@iveri/contracts 0.2.0 → 0.4.0

package/dist/esm/enum/user-permission.enum.d.ts

@@ -60,7 +60,36 @@ export declare enum UserPermission {
     CONDUIT_REPLAY_EXECUTE = "conduit:replay:execute",
     CONDUIT_PROVIDER_READ = "conduit:provider:read",
     /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
-    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage"
+    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage",
+    /** Read destinations. Never exposes their stored header values. */
+    CONDUIT_DESTINATION_READ = "conduit:destination:read",
+    /**
+     * Create, amend or delete a destination — **a URL Conduit will then post to on its own**,
+     * repeatedly, from inside our network, carrying whatever a provider sent.
+     *
+     * Deliberately a single manage permission rather than create/update/delete: the dangerous
+     * act is naming the URL at all, and splitting it would imply the three carry different
+     * risk. They do not.
+     */
+    CONDUIT_DESTINATION_MANAGE = "conduit:destination:manage",
+    CONDUIT_ROUTE_READ = "conduit:route:read",
+    /** Define which captures fan out to which destinations. */
+    CONDUIT_ROUTE_MANAGE = "conduit:route:manage",
+    /**
+     * Read the delivery log and the dead-letter queue, including each attempt's response.
+     *
+     * Grouped with reading rather than with operating the queue: a delivery record holds a
+     * target's response body, which can echo back the payload that was sent.
+     */
+    CONDUIT_DELIVERY_READ = "conduit:delivery:read",
+    /**
+     * Redrive a dead-lettered delivery, or cancel one still pending.
+     *
+     * Separate from `CONDUIT_DELIVERY_READ` for the same reason replay is separate from capture
+     * read: it causes an outbound request rather than returning a row, and redriving a large
+     * dead-letter backlog is a way to flood a customer's own service.
+     */
+    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate"
 }
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/esm/enum/user-permission.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/esm/enum/user-permission.enum.js

@@ -73,6 +73,38 @@ export var UserPermission;
     UserPermission["CONDUIT_PROVIDER_READ"] = "conduit:provider:read";
     /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
     UserPermission["CONDUIT_PROVIDER_MANAGE"] = "conduit:provider:manage";
+    // ── Destination (gateway mode) ──────────────────────────────────────────
+    /** Read destinations. Never exposes their stored header values. */
+    UserPermission["CONDUIT_DESTINATION_READ"] = "conduit:destination:read";
+    /**
+     * Create, amend or delete a destination — **a URL Conduit will then post to on its own**,
+     * repeatedly, from inside our network, carrying whatever a provider sent.
+     *
+     * Deliberately a single manage permission rather than create/update/delete: the dangerous
+     * act is naming the URL at all, and splitting it would imply the three carry different
+     * risk. They do not.
+     */
+    UserPermission["CONDUIT_DESTINATION_MANAGE"] = "conduit:destination:manage";
+    // ── Route (gateway mode) ────────────────────────────────────────────────
+    UserPermission["CONDUIT_ROUTE_READ"] = "conduit:route:read";
+    /** Define which captures fan out to which destinations. */
+    UserPermission["CONDUIT_ROUTE_MANAGE"] = "conduit:route:manage";
+    // ── Delivery (gateway mode) ─────────────────────────────────────────────
+    /**
+     * Read the delivery log and the dead-letter queue, including each attempt's response.
+     *
+     * Grouped with reading rather than with operating the queue: a delivery record holds a
+     * target's response body, which can echo back the payload that was sent.
+     */
+    UserPermission["CONDUIT_DELIVERY_READ"] = "conduit:delivery:read";
+    /**
+     * Redrive a dead-lettered delivery, or cancel one still pending.
+     *
+     * Separate from `CONDUIT_DELIVERY_READ` for the same reason replay is separate from capture
+     * read: it causes an outbound request rather than returning a row, and redriving a large
+     * dead-letter backlog is a way to flood a customer's own service.
+     */
+    UserPermission["CONDUIT_DELIVERY_OPERATE"] = "conduit:delivery:operate";
 })(UserPermission || (UserPermission = {}));
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/esm/enum/user-permission.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,cAkEX;AAlED,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;AACvD,CAAC,EAlEW,cAAc,KAAd,cAAc,QAkEzB;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,cAqGX;AArGD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;AACzD,CAAC,EArGW,cAAc,KAAd,cAAc,QAqGzB;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/dist/esm/type/api-response.type.d.ts

@@ -1,18 +1,5 @@
 import type { ErrorCode } from '../enum/error-code.enum.js';
 import type { Maybe } from './nil.type.js';
-/**
- * Envelope for a successful HTTP response.
- *
- * Every service wraps its payload in this shape, so a client can branch on
- * `success` before touching anything else and never has to guess whether a
- * 200 body is data or an error report.
- *
- * @typeParam T - the response payload type.
- */
-export interface ApiSuccessResponse<T> {
-    success: true;
-    data: T;
-}
 /**
  * The error half of {@link ApiErrorResponse}.
  *
@@ -36,8 +23,30 @@ export interface ApiErrorBody {
     correlationId?: Maybe<string>;
 }
 /**
- * Envelope for a failed HTTP response, emitted by the SDK's global exception
- * filter for every non-2xx status.
+ * Envelope for a failed response, emitted by the SDK's `GlobalExceptionFilter` for every
+ * non-2xx status.
+ *
+ * **Only errors are enveloped.** A success is the bare payload — a tenant response *is* a
+ * tenant, not a `{ success, data }` wrapper around one. So `success: false` discriminates a
+ * shape the client receives *instead of* its payload, never alongside it:
+ *
+ * ```ts
+ * const body: unknown = await response.json();
+ *
+ * if (!response.ok) {
+ *     throw new ApiError(body as ApiErrorResponse);
+ * }
+ *
+ * return body as Tenant;
+ * ```
+ *
+ * This file also declared `ApiSuccessResponse<T>` and a union over the two until 0.3.0.
+ * Nothing ever sent it: both `iveri-identity-api` and `conduit-api` register the exception
+ * filter and no success interceptor. A type describing a response no service produces is worse
+ * than no type at all — reading it, the natural thing to write is `body.data`, which is
+ * `undefined` for every call in the application. It was removed rather than made true, because
+ * bare payloads were already shipped across two services and a frontend and the envelope added
+ * nothing to the HTTP status a client must check regardless.
  */
 export interface ApiErrorResponse {
     success: false;
@@ -47,17 +56,4 @@ export interface ApiErrorResponse {
     /** Request path that produced the error, without the query string. */
     path: string;
 }
-/**
- * Discriminated union of both envelopes. Narrow on `success`:
- *
- * ```ts
- * if (!response.success) {
- *     return handle(response.error.code);
- * }
- * use(response.data);
- * ```
- *
- * @typeParam T - the payload type on the success branch.
- */
-export type ApiResponse<T> = ApiSuccessResponse<T> | ApiErrorResponse;
 //# sourceMappingURL=api-response.type.d.ts.map

package/dist/esm/type/api-response.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-response.type.d.ts","sourceRoot":"","sources":["../../../src/type/api-response.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,CAAC,CAAC;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB,iFAAiF;IACjF,IAAI,EAAE,SAAS,CAAC;IAEhB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEzC;;;OAGG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IAEpB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAElB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC"}
+{"version":3,"file":"api-response.type.d.ts","sourceRoot":"","sources":["../../../src/type/api-response.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB,iFAAiF;IACjF,IAAI,EAAE,SAAS,CAAC;IAEhB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEzC;;;OAGG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IAEpB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAElB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;CAChB"}

package/dist/esm/type/index.d.ts

@@ -1,5 +1,6 @@
 export * from './api-response.type.js';
 export * from './cursor-page.type.js';
+export * from './iso-date-time.type.js';
 export * from './nil.type.js';
 export * from './paginated.type.js';
 export * from './uuid.type.js';

package/dist/esm/type/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/esm/type/index.js

@@ -1,5 +1,6 @@
 export * from './api-response.type.js';
 export * from './cursor-page.type.js';
+export * from './iso-date-time.type.js';
 export * from './nil.type.js';
 export * from './paginated.type.js';
 export * from './uuid.type.js';

package/dist/esm/type/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/esm/type/iso-date-time.type.d.ts

@@ -0,0 +1,17 @@
+/**
+ * An ISO-8601 timestamp as it appears on the wire: `2026-08-02T09:41:17.312Z`.
+ *
+ * **JSON has no date type**, so every timestamp a service sends is a string, whatever the
+ * entity behind it holds. Naming that is not pedantry — it is the single most reliable way to
+ * hand-retype a backend response wrongly. A frontend interface declaring `receivedAt: Date`
+ * compiles, and every `receivedAt.getTime()` throws at runtime against a value that is really
+ * a string. `conduit-admin-web` called this out in a comment and got it right by hand; the
+ * point of putting the shapes in this package is that nobody has to.
+ *
+ * It is an alias, not a branded type, deliberately. A brand would force a cast at every
+ * boundary where a string arrives from `JSON.parse` — which is all of them — and buy nothing,
+ * since the value genuinely is an unvalidated string until someone parses it. What this alias
+ * carries is the instruction: to get a `Date`, write `new Date(value)`.
+ */
+export type IsoDateTime = string;
+//# sourceMappingURL=iso-date-time.type.d.ts.map

package/dist/esm/type/iso-date-time.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso-date-time.type.d.ts","sourceRoot":"","sources":["../../../src/type/iso-date-time.type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC"}

package/dist/esm/type/iso-date-time.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=iso-date-time.type.js.map

package/dist/esm/type/iso-date-time.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso-date-time.type.js","sourceRoot":"","sources":["../../../src/type/iso-date-time.type.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iveri/contracts",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Wire contracts shared by every Iveri backend and frontend. Zero runtime dependencies.",
   "license": "MIT",
   "repository": {
@@ -24,8 +24,28 @@
       "import": "./dist/esm/index.js",
       "require": "./dist/cjs/index.js"
     },
+    "./conduit": {
+      "types": "./dist/cjs/api/conduit/index.d.ts",
+      "import": "./dist/esm/api/conduit/index.js",
+      "require": "./dist/cjs/api/conduit/index.js"
+    },
+    "./identity": {
+      "types": "./dist/cjs/api/identity/index.d.ts",
+      "import": "./dist/esm/api/identity/index.js",
+      "require": "./dist/cjs/api/identity/index.js"
+    },
     "./package.json": "./package.json"
   },
+  "typesVersions": {
+    "*": {
+      "conduit": [
+        "./dist/cjs/api/conduit/index.d.ts"
+      ],
+      "identity": [
+        "./dist/cjs/api/identity/index.d.ts"
+      ]
+    }
+  },
   "sideEffects": false,
   "files": [
     "dist",
@@ -33,7 +53,7 @@
   ],
   "scripts": {
     "clean": "rimraf dist tsconfig.*.tsbuildinfo",
-    "build": "pnpm clean && tsc -p tsconfig.cjs.json && tsc -p tsconfig.esm.json && node ./scripts/write-dist-package-json.mjs && node ./scripts/verify-zero-runtime-deps.mjs",
+    "build": "pnpm clean && tsc -p tsconfig.cjs.json && tsc -p tsconfig.esm.json && node ./scripts/write-dist-package-json.mjs && node ./scripts/verify-zero-runtime-deps.mjs && node ./scripts/verify-entry-points.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "jest",
     "lint": "eslint .",