBlockSchema = z13.object({
-  meters: z13.record(z13.string().min(1).max(64).regex(/^[a-z0-9_]+$/), usageMeterSchema)
+var usageBlockSchema = z18.object({
+  meters: z18.record(z18.string().min(1).max(64).regex(/^[a-z0-9_]+$/), usageMeterSchema)
 });
-var routeMeteringSchema = z13.object({
-  defaults: z13.record(z13.string().min(1).max(64), z13.number().finite().nonnegative()).optional(),
-  reports: z13.array(z13.string().min(1).max(64)).max(20).optional(),
-  estimates: z13.record(z13.string().min(1).max(64), z13.number().finite().nonnegative()).optional(),
-  onStatusCodes: z13.union([
-    z13.string().min(1).max(100),
-    z13.array(z13.number().int().min(100).max(599)).min(1).max(100)
-  ]).optional()
+var routeMeteringSchema = z18.object({
+  defaults: z18.record(z18.string().min(1).max(64), z18.number().finite().nonnegative()).optional(),
+  reports: z18.array(z18.string().min(1).max(64)).max(20).optional(),
+  estimates: z18.record(z18.string().min(1).max(64), z18.number().finite().nonnegative()).optional(),
+  onStatusCodes: routeStatusCodePolicySchema.optional()
 });
-var featureRouteSchema = z13.object({
-  method: z13.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"]).default("*"),
+var featureRouteSchema = z18.object({
+  method: z18.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"]).default("*"),
   // Path is the route under the product's baseUrl. OpenAPI parameter
   // syntax is supported and translated by the compiler:
   //   /users/:id   → /users/*
@@ -1323,44 +1742,48 @@ var featureRouteSchema = z13.object({
   // Path-globs `*` (one segment) and `**` (any subpath) are passed
   // through. The compiler rejects ambiguous compound segments like
   // `/foo/:a-:b` — parameter names must occupy whole segments.
-  path: z13.string().min(1).max(500).regex(/^\/[a-zA-Z0-9_/:.{}*-]*$/, "path must start with / and contain only [a-zA-Z0-9_/:.{}*-]"),
+  path: z18.string().min(1).max(500).regex(/^\/[a-zA-Z0-9_/:.{}*-]*$/, "path must start with / and contain only [a-zA-Z0-9_/:.{}*-]"),
   // Explicit no-usage route. Dynamic/static route metering is declared
   // exclusively under `metering`.
-  unmetered: z13.boolean().optional(),
+  unmetered: z18.boolean().optional(),
   metering: routeMeteringSchema.optional(),
-  inheritDefaultMeters: z13.boolean().optional()
+  inheritDefaultMeters: z18.boolean().optional(),
+  // BYO-Backend V1 — route→backend binding. The compiler materializes
+  // per-feature route layers into this strict route shape, so the key MUST be
+  // declared here or `parse` throws on it (anti-`.strict()`).
+  backend: routeBackendBindingSchema.optional()
 }).strict();
-var featureCatalogEntrySchema = z13.object({
+var featureCatalogEntrySchema = z18.object({
   // Optional human-friendly summary; surfaced in dashboards / settings UI.
-  description: z13.string().max(500).optional(),
-  routes: z13.array(featureRouteSchema).min(1).max(50),
+  description: z18.string().max(500).optional(),
+  routes: z18.array(featureRouteSchema).min(1).max(50),
   // Plans that grant this feature. Feature-first canonical mapping —
   // builders declare "which plans get this feature" on the feature
   // itself rather than enumerating features per plan. Required and
   // non-empty: a feature with no plans grants nothing and is a likely
   // typo. Cross-reference validation (every key resolves to an
   // existing plan) lives in `validateFeatureReferences` below.
-  plans: z13.array(z13.string().min(1)).min(1).max(20)
+  plans: z18.array(z18.string().min(1)).min(1).max(20)
 });
-var featureCatalogSchema = z13.record(z13.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/), featureCatalogEntrySchema);
-var productCleanupPolicyModeSchema = z13.enum([
+var featureCatalogSchema = z18.record(z18.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/), featureCatalogEntrySchema);
+var productCleanupPolicyModeSchema = z18.enum([
   "report",
   "pull_request"
 ]);
-var productChangeApprovalRiskSchema = z13.enum([
+var productChangeApprovalRiskSchema = z18.enum([
   "safe",
   "non_blocking",
   "economic_risk",
   "blocking"
 ]);
-var productOperatorPoliciesSchema = z13.object({
+var productOperatorPoliciesSchema = z18.object({
   /**
    * Route cleanup operator. Disabled by default; report-mode is the safe
    * default so a product can surface zero-traffic runtime-route candidates
    * before it opts into draft PR mutation.
    */
-  cleanup: z13.object({
-    enabled: z13.boolean().default(false),
+  cleanup: z18.object({
+    enabled: z18.boolean().default(false),
     mode: productCleanupPolicyModeSchema.default("report")
   }).default({ enabled: false, mode: "report" }),
   /**
@@ -1368,9 +1791,9 @@ var productOperatorPoliciesSchema = z13.object({
    * the policy a first-class product-as-code field even while enforcement is
    * still report/label-only.
    */
-  change_approval: z13.object({
-    auto_merge_max_risk: z13.enum(["none", "safe", "non_blocking"]).default("none"),
-    require_human_for: z13.array(productChangeApprovalRiskSchema).default(["economic_risk", "blocking"])
+  change_approval: z18.object({
+    auto_merge_max_risk: z18.enum(["none", "safe", "non_blocking"]).default("none"),
+    require_human_for: z18.array(productChangeApprovalRiskSchema).default(["economic_risk", "blocking"])
   }).default({
     auto_merge_max_risk: "none",
     require_human_for: ["economic_risk", "blocking"]
@@ -1382,15 +1805,15 @@ var productOperatorPoliciesSchema = z13.object({
     require_human_for: ["economic_risk", "blocking"]
   }
 });
-var customerIdentityRequirementSchema = z13.enum([
+var customerIdentityRequirementSchema = z18.enum([
   "org_only",
   "org_and_user"
 ]);
-var customerPortalAuthStrategySchema = z13.enum([
+var customerPortalAuthStrategySchema = z18.enum([
   "clerk",
   "test-personas"
 ]);
-var productCustomerContextSchema = z13.object({
+var productCustomerContextSchema = z18.object({
   /**
    * Edge credential identity policy. This is intentionally Product-scoped:
    * B7 keeps Product as the product boundary and avoids customer-side
@@ -1402,19 +1825,19 @@ var productCustomerContextSchema = z13.object({
    * runtime signing secret in product/product.config.ts. Core generates/preserves the
    * secret when this is true and clears it when explicitly false.
    */
-  context_tokens: z13.object({
-    enabled: z13.boolean().default(true)
+  context_tokens: z18.object({
+    enabled: z18.boolean().default(true)
   }).optional(),
   /**
    * Portal auth strategy for environment-scoped product applies. Production
    * portal auth is provisioner-owned; preview/test environments can opt into
    * test personas through Product-as-Code.
    */
-  portal_auth: z13.object({
+  portal_auth: z18.object({
     strategy: customerPortalAuthStrategySchema
   }).optional()
 });
-var productSurfaceTypeSchema = z13.enum([
+var productSurfaceTypeSchema = z18.enum([
   "frontend",
   "api",
   "docs",
@@ -1424,87 +1847,99 @@ var productSurfaceTypeSchema = z13.enum([
   "worker",
   "agent"
 ]);
-var productSurfaceSchema = z13.object({
-  key: z13.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Surface key must be lowercase alphanumeric with hyphens/underscores"),
+var productSurfaceSchema = z18.object({
+  key: z18.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Surface key must be lowercase alphanumeric with hyphens/underscores"),
   type: productSurfaceTypeSchema,
-  display: z13.string().min(1).max(100).optional(),
-  description: z13.string().max(500).optional()
-});
-var productEntitlementSchema = z13.object({
-  key: z13.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Entitlement key must be lowercase alphanumeric with hyphens/underscores"),
-  description: z13.string().max(500).optional(),
-  capabilities: z13.array(z13.string().min(1).max(100)).max(100).optional(),
-  featureGates: z13.record(z13.string().min(1), z13.boolean()).optional(),
-  limits: z13.array(planLimitRuleSchema).max(100).optional(),
-  meters: z13.array(z13.string().min(1).max(64)).max(100).optional()
-});
-var productSurfacesSchema = z13.array(productSurfaceSchema).max(20).default([]);
-var productEntitlementsSchema = z13.array(productEntitlementSchema).max(100).default([]);
-var productWorkflowKindSchema = z13.enum([
+  display: z18.string().min(1).max(100).optional(),
+  description: z18.string().max(500).optional()
+});
+var productEntitlementSchema = z18.object({
+  key: z18.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Entitlement key must be lowercase alphanumeric with hyphens/underscores"),
+  description: z18.string().max(500).optional(),
+  capabilities: z18.array(z18.string().min(1).max(100)).max(100).optional(),
+  featureGates: z18.record(z18.string().min(1), z18.boolean()).optional(),
+  limits: z18.array(planLimitRuleSchema).max(100).optional(),
+  meters: z18.array(z18.string().min(1).max(64)).max(100).optional()
+});
+var productSurfacesSchema = z18.array(productSurfaceSchema).max(20).default([]);
+var productEntitlementsSchema = z18.array(productEntitlementSchema).max(100).default([]);
+var productWorkflowKindSchema = z18.enum([
   "async_job",
   "agent_task",
   "scheduled",
   "lifecycle",
   "background"
 ]);
-var productWorkflowTriggerSchema = z13.discriminatedUnion("type", [
-  z13.object({ type: z13.literal("manual") }),
-  z13.object({
-    type: z13.literal("schedule"),
-    cron: z13.string().min(1).max(120)
+var productWorkflowTriggerSchema = z18.discriminatedUnion("type", [
+  z18.object({ type: z18.literal("manual") }),
+  z18.object({
+    type: z18.literal("schedule"),
+    cron: z18.string().min(1).max(120)
   }),
-  z13.object({
-    type: z13.literal("event"),
-    event: z13.string().min(1).max(120)
+  z18.object({
+    type: z18.literal("event"),
+    event: z18.string().min(1).max(120)
   }),
-  z13.object({
-    type: z13.literal("api"),
-    path: z13.string().min(1).max(240).regex(/^\//, "path must start with /")
+  z18.object({
+    type: z18.literal("api"),
+    path: z18.string().min(1).max(240).regex(/^\//, "path must start with /")
   }),
-  z13.object({
-    type: z13.literal("lifecycle"),
-    event: z13.string().min(1).max(120)
+  z18.object({
+    type: z18.literal("lifecycle"),
+    event: z18.string().min(1).max(120)
   })
 ]);
-var productWorkflowSchema = z13.object({
-  key: z13.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Workflow key must be lowercase alphanumeric with hyphens/underscores"),
-  title: z13.string().min(1).max(120).optional(),
-  description: z13.string().max(1e3).optional(),
+var productWorkflowSchema = z18.object({
+  key: z18.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Workflow key must be lowercase alphanumeric with hyphens/underscores"),
+  title: z18.string().min(1).max(120).optional(),
+  description: z18.string().max(1e3).optional(),
   kind: productWorkflowKindSchema,
   trigger: productWorkflowTriggerSchema,
-  capabilities: z13.array(z13.string().min(1).max(100)).max(100).optional(),
-  meters: z13.array(z13.string().min(1).max(64)).max(100).optional(),
-  estimates: z13.record(z13.string().min(1).max(64), z13.number().finite()).optional(),
-  metadata: z13.record(z13.string().min(1), z13.unknown()).optional()
-});
-var productWorkflowsSchema = z13.array(productWorkflowSchema).max(100).default([]);
-var productSpecSchema = z13.object({
-  product: z13.object({
-    name: z13.string().min(1).max(100),
-    displayName: z13.string().max(200).optional(),
-    description: z13.string().max(2e3).optional(),
-    baseUrl: z13.string().url("baseUrl must be a valid URL"),
-    sandboxBaseUrl: z13.string().url("sandboxBaseUrl must be a valid URL").optional(),
-    visibility: z13.enum(["public", "private"]).default("public"),
+  capabilities: z18.array(z18.string().min(1).max(100)).max(100).optional(),
+  meters: z18.array(z18.string().min(1).max(64)).max(100).optional(),
+  estimates: z18.record(z18.string().min(1).max(64), z18.number().finite()).optional(),
+  metadata: z18.record(z18.string().min(1), z18.unknown()).optional()
+});
+var productWorkflowsSchema = z18.array(productWorkflowSchema).max(100).default([]);
+var productSpecSchema = z18.object({
+  product: z18.object({
+    name: z18.string().min(1).max(100),
+    displayName: z18.string().max(200).optional(),
+    description: z18.string().max(2e3).optional(),
+    baseUrl: z18.string().url("baseUrl must be a valid URL"),
+    sandboxBaseUrl: z18.string().url("sandboxBaseUrl must be a valid URL").optional(),
+    visibility: z18.enum(["public", "private"]).default("public"),
     // Branding
-    logoUrl: z13.string().url().optional(),
-    primaryColor: z13.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+    logoUrl: z18.string().url().optional(),
+    primaryColor: z18.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
     // Environment
-    envBranchPrefix: z13.string().max(50).nullable().optional()
+    envBranchPrefix: z18.string().max(50).nullable().optional()
   }),
-  gateway: z13.object({
-    authHeader: z13.string().min(1).max(100).default("x-api-key"),
-    upstreamAuth: z13.object({
-      type: z13.enum(["none", "static_bearer"]),
-      token: z13.string().optional()
+  gateway: z18.object({
+    authHeader: z18.string().min(1).max(100).default("x-api-key"),
+    upstreamAuth: z18.object({
+      type: z18.enum(["none", "static_bearer"]),
+      token: z18.string().optional()
     }).default({ type: "none" })
   }),
-  metering: z13.object({
-    meters: z13.array(meterDefinitionSchema).max(10).default([]),
-    billOn4xx: z13.boolean().default(false)
+  metering: z18.object({
+    meters: z18.array(meterDefinitionSchema).max(10).default([]),
+    billOn4xx: z18.boolean().default(false)
   }).default({ meters: [], billOn4xx: false }),
+  /**
+   * BYO-Backend V1 — first-class backend declarations, keyed by backend id.
+   * A product may declare MULTIPLE backends; routes bind to one (a default
+   * applies when a product has exactly one backend OR exactly one is marked
+   * `default: true`). Single-backend products stay zero-config.
+   *
+   * OPTIONAL and emits NO key when absent — a product with no `backend`
+   * block hashes byte-identically to the pre-BYOB world. Cross-reference
+   * validation (route→backend resolution, route-meter ∈ backend `meters[]`,
+   * unambiguous default) lives in `validateBackendReferences`.
+   */
+  backend: productBackendBlockSchema.optional(),
   usage: usageBlockSchema.optional(),
-  usagePricing: z13.never({
+  usagePricing: z18.never({
     error: "usagePricing is not supported. Define usage.meters.<key>.rating instead."
   }).optional(),
   features: featureCatalogSchema.optional(),
@@ -1528,12 +1963,12 @@ var productSpecSchema = z13.object({
   // `max_monthly_spend_cents`). The product-level `billing` block
   // retains the transition-policy fields (`gracePeriodDays`,
   // `subscriberChangePolicy`); the strategy enum is gone.
-  billing: z13.object({
-    gracePeriodDays: z13.number().int().nonnegative().default(3),
+  billing: z18.object({
+    gracePeriodDays: z18.number().int().nonnegative().default(3),
     // When true (default), a plan limit INCREASE re-projects onto active
     // subscribers immediately; a DECREASE always defers to period end.
     // Read by advanceActiveSubscribersToLatestCompiledPlans.
-    applyLimitUpgradesInstantly: z13.boolean().optional(),
+    applyLimitUpgradesInstantly: z18.boolean().optional(),
     subscriberChangePolicy: subscriberChangePolicySchema.default({
       default: "preserve_current_period",
       proration: "none",
@@ -1571,7 +2006,7 @@ var productSpecSchema = z13.object({
       allowImmediateEntitlementReduction: false
     }
   }),
-  plans: z13.array(planSpecSchema).max(4).default([]),
+  plans: z18.array(planSpecSchema).max(4).default([]),
   /**
    * Add-on catalog (v0.56+). Composable economic + entitlement
    * overlays that subscribers can pile on top of their base plan.
@@ -1614,16 +2049,16 @@ var productSpecSchema = z13.object({
    *       require_deprecation_window_days: 90
    *       require_successor_route: true
    */
-  lifecycle: z13.object({
-    breaking_changes: z13.object({
+  lifecycle: z18.object({
+    breaking_changes: z18.object({
       /** Minimum days a route must have been marked for removal
        *  (in main-branch YAML) before the publish gate will let
        *  it actually be removed. Set to 0 to disable. */
-      require_deprecation_window_days: z13.number().int().nonnegative().default(0),
+      require_deprecation_window_days: z18.number().int().nonnegative().default(0),
       /** When true, a route removal must declare a successor
        *  route via the lifecycle metadata (mechanics in core
        *  3b-2) before the publish gate accepts it. */
-      require_successor_route: z13.boolean().default(false)
+      require_successor_route: z18.boolean().default(false)
     }).default({
       require_deprecation_window_days: 0,
       require_successor_route: false
@@ -1669,8 +2104,8 @@ var productSpecSchema = z13.object({
    * (preserves today's behaviour). Compiler validation pins the
    * value to a real `plans[].key`.
    */
-  ephemeral: z13.object({
-    defaultPlan: z13.string().min(1).optional()
+  ephemeral: z18.object({
+    defaultPlan: z18.string().min(1).optional()
   }).optional()
 }).superRefine((spec, ctx) => {
   rejectUsagePricing(spec, ctx);
@@ -1680,811 +2115,1046 @@ var productSpecSchema = z13.object({
   validateFeatureReferences(spec, ctx);
   validateRouteMeters(spec, ctx);
   validateLimitMeterReachability(spec, ctx);
+  validateBackendReferences(spec, ctx);
 });
-var productPhaseSchema = z13.object({
+var productPhaseSchema = z18.object({
   product: productSpecSchema.shape.product
 });
-var gatewayPhaseSchema = z13.object({
+var gatewayPhaseSchema = z18.object({
   gateway: productSpecSchema.shape.gateway
 });
-var meteringPhaseSchema = z13.object({
+var meteringPhaseSchema = z18.object({
   metering: productSpecSchema.shape.metering
 });
-var plansPhaseSchema = z13.object({
+var plansPhaseSchema = z18.object({
   plans: productSpecSchema.shape.plans
 });
 
-// ../contracts/dist/plans/spec/policy-types.js
-import { z as z14 } from "zod";
-var rateLimitWindowSchema = z14.string().min(2).max(20).regex(/^\d+(ms|s|m|h)$/, "rate_limit window must look like `60s`, `5m`, `1h`");
-var rateLimitConfigSchema = z14.object({
-  strategy: z14.enum(["token_bucket", "sliding_window", "fixed_window"]).default("token_bucket"),
-  /**
-   * Which request dimensions identify the bucket. v0.3.0 supports a
-   * fixed set; extending requires a coordinated gateway/policy-engine
-   * change. The `subscription` dimension is the steady-state default;
-   * `ip` is for unauthenticated probes; `credential` is finer-grained
-   * than subscription (per-key throttling).
-   */
-  dimensions: z14.array(z14.enum(["subscription", "credential", "ip", "route"])).min(1).max(4).default(["subscription"]),
-  limits: z14.array(z14.object({
-    window: rateLimitWindowSchema,
-    max: z14.number().int().positive().max(1e7)
-  })).min(1).max(10),
-  /**
-   * Bounded fail-open behaviour for DO outages. See architecture RFC
-   * "Fail-open guardrails" section. When the policy executor observes
-   * `max_consecutive_failures` DO-call failures within
-   * `max_window_seconds`, it transitions to `degraded_mode` until
-   * `recovery_threshold` consecutive successes restore normal
-   * evaluation.
-   */
-  fail_open: z14.object({
-    max_consecutive_failures: z14.number().int().positive().default(100),
-    max_window_seconds: z14.number().int().positive().default(60),
-    recovery_threshold: z14.number().int().positive().default(50),
-    degraded_mode: z14.enum([
-      "safe_mode_block",
-      "safe_mode_throttle",
-      "runtime_killswitch_trigger"
-    ]).default("safe_mode_throttle")
-  }).default({
-    max_consecutive_failures: 100,
-    max_window_seconds: 60,
-    recovery_threshold: 50,
-    degraded_mode: "safe_mode_throttle"
-  })
-});
-var authConfigSchema = z14.object({
-  header_name: z14.string().min(1).max(100).default("x-api-key"),
-  /**
-   * How the gateway constructs the upstream Authorization header:
-   *   - `none`          → no upstream auth header added
-   *   - `static_bearer` → forward a configured static token
-   *   - `subscriber_jwt` → mint a per-subscriber JWT (out of scope v0.3.0)
-   */
-  upstream_token_source: z14.discriminatedUnion("type", [
-    z14.object({ type: z14.literal("none") }),
-    z14.object({
-      type: z14.literal("static_bearer"),
-      token_secret_ref: z14.string().min(1).max(200).describe("Reference into the secret store (e.g. CF Secret name); not the raw token")
-    })
-  ]).default({ type: "none" }),
-  /**
-   * When `true`, treat the inbound credential's scopes (if any) as
-   * additional gating beyond the entitlement check. v0.3.0 ships with
-   * `strict` as the default.
-   */
-  scope_mode: z14.enum(["strict", "advisory", "off"]).default("strict")
-});
-var concurrencyConfigSchema = z14.object({
-  max_in_flight: z14.number().int().positive().max(1e4),
-  /**
-   * Which dimensions key the lease bucket. Matches the existing
-   * ConcurrencyLease DO `idFromName` pattern (subscription | capability
-   * tuple).
-   */
-  dimensions: z14.array(z14.enum(["subscription", "credential", "capability"])).min(1).max(3).default(["subscription"]),
-  /**
-   * Optional capability scope. When set, the lease bucket is keyed
-   * partly by this capability name — separate buckets per capability.
-   */
-  capability: z14.string().min(1).max(120).optional(),
+// ../contracts/dist/plans/spec/capabilities-layer.js
+import { z as z19 } from "zod";
+var capabilityLayerSchema = z19.object({
+  capability: z19.string().min(1).max(120).regex(/^[a-z0-9_-]+$/, "capability name must be lowercase alphanumeric with hyphens/underscores"),
+  description: z19.string().max(500).optional(),
   /**
-   * Lease TTL — releases automatically after this many seconds even if
-   * the request never returns (defensive default 30s, mirrors existing
-   * ConcurrencyLease behaviour).
+   * Capability composition is contractual by default — including a new
+   * feature changes the customer's effective entitlement. Mark
+   * `runtime` only for capabilities that compose runtime-only knobs
+   * (e.g. an internal "monitoring" capability that gates dashboard
+   * pages without affecting billable behaviour).
    */
-  lease_ttl_seconds: z14.number().int().positive().max(600).default(30),
-  fail_open: z14.object({
-    max_consecutive_failures: z14.number().int().positive().default(50),
-    max_window_seconds: z14.number().int().positive().default(60),
-    recovery_threshold: z14.number().int().positive().default(20),
-    degraded_mode: z14.enum([
-      "safe_mode_block",
-      "safe_mode_throttle",
-      "runtime_killswitch_trigger"
-    ]).default("safe_mode_throttle")
-  }).default({
-    max_consecutive_failures: 50,
-    max_window_seconds: 60,
-    recovery_threshold: 20,
-    degraded_mode: "safe_mode_throttle"
-  })
+  mutation_class: z19.enum(["runtime", "contractual"]).default("contractual"),
+  includes_features: z19.array(z19.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/)).max(20).default([]),
+  includes_policies: z19.array(z19.string().min(1).max(64).regex(/^[a-z0-9_-]+$/)).max(20).default([]),
+  includes_capabilities: z19.array(z19.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(20).default([])
 });
-var retryConfigSchema = z14.object({
-  max_attempts: z14.number().int().min(1).max(5).default(2),
-  /**
-   * HTTP status codes that trigger a retry. 5xx is the default; opt
-   * into 429 retries only when the upstream understands `Retry-After`.
-   */
-  retry_on_status: z14.array(z14.number().int().min(400).max(599)).min(1).max(20).default([502, 503, 504]),
-  /**
-   * Backoff curve. Total wall-clock attempt time is bounded so the
-   * gateway worker cannot block past `total_budget_ms`.
-   */
-  backoff: z14.object({
-    initial_ms: z14.number().int().positive().max(5e3).default(100),
-    multiplier: z14.number().positive().max(10).default(2),
-    jitter: z14.enum(["none", "full", "equal"]).default("equal"),
-    total_budget_ms: z14.number().int().positive().max(3e4).default(5e3)
-  }).default({
-    initial_ms: 100,
-    multiplier: 2,
-    jitter: "equal",
-    total_budget_ms: 5e3
-  })
+
+// ../contracts/dist/plans/spec/manifest-ir.js
+import { createHash } from "node:crypto";
+import { z as z20 } from "zod";
+var MANIFEST_IR_VERSION = 1;
+var manifestIrSchema = z20.object({
+  irVersion: z20.literal(MANIFEST_IR_VERSION),
+  /** Version of @farthershore/product that emitted this envelope. */
+  sdkVersion: z20.string().min(1).max(64),
+  /** Legacy unified ProductSpec — the live `CompileProductOptions.sourceSpec`. */
+  product: productSpecSchema,
+  /** One entry per feature, sorted by `feature`. */
+  routes: z20.array(routeLayerSchema).max(200).default([]),
+  /** Sorted by `name`. */
+  policies: z20.array(policyLayerSchema).max(200).default([]),
+  /** Sorted by `capability`. */
+  capabilities: z20.array(capabilityLayerSchema).max(200).default([])
+}).strict();
+function canonicalManifestJson(value) {
+  return stableJson(JSON.parse(JSON.stringify(value)));
+}
+function hashManifestIr(ir) {
+  return createHash("sha256").update(canonicalManifestJson(ir)).digest("hex");
+}
+function stableJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, val]) => `${JSON.stringify(key)}:${stableJson(val)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// ../contracts/dist/plans/presets.js
+var FREE = {
+  kind: "free",
+  label: "Free",
+  description: "No recurring fee and no metered usage. Pure freemium tier.",
+  pricing: {
+    meters: [],
+    recurring_fee_cents: 0,
+    billing_interval: "month",
+    grants: [],
+    trial_days: 0
+  }
+};
+var STARTER = {
+  kind: "starter",
+  label: "Starter \u2014 $20/mo + $20 included",
+  description: "$20/month subscription with $20 of usage credit each period. Stripe-style minimum-spend; overage billed at $0.001/request by default.",
+  pricing: {
+    meters: [
+      { dimension: "requests", kind: "linear", price_per_unit_micros: 1e3 }
+    ],
+    recurring_fee_cents: 2e3,
+    billing_interval: "month",
+    grants: [{ kind: "recurring", amount_cents: 2e3 }],
+    trial_days: 0
+  }
+};
+var PRO = {
+  kind: "pro",
+  label: "Pro \u2014 $100/mo + $200 included",
+  description: "$100/month subscription with $200 of usage credit each period and a 14-day trial. Overage billed at $0.0005/request by default.",
+  pricing: {
+    meters: [
+      { dimension: "requests", kind: "linear", price_per_unit_micros: 500 }
+    ],
+    recurring_fee_cents: 1e4,
+    billing_interval: "month",
+    grants: [{ kind: "recurring", amount_cents: 2e4 }],
+    trial_days: 14
+  }
+};
+var PREPAID = {
+  kind: "prepaid",
+  label: "Prepaid \u2014 $50 sign-up credit, then PAYG",
+  description: "$50 one-time credit at signup. Once depleted the subscriber pays-as-they-go at $0.001/request by default.",
+  pricing: {
+    meters: [
+      { dimension: "requests", kind: "linear", price_per_unit_micros: 1e3 }
+    ],
+    recurring_fee_cents: 0,
+    billing_interval: "month",
+    grants: [{ kind: "one_time", amount_cents: 5e3 }],
+    trial_days: 0
+  }
+};
+var METERED = {
+  kind: "metered",
+  label: "Metered (pay-as-you-go)",
+  description: "No subscription fee. Pure usage billing at $0.001/request by default.",
+  pricing: {
+    meters: [
+      { dimension: "requests", kind: "linear", price_per_unit_micros: 1e3 }
+    ],
+    recurring_fee_cents: 0,
+    billing_interval: "month",
+    grants: [],
+    trial_days: 0
+  }
+};
+var PLAN_PRESETS = Object.freeze({
+  free: FREE,
+  starter: STARTER,
+  pro: PRO,
+  prepaid: PREPAID,
+  metered: METERED
 });
-var transformConfigSchema = z14.object({
-  /**
-   * When the transform applies. `request` runs before upstream forward;
-   * `response` runs after. Most transforms are one or the other; both
-   * is rare.
-   */
-  applies_to: z14.enum(["request", "response", "both"]).default("request"),
+
+// ../contracts/dist/plans/subscription-pricing-override.js
+import { z as z21 } from "zod";
+var subscriptionPricingOverrideSchema = z21.object({
+  /** Override the plan's recurring fee for this subscriber. */
+  recurring_fee_cents: z21.number().int().nonnegative().optional(),
   /**
-   * List of key rewrites. Source path uses dot notation (`a.b.c`);
-   * `target` may include the same syntax to move keys around. Drops
-   * are expressed as `target: null`.
+   * Override the plan's credit grants. `grants[]` is the single credit
+   * surface — when present, it fully replaces the plan's grants for this
+   * subscriber (recurring + one-time credit are canonical entries here;
+   * the legacy recurring/one-time scalar knobs were removed).
    */
-  rewrites: z14.array(z14.object({
-    source: z14.string().min(1).max(200),
-    target: z14.string().min(1).max(200).nullable()
-  })).min(1).max(20)
+  grants: z21.array(grantSchema).max(40).optional(),
+  /** Override the minimum-spend floor. */
+  min_monthly_spend_cents: z21.number().int().nonnegative().optional(),
+  /** Override the maximum-spend ceiling. */
+  max_monthly_spend_cents: z21.number().int().nonnegative().optional(),
+  /** Replace the entire meter list for this subscriber. When set, the
+   *  full plan meter array is replaced (not merged) — call it explicit
+   *  rather than implicit so a deal can also REMOVE billable meters,
+   *  not just adjust rates. */
+  meters: z21.array(meterSchema).optional(),
+  /** Free-text notes about the deal. Surfaced in admin UI for audit. */
+  notes: z21.string().max(2e3).optional()
 });
-var policyBodySchema = z14.discriminatedUnion("type", [
-  z14.object({ type: z14.literal("rate_limit"), config: rateLimitConfigSchema }),
-  z14.object({ type: z14.literal("auth"), config: authConfigSchema }),
-  z14.object({ type: z14.literal("concurrency"), config: concurrencyConfigSchema }),
-  z14.object({ type: z14.literal("retry"), config: retryConfigSchema }),
-  z14.object({ type: z14.literal("transform"), config: transformConfigSchema })
-]);
 
-// ../contracts/dist/plans/spec/policies-layer.js
-import { z as z15 } from "zod";
-var cacheProfileSchema = z15.enum(["long", "short", "blocking"]).default("long");
-var policyCompatibilitySchema = z15.object({
-  route_types: z15.array(z15.enum(["http"])).max(5).optional(),
-  meters: z15.array(z15.string().min(1).max(64)).max(20).optional(),
-  auth_modes: z15.array(z15.enum(["api_key", "oauth2", "anonymous"])).max(5).optional()
-});
-var policyFileSchema = z15.intersection(z15.object({
-  /**
-   * Policy name. Referenced by routes via `policies: [<name>]`. Must
-   * be unique across the product; the compiler enforces this in the
-   * cross-file validation pass.
-   */
-  name: z15.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Policy name must be lowercase alphanumeric with hyphens/underscores"),
-  description: z15.string().max(500).optional(),
-  compatible_with: policyCompatibilitySchema.default({}),
-  /**
-   * Mutation class — runtime vs contractual. Policies are operational
-   * by nature so the default is `runtime`. Marking a policy as
-   * `contractual` signals that changes to it require human approval
-   * (invariant #16).
-   */
-  mutation_class: z15.enum(["runtime", "contractual"]).default("runtime"),
-  cacheProfile: cacheProfileSchema
-}), policyBodySchema);
+// src/validate.ts
+function validateManifestIr(candidate) {
+  const parsed = manifestIrSchema.safeParse(candidate);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      issues: parsed.error.issues.map((issue) => ({
+        code: issue.code.toUpperCase(),
+        path: issue.path.map(String).join("."),
+        message: issue.message
+      }))
+    };
+  }
+  const ir = JSON.parse(
+    JSON.stringify(candidate)
+  );
+  return { ok: true, ir, irHash: hashIr(ir) };
+}
+function hashIr(ir) {
+  return hashManifestIr(ir);
+}
 
-// ../contracts/dist/plans/spec/routes-layer.js
-import { z as z17 } from "zod";
+// src/version.ts
+var SDK_VERSION = true ? "0.6.0" : "0.0.0-dev";
 
-// ../contracts/dist/framework/actions/index.js
-import { z as z16 } from "zod";
-var actionKindSchema = z16.enum(["query", "mutation"]);
-var actionAuditPolicySchema = z16.enum(["none", "metadata", "full"]);
-var actionSubjectBindingSchema = z16.object({
-  type: z16.string().min(1).max(64).regex(/^[a-zA-Z0-9_.:-]+$/),
-  from: z16.enum(["header", "path_param"]),
-  name: z16.string().min(1).max(120)
-});
-var actionResourceEffectSchema = z16.object({
-  resource: z16.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/),
-  effect: z16.enum(["create", "delete"])
-});
-var actionSpecSchema = z16.object({
-  id: z16.string().min(1).max(160).regex(/^[a-z0-9_.:-]+$/),
-  title: z16.string().min(1).max(160).optional(),
-  kind: actionKindSchema,
-  actorType: z16.string().min(1).max(64).regex(/^[a-zA-Z0-9_.:-]+$/).optional(),
-  subject: actionSubjectBindingSchema.optional(),
-  inputSchemaRef: z16.string().min(1).max(240).optional(),
-  audit: actionAuditPolicySchema.default("metadata"),
-  resource: actionResourceEffectSchema.optional()
-});
+// src/refs.ts
+function isCapabilityGrant(value) {
+  return typeof value === "object" && value !== null && value.kind === "capability_grant";
+}
+function keyOf(ref) {
+  return typeof ref === "string" ? ref : ref.key;
+}
+function displayFromKey(key) {
+  return key.split("_").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
 
-// ../contracts/dist/plans/spec/routes-layer.js
-var routeMatchSchema = z17.object({
-  method: z17.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"]).default("*"),
-  path: z17.string().min(1).max(500).regex(/^\/[a-zA-Z0-9_/:.{}*-]*$/, "path must start with / and contain only [a-zA-Z0-9_/:.{}*-]")
-});
-var routeDefinitionSchema = z17.object({
-  match: routeMatchSchema,
-  metering: z17.object({
-    defaults: z17.record(z17.string().min(1).max(64), z17.number().finite().nonnegative()).optional(),
-    reports: z17.array(z17.string().min(1).max(64)).max(20).optional(),
-    estimates: z17.record(z17.string().min(1).max(64), z17.number().finite().nonnegative()).optional(),
-    onStatusCodes: z17.union([
-      z17.string().min(1).max(100),
-      z17.array(z17.number().int().min(100).max(599)).min(1).max(100)
-    ]).optional()
-  }).optional(),
-  unmetered: z17.boolean().optional(),
-  inheritDefaultMeters: z17.boolean().optional(),
-  /** Optional explicit action id. When absent, the compiler derives an
-   *  implicit action from feature + method + path. */
-  action: z17.string().min(1).max(160).regex(/^[a-z0-9_.:-]+$/).optional()
-}).strict();
-var routeUpstreamSchema = z17.object({
-  override_origin: z17.string().url("override_origin must be a valid URL").nullable().default(null)
-});
-var routeRuntimeSchema = z17.object({
-  rollout_key: z17.string().min(1).max(120).regex(/^[a-z0-9_-]+$/, "rollout_key must be lowercase alphanumeric with hyphens/underscores").optional(),
-  /**
-   * Optional runtime flags this feature depends on. The runtime
-   * evaluator AND's the feature's enablement across all referenced
-   * flags. If any flag is disabled, the route returns the configured
-   * fallback (404 by default — see /runtime failure matrix).
-   */
-  required_flags: z17.array(z17.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(10).optional()
-});
-var routesFileSchema = z17.object({
-  /**
-   * Feature key — the entitlement unit. Surfaced in dashboards,
-   * subscriptions, and the gateway's matched-route trace.
-   */
-  feature: z17.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/, "feature key must be lowercase alphanumeric with [_.:-]"),
-  description: z17.string().max(500).optional(),
-  /**
-   * Route additions are contractual by default — they expose new API
-   * surface to subscribers. Internal/non-customer-visible routes can
-   * mark themselves `runtime` to allow autonomous agent flips
-   * (invariant #16; see RFC approval matrix).
-   */
-  mutation_class: z17.enum(["runtime", "contractual"]).default("contractual"),
-  cacheProfile: cacheProfileSchema,
-  routes: z17.array(routeDefinitionSchema).min(1).max(50),
-  upstream: routeUpstreamSchema.default({ override_origin: null }),
-  /**
-   * Ordered list of policy names to apply. Executed sequentially by
-   * the gateway policy engine; first-deny wins. Referenced policies
-   * MUST declare compatible `compatible_with` envelopes for this
-   * feature's route/meter shape — the compiler enforces.
-   */
-  policies: z17.array(z17.string().min(1).max(64).regex(/^[a-z0-9_-]+$/)).max(20).default([]),
-  runtime: routeRuntimeSchema.default({}),
-  /**
-   * Capability groups this feature joins. A plan that includes any
-   * referenced capability grants this feature. Capabilities are
-   * resolved at compile time into the plan's expanded feature set.
-   */
-  capabilities: z17.array(z17.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(20).default([]),
-  /**
-   * Plans that grant this feature directly (in addition to capability
-   * membership). Mirrors the legacy `featureCatalogEntrySchema.plans`
-   * field for the common case where the feature isn't part of any
-   * shared capability group.
-   *
-   * v0.3.0 keeps direct-plan binding for migration ergonomics; v0.4
-   * may deprecate this in favour of capability-only composition.
-   */
-  plans: z17.array(z17.string().min(1).max(64)).max(20).default([]),
-  /** Explicit actions declared by this feature. Routes reference them by
-   *  `route.action`; routes without a binding receive implicit actions. */
-  actions: z17.array(actionSpecSchema).max(100).optional()
-});
+// src/backend.ts
+var BACKEND_ID_PATTERN2 = /^[a-z0-9][a-z0-9_-]*$/;
+function createBackendNode(id, options = {}) {
+  if (!BACKEND_ID_PATTERN2.test(id)) {
+    throw new ManifestBuilderError(
+      `backend "${id}": id must be a lowercase slug ([a-z0-9][a-z0-9_-]*)`
+    );
+  }
+  return {
+    id,
+    ...options.name !== void 0 ? { name: options.name } : {},
+    ...options.slug !== void 0 ? { slug: options.slug } : {},
+    ...options.transport !== void 0 ? {
+      transport: {
+        ...options.transport.mode !== void 0 ? { mode: options.transport.mode } : {},
+        ...options.transport.runner !== void 0 ? { runner: options.transport.runner } : {}
+      }
+    } : {},
+    ...options.verification !== void 0 ? { verification: options.verification } : {},
+    ...options.meters?.length ? { meters: options.meters.map(keyOf) } : {},
+    ...options.default !== void 0 ? { default: options.default } : {},
+    ...options.originUrl !== void 0 ? { originUrl: options.originUrl } : {},
+    ...options.originHostname !== void 0 ? { originHostname: options.originHostname } : {}
+  };
+}
+function buildBackendBlock(backendNodes) {
+  const out = {};
+  for (const node of [...backendNodes].sort(
+    (a, b) => a.id.localeCompare(b.id)
+  )) {
+    const { id, ...definition } = node;
+    out[id] = definition;
+  }
+  return out;
+}
+function assertBackendBindingsValid(files, backendNodes, meterDefinitions) {
+  if (backendNodes.length === 0) return;
+  const byId = new Map(backendNodes.map((backend) => [backend.id, backend]));
+  const declaredMeters = new Set(meterDefinitions.map((meter) => meter.key));
+  for (const backend of backendNodes) {
+    for (const meter of backend.meters ?? []) {
+      if (declaredMeters.has(meter)) continue;
+      throw new ManifestBuilderError(
+        `UNKNOWN_METER_IN_BACKEND: backend "${backend.id}" allows meter "${meter}" but it is not declared \u2014 call product.meter("${meter}", ...) first`
+      );
+    }
+  }
+  const ids = backendNodes.map((backend) => backend.id);
+  const explicitDefaults = backendNodes.filter(
+    (backend) => backend.default === true
+  );
+  const defaultId = ids.length === 1 ? ids[0] : explicitDefaults.length === 1 ? explicitDefaults[0].id : null;
+  const ambiguous = defaultId === null;
+  for (const file of files) {
+    const fileBinding = file.backend;
+    if (fileBinding !== void 0 && !byId.has(fileBinding)) {
+      throw new ManifestBuilderError(
+        `UNKNOWN_BACKEND_IN_ROUTE: feature "${file.feature}" binds backend "${fileBinding}" which is not declared \u2014 call product.backend("${fileBinding}", ...) first`
+      );
+    }
+    file.routes.forEach((route, routeIndex) => {
+      const explicit = route.backend ?? fileBinding;
+      if (explicit !== void 0) {
+        if (!byId.has(explicit)) {
+          throw new ManifestBuilderError(
+            `UNKNOWN_BACKEND_IN_ROUTE: feature "${file.feature}" route ${routeIndex} binds backend "${explicit}" which is not declared \u2014 call product.backend("${explicit}", ...) first`
+          );
+        }
+      } else if (ambiguous) {
+        throw new ManifestBuilderError(
+          `AMBIGUOUS_DEFAULT_BACKEND: feature "${file.feature}" route ${routeIndex} has no backend binding and the product declares ${ids.length} backends with no single default \u2014 mark exactly one backend \`default: true\` or bind the route explicitly`
+        );
+      }
+      const boundId = explicit ?? defaultId;
+      if (!boundId) return;
+      const backend = byId.get(boundId);
+      const allow = backend?.meters;
+      if (!allow) return;
+      const allowed = new Set(allow);
+      const routeMeters = /* @__PURE__ */ new Set([
+        ...Object.keys(route.metering?.defaults ?? {}),
+        ...route.metering?.reports ?? [],
+        ...Object.keys(route.metering?.estimates ?? {})
+      ]);
+      for (const meter of routeMeters) {
+        if (allowed.has(meter)) continue;
+        throw new ManifestBuilderError(
+          `ROUTE_METER_NOT_ALLOWED_BY_BACKEND: feature "${file.feature}" route ${routeIndex} meters "${meter}" but backend "${boundId}" does not allow it (backend.meters = [${allow.join(", ")}])`
+        );
+      }
+    });
+  }
+}
 
-// ../contracts/dist/plans/spec/runtime-layer.js
-import { z as z18 } from "zod";
-var keyNameSchema = z18.string().min(1).max(120).regex(/^[a-z0-9_-]+$/, "runtime key must be lowercase alphanumeric with hyphens/underscores");
-var dependsOnSchema = z18.object({
-  runtime_flags: z18.array(keyNameSchema).max(10).optional(),
-  capabilities: z18.array(z18.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(10).optional()
-}).default({});
-var audienceSchema = z18.object({
-  plans: z18.array(z18.string().min(1).max(64)).max(20).optional(),
-  environments: z18.array(z18.string().min(1).max(64)).max(10).optional(),
-  capabilities: z18.array(z18.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(10).optional()
-}).default({});
-var rolloutDefaultsSchema = z18.object({
-  missing_behavior: z18.enum(["treat_as_zero_percent", "treat_as_full_rollout", "fail_closed"]).default("treat_as_zero_percent"),
-  stale_behavior: z18.enum(["use_last_known", "fail_closed_on_signature"]).default("use_last_known")
-});
-var rolloutEntrySchema = z18.object({
-  description: z18.string().max(500).optional(),
-  audience: audienceSchema,
-  /**
-   * Rollout percentage (0-100). 0 = no subscribers in treatment;
-   * 100 = full rollout. Cohort stability invariant #20: increasing
-   * the percent admits more subscribers (existing stay); decreasing
-   * drops subscribers whose deterministic bucket is above the new
-   * boundary (logged as an audit event).
-   */
-  percent: z18.number().int().min(0).max(100),
-  /**
-   * Seed for the deterministic SHA-256 hash that computes bucket
-   * assignment. Rotating the seed is a destructive rebucketing
-   * operation; the workflow runner refuses without approval metadata
-   * (invariant #16).
-   */
-  assignment_seed: z18.string().min(1).max(120).default("default"),
-  depends_on: dependsOnSchema,
-  defaults: rolloutDefaultsSchema.default({
-    missing_behavior: "treat_as_zero_percent",
-    stale_behavior: "use_last_known"
-  })
-});
-var runtimeRolloutFileSchema = z18.object({
-  cacheProfile: cacheProfileSchema.default("blocking"),
-  rollouts: z18.record(keyNameSchema, rolloutEntrySchema).default({})
-});
-var flagDefaultsSchema = z18.object({
-  missing_behavior: z18.enum(["disabled", "enabled", "fail_closed"]).default("disabled"),
-  stale_behavior: z18.enum(["use_last_known", "fail_closed_on_signature"]).default("use_last_known")
-});
-var flagEntrySchema = z18.object({
-  description: z18.string().max(500).optional(),
-  enabled: z18.boolean(),
-  audience: audienceSchema,
-  depends_on: dependsOnSchema,
-  defaults: flagDefaultsSchema.default({
-    missing_behavior: "disabled",
-    stale_behavior: "use_last_known"
-  }),
-  /**
-   * When set, this flag acts as a killswitch — its `enabled: true`
-   * disables traffic for the referenced subjects. Useful for
-   * incident response (`policy_premium-rate-limit_emergency_off`).
-   */
-  killswitch_target: z18.object({
-    kind: z18.enum(["policy", "route", "rollout"]),
-    name: z18.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)
-  }).optional()
-});
-var runtimeFlagsFileSchema = z18.object({
-  cacheProfile: cacheProfileSchema.default("blocking"),
-  flags: z18.record(keyNameSchema, flagEntrySchema).default({})
-});
-var migrationDefaultsSchema = z18.object({
-  missing_behavior: z18.enum(["disabled", "pending_review"]).default("disabled"),
-  stale_behavior: z18.enum(["use_last_known", "fail_closed_on_signature"]).default("use_last_known")
-});
-var migrationTriggerSchema = z18.object({
-  description: z18.string().max(500).optional(),
-  /**
-   * The (fromPlanKey, toPlanKey) migration this trigger configures.
-   * Compiler validates both keys resolve.
-   */
-  from_plan_key: z18.string().min(1).max(64),
-  to_plan_key: z18.string().min(1).max(64),
-  policy: z18.enum([
-    "GRANDFATHER",
-    "MIGRATE_AT_RENEWAL",
-    "MIGRATE_IMMEDIATELY",
-    "MIGRATE_BY_DATE",
-    "OPT_IN"
-  ]).default("MIGRATE_AT_RENEWAL"),
-  proration_policy: z18.enum(["NONE", "PRORATE", "CREDIT"]).default("NONE"),
-  /**
-   * Wall-clock cutover for `MIGRATE_BY_DATE` policy. Ignored for other
-   * policies. Must be in the future at compile time.
-   */
-  cutover_at: z18.string().datetime().optional(),
-  /**
-   * Freeze window per invariant #8 — while this migration is RUNNING,
-   * contractual mutations to the product are rejected at the webhook
-   * layer with 423 LOCKED. Set to `false` to allow concurrent
-   * contract edits (only for migrations that don't touch entitlement
-   * shape — e.g. pure price corrections).
-   */
-  freeze_contract_mutations: z18.boolean().default(true),
-  depends_on: dependsOnSchema,
-  defaults: migrationDefaultsSchema.default({
-    missing_behavior: "disabled",
-    stale_behavior: "use_last_known"
-  })
-});
-var runtimeMigrationsFileSchema = z18.object({
-  cacheProfile: cacheProfileSchema.default("blocking"),
-  migrations: z18.record(keyNameSchema, migrationTriggerSchema).default({})
-});
+// src/product-assembly.ts
+function assembleProductSpec(input) {
+  const { options } = input;
+  const base = {
+    product: {
+      name: input.name,
+      baseUrl: options.origin,
+      ...options.displayName !== void 0 ? { displayName: options.displayName } : {},
+      ...options.description !== void 0 ? { description: options.description } : {},
+      ...options.sandboxOrigin !== void 0 ? { sandboxBaseUrl: options.sandboxOrigin } : {},
+      ...options.visibility !== void 0 ? { visibility: options.visibility } : {},
+      ...options.logoUrl !== void 0 ? { logoUrl: options.logoUrl } : {},
+      ...options.primaryColor !== void 0 ? { primaryColor: options.primaryColor } : {},
+      ...options.envBranchPrefix !== void 0 ? { envBranchPrefix: options.envBranchPrefix } : {}
+    },
+    gateway: {
+      ...options.authHeader !== void 0 ? { authHeader: options.authHeader } : {},
+      ...options.upstreamAuth !== void 0 ? { upstreamAuth: options.upstreamAuth } : {}
+    },
+    metering: {
+      meters: buildMeterDefinitions(
+        input.meters,
+        input.defaultMeterCosts,
+        input.featureLayers,
+        input.workflows
+      ),
+      ...options.billOn4xx !== void 0 ? { billOn4xx: options.billOn4xx } : {}
+    },
+    ...input.backends.length ? { backend: buildBackendBlock(input.backends) } : {},
+    ...options.billing !== void 0 ? { billing: options.billing } : {},
+    ...options.operatorPolicies !== void 0 ? { policies: options.operatorPolicies } : {},
+    ...options.customerContext !== void 0 ? { customer_context: buildCustomerContext(options.customerContext) } : {},
+    ...input.surfaces.length ? { surfaces: sortBy2(input.surfaces, (surface) => surface.key) } : {},
+    ...input.entitlements.length ? {
+      entitlements: sortBy2(
+        input.entitlements,
+        (entitlement) => entitlement.key
+      )
+    } : {},
+    ...input.workflows.length ? { workflows: sortBy2(input.workflows, (workflow) => workflow.key) } : {},
+    ...input.frontendManifest !== void 0 ? { frontend: input.frontendManifest } : {},
+    ...input.migrations.length ? { migrations: sortBy2(input.migrations, (migration) => migration.id) } : {},
+    ...input.resources.length ? { resources: sortBy2(input.resources, (resource) => resource.name) } : {},
+    plans: sortBy2(input.plans, (plan) => plan.key)
+  };
+  return mergeProductPatch(
+    base,
+    input.productPatch
+  );
+}
+function buildMeterDefinitions(meters, defaultMeterCosts, featureLayers, workflows) {
+  const routeValueMeters = routeValueMeterKeys(
+    defaultMeterCosts,
+    featureLayers,
+    workflows
+  );
+  return sortBy2(meters, (meter) => meter.key).map((meter) => {
+    if (meter.aggregation !== void 0) return meter;
+    if (!routeValueMeters.has(meter.key)) return meter;
+    return { ...meter, aggregation: "SUM" };
+  });
+}
+function routeValueMeterKeys(defaultMeterCosts, featureLayers, workflows) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const cost of defaultMeterCosts) {
+    keys.add(cost.meter);
+  }
+  for (const file of featureLayers) {
+    for (const route of file.routes) {
+      for (const meter of Object.keys(route.metering?.defaults ?? {})) {
+        keys.add(meter);
+      }
+      for (const meter of route.metering?.reports ?? []) {
+        keys.add(meter);
+      }
+    }
+  }
+  for (const workflow of workflows) {
+    for (const meter of workflow.meters ?? []) keys.add(meter);
+    for (const meter of Object.keys(workflow.estimates ?? {})) keys.add(meter);
+  }
+  return keys;
+}
+function buildCustomerContext(options) {
+  return {
+    ...options.identityRequirement !== void 0 ? { identity_requirement: options.identityRequirement } : {},
+    ...options.contextTokens !== void 0 ? { context_tokens: options.contextTokens } : {},
+    ...options.customerAuth !== void 0 ? { portal_auth: options.customerAuth } : {}
+  };
+}
+function sortBy2(items, key) {
+  return [...items].sort((a, b) => key(a).localeCompare(key(b)));
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeProductPatch(base, patch) {
+  const out = { ...base };
+  for (const [key, value] of Object.entries(patch)) {
+    const existing = out[key];
+    if (isPlainObject(existing) && isPlainObject(value)) {
+      out[key] = mergeProductPatch(existing, value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
 
-// ../contracts/dist/plans/spec/capabilities-layer.js
-import { z as z19 } from "zod";
-var capabilityFileSchema = z19.object({
-  capability: z19.string().min(1).max(120).regex(/^[a-z0-9_-]+$/, "capability name must be lowercase alphanumeric with hyphens/underscores"),
-  description: z19.string().max(500).optional(),
-  /**
-   * Capability composition is contractual by default — including a new
-   * feature changes the customer's effective entitlement. Mark
-   * `runtime` only for capabilities that compose runtime-only knobs
-   * (e.g. an internal "monitoring" capability that gates dashboard
-   * pages without affecting billable behaviour).
-   */
-  mutation_class: z19.enum(["runtime", "contractual"]).default("contractual"),
-  includes_features: z19.array(z19.string().min(1).max(100).regex(/^[a-z0-9_.:-]+$/)).max(20).default([]),
-  includes_policies: z19.array(z19.string().min(1).max(64).regex(/^[a-z0-9_-]+$/)).max(20).default([]),
-  includes_capabilities: z19.array(z19.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(20).default([])
-});
+// src/frontend.ts
+function createFrontendManifest() {
+  return { version: 1, nav: [], pages: [] };
+}
+function setFrontendNav(manifest, items) {
+  manifest.nav = items.map((item) => ({
+    label: item.label,
+    path: item.path,
+    ...item.capability !== void 0 ? { capability: keyOf(item.capability) } : {}
+  }));
+}
+function addFrontendPage(manifest, path, options) {
+  if (manifest.pages?.some((page) => page.path === path)) {
+    throw new ManifestBuilderError(
+      `duplicate frontend page "${path}" \u2014 each frontend page path must be declared once`
+    );
+  }
+  manifest.pages ??= [];
+  manifest.pages.push({
+    path,
+    title: options.title,
+    requiresAuth: options.requiresAuth,
+    ...options.capability !== void 0 ? { capability: keyOf(options.capability) } : {},
+    ...options.components?.length ? {
+      components: options.components.map((component) => ({
+        component: component.component,
+        ...component.props !== void 0 ? { props: component.props } : {},
+        ...component.capability !== void 0 ? { capability: keyOf(component.capability) } : {},
+        ...component.gateMode !== void 0 ? { gateMode: component.gateMode } : {}
+      }))
+    } : {}
+  });
+}
+function frontendCapabilityKeys(manifest) {
+  return [
+    ...(manifest.nav ?? []).flatMap(
+      (item) => item.capability ? [item.capability] : []
+    ),
+    ...(manifest.pages ?? []).flatMap((page) => [
+      ...page.capability ? [page.capability] : [],
+      ...(page.components ?? []).flatMap(
+        (component) => component.capability ? [component.capability] : []
+      )
+    ])
+  ];
+}
 
-// ../contracts/dist/plans/spec/product-v2.js
-import { z as z20 } from "zod";
-var PRODUCT_V2_SCHEMA_VERSION = 1;
-var billingKnobsShape2 = {
-  meters: z20.array(meterSchema).default([]),
-  recurring_fee_cents: z20.number().int().nonnegative().default(0),
-  /** Billing cadence (`month` default / `year`). Drives the Stripe price
-   *  `recurring.interval` and the entitlement billing-period window. */
-  billing_interval: billingIntervalSchema.default("month"),
-  trial_days: z20.number().int().nonnegative().default(0),
-  max_monthly_spend_cents: z20.number().int().nonnegative().optional(),
-  min_monthly_spend_cents: z20.number().int().nonnegative().optional(),
-  // Unified grants array — the SINGLE credit surface. Recurring +
-  // one-time credit are canonical entries here (the legacy scalar knobs
-  // were removed).
-  grants: z20.array(grantSchema).max(40).default([])
-};
-var planSpecV2Schema = z20.object({
-  key: z20.string().min(1).max(64).regex(/^[a-z0-9_-]+$/, "Plan key must be lowercase alphanumeric with hyphens/underscores"),
-  name: z20.string().min(1).max(100),
-  description: z20.string().max(500).optional(),
-  details: z20.array(z20.string().max(200)).max(10).optional(),
-  ...billingKnobsShape2,
-  free: z20.boolean().default(false),
-  /**
-   * Capability composition references. The compiler's
-   * `resolve-capabilities` pass walks the graph and expands this into
-   * concrete (features, policies) sets stored on the CompiledPlan.
-   *
-   * Replaces the legacy `featureGates` block (which is now expressed
-   * via capability composition) and the per-plan inverse feature
-   * mapping (`featureCatalogEntry.plans[]`).
-   *
-   * A plan may reference zero capabilities — useful for free / starter
-   * plans that grant access only via direct route bindings.
-   */
-  capabilities: z20.array(z20.string().min(1).max(120).regex(/^[a-z0-9_-]+$/)).max(20).default([]),
-  limits: z20.array(planLimitRuleSchema).max(20).default([]),
-  /**
-   * Control-plane capability caps (count limits + boolean toggles).
-   * Same semantics as the legacy `capability_limits` field.
-   */
-  capability_limits: z20.record(z20.string().min(1).max(120), z20.union([z20.number().int().nonnegative(), z20.boolean()])).default({}),
-  overageBehavior: z20.enum(["block", "allow_and_bill"]).default("block"),
-  selfServeEnabled: z20.boolean().default(true),
-  /**
-   * Marks a plan as the pinned-cohort head (status LEGACY_STABLE). Only
-   * existing subscribers stay on legacy plans; new subscribers cannot
-   * join. Removing a legacy plan while subscribers are pinned is a
-   * compile error.
-   */
-  legacy: z20.boolean().optional().default(false),
-  archive: z20.object({
-    at: z20.string().datetime().optional(),
-    transitionTo: z20.string().optional(),
-    strategy: z20.enum(["auto", "explicit", "block"]).default("auto")
-  }).optional()
-}).superRefine((plan, ctx) => {
-  refineSingleCanonicalGrant(plan.grants, ctx);
-});
-var DEFAULT_SUBSCRIBER_CHANGE_POLICY = {
-  default: "preserve_current_period",
-  proration: "none",
-  when: {
-    price_increase: "preserve_current_period",
-    price_decrease: "switch_immediately",
-    feature_added: "switch_immediately",
-    feature_removed: "preserve_current_period",
-    limit_increased: "switch_immediately",
-    limit_reduced: "preserve_current_period",
-    credit_increased: "switch_immediately",
-    credit_reduced: "preserve_current_period",
-    rating_changed: "preserve_current_period"
-  },
-  allowImmediatePriceIncrease: false,
-  allowImmediateEntitlementReduction: false
-};
-var productSpecV2Schema = z20.object({
-  /**
-   * Schema-version stamp. Forward migrations target a higher value;
-   * readers refuse unsupported versions per invariant #2.
-   */
-  artifactSchemaVersion: z20.literal(PRODUCT_V2_SCHEMA_VERSION).default(PRODUCT_V2_SCHEMA_VERSION),
-  product: z20.object({
-    name: z20.string().min(1).max(100),
-    displayName: z20.string().max(200).optional(),
-    description: z20.string().max(2e3).optional(),
-    baseUrl: z20.string().url("baseUrl must be a valid URL"),
-    sandboxBaseUrl: z20.string().url("sandboxBaseUrl must be a valid URL").optional(),
-    visibility: z20.enum(["public", "private"]).default("public"),
-    logoUrl: z20.string().url().optional(),
-    primaryColor: z20.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
-    envBranchPrefix: z20.string().max(50).nullable().optional()
-  }),
-  /**
-   * Meter catalog. Referenced by route `metering` metadata.
-   * Same shape as the legacy meterDefinitionSchema (re-exported from
-   * product.ts to keep one source of truth during the transition).
-   *
-   * Lifted to a top-level array so the compiler can hash + invalidate
-   * meter changes independently from plan changes (incremental
-   * compilation per invariant #1 + Merkle DAG).
-   */
-  meters: z20.array(meterDefinitionSchema).max(10).default([]),
-  /**
-   * Bill on 4xx responses (independent of meter setup). Stays on the
-   * product spec because it's a contractual choice that affects
-   * billing predictability.
-   */
-  billOn4xx: z20.boolean().default(false),
-  frontend: frontendManifestSchema.optional(),
-  migrations: migrationDeclsSchema.optional(),
-  resources: countedResourcesSchema,
-  policies: productOperatorPoliciesSchema,
-  customer_context: productCustomerContextSchema.optional(),
-  surfaces: productSurfacesSchema,
-  entitlements: productEntitlementsSchema,
-  workflows: productWorkflowsSchema,
-  billing: z20.object({
-    gracePeriodDays: z20.number().int().nonnegative().default(3),
-    // When true (default), a plan limit INCREASE re-projects onto active
-    // subscribers immediately; a DECREASE always defers to period end.
-    // Read by advanceActiveSubscribersToLatestCompiledPlans.
-    applyLimitUpgradesInstantly: z20.boolean().optional(),
-    subscriberChangePolicy: subscriberChangePolicySchema.default(DEFAULT_SUBSCRIBER_CHANGE_POLICY)
-  }).default({
-    gracePeriodDays: 3,
-    subscriberChangePolicy: DEFAULT_SUBSCRIBER_CHANGE_POLICY
-  }),
-  plans: z20.array(planSpecV2Schema).max(4).default([]),
-  add_ons: addOnsBlockSchema,
-  lifecycle: z20.object({
-    breaking_changes: z20.object({
-      require_deprecation_window_days: z20.number().int().nonnegative().default(0),
-      require_successor_route: z20.boolean().default(false)
-    }).default({
-      require_deprecation_window_days: 0,
-      require_successor_route: false
-    })
-  }).default({
-    breaking_changes: {
-      require_deprecation_window_days: 0,
-      require_successor_route: false
+// src/route-metering.ts
+function parseRouteMatch(match) {
+  const trimmed = match.trim();
+  const space = trimmed.indexOf(" ");
+  if (space === -1) {
+    if (!trimmed.startsWith("/")) {
+      throw new ManifestBuilderError(
+        `route "${match}": expected "METHOD /path" or "/path"`
+      );
+    }
+    return { method: "*", path: trimmed };
+  }
+  const method = trimmed.slice(0, space).toUpperCase();
+  const path = trimmed.slice(space + 1).trim();
+  const methods = [
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+    "OPTIONS",
+    "*"
+  ];
+  if (!methods.includes(method)) {
+    throw new ManifestBuilderError(
+      `route "${match}": unknown HTTP method "${method}"`
+    );
+  }
+  if (!path.startsWith("/")) {
+    throw new ManifestBuilderError(
+      `route "${match}": path must start with "/"`
+    );
+  }
+  return { method, path };
+}
+function makeMeterRef(key) {
+  return {
+    kind: "meter",
+    key,
+    fixed: (value) => ({ kind: "meter_cost", meter: key, value }),
+    estimate: (value) => ({ kind: "meter_estimate", meter: key, value })
+  };
+}
+function normalizeMeterCost(cost, hasMeter) {
+  if (!cost || cost.kind !== "meter_cost") {
+    throw new ManifestBuilderError(
+      "meter cost must be created by meter.fixed(value)"
+    );
+  }
+  if (!hasMeter(cost.meter)) {
+    throw new ManifestBuilderError(
+      `meter cost references unknown meter "${cost.meter}"`
+    );
+  }
+  if (!Number.isFinite(cost.value) || cost.value < 0) {
+    throw new ManifestBuilderError(
+      `meter "${cost.meter}" fixed value must be a non-negative finite number`
+    );
+  }
+  return cost;
+}
+function normalizeMeterCosts(costs, normalize) {
+  if (!costs) return [];
+  const entries = Array.isArray(costs) ? costs : [costs];
+  return entries.map((cost) => normalize(cost));
+}
+function normalizeMeterRefs(refs) {
+  const entries = Array.isArray(refs) ? refs : [refs];
+  return entries.map(keyOf);
+}
+function statusPolicyPartIsValid2(part) {
+  const trimmed = part.trim();
+  if (!trimmed) return false;
+  const [startRaw, endRaw, extra] = trimmed.split("-");
+  if (extra !== void 0 || !/^\d{3}$/.test(startRaw ?? "")) return false;
+  const start = Number(startRaw);
+  const end = endRaw === void 0 ? start : Number(endRaw);
+  if (endRaw !== void 0 && !/^\d{3}$/.test(endRaw)) return false;
+  return start >= 100 && start <= 599 && end >= 100 && end <= 599 && start <= end;
+}
+function assertStatusCodePolicy(value) {
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      throw new ManifestBuilderError("onStatusCodes cannot be an empty array");
     }
-  }),
-  webhooks: webhooksBlockSchema.optional(),
-  environments: environmentsBlockSchema.optional(),
-  ephemeral: z20.object({
-    defaultPlan: z20.string().min(1).optional()
-  }).optional()
-});
-
-// ../contracts/dist/plans/spec/manifest-ir.js
-import { createHash } from "node:crypto";
-import { z as z21 } from "zod";
-var MANIFEST_IR_VERSION = 1;
-var manifestIrSchema = z21.object({
-  irVersion: z21.literal(MANIFEST_IR_VERSION),
-  /** Version of @farthershore/product that emitted this envelope. */
-  sdkVersion: z21.string().min(1).max(64),
-  /** Legacy unified ProductSpec — the live `CompileProductOptions.sourceSpec`. */
-  product: productSpecSchema,
-  /** One entry per feature, sorted by `feature` (mirrors /routes/<feature>.yaml). */
-  routes: z21.array(routesFileSchema).max(200).default([]),
-  /** Sorted by `name` (mirrors /policies/<name>.yaml). */
-  policies: z21.array(policyFileSchema).max(200).default([]),
-  /** Sorted by `capability` (mirrors /capabilities/<name>.yaml). */
-  capabilities: z21.array(capabilityFileSchema).max(200).default([]),
-  /** Reserved. Always null at irVersion 1 — runtime stays YAML/dashboard. */
-  runtime: z21.object({
-    rollout: z21.null().default(null),
-    flags: z21.null().default(null),
-    migrations: z21.null().default(null)
-  }).default({ rollout: null, flags: null, migrations: null })
-});
-function canonicalManifestJson(value) {
-  return stableJson(JSON.parse(JSON.stringify(value)));
+    for (const status of value) {
+      if (!Number.isInteger(status) || status < 100 || status > 599) {
+        throw new ManifestBuilderError(
+          `onStatusCodes array contains invalid HTTP status "${status}"`
+        );
+      }
+    }
+    return;
+  }
+  if (!value.split(",").every(statusPolicyPartIsValid2)) {
+    throw new ManifestBuilderError(
+      'onStatusCodes must be comma-separated HTTP status codes or numeric ranges, e.g. "200-299,304"'
+    );
+  }
 }
-function hashManifestIr(ir) {
-  return createHash("sha256").update(canonicalManifestJson(ir)).digest("hex");
+function assertEstimateValue(meter, value) {
+  if (!Number.isFinite(value) || value < 0) {
+    throw new ManifestBuilderError(
+      `meter "${meter}" estimate must be a non-negative finite number`
+    );
+  }
 }
-function stableJson(value) {
-  if (Array.isArray(value))
-    return `[${value.map(stableJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, val]) => `${JSON.stringify(key)}:${stableJson(val)}`).join(",")}}`;
+function normalizeMeterEstimate(estimate, hasMeter) {
+  if (!estimate || estimate.kind !== "meter_estimate") {
+    throw new ManifestBuilderError(
+      "meter estimate must be created by meter.estimate(value)"
+    );
   }
-  return JSON.stringify(value);
+  if (!hasMeter(estimate.meter)) {
+    throw new ManifestBuilderError(
+      `meter estimate references unknown meter "${estimate.meter}"`
+    );
+  }
+  assertEstimateValue(estimate.meter, estimate.value);
+  return estimate;
 }
-
-// ../contracts/dist/plans/presets.js
-var FREE = {
-  kind: "free",
-  label: "Free",
-  description: "No recurring fee and no metered usage. Pure freemium tier.",
-  pricing: {
-    meters: [],
-    recurring_fee_cents: 0,
-    billing_interval: "month",
-    grants: [],
-    trial_days: 0
+function isMeterEstimate(value) {
+  return typeof value === "object" && value !== null && value.kind === "meter_estimate";
+}
+function normalizeMeterEstimates(estimates, hasMeter) {
+  if (!estimates) return {};
+  if (Array.isArray(estimates)) {
+    return Object.fromEntries(
+      estimates.map((estimate) => {
+        const normalized = normalizeMeterEstimate(estimate, hasMeter);
+        return [normalized.meter, normalized.value];
+      })
+    );
   }
-};
-var STARTER = {
-  kind: "starter",
-  label: "Starter \u2014 $20/mo + $20 included",
-  description: "$20/month subscription with $20 of usage credit each period. Stripe-style minimum-spend; overage billed at $0.001/request by default.",
-  pricing: {
-    meters: [
-      { dimension: "requests", kind: "linear", price_per_unit_micros: 1e3 }
-    ],
-    recurring_fee_cents: 2e3,
-    billing_interval: "month",
-    grants: [{ kind: "recurring", amount_cents: 2e3 }],
-    trial_days: 0
+  if (isMeterEstimate(estimates)) {
+    const normalized = normalizeMeterEstimate(estimates, hasMeter);
+    return { [normalized.meter]: normalized.value };
   }
-};
-var PRO = {
-  kind: "pro",
-  label: "Pro \u2014 $100/mo + $200 included",
-  description: "$100/month subscription with $200 of usage credit each period and a 14-day trial. Overage billed at $0.0005/request by default.",
-  pricing: {
-    meters: [
-      { dimension: "requests", kind: "linear", price_per_unit_micros: 500 }
-    ],
-    recurring_fee_cents: 1e4,
-    billing_interval: "month",
-    grants: [{ kind: "recurring", amount_cents: 2e4 }],
-    trial_days: 14
+  const estimateMap = estimates;
+  for (const [meter, value] of Object.entries(estimateMap)) {
+    assertEstimateValue(meter, value);
   }
-};
-var PREPAID = {
-  kind: "prepaid",
-  label: "Prepaid \u2014 $50 sign-up credit, then PAYG",
-  description: "$50 one-time credit at signup. Once depleted the subscriber pays-as-they-go at $0.001/request by default.",
-  pricing: {
-    meters: [
-      { dimension: "requests", kind: "linear", price_per_unit_micros: 1e3 }
-    ],
-    recurring_fee_cents: 0,
-    billing_interval: "month",
-    grants: [{ kind: "one_time", amount_cents: 5e3 }],
-    trial_days: 0
+  return { ...estimateMap };
+}
+function buildRouteDefinition(match, options, deps) {
+  const parsed = parseRouteMatch(match);
+  const metering = buildRouteMetering(options, deps);
+  return {
+    match: parsed,
+    ...metering ? { metering } : {},
+    ...options.unmetered !== void 0 ? { unmetered: options.unmetered } : {},
+    ...options.inheritDefaultMeters !== void 0 ? { inheritDefaultMeters: options.inheritDefaultMeters } : {},
+    ...options.action !== void 0 ? { action: keyOf(options.action) } : {},
+    ...options.backend !== void 0 ? { backend: keyOf(options.backend) } : {}
+  };
+}
+function buildRouteMetering(options, deps) {
+  if (options.unmetered === true) return void 0;
+  const defaults = {};
+  for (const cost of normalizeMeterCosts(
+    options.costs,
+    (cost2) => deps.normalizeMeterCost(cost2)
+  )) {
+    defaults[cost.meter] = (defaults[cost.meter] ?? 0) + cost.value;
+  }
+  const reports = [...new Set(normalizeMeterRefs(options.reports ?? []))];
+  const estimates = {};
+  for (const meter of reports) {
+    const definition = deps.getMeterDefinition(meter);
+    if (typeof definition?.estimate === "number") {
+      assertEstimateValue(meter, definition.estimate);
+      estimates[meter] = definition.estimate;
+    }
   }
-};
-var METERED = {
-  kind: "metered",
-  label: "Metered (pay-as-you-go)",
-  description: "No subscription fee. Pure usage billing at $0.001/request by default.",
-  pricing: {
-    meters: [
-      { dimension: "requests", kind: "linear", price_per_unit_micros: 1e3 }
-    ],
-    recurring_fee_cents: 0,
-    billing_interval: "month",
-    grants: [],
-    trial_days: 0
+  const explicitEstimates = normalizeMeterEstimates(
+    options.estimates,
+    (meter) => deps.getMeterDefinition(meter) !== void 0
+  );
+  for (const [meter, value] of Object.entries(explicitEstimates)) {
+    estimates[meter] = value;
+  }
+  const out = {};
+  if (Object.keys(defaults).length) out.defaults = defaults;
+  if (reports.length) out.reports = reports;
+  if (Object.keys(estimates).length) out.estimates = estimates;
+  if (options.onStatusCodes !== void 0) {
+    assertStatusCodePolicy(options.onStatusCodes);
+    out.onStatusCodes = options.onStatusCodes;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+function materializeRoute(route, defaultMeterCosts) {
+  if (route.unmetered === true) return route;
+  const defaults = {
+    ...route.metering?.defaults ?? {}
+  };
+  if (route.inheritDefaultMeters !== false) {
+    for (const cost of defaultMeterCosts) {
+      defaults[cost.meter] = (defaults[cost.meter] ?? 0) + cost.value;
+    }
   }
-};
-var PLAN_PRESETS = Object.freeze({
-  free: FREE,
-  starter: STARTER,
-  pro: PRO,
-  prepaid: PREPAID,
-  metered: METERED
-});
+  const hasMetering = route.metering !== void 0 || Object.keys(defaults).length > 0;
+  const metering = hasMetering ? {
+    ...route.metering ?? {},
+    ...Object.keys(defaults).length ? { defaults } : {}
+  } : void 0;
+  return {
+    ...route,
+    ...metering ? { metering } : {}
+  };
+}
+function routeMeterDependencyKeys(route) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const meter of Object.keys(route.metering?.defaults ?? {})) {
+    keys.add(meter);
+  }
+  for (const meter of route.metering?.reports ?? []) keys.add(meter);
+  for (const meter of Object.keys(route.metering?.estimates ?? {})) {
+    keys.add(meter);
+  }
+  return [...keys];
+}
+function assertRouteMeteringValid(files, meterDefinitions) {
+  const definitions = new Map(
+    Array.from(meterDefinitions, (meter) => [meter.key, meter])
+  );
+  for (const file of files) {
+    file.routes.forEach((route, routeIndex) => {
+      if (route.unmetered === true) return;
+      const defaults = new Set(Object.keys(route.metering?.defaults ?? {}));
+      const reports = new Set(route.metering?.reports ?? []);
+      for (const meter of defaults) {
+        if (definitions.has(meter)) continue;
+        throw new ManifestBuilderError(
+          `feature "${file.feature}" route ${routeIndex}: fixed meter "${meter}" is not declared \u2014 declare it with product.meter("${meter}", ...) first`
+        );
+      }
+      for (const meter of route.metering?.reports ?? []) {
+        if (!definitions.has(meter)) {
+          throw new ManifestBuilderError(
+            `feature "${file.feature}" route ${routeIndex}: reported meter "${meter}" is not declared \u2014 declare it with product.meter("${meter}", ...) first`
+          );
+        }
+        if (defaults.has(meter)) {
+          throw new ManifestBuilderError(
+            `feature "${file.feature}" route ${routeIndex}: meter "${meter}" cannot be both a fixed route cost and a dynamic report`
+          );
+        }
+      }
+      for (const meter of route.metering?.reports ?? []) {
+        const definition = definitions.get(meter);
+        const enforcement = definition?.enforcementType ?? "estimated_then_settled";
+        const hasEstimate = route.metering?.estimates && Object.prototype.hasOwnProperty.call(route.metering.estimates, meter);
+        if ((enforcement === "exact_pre_request" || enforcement === "estimated_then_settled") && !hasEstimate) {
+          throw new ManifestBuilderError(
+            `feature "${file.feature}" route ${routeIndex}: reported meter "${meter}" needs an estimate for gateway admission`
+          );
+        }
+      }
+      for (const [meter, value] of Object.entries(
+        route.metering?.estimates ?? {}
+      )) {
+        assertEstimateValue(meter, value);
+        if (!definitions.has(meter)) {
+          throw new ManifestBuilderError(
+            `feature "${file.feature}" route ${routeIndex}: estimate meter "${meter}" is not declared \u2014 declare it with product.meter("${meter}", ...) first`
+          );
+        }
+        if (reports.has(meter)) continue;
+        throw new ManifestBuilderError(
+          `feature "${file.feature}" route ${routeIndex}: estimate meter "${meter}" must also be listed in reports because estimates are pre-request reservations for dynamic usage`
+        );
+      }
+    });
+  }
+}
 
-// ../contracts/dist/plans/subscription-pricing-override.js
-import { z as z22 } from "zod";
-var subscriptionPricingOverrideSchema = z22.object({
-  /** Override the plan's recurring fee for this subscriber. */
-  recurring_fee_cents: z22.number().int().nonnegative().optional(),
-  /**
-   * Override the plan's credit grants. `grants[]` is the single credit
-   * surface — when present, it fully replaces the plan's grants for this
-   * subscriber (recurring + one-time credit are canonical entries here;
-   * the legacy recurring/one-time scalar knobs were removed).
-   */
-  grants: z22.array(grantSchema).max(40).optional(),
-  /** Override the minimum-spend floor. */
-  min_monthly_spend_cents: z22.number().int().nonnegative().optional(),
-  /** Override the maximum-spend ceiling. */
-  max_monthly_spend_cents: z22.number().int().nonnegative().optional(),
-  /** Replace the entire meter list for this subscriber. When set, the
-   *  full plan meter array is replaced (not merged) — call it explicit
-   *  rather than implicit so a deal can also REMOVE billable meters,
-   *  not just adjust rates. */
-  meters: z22.array(meterSchema).optional(),
-  /** Free-text notes about the deal. Surfaced in admin UI for audit. */
-  notes: z22.string().max(2e3).optional()
-});
+// src/dependencies.ts
+function capabilityDependsOn(file) {
+  return [
+    ...dependenciesFor("feature", file.includes_features),
+    ...dependenciesFor("policy", file.includes_policies),
+    ...dependenciesFor("capability", file.includes_capabilities)
+  ];
+}
+function policyDependsOn(file) {
+  return dependenciesFor("meter", file.compatible_with?.meters);
+}
+function entitlementDependsOn(entitlement, hasResource) {
+  const limitDimensions = (entitlement.limits ?? []).map(
+    (limit) => limit.dimension
+  );
+  return [
+    ...dependenciesFor("capability", entitlement.capabilities),
+    ...existingDependenciesFor(
+      "meter",
+      [...entitlement.meters ?? [], ...limitDimensions],
+      hasResource
+    )
+  ];
+}
+function workflowDependsOn(workflow) {
+  return [
+    ...dependenciesFor("capability", workflow.capabilities),
+    ...dependenciesFor("meter", [
+      ...workflow.meters ?? [],
+      ...Object.keys(workflow.estimates ?? {})
+    ])
+  ];
+}
+function featureDependsOn(file) {
+  const meterKeys = file.routes.flatMap(
+    (route) => routeMeterDependencyKeys(route)
+  );
+  const backendKeys = [
+    ...file.backend !== void 0 ? [file.backend] : [],
+    ...file.routes.flatMap(
+      (route) => route.backend !== void 0 ? [route.backend] : []
+    )
+  ];
+  return [
+    ...dependenciesFor("policy", file.policies),
+    ...dependenciesFor("plan", file.plans),
+    ...dependenciesFor("meter", meterKeys),
+    ...dependenciesFor("backend", backendKeys)
+  ];
+}
+function actionDependsOn(featureKey, action) {
+  return [
+    resourceDependency("feature", featureKey),
+    ...action.resource ? [resourceDependency("counted_resource", action.resource.resource)] : []
+  ];
+}
+function planDependsOn(plan, hasResource) {
+  const caps = Array.isArray(plan.capabilities) ? plan.capabilities.map(String) : [];
+  const limitDimensions = (plan.limits ?? []).map((limit) => limit.dimension);
+  const pricedMeterDimensions = (plan.meters ?? []).map(
+    (meter) => meter.dimension
+  );
+  const capacityKeys = Object.keys(plan.capability_limits ?? {});
+  return [
+    ...dependenciesFor("capability", caps),
+    ...existingDependenciesFor(
+      "meter",
+      [...limitDimensions, ...pricedMeterDimensions],
+      hasResource
+    ),
+    ...existingDependenciesFor("counted_resource", capacityKeys, hasResource)
+  ];
+}
+function migrationDependsOn(migration) {
+  return [
+    resourceDependency("plan", migration.from.plan),
+    resourceDependency("plan", migration.to.plan),
+    ...dependenciesFor(
+      "plan",
+      migration.pins?.map((pin) => pin.pinTo.plan)
+    )
+  ];
+}
+function frontendDependsOn(manifest) {
+  return dependenciesFor("capability", frontendCapabilityKeys(manifest));
+}
+function assertResourceDependenciesSatisfied(missing) {
+  if (missing.length === 0) return;
+  const details = missing.slice(0, 8).map(
+    ({ from, missing: dependency }) => `${describeResourceUrn(from)} depends on missing ${describeResourceUrn(
+      dependency
+    )}`
+  ).join("; ");
+  const suffix = missing.length > 8 ? `; plus ${missing.length - 8} more` : "";
+  throw new ManifestBuilderError(
+    `manifest has unresolved resource reference(s): ${details}${suffix}`
+  );
+}
+function dependenciesFor(kind, keys) {
+  return [...new Set(keys ?? [])].map((key) => resourceDependency(kind, key));
+}
+function existingDependenciesFor(kind, keys, hasResource) {
+  return [...new Set(keys)].filter((key) => hasResource(kind, key)).map((key) => resourceDependency(kind, key));
+}
+function describeResourceUrn(urn) {
+  const parts = urn.split(":");
+  const kind = parts[3] ?? "resource";
+  const key = parts.slice(4).join(":");
+  return `${kind} "${decodeURIComponent(key)}"`;
+}
 
-// src/validate.ts
-function validateManifestIr(candidate) {
-  const parsed = manifestIrSchema.safeParse(candidate);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      issues: parsed.error.issues.map((issue) => ({
-        code: issue.code.toUpperCase(),
-        path: issue.path.map(String).join("."),
-        message: issue.message
+// src/declarations.ts
+function buildCapabilityLayer(key, options = {}) {
+  return {
+    capability: key,
+    ...options.description !== void 0 || options.title !== void 0 ? { description: options.description ?? options.title } : {},
+    ...options.mutationClass !== void 0 ? { mutation_class: options.mutationClass } : {},
+    ...options.includesFeatures?.length ? { includes_features: options.includesFeatures.map(keyOf) } : {},
+    ...options.includesPolicies?.length ? { includes_policies: options.includesPolicies.map(keyOf) } : {},
+    ...options.includesCapabilities?.length ? { includes_capabilities: options.includesCapabilities.map(keyOf) } : {}
+  };
+}
+function buildFeatureLayer(key, options, buildRoute) {
+  const layer = {
+    feature: key,
+    routes: [],
+    ...options.description !== void 0 ? { description: options.description } : {},
+    ...options.mutationClass !== void 0 ? { mutation_class: options.mutationClass } : {},
+    ...options.cacheProfile !== void 0 ? { cacheProfile: options.cacheProfile } : {},
+    ...options.upstreamOrigin !== void 0 ? { upstream: { override_origin: options.upstreamOrigin } } : {},
+    ...options.policies?.length ? { policies: options.policies.map(keyOf) } : {},
+    ...options.plans?.length ? { plans: options.plans.map(keyOf) } : {},
+    ...options.actions?.length ? {
+      actions: options.actions.map(({ id, ...action }) => ({
+        id,
+        ...action
       }))
-    };
-  }
-  const ir = JSON.parse(
-    JSON.stringify(candidate)
-  );
-  return { ok: true, ir, irHash: hashIr(ir) };
+    } : {},
+    ...options.rolloutKey !== void 0 || options.requiredFlags?.length ? {
+      runtime: {
+        ...options.rolloutKey !== void 0 ? { rollout_key: options.rolloutKey } : {},
+        ...options.requiredFlags?.length ? { required_flags: options.requiredFlags } : {}
+      }
+    } : {}
+  };
+  for (const route of options.routes ?? []) {
+    layer.routes.push(buildRoute(route.match, route));
+  }
+  return layer;
 }
-function hashIr(ir) {
-  return hashManifestIr(ir);
+function buildPolicyLayer(name, options) {
+  return {
+    name,
+    type: options.type,
+    config: options.config,
+    ...options.description !== void 0 ? { description: options.description } : {},
+    ...options.mutationClass !== void 0 ? { mutation_class: options.mutationClass } : {},
+    ...options.cacheProfile !== void 0 ? { cacheProfile: options.cacheProfile } : {},
+    ...options.compatibleWith ? {
+      compatible_with: {
+        ...options.compatibleWith.routeTypes ? { route_types: options.compatibleWith.routeTypes } : {},
+        ...options.compatibleWith.meters ? { meters: options.compatibleWith.meters.map(keyOf) } : {},
+        ...options.compatibleWith.authModes ? { auth_modes: options.compatibleWith.authModes } : {}
+      }
+    } : {}
+  };
 }
-
-// src/version.ts
-var SDK_VERSION = true ? "0.4.0" : "0.0.0-dev";
-
-// src/product.ts
-var PRODUCT_BRAND = Symbol.for("farthershore.product.product");
-function isCapabilityGrant(value) {
-  return typeof value === "object" && value !== null && value.kind === "capability_grant";
+function buildSurfaceSpec(type, options = {}) {
+  const key = options.key ?? type;
+  return {
+    key,
+    type,
+    ...options.display !== void 0 ? { display: options.display } : {},
+    ...options.description !== void 0 ? { description: options.description } : {}
+  };
 }
-function keyOf(ref) {
-  return typeof ref === "string" ? ref : ref.key;
+function buildWorkflowSpec(key, options = {}) {
+  return {
+    key,
+    kind: options.kind ?? "async_job",
+    trigger: options.trigger ?? { type: "manual" },
+    ...options.title !== void 0 ? { title: options.title } : {},
+    ...options.description !== void 0 ? { description: options.description } : {},
+    ...options.capabilities?.length ? { capabilities: options.capabilities.map(keyOf) } : {},
+    ...options.meters?.length ? { meters: options.meters.map(keyOf) } : {},
+    ...options.estimates !== void 0 ? { estimates: options.estimates } : {},
+    ...options.metadata !== void 0 ? { metadata: options.metadata } : {}
+  };
 }
-function displayFromKey(key) {
-  return key.split("_").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+function buildEntitlementSpec(key, options = {}) {
+  return {
+    key,
+    ...options.description !== void 0 ? { description: options.description } : {},
+    ...options.capabilities?.length ? { capabilities: options.capabilities.map(keyOf) } : {},
+    ...options.featureGates !== void 0 ? { featureGates: options.featureGates } : {},
+    ...options.limits?.length ? { limits: options.limits } : {},
+    ...options.meters?.length ? { meters: options.meters.map(keyOf) } : {}
+  };
 }
-function parseRouteMatch(match) {
-  const trimmed = match.trim();
-  const space = trimmed.indexOf(" ");
-  if (space === -1) {
-    if (!trimmed.startsWith("/")) {
+function buildPlanSpec(key, options) {
+  const { capabilityKeys, capabilityLimits, creditGrants } = normalizePlanGrants(options);
+  const rawCaps = Array.isArray(options.raw?.capabilities) ? options.raw.capabilities.map(String) : [];
+  const capabilities = [.../* @__PURE__ */ new Set([...capabilityKeys, ...rawCaps])];
+  const spec = {
+    key,
+    name: options.name,
+    ...options.description !== void 0 ? { description: options.description } : {},
+    ...options.details ? { details: options.details } : {},
+    ...options.price ? {
+      recurring_fee_cents: options.price.recurring_fee_cents,
+      billing_interval: options.price.billing_interval,
+      ...options.price.free ? { free: true } : {}
+    } : {},
+    ...options.meters ? { meters: options.meters } : {},
+    ...creditGrants.length ? { grants: creditGrants } : {},
+    ...options.trialDays !== void 0 ? { trial_days: options.trialDays } : {},
+    ...options.maxMonthlySpendCents !== void 0 ? { max_monthly_spend_cents: options.maxMonthlySpendCents } : {},
+    ...options.minMonthlySpendCents !== void 0 ? { min_monthly_spend_cents: options.minMonthlySpendCents } : {},
+    ...options.limits ? { limits: options.limits } : {},
+    ...options.featureGates ? { featureGates: options.featureGates } : {},
+    ...Object.keys(capabilityLimits).length ? { capability_limits: capabilityLimits } : {},
+    ...options.overageBehavior !== void 0 ? { overageBehavior: options.overageBehavior } : {},
+    ...options.selfServeEnabled !== void 0 ? { selfServeEnabled: options.selfServeEnabled } : {},
+    ...options.legacy !== void 0 ? { legacy: options.legacy } : {},
+    ...options.archive ? { archive: options.archive } : {},
+    ...options.raw ?? {},
+    ...capabilities.length ? { capabilities } : {}
+  };
+  return spec;
+}
+function normalizePlanGrants(options) {
+  const capabilityKeys = (options.capabilities ?? []).map(keyOf);
+  const capabilityLimits = {
+    ...options.capabilityLimits ?? {}
+  };
+  const creditGrants = [];
+  for (const grant of options.grants ?? []) {
+    if (isCapabilityGrant(grant)) {
+      if (!capabilityKeys.includes(grant.capability)) {
+        capabilityKeys.push(grant.capability);
+      }
+      Object.assign(capabilityLimits, grant.limits ?? {});
+    } else {
+      creditGrants.push(grant);
+    }
+  }
+  return { capabilityKeys, capabilityLimits, creditGrants };
+}
+function buildMigrationDecl(id, options) {
+  return {
+    id,
+    from: normalizeMigrationPlanRef(options.from),
+    to: normalizeMigrationTargetRef(options.to),
+    newCustomers: options.newCustomers ?? "immediate",
+    existingCustomers: options.existingCustomers,
+    ...options.pins?.length ? {
+      pins: options.pins.map((pin) => ({
+        subscriber: pin.subscriber,
+        pinTo: {
+          plan: keyOf(pin.pinTo.plan),
+          version: pin.pinTo.version
+        },
+        ...pin.until !== void 0 ? { until: pin.until } : {},
+        ...pin.notes !== void 0 ? { notes: pin.notes } : {}
+      }))
+    } : {}
+  };
+}
+function assertUniqueMigrationIds(migrations) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const migration of migrations) {
+    if (seen.has(migration.id)) {
       throw new ManifestBuilderError(
-        `route "${match}": expected "METHOD /path" or "/path"`
+        `duplicate migration "${migration.id}" \u2014 each migration id must be declared once`
       );
     }
-    return { method: "*", path: trimmed };
-  }
-  const method = trimmed.slice(0, space).toUpperCase();
-  const path = trimmed.slice(space + 1).trim();
-  const methods = [
-    "GET",
-    "POST",
-    "PUT",
-    "PATCH",
-    "DELETE",
-    "HEAD",
-    "OPTIONS",
-    "*"
-  ];
-  if (!methods.includes(method)) {
-    throw new ManifestBuilderError(
-      `route "${match}": unknown HTTP method "${method}"`
-    );
-  }
-  if (!path.startsWith("/")) {
-    throw new ManifestBuilderError(
-      `route "${match}": path must start with "/"`
-    );
+    seen.add(migration.id);
   }
-  return { method, path };
 }
+function normalizeMigrationPlanRef(ref) {
+  return {
+    plan: keyOf(ref.plan),
+    ...ref.version !== void 0 ? { version: ref.version } : {}
+  };
+}
+function normalizeMigrationTargetRef(ref) {
+  return {
+    plan: keyOf(ref.plan),
+    version: ref.version ?? "head"
+  };
+}
+
+// src/product.ts
+var PRODUCT_BRAND = Symbol.for("farthershore.product.product");
+var PRODUCT_MANIFEST_COMPILER = Symbol.for(
+  "farthershore.product.manifestCompiler"
+);
 var Product = class {
   [PRODUCT_BRAND] = true;
   name;
   options;
   graph = new ManifestResourceGraph();
   defaultMeterCosts = [];
-  frontendManifest;
   productPatch = {};
   /** Sugar for binding API routes to features. */
   api;
   frontend;
   lifecycle;
-  offering;
-  /** Escape hatches — raw platform-schema JSON, validated at toIR(). */
+  /** Escape hatches — raw platform-schema JSON, validated by the compiler. */
   raw;
   constructor(name, options) {
     if (!name || typeof name !== "string") {
@@ -2504,7 +3174,7 @@ var Product = class {
     this.api = {
       route: (match, options2) => {
         const featureKey = keyOf(options2.feature);
-        const file = this.getFeatureFile(featureKey);
+        const file = this.getFeatureLayer(featureKey);
         if (!file) {
           throw new ManifestBuilderError(
             `api.route("${match}"): feature "${featureKey}" is not declared \u2014 call product.feature("${featureKey}", \u2026) first`
@@ -2518,41 +3188,17 @@ var Product = class {
     this.frontend = {
       nav: (items) => {
         const manifest = this.ensureFrontendManifest();
-        manifest.nav = items.map((item) => ({
-          label: item.label,
-          path: item.path,
-          ...item.capability !== void 0 ? { capability: keyOf(item.capability) } : {}
-        }));
+        setFrontendNav(manifest, items);
         this.syncFrontendGraphNode(manifest);
         return this;
       },
       page: (path, options2) => {
         const manifest = this.ensureFrontendManifest();
-        if (manifest.pages?.some((page) => page.path === path)) {
-          throw new ManifestBuilderError(
-            `duplicate frontend page "${path}" \u2014 each frontend page path must be declared once`
-          );
-        }
-        manifest.pages ??= [];
-        manifest.pages.push({
-          path,
-          title: options2.title,
-          requiresAuth: options2.requiresAuth,
-          ...options2.capability !== void 0 ? { capability: keyOf(options2.capability) } : {},
-          ...options2.components?.length ? {
-            components: options2.components.map((component) => ({
-              component: component.component,
-              ...component.props !== void 0 ? { props: component.props } : {},
-              ...component.capability !== void 0 ? { capability: keyOf(component.capability) } : {},
-              ...component.gateMode !== void 0 ? { gateMode: component.gateMode } : {}
-            }))
-          } : {}
-        });
+        addFrontendPage(manifest, path, options2);
         this.syncFrontendGraphNode(manifest);
         return this;
       },
       manifest: (manifest) => {
-        this.frontendManifest = manifest;
         this.syncFrontendGraphNode(manifest);
         return this;
       }
@@ -2560,77 +3206,60 @@ var Product = class {
     this.lifecycle = {
       migration: (id, options2) => {
         this.assertNewKey("lifecycle_migration", id, "migration");
-        const migration = {
-          id,
-          from: this.normalizeMigrationPlanRef(options2.from),
-          to: this.normalizeMigrationTargetRef(options2.to),
-          newCustomers: options2.newCustomers ?? "immediate",
-          existingCustomers: options2.existingCustomers,
-          ...options2.pins?.length ? {
-            pins: options2.pins.map((pin) => ({
-              subscriber: pin.subscriber,
-              pinTo: {
-                plan: keyOf(pin.pinTo.plan),
-                version: pin.pinTo.version
-              },
-              ...pin.until !== void 0 ? { until: pin.until } : {},
-              ...pin.notes !== void 0 ? { notes: pin.notes } : {}
-            }))
-          } : {}
-        };
+        const migration = buildMigrationDecl(id, options2);
         this.graph.register(
           "lifecycle_migration",
           id,
           migration,
-          this.migrationDependsOn(migration)
+          migrationDependsOn(migration)
         );
         return this;
       },
       migrations: (migrations) => {
-        this.assertUniqueMigrationIds(migrations);
+        assertUniqueMigrationIds(migrations);
         this.graph.clearKind("lifecycle_migration");
         for (const migration of migrations) {
           this.graph.register(
             "lifecycle_migration",
             migration.id,
             migration,
-            this.migrationDependsOn(migration)
+            migrationDependsOn(migration)
           );
         }
         return this;
       }
     };
-    this.offering = {
-      plan: (key, options2) => this.plan(key, options2)
-    };
     this.raw = {
       productPatch: (patch) => {
-        this.productPatch = deepMerge(this.productPatch, patch);
+        this.productPatch = mergeProductPatch(this.productPatch, patch);
         return this;
       },
       plan: (spec) => {
         this.assertNewKey("plan", spec.key, "plan");
-        this.graph.register("plan", spec.key, spec, this.planDependsOn(spec));
-        return this;
-      },
-      routesFile: (file) => {
-        this.assertNewKey("feature", file.feature, "feature");
-        this.registerFeatureFile(file);
+        this.graph.register(
+          "plan",
+          spec.key,
+          spec,
+          planDependsOn(
+            spec,
+            (kind, dependencyKey) => this.graph.has(kind, dependencyKey)
+          )
+        );
         return this;
       },
-      policyFile: (file) => {
-        this.assertNewKey("policy", file.name, "policy");
-        this.graph.register("policy", file.name, file);
+      routeLayer: (layer) => {
+        this.assertNewKey("feature", layer.feature, "feature");
+        this.registerFeatureLayer(layer);
         return this;
       },
-      capabilityFile: (file) => {
-        this.assertNewKey("capability", file.capability, "capability");
-        this.graph.register("capability", file.capability, file);
+      policyLayer: (layer) => {
+        this.assertNewKey("policy", layer.name, "policy");
+        this.graph.register("policy", layer.name, layer);
         return this;
       },
-      frontend: (manifest) => {
-        this.frontendManifest = manifest;
-        this.syncFrontendGraphNode(manifest);
+      capabilityLayer: (layer) => {
+        this.assertNewKey("capability", layer.capability, "capability");
+        this.graph.register("capability", layer.capability, layer);
         return this;
       }
     };
@@ -2643,7 +3272,7 @@ var Product = class {
       display: meterOptions.display ?? displayFromKey(key),
       ...meterOptions
     });
-    const ref = this.makeMeterRef(key);
+    const ref = makeMeterRef(key);
     if (routeDefault !== void 0) {
       this.defaultMeterCosts.push(
         this.normalizeMeterCost(ref.fixed(routeDefault))
@@ -2651,6 +3280,18 @@ var Product = class {
     }
     return ref;
   }
+  /**
+   * BYO-Backend V1 — declare a first-class backend (an always-running HTTP
+   * container Farther Shore wraps). Products may declare MULTIPLE backends;
+   * routes bind to one via `route(..., { backend })`. A product with exactly
+   * one backend (or exactly one marked `default: true`) makes it the implicit
+   * default, so single-backend products stay zero-config.
+   */
+  backend(id, options = {}) {
+    this.assertNewKey("backend", id, "backend");
+    this.graph.register("backend", id, createBackendNode(id, options));
+    return { kind: "backend", key: id };
+  }
   requests(options = {}) {
     return this.meter("requests", {
       display: options.display ?? "Requests",
@@ -2676,20 +3317,8 @@ var Product = class {
   }
   capability(key, options = {}) {
     this.assertNewKey("capability", key, "capability");
-    const file = {
-      capability: key,
-      ...options.description !== void 0 || options.title !== void 0 ? { description: options.description ?? options.title } : {},
-      ...options.mutationClass !== void 0 ? { mutation_class: options.mutationClass } : {},
-      ...options.includesFeatures?.length ? { includes_features: options.includesFeatures.map(keyOf) } : {},
-      ...options.includesPolicies?.length ? { includes_policies: options.includesPolicies.map(keyOf) } : {},
-      ...options.includesCapabilities?.length ? { includes_capabilities: options.includesCapabilities.map(keyOf) } : {}
-    };
-    this.graph.register(
-      "capability",
-      key,
-      file,
-      this.capabilityDependsOn(file)
-    );
+    const layer = buildCapabilityLayer(key, options);
+    this.graph.register("capability", key, layer, capabilityDependsOn(layer));
     return {
       kind: "capability",
       key,
@@ -2702,52 +3331,31 @@ var Product = class {
   }
   feature(key, options = {}) {
     this.assertNewKey("feature", key, "feature");
-    const file = {
-      feature: key,
-      routes: [],
-      ...options.description !== void 0 ? { description: options.description } : {},
-      ...options.mutationClass !== void 0 ? { mutation_class: options.mutationClass } : {},
-      ...options.cacheProfile !== void 0 ? { cacheProfile: options.cacheProfile } : {},
-      ...options.upstreamOrigin !== void 0 ? { upstream: { override_origin: options.upstreamOrigin } } : {},
-      ...options.policies?.length ? { policies: options.policies.map(keyOf) } : {},
-      ...options.capabilities?.length ? { capabilities: options.capabilities.map(keyOf) } : {},
-      ...options.plans?.length ? { plans: options.plans.map(keyOf) } : {},
-      ...options.actions?.length ? {
-        actions: options.actions.map(({ id, ...action }) => ({
-          id,
-          ...action
-        }))
-      } : {},
-      ...options.rolloutKey !== void 0 || options.requiredFlags?.length ? {
-        runtime: {
-          ...options.rolloutKey !== void 0 ? { rollout_key: options.rolloutKey } : {},
-          ...options.requiredFlags?.length ? { required_flags: options.requiredFlags } : {}
-        }
-      } : {}
-    };
-    for (const route of options.routes ?? []) {
-      file.routes.push(this.buildRoute(route.match, route));
-    }
-    this.registerFeatureFile(file);
+    const layer = buildFeatureLayer(
+      key,
+      options,
+      (match, routeOptions) => this.buildRoute(match, routeOptions)
+    );
+    this.registerFeatureLayer(layer);
     const ref = {
       kind: "feature",
       key,
       action: (id, actionOptions) => {
-        file.actions ??= [];
-        if (file.actions.some((action2) => action2.id === id) || this.graph.has("action", id)) {
+        layer.actions ??= [];
+        if (layer.actions.some((action2) => action2.id === id) || this.graph.has("action", id)) {
           throw new ManifestBuilderError(
             `duplicate action "${id}" \u2014 each action id must be declared once`
           );
         }
         const action = { id, ...actionOptions };
-        file.actions.push(action);
+        layer.actions.push(action);
         this.registerAction(key, action);
-        this.syncFeatureGraphNode(file);
+        this.syncFeatureGraphNode(layer);
         return { kind: "action", key: id };
       },
       route: (match, routeOptions) => {
-        file.routes.push(this.buildRoute(match, routeOptions ?? {}));
-        this.syncFeatureGraphNode(file);
+        layer.routes.push(this.buildRoute(match, routeOptions ?? {}));
+        this.syncFeatureGraphNode(layer);
         return ref;
       }
     };
@@ -2755,126 +3363,48 @@ var Product = class {
   }
   policy(name, options) {
     this.assertNewKey("policy", name, "policy");
-    const file = {
-      name,
-      type: options.type,
-      config: options.config,
-      ...options.description !== void 0 ? { description: options.description } : {},
-      ...options.mutationClass !== void 0 ? { mutation_class: options.mutationClass } : {},
-      ...options.cacheProfile !== void 0 ? { cacheProfile: options.cacheProfile } : {},
-      ...options.compatibleWith ? {
-        compatible_with: {
-          ...options.compatibleWith.routeTypes ? { route_types: options.compatibleWith.routeTypes } : {},
-          ...options.compatibleWith.meters ? { meters: options.compatibleWith.meters.map(keyOf) } : {},
-          ...options.compatibleWith.authModes ? { auth_modes: options.compatibleWith.authModes } : {}
-        }
-      } : {}
-    };
-    this.graph.register("policy", name, file, this.policyDependsOn(file));
+    const layer = buildPolicyLayer(name, options);
+    this.graph.register("policy", name, layer, policyDependsOn(layer));
     return { kind: "policy", key: name };
   }
   surface(type, options = {}) {
-    const key = options.key ?? type;
-    this.assertNewKey("surface", key, "surface");
-    const surface = {
-      key,
-      type,
-      ...options.display !== void 0 ? { display: options.display } : {},
-      ...options.description !== void 0 ? { description: options.description } : {}
-    };
-    this.graph.register("surface", key, surface);
-    return { kind: "surface", key };
+    const surface = buildSurfaceSpec(type, options);
+    this.assertNewKey("surface", surface.key, "surface");
+    this.graph.register("surface", surface.key, surface);
+    return { kind: "surface", key: surface.key };
   }
   workflow(key, options = {}) {
     this.assertNewKey("workflow", key, "workflow");
-    const workflow = {
-      key,
-      kind: options.kind ?? "async_job",
-      trigger: options.trigger ?? { type: "manual" },
-      ...options.title !== void 0 ? { title: options.title } : {},
-      ...options.description !== void 0 ? { description: options.description } : {},
-      ...options.capabilities?.length ? { capabilities: options.capabilities.map(keyOf) } : {},
-      ...options.meters?.length ? { meters: options.meters.map(keyOf) } : {},
-      ...options.estimates !== void 0 ? { estimates: options.estimates } : {},
-      ...options.metadata !== void 0 ? { metadata: options.metadata } : {}
-    };
-    this.graph.register(
-      "workflow",
-      key,
-      workflow,
-      this.workflowDependsOn(workflow)
-    );
+    const workflow = buildWorkflowSpec(key, options);
+    this.graph.register("workflow", key, workflow, workflowDependsOn(workflow));
     return { kind: "workflow", key };
   }
   entitlement(key, options = {}) {
     this.assertNewKey("entitlement", key, "entitlement");
-    const entitlement = {
-      key,
-      ...options.description !== void 0 ? { description: options.description } : {},
-      ...options.capabilities?.length ? { capabilities: options.capabilities.map(keyOf) } : {},
-      ...options.featureGates !== void 0 ? { featureGates: options.featureGates } : {},
-      ...options.limits?.length ? { limits: options.limits } : {},
-      ...options.meters?.length ? { meters: options.meters.map(keyOf) } : {}
-    };
+    const entitlement = buildEntitlementSpec(key, options);
     this.graph.register(
       "entitlement",
       key,
       entitlement,
-      this.entitlementDependsOn(entitlement)
+      entitlementDependsOn(
+        entitlement,
+        (kind, dependencyKey) => this.graph.has(kind, dependencyKey)
+      )
     );
     return { kind: "entitlement", key };
   }
   plan(key, options) {
     this.assertNewKey("plan", key, "plan");
-    const capabilityKeys = (options.capabilities ?? []).map(keyOf);
-    const capabilityLimits = {
-      ...options.capabilityLimits ?? {}
-    };
-    const creditGrants = [];
-    for (const grant of options.grants ?? []) {
-      if (isCapabilityGrant(grant)) {
-        if (!capabilityKeys.includes(grant.capability)) {
-          capabilityKeys.push(grant.capability);
-        }
-        Object.assign(capabilityLimits, grant.limits ?? {});
-      } else {
-        creditGrants.push(grant);
-      }
-    }
-    const spec = {
+    const spec = buildPlanSpec(key, options);
+    this.graph.register(
+      "plan",
       key,
-      name: options.name,
-      ...options.description !== void 0 ? { description: options.description } : {},
-      ...options.details ? { details: options.details } : {},
-      ...options.price ? {
-        recurring_fee_cents: options.price.recurring_fee_cents,
-        billing_interval: options.price.billing_interval,
-        ...options.price.free ? { free: true } : {}
-      } : {},
-      ...options.meters ? { meters: options.meters } : {},
-      ...creditGrants.length ? { grants: creditGrants } : {},
-      ...options.trialDays !== void 0 ? { trial_days: options.trialDays } : {},
-      ...options.maxMonthlySpendCents !== void 0 ? { max_monthly_spend_cents: options.maxMonthlySpendCents } : {},
-      ...options.minMonthlySpendCents !== void 0 ? { min_monthly_spend_cents: options.minMonthlySpendCents } : {},
-      ...options.limits ? { limits: options.limits } : {},
-      ...options.featureGates ? { featureGates: options.featureGates } : {},
-      ...Object.keys(capabilityLimits).length ? { capability_limits: capabilityLimits } : {},
-      ...options.overageBehavior !== void 0 ? { overageBehavior: options.overageBehavior } : {},
-      ...options.selfServeEnabled !== void 0 ? { selfServeEnabled: options.selfServeEnabled } : {},
-      ...options.legacy !== void 0 ? { legacy: options.legacy } : {},
-      ...options.archive ? { archive: options.archive } : {},
-      ...options.raw ?? {}
-    };
-    const rawCaps = Array.isArray(
-      spec.capabilities
-    ) ? spec.capabilities.map(
-      String
-    ) : [];
-    const mergedCaps = [.../* @__PURE__ */ new Set([...capabilityKeys, ...rawCaps])];
-    if (mergedCaps.length) {
-      spec.capabilities = mergedCaps;
-    }
-    this.graph.register("plan", key, spec, this.planDependsOn(spec));
+      spec,
+      planDependsOn(
+        spec,
+        (kind, dependencyKey) => this.graph.has(kind, dependencyKey)
+      )
+    );
     return { kind: "plan", key };
   }
   use(...modules) {
@@ -2887,11 +3417,19 @@ var Product = class {
   resourceGraph() {
     return this.graph.snapshot();
   }
-  /** Assemble + validate the Manifest IR. Throws ManifestValidationError
-   *  with structured issues when the declared state is invalid. */
-  toIR() {
-    const routes = this.materializeFeatureFiles();
-    this.assertRouteMeteringValid(routes);
+  /** @internal Internal platform compiler entrypoint. Builder code exports the
+   *  Product; the bot/CLI/build-runner decide when to compile and apply it. */
+  [PRODUCT_MANIFEST_COMPILER]() {
+    const routes = this.materializeFeatureLayers();
+    assertRouteMeteringValid(
+      routes,
+      this.graph.values("meter")
+    );
+    assertBackendBindingsValid(
+      routes,
+      this.graph.values("backend"),
+      this.graph.values("meter")
+    );
     this.assertGraphDependenciesSatisfied();
     const candidate = {
       irVersion: 1,
@@ -2900,245 +3438,67 @@ var Product = class {
       routes,
       policies: this.graph.sortedValues(
         "policy",
-        (file) => file.name
+        (layer) => layer.name
       ),
       capabilities: this.graph.sortedValues(
         "capability",
-        (file) => file.capability
-      ),
-      runtime: { rollout: null, flags: null, migrations: null }
+        (layer) => layer.capability
+      )
     };
     const result = validateManifestIr(candidate);
     if (!result.ok) throw new ManifestValidationError(result.issues);
     return { ir: result.ir, irHash: result.irHash };
   }
   buildProductSpec() {
-    const options = this.options;
-    const base = {
-      product: {
-        name: this.name,
-        baseUrl: options.origin,
-        ...options.displayName !== void 0 ? { displayName: options.displayName } : {},
-        ...options.description !== void 0 ? { description: options.description } : {},
-        ...options.sandboxOrigin !== void 0 ? { sandboxBaseUrl: options.sandboxOrigin } : {},
-        ...options.visibility !== void 0 ? { visibility: options.visibility } : {},
-        ...options.logoUrl !== void 0 ? { logoUrl: options.logoUrl } : {},
-        ...options.primaryColor !== void 0 ? { primaryColor: options.primaryColor } : {},
-        ...options.envBranchPrefix !== void 0 ? { envBranchPrefix: options.envBranchPrefix } : {}
-      },
-      gateway: {
-        ...options.authHeader !== void 0 ? { authHeader: options.authHeader } : {},
-        ...options.upstreamAuth !== void 0 ? { upstreamAuth: options.upstreamAuth } : {}
-      },
-      metering: {
-        meters: this.buildMeterDefinitions(),
-        ...options.billOn4xx !== void 0 ? { billOn4xx: options.billOn4xx } : {}
-      },
-      ...options.billing !== void 0 ? { billing: options.billing } : {},
-      ...options.operatorPolicies !== void 0 ? { policies: options.operatorPolicies } : {},
-      ...options.customerContext !== void 0 ? { customer_context: buildCustomerContext(options.customerContext) } : {},
-      ...this.graph.values("surface").length ? {
-        surfaces: this.graph.sortedValues(
-          "surface",
-          (surface) => surface.key
-        )
-      } : {},
-      ...this.graph.values("entitlement").length ? {
-        entitlements: this.graph.sortedValues(
-          "entitlement",
-          (entitlement) => entitlement.key
-        )
-      } : {},
-      ...this.graph.values("workflow").length ? {
-        workflows: this.graph.sortedValues(
-          "workflow",
-          (workflow) => workflow.key
-        )
-      } : {},
-      ...this.graph.has("frontend", "manifest") ? {
-        frontend: this.graph.get(
-          "frontend",
-          "manifest"
-        )?.value
-      } : {},
-      ...this.graph.values("lifecycle_migration").length ? {
-        migrations: this.graph.sortedValues(
-          "lifecycle_migration",
-          (migration) => migration.id
-        )
-      } : {},
-      ...this.graph.values("counted_resource").length ? {
-        resources: this.graph.sortedValues(
-          "counted_resource",
-          (resource) => resource.name
-        )
-      } : {},
-      plans: this.graph.sortedValues("plan", (plan) => plan.key)
-    };
-    return deepMerge(
-      base,
-      this.productPatch
-    );
-  }
-  buildMeterDefinitions() {
-    const routeValueMeters = this.routeValueMeterKeys();
-    return this.graph.sortedValues("meter", (meter) => meter.key).map((meter) => {
-      if (meter.aggregation !== void 0) return meter;
-      if (!routeValueMeters.has(meter.key)) return meter;
-      return { ...meter, aggregation: "SUM" };
+    return assembleProductSpec({
+      name: this.name,
+      options: this.options,
+      productPatch: this.productPatch,
+      meters: this.graph.values("meter"),
+      defaultMeterCosts: this.defaultMeterCosts,
+      backends: this.graph.values("backend"),
+      surfaces: this.graph.values("surface"),
+      entitlements: this.graph.values("entitlement"),
+      workflows: this.graph.values("workflow"),
+      frontendManifest: this.graph.get(
+        "frontend",
+        "manifest"
+      )?.value,
+      migrations: this.graph.values("lifecycle_migration"),
+      resources: this.graph.values("counted_resource"),
+      plans: this.graph.values("plan"),
+      featureLayers: this.graph.values("feature")
     });
   }
-  routeValueMeterKeys() {
-    const keys = /* @__PURE__ */ new Set();
-    for (const cost of this.defaultMeterCosts) {
-      keys.add(cost.meter);
-    }
-    for (const file of this.graph.values("feature")) {
-      for (const route of file.routes) {
-        for (const meter of Object.keys(route.metering?.defaults ?? {})) {
-          keys.add(meter);
-        }
-        for (const meter of route.metering?.reports ?? []) {
-          keys.add(meter);
-        }
-      }
-    }
-    for (const workflow of this.graph.values("workflow")) {
-      for (const meter of workflow.meters ?? []) keys.add(meter);
-      for (const meter of Object.keys(workflow.estimates ?? {}))
-        keys.add(meter);
-    }
-    return keys;
-  }
   buildRoute(match, options) {
-    const parsed = parseRouteMatch(match);
-    const metering = this.buildRouteMetering(options);
-    return {
-      match: parsed,
-      ...metering ? { metering } : {},
-      ...options.unmetered !== void 0 ? { unmetered: options.unmetered } : {},
-      ...options.inheritDefaultMeters !== void 0 ? { inheritDefaultMeters: options.inheritDefaultMeters } : {},
-      ...options.action !== void 0 ? { action: keyOf(options.action) } : {}
-    };
-  }
-  makeMeterRef(key) {
-    return {
-      kind: "meter",
-      key,
-      fixed: (value) => ({ kind: "meter_cost", meter: key, value }),
-      estimate: (value) => ({ kind: "meter_cost", meter: key, value })
-    };
+    return buildRouteDefinition(match, options, {
+      normalizeMeterCost: (cost) => this.normalizeMeterCost(cost),
+      getMeterDefinition: (key) => this.graph.get("meter", key)?.value
+    });
   }
-  buildRouteMetering(options) {
-    if (options.unmetered === true) return void 0;
-    const defaults = {};
-    for (const cost of this.normalizeMeterCosts(options.costs)) {
-      defaults[cost.meter] = (defaults[cost.meter] ?? 0) + cost.value;
-    }
-    const reports = [
-      ...new Set(this.normalizeMeterRefs(options.reports ?? []))
-    ];
-    const estimates = {};
-    for (const meter of reports) {
-      const definition = this.graph.get(
-        "meter",
-        meter
-      )?.value;
-      if (typeof definition?.estimate === "number") {
-        estimates[meter] = definition.estimate;
-      }
-    }
-    for (const [meter, value] of Object.entries(options.estimates ?? {})) {
-      estimates[meter] = value;
-    }
-    const out = {};
-    if (Object.keys(defaults).length) out.defaults = defaults;
-    if (reports.length) out.reports = reports;
-    if (Object.keys(estimates).length) out.estimates = estimates;
-    if (options.onStatusCodes !== void 0)
-      out.onStatusCodes = options.onStatusCodes;
-    return Object.keys(out).length ? out : void 0;
-  }
-  materializeFeatureFiles() {
-    return this.graph.sortedValues("feature", (file) => file.feature).map((file) => ({
-      ...file,
-      routes: file.routes.map((route) => this.materializeRoute(route))
+  materializeFeatureLayers() {
+    return this.graph.sortedValues("feature", (layer) => layer.feature).map((layer) => ({
+      ...layer,
+      routes: layer.routes.map(
+        (route) => materializeRoute(route, this.defaultMeterCosts)
+      )
     }));
   }
-  materializeRoute(route) {
-    if (route.unmetered === true) return route;
-    const defaults = {
-      ...route.metering?.defaults ?? {}
-    };
-    if (route.inheritDefaultMeters !== false) {
-      for (const cost of this.defaultMeterCosts) {
-        defaults[cost.meter] = (defaults[cost.meter] ?? 0) + cost.value;
-      }
-    }
-    const hasMetering = route.metering !== void 0 || Object.keys(defaults).length > 0;
-    const metering = hasMetering ? {
-      ...route.metering ?? {},
-      ...Object.keys(defaults).length ? { defaults } : {}
-    } : void 0;
-    return {
-      ...route,
-      ...metering ? { metering } : {}
-    };
-  }
   normalizeMeterCost(cost) {
-    if (!cost || cost.kind !== "meter_cost") {
-      throw new ManifestBuilderError(
-        "meter cost must be created by meter.fixed(value)"
-      );
-    }
-    if (!this.graph.has("meter", cost.meter)) {
-      throw new ManifestBuilderError(
-        `meter cost references unknown meter "${cost.meter}"`
-      );
-    }
-    if (!Number.isFinite(cost.value) || cost.value < 0) {
-      throw new ManifestBuilderError(
-        `meter "${cost.meter}" fixed value must be a non-negative finite number`
-      );
-    }
-    return cost;
-  }
-  normalizeMeterCosts(costs) {
-    if (!costs) return [];
-    const entries = Array.isArray(costs) ? costs : [costs];
-    return entries.map((cost) => this.normalizeMeterCost(cost));
-  }
-  normalizeMeterRefs(refs) {
-    const entries = Array.isArray(refs) ? refs : [refs];
-    return entries.map(keyOf);
+    return normalizeMeterCost(
+      cost,
+      (meter) => this.graph.has("meter", meter)
+    );
   }
   ensureFrontendManifest() {
-    this.frontendManifest ??= { version: 1, nav: [], pages: [] };
-    this.syncFrontendGraphNode(this.frontendManifest);
-    return this.frontendManifest;
-  }
-  normalizeMigrationPlanRef(ref) {
-    return {
-      plan: keyOf(ref.plan),
-      ...ref.version !== void 0 ? { version: ref.version } : {}
-    };
-  }
-  normalizeMigrationTargetRef(ref) {
-    return {
-      plan: keyOf(ref.plan),
-      version: ref.version ?? "head"
-    };
-  }
-  assertUniqueMigrationIds(migrations) {
-    const seen = /* @__PURE__ */ new Set();
-    for (const migration of migrations) {
-      if (seen.has(migration.id)) {
-        throw new ManifestBuilderError(
-          `duplicate migration "${migration.id}" \u2014 each migration id must be declared once`
-        );
-      }
-      seen.add(migration.id);
-    }
+    const existing = this.graph.get(
+      "frontend",
+      "manifest"
+    )?.value;
+    if (existing) return existing;
+    const manifest = createFrontendManifest();
+    this.syncFrontendGraphNode(manifest);
+    return manifest;
   }
   assertNewKey(kind, key, label) {
     if (this.graph.has(kind, key)) {
@@ -3148,39 +3508,24 @@ var Product = class {
     }
   }
   assertGraphDependenciesSatisfied() {
-    const missing = this.graph.missingDependencies();
-    if (missing.length === 0) return;
-    const details = missing.slice(0, 8).map(
-      ({ from, missing: dependency }) => `${describeResourceUrn(from)} depends on missing ${describeResourceUrn(
-        dependency
-      )}`
-    ).join("; ");
-    const suffix = missing.length > 8 ? `; plus ${missing.length - 8} more` : "";
-    throw new ManifestBuilderError(
-      `manifest has unresolved resource reference(s): ${details}${suffix}`
-    );
+    assertResourceDependenciesSatisfied(this.graph.missingDependencies());
   }
-  getFeatureFile(key) {
+  getFeatureLayer(key) {
     return this.graph.get("feature", key)?.value ?? null;
   }
-  registerFeatureFile(file) {
+  registerFeatureLayer(layer) {
     this.graph.register(
       "feature",
-      file.feature,
-      file,
-      this.featureDependsOn(file)
+      layer.feature,
+      layer,
+      featureDependsOn(layer)
     );
-    for (const action of file.actions ?? []) {
-      this.registerAction(file.feature, action);
+    for (const action of layer.actions ?? []) {
+      this.registerAction(layer.feature, action);
     }
   }
-  syncFeatureGraphNode(file) {
-    this.graph.upsert(
-      "feature",
-      file.feature,
-      file,
-      this.featureDependsOn(file)
-    );
+  syncFeatureGraphNode(layer) {
+    this.graph.upsert("feature", layer.feature, layer, featureDependsOn(layer));
   }
   registerAction(featureKey, action) {
     this.assertNewKey("action", action.id, "action");
@@ -3188,7 +3533,7 @@ var Product = class {
       "action",
       action.id,
       action,
-      this.actionDependsOn(featureKey, action)
+      actionDependsOn(featureKey, action)
     );
   }
   syncFrontendGraphNode(manifest) {
@@ -3196,195 +3541,15 @@ var Product = class {
       "frontend",
       "manifest",
       manifest,
-      this.frontendDependsOn(manifest)
-    );
-  }
-  capabilityDependsOn(file) {
-    return [
-      ...this.dependenciesFor("feature", file.includes_features),
-      ...this.dependenciesFor("policy", file.includes_policies),
-      ...this.dependenciesFor("capability", file.includes_capabilities)
-    ];
-  }
-  policyDependsOn(file) {
-    return this.dependenciesFor("meter", file.compatible_with?.meters);
-  }
-  entitlementDependsOn(entitlement) {
-    const limitDimensions = (entitlement.limits ?? []).map(
-      (limit) => limit.dimension
-    );
-    return [
-      ...this.dependenciesFor("capability", entitlement.capabilities),
-      ...this.existingDependenciesFor("meter", [
-        ...entitlement.meters ?? [],
-        ...limitDimensions
-      ])
-    ];
-  }
-  workflowDependsOn(workflow) {
-    return [
-      ...this.dependenciesFor("capability", workflow.capabilities),
-      ...this.dependenciesFor("meter", [
-        ...workflow.meters ?? [],
-        ...Object.keys(workflow.estimates ?? {})
-      ])
-    ];
-  }
-  featureDependsOn(file) {
-    const meterKeys = file.routes.flatMap(
-      (route) => this.routeMeterDependencyKeys(route)
-    );
-    return [
-      ...this.dependenciesFor("policy", file.policies),
-      ...this.dependenciesFor("capability", file.capabilities),
-      ...this.dependenciesFor("plan", file.plans),
-      ...this.dependenciesFor("meter", meterKeys)
-    ];
-  }
-  routeMeterDependencyKeys(route) {
-    const keys = /* @__PURE__ */ new Set();
-    for (const meter of Object.keys(route.metering?.defaults ?? {})) {
-      keys.add(meter);
-    }
-    for (const meter of route.metering?.reports ?? []) keys.add(meter);
-    for (const meter of Object.keys(route.metering?.estimates ?? {})) {
-      keys.add(meter);
-    }
-    return [...keys];
-  }
-  assertRouteMeteringValid(files) {
-    const declaredMeters = new Set(
-      this.graph.values("meter").map((meter) => meter.key)
-    );
-    for (const file of files) {
-      file.routes.forEach((route, routeIndex) => {
-        if (route.unmetered === true) return;
-        const defaults = new Set(Object.keys(route.metering?.defaults ?? {}));
-        for (const meter of defaults) {
-          if (declaredMeters.has(meter)) continue;
-          throw new ManifestBuilderError(
-            `feature "${file.feature}" route ${routeIndex}: fixed meter "${meter}" is not declared \u2014 declare it with product.meter("${meter}", ...) first`
-          );
-        }
-        for (const meter of route.metering?.reports ?? []) {
-          if (!declaredMeters.has(meter)) {
-            throw new ManifestBuilderError(
-              `feature "${file.feature}" route ${routeIndex}: reported meter "${meter}" is not declared \u2014 declare it with product.meter("${meter}", ...) first`
-            );
-          }
-          if (defaults.has(meter)) {
-            throw new ManifestBuilderError(
-              `feature "${file.feature}" route ${routeIndex}: meter "${meter}" cannot be both a fixed route cost and a dynamic report`
-            );
-          }
-        }
-        for (const meter of route.metering?.reports ?? []) {
-          const definition = this.graph.get(
-            "meter",
-            meter
-          )?.value;
-          const enforcement = definition?.enforcementType ?? "estimated_then_settled";
-          const hasEstimate = route.metering?.estimates && Object.prototype.hasOwnProperty.call(
-            route.metering.estimates,
-            meter
-          );
-          if ((enforcement === "exact_pre_request" || enforcement === "estimated_then_settled") && !hasEstimate) {
-            throw new ManifestBuilderError(
-              `feature "${file.feature}" route ${routeIndex}: reported meter "${meter}" needs an estimate for gateway admission`
-            );
-          }
-        }
-        for (const meter of Object.keys(route.metering?.estimates ?? {})) {
-          if (declaredMeters.has(meter)) continue;
-          throw new ManifestBuilderError(
-            `feature "${file.feature}" route ${routeIndex}: estimate meter "${meter}" is not declared \u2014 declare it with product.meter("${meter}", ...) first`
-          );
-        }
-      });
-    }
-  }
-  actionDependsOn(featureKey, action) {
-    return [
-      resourceDependency("feature", featureKey),
-      ...action.resource ? [resourceDependency("counted_resource", action.resource.resource)] : []
-    ];
-  }
-  planDependsOn(plan) {
-    const caps = Array.isArray(plan.capabilities) ? plan.capabilities.map(String) : [];
-    const limitDimensions = (plan.limits ?? []).map((limit) => limit.dimension);
-    const pricedMeterDimensions = (plan.meters ?? []).map(
-      (meter) => meter.dimension
+      frontendDependsOn(manifest)
     );
-    const capacityKeys = Object.keys(plan.capability_limits ?? {});
-    return [
-      ...this.dependenciesFor("capability", caps),
-      ...this.existingDependenciesFor("meter", [
-        ...limitDimensions,
-        ...pricedMeterDimensions
-      ]),
-      ...this.existingDependenciesFor("counted_resource", capacityKeys)
-    ];
-  }
-  migrationDependsOn(migration) {
-    return [
-      resourceDependency("plan", migration.from.plan),
-      resourceDependency("plan", migration.to.plan),
-      ...this.dependenciesFor(
-        "plan",
-        migration.pins?.map((pin) => pin.pinTo.plan)
-      )
-    ];
-  }
-  frontendDependsOn(manifest) {
-    return this.dependenciesFor("capability", [
-      ...(manifest.nav ?? []).flatMap(
-        (item) => item.capability ? [item.capability] : []
-      ),
-      ...(manifest.pages ?? []).flatMap((page) => [
-        ...page.capability ? [page.capability] : [],
-        ...(page.components ?? []).flatMap(
-          (component) => component.capability ? [component.capability] : []
-        )
-      ])
-    ]);
-  }
-  dependenciesFor(kind, keys) {
-    return [...new Set(keys ?? [])].map((key) => resourceDependency(kind, key));
-  }
-  existingDependenciesFor(kind, keys) {
-    return [...new Set(keys)].filter((key) => this.graph.has(kind, key)).map((key) => resourceDependency(kind, key));
   }
 };
 function isProduct(value) {
   return typeof value === "object" && value !== null && value[PRODUCT_BRAND] === true;
 }
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function buildCustomerContext(options) {
-  return {
-    ...options.identityRequirement !== void 0 ? { identity_requirement: options.identityRequirement } : {},
-    ...options.contextTokens !== void 0 ? { context_tokens: options.contextTokens } : {},
-    ...options.customerAuth !== void 0 ? { portal_auth: options.customerAuth } : {}
-  };
-}
-function deepMerge(base, patch) {
-  const out = { ...base };
-  for (const [key, value] of Object.entries(patch)) {
-    const existing = out[key];
-    if (isPlainObject(existing) && isPlainObject(value)) {
-      out[key] = deepMerge(existing, value);
-    } else {
-      out[key] = value;
-    }
-  }
-  return out;
-}
-function describeResourceUrn(urn) {
-  const parts = urn.split(":");
-  const kind = parts[3] ?? "resource";
-  const key = parts.slice(4).join(":");
-  return `${kind} "${decodeURIComponent(key)}"`;
+function compileProductToManifest(product) {
+  return product[PRODUCT_MANIFEST_COMPILER]();
 }
 
 // src/bin.ts
@@ -3487,7 +3652,7 @@ async function main() {
     process.exit(1);
   }
   try {
-    const { ir, irHash } = candidate.toIR();
+    const { ir, irHash } = compileProductToManifest(candidate);
     await writeFile(
       resolve(process.cwd(), args.out),
       `${JSON.stringify({ ir, irHash }, null, 2)}