@kici-dev/engine 0.1.26 → 0.2.0

package/dist/approval/types.d.ts

@@ -2,7 +2,7 @@
  * Shared approval requirement + clause types.
  *
  * One normalized `ApprovalRequirement` is produced by both approval triggers —
- * a mandatory environment policy and an explicit SDK `approval` config — and is
+ * a mandatory context policy and an explicit SDK `approval` config — and is
  * consumed identically by the orchestrator gate, the resolver, the held-run
  * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
  * module is safe in the browser-facing engine barrel.
@@ -21,17 +21,24 @@ export declare const approverClauseSchema: z.ZodUnion<readonly [z.ZodObject<{
 export type ApproverClause = z.infer<typeof approverClauseSchema>;
 /** Granularity of a held element. */
 export declare const HoldScope: z.ZodEnum<{
-    workflow: "workflow";
     job: "job";
     step: "step";
+    workflow: "workflow";
 }>;
 export type HoldScope = z.infer<typeof HoldScope>;
-/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+/** What triggered the hold: a context policy (mandatory) or SDK code (explicit). */
 export declare const TriggerSource: z.ZodEnum<{
-    environment: "environment";
+    context: "context";
     explicit: "explicit";
 }>;
 export type TriggerSource = z.infer<typeof TriggerSource>;
+/**
+ * A valid manual-approval timeout: a positive integer number of seconds. The
+ * single source of truth for the positivity invariant — referenced by the
+ * `step.approval-request` wire schema, the SDK compile-time check, and the
+ * orchestrator's pre-dispatch approval-timeout guard.
+ */
+export declare const approvalTimeoutSecondsSchema: z.ZodNumber;
 /**
  * The normalized requirement attached to a held element. `clauses` is a flat
  * AND list; an empty list means "any approval-capable org member". `expiresAt`

package/dist/approval/types.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 * Shared approval requirement + clause types.
 *
 * One normalized `ApprovalRequirement` is produced by both approval triggers —
-* a mandatory environment policy and an explicit SDK `approval` config — and is
+* a mandatory context policy and an explicit SDK `approval` config — and is
 * consumed identically by the orchestrator gate, the resolver, the held-run
 * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
 * module is safe in the browser-facing engine barrel.
@@ -22,8 +22,15 @@ const HoldScope = z.enum([
 	"job",
 	"step"
 ]);
-/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
-const TriggerSource = z.enum(["environment", "explicit"]);
+/** What triggered the hold: a context policy (mandatory) or SDK code (explicit). */
+const TriggerSource = z.enum(["context", "explicit"]);
+/**
+* A valid manual-approval timeout: a positive integer number of seconds. The
+* single source of truth for the positivity invariant — referenced by the
+* `step.approval-request` wire schema, the SDK compile-time check, and the
+* orchestrator's pre-dispatch approval-timeout guard.
+*/
+const approvalTimeoutSecondsSchema = z.number().int().positive();
 /**
 * The normalized requirement attached to a held element. `clauses` is a flat
 * AND list; an empty list means "any approval-capable org member". `expiresAt`
@@ -37,6 +44,6 @@ const approvalRequirementSchema = z.object({
 /** An individual approve/reject decision recorded against a held element. */
 const ApprovalDecision = z.enum(["approve", "reject"]);
 //#endregion
-export { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema };
+export { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approvalTimeoutSecondsSchema, approverClauseSchema };
 
 //# sourceMappingURL=types.js.map

package/dist/artifacts/name.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Artifact name contract, shared by every tier that handles a name.
+ *
+ * An artifact name is the user-facing key an artifact is uploaded under and
+ * downloaded by, and it becomes a path segment of the storage object key. It is
+ * therefore restricted to a conservative, filesystem/URL-safe character set
+ * (letters, digits, `.`, `_`, `-`) with a bounded length, so names stay portable
+ * across storage backends and can never escape their per-run prefix.
+ *
+ * The schema lives in the engine — not the SDK — because it is a trust-boundary
+ * contract, not just an SDK ergonomic. The orchestrator validates every inbound
+ * name against it before minting a presigned PUT, the agent sandbox validates it
+ * at the call site, and `@kici-dev/sdk` re-exports it so workflow authors keep
+ * the same public symbol. One definition, three consumers: a name the SDK
+ * accepts is exactly a name the orchestrator accepts.
+ *
+ * The rejection **message** lives here too, for the same reason: a workflow
+ * author must read one sentence whichever tier refused the name.
+ *
+ * Pure Zod, no `node:*` imports — safe for the browser-facing engine barrel.
+ */
+import { z } from 'zod';
+/** Maximum length of an artifact name, in characters. */
+export declare const ARTIFACT_NAME_MAX_LENGTH = 128;
+/**
+ * Zod schema validating an artifact name.
+ *
+ * The character set and the all-dots exclusion together make the mapping from a
+ * name to its storage segment the identity, and therefore injective: two
+ * distinct accepted names can never produce the same key. A name outside the
+ * character set would be sanitized onto some other name's segment (`a/b` and
+ * `a_b` both become `a_b`), and an all-dots name has to be escaped away from a
+ * path-canonicalizable segment (`.` and `_.` would both become `_.`). Either
+ * collision lets a second upload silently overwrite the first object while both
+ * records keep their own hash, so both are rejected outright.
+ */
+export declare const ArtifactNameSchema: z.ZodString;
+/** Prefix every artifact-name rejection carries, so callers can match on it. */
+export declare const ARTIFACT_INVALID_NAME_PREFIX = "invalid artifact name";
+/**
+ * Message for a name that fails the {@link ArtifactNameSchema} contract.
+ *
+ * Lives beside the schema, not in either consumer, because the rejection wording
+ * is part of the contract: the agent sandbox validates at the call site and the
+ * orchestrator validates at the trust boundary, and a workflow author must read
+ * the same sentence whichever tier refused the name. `detail` is one of the
+ * schema's own fixed messages (via {@link checkArtifactName}), never caller
+ * input.
+ */
+export declare function artifactInvalidNameError(detail: string): string;
+/**
+ * Validate a name against the shared contract, returning the schema's own
+ * message on failure and `null` when the name conforms.
+ *
+ * Only the first issue is reported. The schema's checks are ordered and each
+ * carries a single fixed message, so one detail fully describes the violation —
+ * and rendering exactly one keeps every tier's message identical.
+ */
+export declare function checkArtifactName(name: string): string | null;
+//# sourceMappingURL=name.d.ts.map

package/dist/artifacts/name.js

@@ -0,0 +1,71 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/artifacts/name.ts
+/**
+* Artifact name contract, shared by every tier that handles a name.
+*
+* An artifact name is the user-facing key an artifact is uploaded under and
+* downloaded by, and it becomes a path segment of the storage object key. It is
+* therefore restricted to a conservative, filesystem/URL-safe character set
+* (letters, digits, `.`, `_`, `-`) with a bounded length, so names stay portable
+* across storage backends and can never escape their per-run prefix.
+*
+* The schema lives in the engine — not the SDK — because it is a trust-boundary
+* contract, not just an SDK ergonomic. The orchestrator validates every inbound
+* name against it before minting a presigned PUT, the agent sandbox validates it
+* at the call site, and `@kici-dev/sdk` re-exports it so workflow authors keep
+* the same public symbol. One definition, three consumers: a name the SDK
+* accepts is exactly a name the orchestrator accepts.
+*
+* The rejection **message** lives here too, for the same reason: a workflow
+* author must read one sentence whichever tier refused the name.
+*
+* Pure Zod, no `node:*` imports — safe for the browser-facing engine barrel.
+*/
+/** Maximum length of an artifact name, in characters. */
+const ARTIFACT_NAME_MAX_LENGTH = 128;
+/**
+* Zod schema validating an artifact name.
+*
+* The character set and the all-dots exclusion together make the mapping from a
+* name to its storage segment the identity, and therefore injective: two
+* distinct accepted names can never produce the same key. A name outside the
+* character set would be sanitized onto some other name's segment (`a/b` and
+* `a_b` both become `a_b`), and an all-dots name has to be escaped away from a
+* path-canonicalizable segment (`.` and `_.` would both become `_.`). Either
+* collision lets a second upload silently overwrite the first object while both
+* records keep their own hash, so both are rejected outright.
+*/
+const ArtifactNameSchema = z.string().min(1, "artifact name must be non-empty").max(128, `artifact name must be <= 128 chars`).regex(/^[A-Za-z0-9._-]+$/, "artifact name may only contain letters, digits, \".\", \"_\", and \"-\"").refine((n) => !/^\.+$/.test(n), "artifact name must contain more than dots");
+/** Prefix every artifact-name rejection carries, so callers can match on it. */
+const ARTIFACT_INVALID_NAME_PREFIX = "invalid artifact name";
+/**
+* Message for a name that fails the {@link ArtifactNameSchema} contract.
+*
+* Lives beside the schema, not in either consumer, because the rejection wording
+* is part of the contract: the agent sandbox validates at the call site and the
+* orchestrator validates at the trust boundary, and a workflow author must read
+* the same sentence whichever tier refused the name. `detail` is one of the
+* schema's own fixed messages (via {@link checkArtifactName}), never caller
+* input.
+*/
+function artifactInvalidNameError(detail) {
+	return `${ARTIFACT_INVALID_NAME_PREFIX}: ${detail}`;
+}
+/**
+* Validate a name against the shared contract, returning the schema's own
+* message on failure and `null` when the name conforms.
+*
+* Only the first issue is reported. The schema's checks are ordered and each
+* carries a single fixed message, so one detail fully describes the violation —
+* and rendering exactly one keeps every tier's message identical.
+*/
+function checkArtifactName(name) {
+	const parsed = ArtifactNameSchema.safeParse(name);
+	if (parsed.success) return null;
+	return parsed.error.issues[0]?.message ?? "artifact name is not permitted";
+}
+//#endregion
+export { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema, artifactInvalidNameError, checkArtifactName };
+
+//# sourceMappingURL=name.js.map

package/dist/audit/access-log-policy.d.ts

@@ -27,8 +27,8 @@ import { type ActorPrincipal } from '../protocol/messages/actor.js';
 /** Discriminator for the per-action policy entry. */
 export declare const AccessLogPolicyKind: z.ZodEnum<{
     always: "always";
-    sample: "sample";
     rate_limit: "rate_limit";
+    sample: "sample";
 }>;
 export type AccessLogPolicyKind = z.infer<typeof AccessLogPolicyKind>;
 export type AccessLogPolicy = {

package/dist/audit/access-log-policy.js

@@ -67,11 +67,12 @@ const POLICY_BY_ACTION = {
 		allowedRate: .1
 	},
 	"attestations.read": { kind: "always" },
+	"artifacts.read": { kind: "always" },
 	"event_log.list.read": {
 		kind: "sample",
 		allowedRate: .05
 	},
-	"environment.list.read": {
+	"context.list.read": {
 		kind: "sample",
 		allowedRate: .1
 	},
@@ -83,11 +84,11 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .1
 	},
-	"environment.get.read": {
+	"context.get.read": {
 		kind: "sample",
 		allowedRate: .2
 	},
-	"environment.history.read": {
+	"context.history.read": {
 		kind: "sample",
 		allowedRate: .2
 	},
@@ -95,7 +96,7 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .2
 	},
-	"env_binding.list.read": {
+	"context_binding.list.read": {
 		kind: "sample",
 		allowedRate: .2
 	},
@@ -131,16 +132,16 @@ const POLICY_BY_ACTION = {
 	"job.cancel": { kind: "always" },
 	"event_log.detail.read": { kind: "always" },
 	"event_log.payload.read": { kind: "always" },
-	"environment.create": { kind: "always" },
-	"environment.update": { kind: "always" },
-	"environment.delete": { kind: "always" },
-	"env_var.list.read": { kind: "always" },
-	"env_var.set": { kind: "always" },
-	"env_var.delete": { kind: "always" },
+	"context.create": { kind: "always" },
+	"context.update": { kind: "always" },
+	"context.delete": { kind: "always" },
+	"context_var.list.read": { kind: "always" },
+	"context_var.set": { kind: "always" },
+	"context_var.delete": { kind: "always" },
 	"source_override.list.read": { kind: "always" },
 	"source_override.set": { kind: "always" },
 	"source_override.delete": { kind: "always" },
-	"env_binding.set": { kind: "always" },
+	"context_binding.set": { kind: "always" },
 	"secret.list.read": { kind: "always" },
 	"secret.set": { kind: "always" },
 	"secret.delete": { kind: "always" },
@@ -164,7 +165,15 @@ const POLICY_BY_ACTION = {
 	"fleet.pre_boot.send": { kind: "always" },
 	"global_workflows.update": { kind: "always" },
 	"org_settings.dashboard_write_policy.update": { kind: "always" },
+	"trust_policy.updated": { kind: "always" },
 	"cluster_name.update": { kind: "always" },
+	"attestation.retry": { kind: "always" },
+	"db.fresh": { kind: "always" },
+	"db.ensure": { kind: "always" },
+	"db.create_role": { kind: "always" },
+	"db.create_readonly_user": { kind: "always" },
+	"db.reindex": { kind: "always" },
+	"db.refresh_collation_version": { kind: "always" },
 	"access_log.list.read": { kind: "always" },
 	"event_dlq.list.read": {
 		kind: "sample",

package/dist/audit/activity.d.ts

@@ -31,8 +31,8 @@ export type ActivityRowSource = z.infer<typeof ActivityRowSource>;
  */
 export declare const ActivityFilterSource: z.ZodEnum<{
     access_log: "access_log";
-    audit_log: "audit_log";
     all: "all";
+    audit_log: "audit_log";
 }>;
 export type ActivityFilterSource = z.infer<typeof ActivityFilterSource>;
 /**
@@ -51,11 +51,11 @@ export declare const activityRowSchema: z.ZodObject<{
     }>;
     createdAt: z.ZodString;
     actorType: z.ZodEnum<{
-        user: "user";
         api_key: "api_key";
-        service_account: "service_account";
         platform_operator: "platform_operator";
+        service_account: "service_account";
         system: "system";
+        user: "user";
     }>;
     actorId: z.ZodString;
     actorMeta: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -65,18 +65,18 @@ export declare const activityRowSchema: z.ZodObject<{
     targetType: z.ZodNullable<z.ZodString>;
     targetId: z.ZodNullable<z.ZodString>;
     outcome: z.ZodNullable<z.ZodEnum<{
-        error: "error";
         allowed: "allowed";
         denied: "denied";
+        error: "error";
     }>>;
     errorMessage: z.ZodNullable<z.ZodString>;
     details: z.ZodNullable<z.ZodUnknown>;
     requestId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     origin: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        admin_cli: "admin_cli";
+        admin_http: "admin_http";
         agent: "agent";
         platform_proxy: "platform_proxy";
-        admin_http: "admin_http";
-        admin_cli: "admin_cli";
     }>>>;
 }, z.core.$strip>;
 export type ActivityRow = z.infer<typeof activityRowSchema>;
@@ -88,28 +88,28 @@ export type ActivityRow = z.infer<typeof activityRowSchema>;
 export declare const activityFilterSchema: z.ZodObject<{
     source: z.ZodDefault<z.ZodEnum<{
         access_log: "access_log";
-        audit_log: "audit_log";
         all: "all";
+        audit_log: "audit_log";
     }>>;
     actorType: z.ZodOptional<z.ZodEnum<{
-        user: "user";
         api_key: "api_key";
-        service_account: "service_account";
         platform_operator: "platform_operator";
+        service_account: "service_account";
         system: "system";
+        user: "user";
     }>>;
     actorId: z.ZodOptional<z.ZodString>;
     action: z.ZodOptional<z.ZodString>;
     outcome: z.ZodOptional<z.ZodEnum<{
-        error: "error";
         allowed: "allowed";
         denied: "denied";
+        error: "error";
     }>>;
     origin: z.ZodOptional<z.ZodEnum<{
+        admin_cli: "admin_cli";
+        admin_http: "admin_http";
         agent: "agent";
         platform_proxy: "platform_proxy";
-        admin_http: "admin_http";
-        admin_cli: "admin_cli";
     }>>;
     targetType: z.ZodOptional<z.ZodString>;
     targetId: z.ZodOptional<z.ZodString>;

package/dist/audit/retention-policy.js

@@ -20,14 +20,15 @@ const ACCESS_LOG_WARM_DAYS = {
 	"run.orch_logs.read": 30,
 	"step.logs.read": 30,
 	"attestations.read": 30,
+	"artifacts.read": 30,
 	"event_log.list.read": 30,
-	"environment.list.read": 30,
-	"environment.get.read": 30,
-	"environment.history.read": 30,
+	"context.list.read": 30,
+	"context.get.read": 30,
+	"context.history.read": 30,
 	"registration.list.read": 30,
 	"global_workflows.get.read": 30,
 	"held_run.list.read": 30,
-	"env_binding.list.read": 30,
+	"context_binding.list.read": 30,
 	"backend.list.read": 30,
 	"backend.get.read": 30,
 	"diagnostics.read": 30,
@@ -37,7 +38,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"event_log.detail.read": 180,
 	"event_log.payload.read": 180,
 	"run.payload.read": 180,
-	"env_var.list.read": 180,
+	"context_var.list.read": 180,
 	"source_override.list.read": 180,
 	"access_log.list.read": 180,
 	"secret.list.read": 180,
@@ -46,14 +47,14 @@ const ACCESS_LOG_WARM_DAYS = {
 	"run.manual_schedule": 180,
 	"run.trigger": 180,
 	"job.cancel": 180,
-	"environment.create": 180,
-	"environment.update": 180,
-	"environment.delete": 180,
-	"env_var.set": 180,
-	"env_var.delete": 180,
+	"context.create": 180,
+	"context.update": 180,
+	"context.delete": 180,
+	"context_var.set": 180,
+	"context_var.delete": 180,
 	"source_override.set": 180,
 	"source_override.delete": 180,
-	"env_binding.set": 180,
+	"context_binding.set": 180,
 	"held_run.approve": 180,
 	"held_run.auto_approve": 180,
 	"held_run.reject": 180,
@@ -70,7 +71,15 @@ const ACCESS_LOG_WARM_DAYS = {
 	"fleet.pre_boot.send": 180,
 	"global_workflows.update": 180,
 	"org_settings.dashboard_write_policy.update": 180,
+	"trust_policy.updated": 180,
 	"cluster_name.update": 180,
+	"attestation.retry": 180,
+	"db.fresh": 180,
+	"db.ensure": 180,
+	"db.create_role": 180,
+	"db.create_readonly_user": 180,
+	"db.reindex": 180,
+	"db.refresh_collation_version": 180,
 	"event_dlq.list.read": 30,
 	"event_dlq.retry": 180,
 	"event_dlq.discard": 180,
@@ -265,14 +274,15 @@ const ACCESS_LOG_COLD_DAYS = {
 	"run.orch_logs.read": 180,
 	"step.logs.read": 180,
 	"attestations.read": 180,
+	"artifacts.read": 180,
 	"event_log.list.read": 180,
-	"environment.list.read": 180,
-	"environment.get.read": 180,
-	"environment.history.read": 180,
+	"context.list.read": 180,
+	"context.get.read": 180,
+	"context.history.read": 180,
 	"registration.list.read": 180,
 	"global_workflows.get.read": 180,
 	"held_run.list.read": 180,
-	"env_binding.list.read": 180,
+	"context_binding.list.read": 180,
 	"backend.list.read": 180,
 	"backend.get.read": 180,
 	"diagnostics.read": 30,
@@ -282,7 +292,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"event_log.detail.read": 730,
 	"event_log.payload.read": 730,
 	"run.payload.read": 730,
-	"env_var.list.read": 730,
+	"context_var.list.read": 730,
 	"source_override.list.read": 730,
 	"access_log.list.read": 730,
 	"secret.list.read": 730,
@@ -291,14 +301,14 @@ const ACCESS_LOG_COLD_DAYS = {
 	"run.manual_schedule": 730,
 	"run.trigger": 730,
 	"job.cancel": 730,
-	"environment.create": 730,
-	"environment.update": 730,
-	"environment.delete": 730,
-	"env_var.set": 730,
-	"env_var.delete": 730,
+	"context.create": 730,
+	"context.update": 730,
+	"context.delete": 730,
+	"context_var.set": 730,
+	"context_var.delete": 730,
 	"source_override.set": 730,
 	"source_override.delete": 730,
-	"env_binding.set": 730,
+	"context_binding.set": 730,
 	"held_run.approve": 730,
 	"held_run.auto_approve": 730,
 	"held_run.reject": 730,
@@ -315,7 +325,15 @@ const ACCESS_LOG_COLD_DAYS = {
 	"fleet.pre_boot.send": 730,
 	"global_workflows.update": 730,
 	"org_settings.dashboard_write_policy.update": 730,
+	"trust_policy.updated": 730,
 	"cluster_name.update": 730,
+	"attestation.retry": 730,
+	"db.fresh": 730,
+	"db.ensure": 730,
+	"db.create_role": 730,
+	"db.create_readonly_user": 730,
+	"db.reindex": 730,
+	"db.refresh_collation_version": 730,
 	"event_dlq.list.read": 180,
 	"event_dlq.retry": 730,
 	"event_dlq.discard": 730,

package/dist/billing/plan-type.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+/**
+ * Plan tier discriminator. Single source of truth for the four hosted tiers
+ * (`free`, `pro`, `team`, `business`); Enterprise is `pro` / `team` /
+ * `business` with a custom `plan_config` override, not a tier of its own.
+ *
+ * Lives in the engine rather than the Platform package because the browser
+ * dashboard needs the same vocabulary and cannot import a private package.
+ * Pure Zod with no Node built-ins, so it is safe on the engine barrel.
+ *
+ * Use `PlanType` (the Zod schema) inside other schemas; use `PlanType.enum.X`
+ * to reference a specific value in code; use `type PlanType` for the derived
+ * TypeScript type.
+ */
+export declare const PlanType: z.ZodEnum<{
+    business: "business";
+    free: "free";
+    pro: "pro";
+    team: "team";
+}>;
+export type PlanType = z.infer<typeof PlanType>;
+/**
+ * The purchasable subset of `PlanType`. `free` is the default state an org
+ * lands in, never something checkout can be started for, so every checkout /
+ * upgrade / subscription-metadata surface takes this narrower enum instead of
+ * re-spelling the three paid tiers by hand.
+ */
+export declare const PaidPlanType: z.ZodEnum<{
+    business: "business";
+    pro: "pro";
+    team: "team";
+}>;
+export type PaidPlanType = z.infer<typeof PaidPlanType>;
+/** Every hosted tier, in ascending rank order. */
+export declare const PLAN_TYPES: readonly PlanType[];
+/**
+ * Narrow a tier to the purchasable subset (everything except `free`). Derived
+ * from `PaidPlanType`, so a new paid tier needs no edit here and no edit at any
+ * call site that used to spell the paid set out as a boolean chain.
+ */
+export declare function isPaidTier(tier: PlanType): tier is PaidPlanType;
+/**
+ * Rank a plan tier for up/down direction comparisons.
+ *
+ * The `Object.hasOwn` guard is not defensive padding: a bare index into an
+ * object literal inherits `Object.prototype`, so `planRank('toString')` would
+ * return a *function* rather than a number, and any `??`-style fallback a
+ * caller wrapped it in would never fire. Every current caller passes a
+ * `safeParse`d tier, so the throw is unreachable in practice — but a loud
+ * error beats silently ranking a forged string above `business`.
+ */
+export declare function planRank(p: PlanType): number;
+//# sourceMappingURL=plan-type.d.ts.map

package/dist/billing/plan-type.js

@@ -0,0 +1,70 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/billing/plan-type.ts
+/**
+* Plan tier discriminator. Single source of truth for the four hosted tiers
+* (`free`, `pro`, `team`, `business`); Enterprise is `pro` / `team` /
+* `business` with a custom `plan_config` override, not a tier of its own.
+*
+* Lives in the engine rather than the Platform package because the browser
+* dashboard needs the same vocabulary and cannot import a private package.
+* Pure Zod with no Node built-ins, so it is safe on the engine barrel.
+*
+* Use `PlanType` (the Zod schema) inside other schemas; use `PlanType.enum.X`
+* to reference a specific value in code; use `type PlanType` for the derived
+* TypeScript type.
+*/
+const PlanType = z.enum([
+	"free",
+	"pro",
+	"team",
+	"business"
+]);
+/**
+* The purchasable subset of `PlanType`. `free` is the default state an org
+* lands in, never something checkout can be started for, so every checkout /
+* upgrade / subscription-metadata surface takes this narrower enum instead of
+* re-spelling the three paid tiers by hand.
+*/
+const PaidPlanType = PlanType.exclude(["free"]);
+/** Every hosted tier, in ascending rank order. */
+const PLAN_TYPES = PlanType.options;
+/**
+* Narrow a tier to the purchasable subset (everything except `free`). Derived
+* from `PaidPlanType`, so a new paid tier needs no edit here and no edit at any
+* call site that used to spell the paid set out as a boolean chain.
+*/
+function isPaidTier(tier) {
+	return PaidPlanType.safeParse(tier).success;
+}
+/**
+* Monotonic tier rank for up/down comparison. free < pro < team < business.
+*
+* Typed `Record<PlanType, number>` on purpose: adding a tier to the enum
+* without ranking it fails `pnpm typecheck` instead of silently yielding
+* `undefined` at runtime.
+*/
+const PLAN_RANK = {
+	[PlanType.enum.free]: 0,
+	[PlanType.enum.pro]: 1,
+	[PlanType.enum.team]: 2,
+	[PlanType.enum.business]: 3
+};
+/**
+* Rank a plan tier for up/down direction comparisons.
+*
+* The `Object.hasOwn` guard is not defensive padding: a bare index into an
+* object literal inherits `Object.prototype`, so `planRank('toString')` would
+* return a *function* rather than a number, and any `??`-style fallback a
+* caller wrapped it in would never fire. Every current caller passes a
+* `safeParse`d tier, so the throw is unreachable in practice — but a loud
+* error beats silently ranking a forged string above `business`.
+*/
+function planRank(p) {
+	if (!Object.hasOwn(PLAN_RANK, p)) throw new Error(`planRank: '${String(p)}' is not a plan tier`);
+	return PLAN_RANK[p];
+}
+//#endregion
+export { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank };
+
+//# sourceMappingURL=plan-type.js.map

package/dist/bundler/rolldown-config.d.ts

@@ -22,7 +22,7 @@ export interface WorkflowBundleOptions {
  */
 export declare function createWorkflowBundleConfig(options: WorkflowBundleOptions): {
     input: string;
-    platform: "node";
+    platform: 'node';
     external: string[];
     treeshake: boolean;
     cwd: string | undefined;
@@ -33,8 +33,8 @@ export declare function createWorkflowBundleConfig(options: WorkflowBundleOption
     };
     output: {
         file: string | undefined;
-        format: "es";
-        sourcemap: boolean | "inline";
+        format: 'es';
+        sourcemap: "inline" | boolean;
         inlineDynamicImports: boolean;
     };
 };

package/dist/check-mode.d.ts

@@ -23,11 +23,11 @@ export type CheckMode = z.infer<typeof CheckMode>;
  * dry-run -> "would change", no_check -> "no check".
  */
 export declare const CheckStepOutcome: z.ZodEnum<{
-    skipped: "skipped";
     applied: "applied";
     declined: "declined";
     "dry-run": "dry-run";
     no_check: "no_check";
+    skipped: "skipped";
 }>;
 export type CheckStepOutcome = z.infer<typeof CheckStepOutcome>;
 //# sourceMappingURL=check-mode.d.ts.map