@nebutra/contracts 2.0.0 → 3.0.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @nebutra/contracts@2.0.0 build /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/commerce/contracts
+> @nebutra/contracts@3.0.0 build /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/commerce/contracts
 > tsup
 
 CLI Building entry: src/admin.ts, src/billing.ts, src/events.ts, src/identity.ts, src/index.ts, src/notifications.ts, src/sleptons.ts
@@ -9,39 +9,39 @@
 CLI Target: es2022
 CLI Cleaning output folder
 ESM Build start
-ESM dist/admin.js              1.04 KB
+ESM dist/admin.js              1.12 KB
 ESM dist/billing.js            332.00 B
 ESM dist/events.js             173.00 B
 ESM dist/identity.js           563.00 B
-ESM dist/index.js              4.36 KB
-ESM dist/chunk-ERZTZ3PW.js     8.13 KB
+ESM dist/index.js              4.44 KB
+ESM dist/chunk-G65TWQGE.js     8.52 KB
 ESM dist/chunk-NFJTVIKD.js     1.32 KB
 ESM dist/chunk-2NXI4PJM.js     565.00 B
 ESM dist/chunk-5JNQ2KAT.js     2.07 KB
 ESM dist/notifications.js      1.11 KB
-ESM dist/chunk-F4BR76CX.js     2.91 KB
 ESM dist/sleptons.js           1.40 KB
+ESM dist/chunk-BX2ZIODN.js     2.88 KB
 ESM dist/chunk-PU65L2HQ.js     6.74 KB
 ESM dist/admin.js.map          71.00 B
 ESM dist/billing.js.map        71.00 B
 ESM dist/events.js.map         71.00 B
 ESM dist/identity.js.map       71.00 B
 ESM dist/index.js.map          71.00 B
-ESM dist/chunk-ERZTZ3PW.js.map 16.58 KB
+ESM dist/chunk-G65TWQGE.js.map 18.03 KB
 ESM dist/chunk-NFJTVIKD.js.map 2.78 KB
 ESM dist/chunk-2NXI4PJM.js.map 1.16 KB
 ESM dist/chunk-5JNQ2KAT.js.map 4.47 KB
 ESM dist/notifications.js.map  71.00 B
-ESM dist/chunk-F4BR76CX.js.map 6.05 KB
 ESM dist/sleptons.js.map       71.00 B
+ESM dist/chunk-BX2ZIODN.js.map 6.00 KB
 ESM dist/chunk-PU65L2HQ.js.map 14.02 KB
-ESM ⚡️ Build success in 94ms
+ESM ⚡️ Build success in 96ms
 DTS Build start
-DTS ⚡️ Build success in 22232ms
-DTS dist/index.d.ts         3.15 KB
-DTS dist/admin.d.ts         14.76 KB
+DTS ⚡️ Build success in 28456ms
+DTS dist/index.d.ts         3.18 KB
+DTS dist/admin.d.ts         15.67 KB
 DTS dist/billing.d.ts       2.11 KB
 DTS dist/events.d.ts        1020.00 B
 DTS dist/identity.d.ts      4.03 KB
-DTS dist/notifications.d.ts 6.09 KB
+DTS dist/notifications.d.ts 6.02 KB
 DTS dist/sleptons.d.ts      21.11 KB

package/.turbo/turbo-test.log

@@ -1,15 +1,15 @@
 
-> @nebutra/contracts@2.0.0 test /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/commerce/contracts
+> @nebutra/contracts@3.0.0 test /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/commerce/contracts
 > vitest run
 
 
  RUN  v4.1.4 /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/commerce/contracts
 
- ✓ src/__tests__/admin.test.ts (5 tests) 91ms
- ✓ src/sleptons.test.ts (6 tests) 50ms
+ ✓ src/__tests__/admin.test.ts (5 tests) 110ms
+ ✓ src/sleptons.test.ts (6 tests) 136ms
 
  Test Files  2 passed (2)
       Tests  11 passed (11)
-   Start at  02:31:07
-   Duration  1.49s (transform 388ms, setup 0ms, import 1.34s, tests 141ms, environment 0ms)
+   Start at  08:50:36
+   Duration  1.77s (transform 700ms, setup 0ms, import 1.66s, tests 246ms, environment 0ms)
 

package/.turbo/turbo-typecheck.log

@@ -1,4 +1,4 @@
 
-> @nebutra/contracts@2.0.0 typecheck /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/commerce/contracts
+> @nebutra/contracts@3.0.0 typecheck /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/commerce/contracts
 > tsc --noEmit
 

package/CHANGELOG.md

@@ -1,5 +1,7 @@
 # @nebutra/contracts
 
+## 3.0.0
+
 ## 2.0.0
 
 ### Minor Changes

package/dist/admin.d.ts

@@ -412,5 +412,22 @@ type AdminError = z.infer<typeof AdminErrorSchema>;
 declare function assertApplyAllowed(action: AdminAction, request: ActionRequest): AdminError | null;
 /** Resolve a contract path against the manifest origin. */
 declare function resolveContractUrl(manifest: Pick<AdminManifest, "origin">, path: string): string;
+/**
+ * The HTTP status an admin error travels as.
+ *
+ * Cloudflare sits in front of every admin and product host, and it replaces an
+ * origin's `502` or `504` with its own branded HTML error page. The body we
+ * wrote — the code and the message the operator needs — is discarded before the
+ * browser sees it, so the console can only report `network · HTTP 502`. A
+ * contract endpoint therefore never answers with a gateway status: an upstream
+ * that failed is `503`, and a fault of our own is `500`. Both reach the client
+ * with their JSON envelope intact.
+ */
+declare const ADMIN_ERROR_STATUS: Record<AdminError["error"]["code"], number>;
+/**
+ * Narrow an arbitrary status to one that survives the CDN, preserving anything
+ * already safe. Use it when echoing an upstream contract call's status.
+ */
+declare function cdnSafeStatus(status: number | undefined, fallback?: number): number;
 
-export { ADMIN_CONTRACT_VERSION, type ActionPlan, ActionPlanSchema, type ActionRequest, ActionRequestSchema, type ActionResult, ActionResultSchema, type AdminAction, AdminActionSchema, type AdminColumn, AdminColumnSchema, type AdminDomain, type AdminDomainId, AdminDomainIdSchema, AdminDomainSchema, type AdminError, AdminErrorSchema, type AdminManifest, AdminManifestSchema, type AdminPolicy, AdminPolicySchema, type AdminResource, AdminResourceSchema, type AdminSeverity, AdminSeveritySchema, type AdminSignal, AdminSignalSchema, type AdminStatus, AdminStatusSchema, PlanDiffEntrySchema, type ResourceList, ResourceListSchema, STAFF_ROLE_RANK, type SignalReading, SignalReadingSchema, type StaffRole, StaffRoleSchema, assertApplyAllowed, resolveContractUrl, roleAtLeast };
+export { ADMIN_CONTRACT_VERSION, ADMIN_ERROR_STATUS, type ActionPlan, ActionPlanSchema, type ActionRequest, ActionRequestSchema, type ActionResult, ActionResultSchema, type AdminAction, AdminActionSchema, type AdminColumn, AdminColumnSchema, type AdminDomain, type AdminDomainId, AdminDomainIdSchema, AdminDomainSchema, type AdminError, AdminErrorSchema, type AdminManifest, AdminManifestSchema, type AdminPolicy, AdminPolicySchema, type AdminResource, AdminResourceSchema, type AdminSeverity, AdminSeveritySchema, type AdminSignal, AdminSignalSchema, type AdminStatus, AdminStatusSchema, PlanDiffEntrySchema, type ResourceList, ResourceListSchema, STAFF_ROLE_RANK, type SignalReading, SignalReadingSchema, type StaffRole, StaffRoleSchema, assertApplyAllowed, cdnSafeStatus, resolveContractUrl, roleAtLeast };

package/dist/admin.js

@@ -1,5 +1,6 @@
 import {
   ADMIN_CONTRACT_VERSION,
+  ADMIN_ERROR_STATUS,
   ActionPlanSchema,
   ActionRequestSchema,
   ActionResultSchema,
@@ -20,11 +21,13 @@ import {
   SignalReadingSchema,
   StaffRoleSchema,
   assertApplyAllowed,
+  cdnSafeStatus,
   resolveContractUrl,
   roleAtLeast
-} from "./chunk-ERZTZ3PW.js";
+} from "./chunk-G65TWQGE.js";
 export {
   ADMIN_CONTRACT_VERSION,
+  ADMIN_ERROR_STATUS,
   ActionPlanSchema,
   ActionRequestSchema,
   ActionResultSchema,
@@ -45,6 +48,7 @@ export {
   SignalReadingSchema,
   StaffRoleSchema,
   assertApplyAllowed,
+  cdnSafeStatus,
   resolveContractUrl,
   roleAtLeast
 };

package/dist/{chunk-F4BR76CX.js → chunk-BX2ZIODN.js}

@@ -8,9 +8,9 @@ var NotificationFrequencyContractSchema = z.enum([
   "never"
 ]);
 var NotificationRuntimeStatusContractSchema = z.object({
-  provider: z.enum(["novu", "direct"]),
+  provider: z.enum(["direct"]),
   providerLabel: z.string().min(1),
-  mode: z.enum(["managed", "self_hosted", "preview", "degraded"]),
+  mode: z.enum(["self_hosted", "preview"]),
   canManagePreferences: z.boolean(),
   canViewInbox: z.boolean(),
   canMarkInboxRead: z.boolean(),
@@ -82,4 +82,4 @@ export {
   NotificationSettingsUpdateRequestContractSchema,
   NotificationSettingsUpdateResponseContractSchema
 };
-//# sourceMappingURL=chunk-F4BR76CX.js.map
+//# sourceMappingURL=chunk-BX2ZIODN.js.map

package/dist/chunk-BX2ZIODN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/notifications.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const NotificationChannelContractSchema = z.enum([\"in_app\", \"email\", \"push\", \"sms\", \"chat\"]);\nexport type NotificationChannelContract = z.infer<typeof NotificationChannelContractSchema>;\n\nexport const NotificationFrequencyContractSchema = z.enum([\n  \"immediate\",\n  \"daily\",\n  \"weekly\",\n  \"never\",\n]);\nexport type NotificationFrequencyContract = z.infer<typeof NotificationFrequencyContractSchema>;\n\nexport const NotificationRuntimeStatusContractSchema = z.object({\n  provider: z.enum([\"direct\"]),\n  providerLabel: z.string().min(1),\n  mode: z.enum([\"self_hosted\", \"preview\"]),\n  canManagePreferences: z.boolean(),\n  canViewInbox: z.boolean(),\n  canMarkInboxRead: z.boolean(),\n  summary: z.string().min(1),\n  reason: z.string().optional(),\n  missing: z.array(z.string()),\n});\nexport type NotificationRuntimeStatusContract = z.infer<\n  typeof NotificationRuntimeStatusContractSchema\n>;\n\nexport const NotificationPreferenceContractSchema = z.object({\n  userId: z.string().min(1),\n  tenantId: z.string().min(1).optional(),\n  channel: NotificationChannelContractSchema,\n  enabled: z.boolean(),\n  disabledCategories: z.array(z.string()).optional(),\n  frequency: NotificationFrequencyContractSchema,\n  updatedAt: z.string().datetime().optional(),\n});\nexport type NotificationPreferenceContract = z.infer<typeof NotificationPreferenceContractSchema>;\n\nexport const NotificationItemContractSchema = z.object({\n  id: z.string().min(1),\n  userId: z.string().min(1),\n  tenantId: z.string().min(1).optional(),\n  type: z.string().min(1),\n  title: z.string(),\n  body: z.string(),\n  data: z.record(z.string(), z.unknown()).optional(),\n  read: z.boolean(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\nexport type NotificationItemContract = z.infer<typeof NotificationItemContractSchema>;\n\nexport const NotificationListQueryContractSchema = z.object({\n  limit: z.coerce.number().int().min(1).max(100).default(50),\n  offset: z.coerce.number().int().min(0).default(0),\n  unreadOnly: z.coerce.boolean().optional(),\n});\nexport type NotificationListQueryContract = z.infer<typeof NotificationListQueryContractSchema>;\n\nexport const NotificationListResponseContractSchema = z.object({\n  items: z.array(NotificationItemContractSchema),\n  total: z.number().int().nonnegative(),\n  unreadCount: z.number().int().nonnegative(),\n});\nexport type NotificationListResponseContract = z.infer<\n  typeof NotificationListResponseContractSchema\n>;\n\nexport const NotificationUnreadCountResponseContractSchema = z.object({\n  count: z.number().int().nonnegative(),\n});\nexport type NotificationUnreadCountResponseContract = z.infer<\n  typeof NotificationUnreadCountResponseContractSchema\n>;\n\nexport const NotificationMarkReadRequestContractSchema = z.object({\n  ids: z.array(z.string().min(1)).min(1).max(100),\n});\nexport type NotificationMarkReadRequestContract = z.infer<\n  typeof NotificationMarkReadRequestContractSchema\n>;\n\nexport const NotificationMutationCountResponseContractSchema = z.object({\n  count: z.number().int().nonnegative(),\n});\nexport type NotificationMutationCountResponseContract = z.infer<\n  typeof NotificationMutationCountResponseContractSchema\n>;\n\nexport const NotificationSettingsUpdateRequestContractSchema = z.object({\n  type: z.string().min(1),\n  channel: NotificationChannelContractSchema,\n  enabled: z.boolean(),\n});\nexport type NotificationSettingsUpdateRequestContract = z.infer<\n  typeof NotificationSettingsUpdateRequestContractSchema\n>;\n\nexport const NotificationSettingsUpdateResponseContractSchema = z.object({\n  ok: z.literal(true),\n  preference: NotificationPreferenceContractSchema,\n});\nexport type NotificationSettingsUpdateResponseContract = z.infer<\n  typeof NotificationSettingsUpdateResponseContractSchema\n>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,oCAAoC,EAAE,KAAK,CAAC,UAAU,SAAS,QAAQ,OAAO,MAAM,CAAC;AAG3F,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0CAA0C,EAAE,OAAO;AAAA,EAC9D,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;AAAA,EAC3B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,MAAM,EAAE,KAAK,CAAC,eAAe,SAAS,CAAC;AAAA,EACvC,sBAAsB,EAAE,QAAQ;AAAA,EAChC,cAAc,EAAE,QAAQ;AAAA,EACxB,kBAAkB,EAAE,QAAQ;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAC7B,CAAC;AAKM,IAAM,uCAAuC,EAAE,OAAO;AAAA,EAC3D,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,SAAS;AAAA,EACT,SAAS,EAAE,QAAQ;AAAA,EACnB,oBAAoB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACjD,WAAW;AAAA,EACX,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,QAAQ;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAChD,YAAY,EAAE,OAAO,QAAQ,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,OAAO,EAAE,MAAM,8BAA8B;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAKM,IAAM,gDAAgD,EAAE,OAAO;AAAA,EACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACtC,CAAC;AAKM,IAAM,4CAA4C,EAAE,OAAO;AAAA,EAChE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAChD,CAAC;AAKM,IAAM,kDAAkD,EAAE,OAAO;AAAA,EACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACtC,CAAC;AAKM,IAAM,kDAAkD,EAAE,OAAO;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,SAAS;AAAA,EACT,SAAS,EAAE,QAAQ;AACrB,CAAC;AAKM,IAAM,mDAAmD,EAAE,OAAO;AAAA,EACvE,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY;AACd,CAAC;","names":[]}

package/dist/{chunk-ERZTZ3PW.js → chunk-G65TWQGE.js}

@@ -228,6 +228,20 @@ function assertApplyAllowed(action, request) {
 function resolveContractUrl(manifest, path) {
   return new URL(path, manifest.origin).toString();
 }
+var ADMIN_ERROR_STATUS = {
+  unauthenticated: 401,
+  forbidden: 403,
+  not_found: 404,
+  invalid_input: 400,
+  plan_required: 409,
+  plan_expired: 409,
+  upstream_unavailable: 503,
+  internal: 500
+};
+function cdnSafeStatus(status, fallback = 503) {
+  if (!status || status === 502 || status === 504 || status < 400 || status > 599) return fallback;
+  return status;
+}
 
 export {
   ADMIN_CONTRACT_VERSION,
@@ -252,6 +266,8 @@ export {
   SignalReadingSchema,
   AdminErrorSchema,
   assertApplyAllowed,
-  resolveContractUrl
+  resolveContractUrl,
+  ADMIN_ERROR_STATUS,
+  cdnSafeStatus
 };
-//# sourceMappingURL=chunk-ERZTZ3PW.js.map
+//# sourceMappingURL=chunk-G65TWQGE.js.map

package/dist/{chunk-ERZTZ3PW.js.map → chunk-G65TWQGE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/admin.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * Admin Contract — `nebutra.admin/v1`.\n *\n * Every Nebutra SaaS exposes one manifest describing the admin surface it\n * owns: resources (nouns), actions (audited verbs, plan → apply), signals\n * (probed facts) and policies (actions the system runs by itself). The\n * platform admin renders any product from its manifest; an agent derives\n * tools from it. Nothing product-specific lives in the renderer.\n *\n * See docs/plans/2026-09-08-admin-of-admins-model.md.\n */\n\nexport const ADMIN_CONTRACT_VERSION = \"nebutra.admin/v1\" as const;\n\n/** One status vocabulary. `unknown` is first-class and never renders green. */\nexport const AdminStatusSchema = z.enum([\"healthy\", \"degraded\", \"down\", \"unknown\"]);\nexport type AdminStatus = z.infer<typeof AdminStatusSchema>;\n\n/** One role ladder; product roles map onto it, staff grants mean the same everywhere. */\nexport const StaffRoleSchema = z.enum([\n  \"platform_readonly\",\n  \"platform_support\",\n  \"platform_operator\",\n  \"platform_owner\",\n]);\nexport type StaffRole = z.infer<typeof StaffRoleSchema>;\nexport const STAFF_ROLE_RANK: Record<StaffRole, number> = {\n  platform_readonly: 0,\n  platform_support: 1,\n  platform_operator: 2,\n  platform_owner: 3,\n};\nexport function roleAtLeast(role: StaffRole, required: StaffRole): boolean {\n  return STAFF_ROLE_RANK[role] >= STAFF_ROLE_RANK[required];\n}\n\nexport const AdminSeveritySchema = z.enum([\"info\", \"warn\", \"critical\"]);\nexport type AdminSeverity = z.infer<typeof AdminSeveritySchema>;\n\n/** The canonical eleven. A product declares the subset it has. */\nexport const AdminDomainIdSchema = z.enum([\n  \"identity\",\n  \"access\",\n  \"commerce\",\n  \"usage\",\n  \"catalog\",\n  \"operations\",\n  \"integrations\",\n  \"trust\",\n  \"support\",\n  \"growth\",\n  \"settings\",\n  // Platform-only cross-cutting domain: shared AI supply (router).\n  \"supply\",\n]);\nexport type AdminDomainId = z.infer<typeof AdminDomainIdSchema>;\n\nconst IdSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-z][a-z0-9._-]*$/, \"ids are lowercase dotted identifiers\");\nconst UrlPathSchema = z.string().min(1).regex(/^\\//, \"contract urls are origin-relative paths\");\n\nexport const AdminColumnSchema = z.object({\n  key: z.string().min(1),\n  label: z.string().min(1),\n  kind: z.enum([\"text\", \"mono\", \"status\", \"badge\", \"number\", \"time\", \"link\"]).default(\"text\"),\n  /** Right-align numbers; the renderer does not guess from values. */\n  align: z.enum([\"start\", \"end\"]).default(\"start\"),\n});\nexport type AdminColumn = z.infer<typeof AdminColumnSchema>;\n\nexport const AdminResourceSchema = z.object({\n  id: IdSchema,\n  label: z.string().min(1),\n  /** `GET list` → ResourceList */\n  list: UrlPathSchema,\n  /** `GET detail` with `{id}` placeholder → one item */\n  detail: UrlPathSchema.optional(),\n  columns: z.array(AdminColumnSchema).min(1),\n  /** Column key that identifies a row. */\n  key: z.string().min(1).default(\"id\"),\n  search: z.boolean().default(false),\n  /** Action ids applicable per row. */\n  actions: z.array(IdSchema).default([]),\n});\nexport type AdminResource = z.infer<typeof AdminResourceSchema>;\n\nexport const AdminActionSchema = z.object({\n  id: IdSchema,\n  verb: z.string().min(1),\n  /** Resource the action belongs to; omitted = domain-level action. */\n  resource: IdSchema.optional(),\n  /** Minimum staff role. Read-only tier never sees write controls. */\n  role: StaffRoleSchema,\n  /** `POST url` with ActionRequest (`mode: plan | apply`). */\n  url: UrlPathSchema,\n  /** Plan step is mandatory; `false` only for idempotent, non-destructive refreshes. */\n  plan: z.boolean().default(true),\n  destructive: z.boolean().default(false),\n  /** JSON Schema for `input`; doubles as the MCP tool inputSchema. */\n  input: z.record(z.string(), z.unknown()).optional(),\n  description: z.string().optional(),\n});\nexport type AdminAction = z.infer<typeof AdminActionSchema>;\n\nexport const AdminSignalSchema = z.object({\n  id: IdSchema,\n  label: z.string().min(1),\n  severity: AdminSeveritySchema,\n  /** `GET probe` → SignalReading. Probed, never configured. */\n  probe: UrlPathSchema,\n  resource: IdSchema.optional(),\n  /** Action that resolves the signal when raised. */\n  action: IdSchema.optional(),\n});\nexport type AdminSignal = z.infer<typeof AdminSignalSchema>;\n\nexport const AdminPolicySchema = z.object({\n  id: IdSchema,\n  label: z.string().min(1),\n  /** Event name (`nebutra/<domain>.<thing>.<verb>`) that triggers the policy. */\n  on: z.string().min(1),\n  runs: IdSchema,\n  enabled: z.boolean().default(true),\n  /** Natural-language intent the policy was compiled from, when it was. */\n  intent: z.string().optional(),\n});\nexport type AdminPolicy = z.infer<typeof AdminPolicySchema>;\n\nexport const AdminDomainSchema = z.object({\n  id: AdminDomainIdSchema,\n  label: z.string().min(1),\n  resources: z.array(AdminResourceSchema).default([]),\n  actions: z.array(AdminActionSchema).default([]),\n  signals: z.array(AdminSignalSchema).default([]),\n  policies: z.array(AdminPolicySchema).default([]),\n  /** Product-owned browser surface for what the generic renderer cannot express. */\n  slot: UrlPathSchema.optional(),\n});\nexport type AdminDomain = z.infer<typeof AdminDomainSchema>;\n\nexport const AdminManifestSchema = z\n  .object({\n    contract: z.literal(ADMIN_CONTRACT_VERSION),\n    product: IdSchema,\n    label: z.string().min(1),\n    version: z.string().min(1),\n    /** Absolute origin every relative url resolves against. */\n    origin: z.string().url(),\n    graph: z.enum([\"core\", \"runtime\", \"labs\"]),\n    status: z.enum([\"stable\", \"foundation\", \"wip\", \"experimental\"]),\n    /** `GET health` → @nebutra/health HealthCheckResult. */\n    health: UrlPathSchema,\n    /** `GET audit?…` → audit events (nebutra.audit/v1). */\n    audit: UrlPathSchema.optional(),\n    domains: z.array(AdminDomainSchema).min(1),\n  })\n  .superRefine((m, ctx) => {\n    for (const d of m.domains) {\n      const actionIds = new Set(d.actions.map((a) => a.id));\n      const resourceIds = new Set(d.resources.map((r) => r.id));\n      for (const r of d.resources) {\n        for (const a of r.actions) {\n          if (!actionIds.has(a)) {\n            ctx.addIssue({\n              code: \"custom\",\n              message: `resource ${r.id} references unknown action ${a}`,\n            });\n          }\n        }\n      }\n      for (const s of d.signals) {\n        if (s.action && !actionIds.has(s.action)) {\n          ctx.addIssue({\n            code: \"custom\",\n            message: `signal ${s.id} references unknown action ${s.action}`,\n          });\n        }\n        if (s.resource && !resourceIds.has(s.resource)) {\n          ctx.addIssue({\n            code: \"custom\",\n            message: `signal ${s.id} references unknown resource ${s.resource}`,\n          });\n        }\n      }\n      for (const p of d.policies) {\n        if (!actionIds.has(p.runs)) {\n          ctx.addIssue({ code: \"custom\", message: `policy ${p.id} runs unknown action ${p.runs}` });\n        }\n      }\n    }\n  });\nexport type AdminManifest = z.infer<typeof AdminManifestSchema>;\n\n// -----------------------------------------------------------------------------\n// Wire envelopes\n// -----------------------------------------------------------------------------\n\nexport const ResourceListSchema = z.object({\n  items: z.array(z.record(z.string(), z.unknown())),\n  total: z.number().int().min(0),\n  /** When the list was produced from live probes; omitted for pure reads. */\n  probedAt: z.string().datetime().optional(),\n});\nexport type ResourceList = z.infer<typeof ResourceListSchema>;\n\nexport const ActionRequestSchema = z.discriminatedUnion(\"mode\", [\n  z.object({ mode: z.literal(\"plan\"), input: z.record(z.string(), z.unknown()).default({}) }),\n  z.object({\n    mode: z.literal(\"apply\"),\n    input: z.record(z.string(), z.unknown()).default({}),\n    /** Required when the action is destructive; ties the apply to a reviewed plan. */\n    planId: z.string().min(1).optional(),\n  }),\n]);\nexport type ActionRequest = z.infer<typeof ActionRequestSchema>;\n\nexport const PlanDiffEntrySchema = z.object({\n  op: z.enum([\"add\", \"remove\", \"change\"]),\n  path: z.string().min(1),\n  from: z.unknown().optional(),\n  to: z.unknown().optional(),\n});\nexport const ActionPlanSchema = z.object({\n  planId: z.string().min(1),\n  summary: z.string().min(1),\n  diff: z.array(PlanDiffEntrySchema),\n  affected: z\n    .array(z.object({ resource: IdSchema, id: z.string(), label: z.string().optional() }))\n    .default([]),\n  warnings: z.array(z.string()).default([]),\n  /** Plans expire; an apply after this is refused. */\n  expiresAt: z.string().datetime(),\n});\nexport type ActionPlan = z.infer<typeof ActionPlanSchema>;\n\nexport const ActionResultSchema = z.object({\n  /** Audit event id written by the product for this apply. */\n  auditId: z.string().min(1),\n  summary: z.string().min(1),\n  result: z.record(z.string(), z.unknown()).optional(),\n});\nexport type ActionResult = z.infer<typeof ActionResultSchema>;\n\nexport const SignalReadingSchema = z.object({\n  id: IdSchema,\n  status: z.enum([\"ok\", \"raised\", \"unknown\"]),\n  severity: AdminSeveritySchema,\n  probedAt: z.string().datetime(),\n  title: z.string().optional(),\n  detail: z.string().optional(),\n  resource: IdSchema.optional(),\n  action: IdSchema.optional(),\n  data: z.record(z.string(), z.unknown()).optional(),\n});\nexport type SignalReading = z.infer<typeof SignalReadingSchema>;\n\n/** Standard error body for contract endpoints. */\nexport const AdminErrorSchema = z.object({\n  error: z.object({\n    code: z.enum([\n      \"unauthenticated\",\n      \"forbidden\",\n      \"not_found\",\n      \"invalid_input\",\n      \"plan_required\",\n      \"plan_expired\",\n      \"upstream_unavailable\",\n      \"internal\",\n    ]),\n    message: z.string(),\n  }),\n});\nexport type AdminError = z.infer<typeof AdminErrorSchema>;\n\n/** Validate an apply against its action: destructive applies must reference a plan. */\nexport function assertApplyAllowed(action: AdminAction, request: ActionRequest): AdminError | null {\n  if (request.mode !== \"apply\") return null;\n  if ((action.destructive || action.plan) && !request.planId) {\n    return {\n      error: {\n        code: \"plan_required\",\n        message: `${action.id} requires a reviewed plan before apply`,\n      },\n    };\n  }\n  return null;\n}\n\n/** Resolve a contract path against the manifest origin. */\nexport function resolveContractUrl(manifest: Pick<AdminManifest, \"origin\">, path: string): string {\n  return new URL(path, manifest.origin).toString();\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAcX,IAAM,yBAAyB;AAG/B,IAAM,oBAAoB,EAAE,KAAK,CAAC,WAAW,YAAY,QAAQ,SAAS,CAAC;AAI3E,IAAM,kBAAkB,EAAE,KAAK;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,kBAA6C;AAAA,EACxD,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,gBAAgB;AAClB;AACO,SAAS,YAAY,MAAiB,UAA8B;AACzE,SAAO,gBAAgB,IAAI,KAAK,gBAAgB,QAAQ;AAC1D;AAEO,IAAM,sBAAsB,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,CAAC;AAI/D,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AACF,CAAC;AAGD,IAAM,WAAW,EACd,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,uBAAuB,sCAAsC;AACtE,IAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,OAAO,yCAAyC;AAEvF,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,SAAS,UAAU,QAAQ,MAAM,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA,EAE1F,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,QAAQ,OAAO;AACjD,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,MAAM;AAAA;AAAA,EAEN,QAAQ,cAAc,SAAS;AAAA,EAC/B,SAAS,EAAE,MAAM,iBAAiB,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,IAAI;AAAA,EACnC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEjC,SAAS,EAAE,MAAM,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAU,SAAS,SAAS;AAAA;AAAA,EAE5B,MAAM;AAAA;AAAA,EAEN,KAAK;AAAA;AAAA,EAEL,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC9B,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEtC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAClD,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,UAAU;AAAA;AAAA,EAEV,OAAO;AAAA,EACP,UAAU,SAAS,SAAS;AAAA;AAAA,EAE5B,QAAQ,SAAS,SAAS;AAC5B,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM;AAAA,EACN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,WAAW,EAAE,MAAM,mBAAmB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClD,SAAS,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,SAAS,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,UAAU,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAE/C,MAAM,cAAc,SAAS;AAC/B,CAAC;AAGM,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,UAAU,EAAE,QAAQ,sBAAsB;AAAA,EAC1C,SAAS;AAAA,EACT,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,OAAO,EAAE,KAAK,CAAC,QAAQ,WAAW,MAAM,CAAC;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,UAAU,cAAc,OAAO,cAAc,CAAC;AAAA;AAAA,EAE9D,QAAQ;AAAA;AAAA,EAER,OAAO,cAAc,SAAS;AAAA,EAC9B,SAAS,EAAE,MAAM,iBAAiB,EAAE,IAAI,CAAC;AAC3C,CAAC,EACA,YAAY,CAAC,GAAG,QAAQ;AACvB,aAAW,KAAK,EAAE,SAAS;AACzB,UAAM,YAAY,IAAI,IAAI,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACpD,UAAM,cAAc,IAAI,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACxD,eAAW,KAAK,EAAE,WAAW;AAC3B,iBAAW,KAAK,EAAE,SAAS;AACzB,YAAI,CAAC,UAAU,IAAI,CAAC,GAAG;AACrB,cAAI,SAAS;AAAA,YACX,MAAM;AAAA,YACN,SAAS,YAAY,EAAE,EAAE,8BAA8B,CAAC;AAAA,UAC1D,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,eAAW,KAAK,EAAE,SAAS;AACzB,UAAI,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,MAAM,GAAG;AACxC,YAAI,SAAS;AAAA,UACX,MAAM;AAAA,UACN,SAAS,UAAU,EAAE,EAAE,8BAA8B,EAAE,MAAM;AAAA,QAC/D,CAAC;AAAA,MACH;AACA,UAAI,EAAE,YAAY,CAAC,YAAY,IAAI,EAAE,QAAQ,GAAG;AAC9C,YAAI,SAAS;AAAA,UACX,MAAM;AAAA,UACN,SAAS,UAAU,EAAE,EAAE,gCAAgC,EAAE,QAAQ;AAAA,QACnE,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,KAAK,EAAE,UAAU;AAC1B,UAAI,CAAC,UAAU,IAAI,EAAE,IAAI,GAAG;AAC1B,YAAI,SAAS,EAAE,MAAM,UAAU,SAAS,UAAU,EAAE,EAAE,wBAAwB,EAAE,IAAI,GAAG,CAAC;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAOI,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA;AAAA,EAE7B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,sBAAsB,EAAE,mBAAmB,QAAQ;AAAA,EAC9D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;AAAA,EAC1F,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,IAEnD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,CAAC;AACH,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,KAAK,CAAC,OAAO,UAAU,QAAQ,CAAC;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAM,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC3B,IAAI,EAAE,QAAQ,EAAE,SAAS;AAC3B,CAAC;AACM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,MAAM,EAAE,MAAM,mBAAmB;AAAA,EACjC,UAAU,EACP,MAAM,EAAE,OAAO,EAAE,UAAU,UAAU,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EACpF,QAAQ,CAAC,CAAC;AAAA,EACb,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAExC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,qBAAqB,EAAE,OAAO;AAAA;AAAA,EAEzC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,IAAI;AAAA,EACJ,QAAQ,EAAE,KAAK,CAAC,MAAM,UAAU,SAAS,CAAC;AAAA,EAC1C,UAAU;AAAA,EACV,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,UAAU,SAAS,SAAS;AAAA,EAC5B,QAAQ,SAAS,SAAS;AAAA,EAC1B,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACnD,CAAC;AAIM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,SAAS,EAAE,OAAO;AAAA,EACpB,CAAC;AACH,CAAC;AAIM,SAAS,mBAAmB,QAAqB,SAA2C;AACjG,MAAI,QAAQ,SAAS,QAAS,QAAO;AACrC,OAAK,OAAO,eAAe,OAAO,SAAS,CAAC,QAAQ,QAAQ;AAC1D,WAAO;AAAA,MACL,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,GAAG,OAAO,EAAE;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,UAAyC,MAAsB;AAChG,SAAO,IAAI,IAAI,MAAM,SAAS,MAAM,EAAE,SAAS;AACjD;","names":[]}
+{"version":3,"sources":["../src/admin.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * Admin Contract — `nebutra.admin/v1`.\n *\n * Every Nebutra SaaS exposes one manifest describing the admin surface it\n * owns: resources (nouns), actions (audited verbs, plan → apply), signals\n * (probed facts) and policies (actions the system runs by itself). The\n * platform admin renders any product from its manifest; an agent derives\n * tools from it. Nothing product-specific lives in the renderer.\n *\n * See docs/plans/2026-09-08-admin-of-admins-model.md.\n */\n\nexport const ADMIN_CONTRACT_VERSION = \"nebutra.admin/v1\" as const;\n\n/** One status vocabulary. `unknown` is first-class and never renders green. */\nexport const AdminStatusSchema = z.enum([\"healthy\", \"degraded\", \"down\", \"unknown\"]);\nexport type AdminStatus = z.infer<typeof AdminStatusSchema>;\n\n/** One role ladder; product roles map onto it, staff grants mean the same everywhere. */\nexport const StaffRoleSchema = z.enum([\n  \"platform_readonly\",\n  \"platform_support\",\n  \"platform_operator\",\n  \"platform_owner\",\n]);\nexport type StaffRole = z.infer<typeof StaffRoleSchema>;\nexport const STAFF_ROLE_RANK: Record<StaffRole, number> = {\n  platform_readonly: 0,\n  platform_support: 1,\n  platform_operator: 2,\n  platform_owner: 3,\n};\nexport function roleAtLeast(role: StaffRole, required: StaffRole): boolean {\n  return STAFF_ROLE_RANK[role] >= STAFF_ROLE_RANK[required];\n}\n\nexport const AdminSeveritySchema = z.enum([\"info\", \"warn\", \"critical\"]);\nexport type AdminSeverity = z.infer<typeof AdminSeveritySchema>;\n\n/** The canonical eleven. A product declares the subset it has. */\nexport const AdminDomainIdSchema = z.enum([\n  \"identity\",\n  \"access\",\n  \"commerce\",\n  \"usage\",\n  \"catalog\",\n  \"operations\",\n  \"integrations\",\n  \"trust\",\n  \"support\",\n  \"growth\",\n  \"settings\",\n  // Platform-only cross-cutting domain: shared AI supply (router).\n  \"supply\",\n]);\nexport type AdminDomainId = z.infer<typeof AdminDomainIdSchema>;\n\nconst IdSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-z][a-z0-9._-]*$/, \"ids are lowercase dotted identifiers\");\nconst UrlPathSchema = z.string().min(1).regex(/^\\//, \"contract urls are origin-relative paths\");\n\nexport const AdminColumnSchema = z.object({\n  key: z.string().min(1),\n  label: z.string().min(1),\n  kind: z.enum([\"text\", \"mono\", \"status\", \"badge\", \"number\", \"time\", \"link\"]).default(\"text\"),\n  /** Right-align numbers; the renderer does not guess from values. */\n  align: z.enum([\"start\", \"end\"]).default(\"start\"),\n});\nexport type AdminColumn = z.infer<typeof AdminColumnSchema>;\n\nexport const AdminResourceSchema = z.object({\n  id: IdSchema,\n  label: z.string().min(1),\n  /** `GET list` → ResourceList */\n  list: UrlPathSchema,\n  /** `GET detail` with `{id}` placeholder → one item */\n  detail: UrlPathSchema.optional(),\n  columns: z.array(AdminColumnSchema).min(1),\n  /** Column key that identifies a row. */\n  key: z.string().min(1).default(\"id\"),\n  search: z.boolean().default(false),\n  /** Action ids applicable per row. */\n  actions: z.array(IdSchema).default([]),\n});\nexport type AdminResource = z.infer<typeof AdminResourceSchema>;\n\nexport const AdminActionSchema = z.object({\n  id: IdSchema,\n  verb: z.string().min(1),\n  /** Resource the action belongs to; omitted = domain-level action. */\n  resource: IdSchema.optional(),\n  /** Minimum staff role. Read-only tier never sees write controls. */\n  role: StaffRoleSchema,\n  /** `POST url` with ActionRequest (`mode: plan | apply`). */\n  url: UrlPathSchema,\n  /** Plan step is mandatory; `false` only for idempotent, non-destructive refreshes. */\n  plan: z.boolean().default(true),\n  destructive: z.boolean().default(false),\n  /** JSON Schema for `input`; doubles as the MCP tool inputSchema. */\n  input: z.record(z.string(), z.unknown()).optional(),\n  description: z.string().optional(),\n});\nexport type AdminAction = z.infer<typeof AdminActionSchema>;\n\nexport const AdminSignalSchema = z.object({\n  id: IdSchema,\n  label: z.string().min(1),\n  severity: AdminSeveritySchema,\n  /** `GET probe` → SignalReading. Probed, never configured. */\n  probe: UrlPathSchema,\n  resource: IdSchema.optional(),\n  /** Action that resolves the signal when raised. */\n  action: IdSchema.optional(),\n});\nexport type AdminSignal = z.infer<typeof AdminSignalSchema>;\n\nexport const AdminPolicySchema = z.object({\n  id: IdSchema,\n  label: z.string().min(1),\n  /** Event name (`nebutra/<domain>.<thing>.<verb>`) that triggers the policy. */\n  on: z.string().min(1),\n  runs: IdSchema,\n  enabled: z.boolean().default(true),\n  /** Natural-language intent the policy was compiled from, when it was. */\n  intent: z.string().optional(),\n});\nexport type AdminPolicy = z.infer<typeof AdminPolicySchema>;\n\nexport const AdminDomainSchema = z.object({\n  id: AdminDomainIdSchema,\n  label: z.string().min(1),\n  resources: z.array(AdminResourceSchema).default([]),\n  actions: z.array(AdminActionSchema).default([]),\n  signals: z.array(AdminSignalSchema).default([]),\n  policies: z.array(AdminPolicySchema).default([]),\n  /** Product-owned browser surface for what the generic renderer cannot express. */\n  slot: UrlPathSchema.optional(),\n});\nexport type AdminDomain = z.infer<typeof AdminDomainSchema>;\n\nexport const AdminManifestSchema = z\n  .object({\n    contract: z.literal(ADMIN_CONTRACT_VERSION),\n    product: IdSchema,\n    label: z.string().min(1),\n    version: z.string().min(1),\n    /** Absolute origin every relative url resolves against. */\n    origin: z.string().url(),\n    graph: z.enum([\"core\", \"runtime\", \"labs\"]),\n    status: z.enum([\"stable\", \"foundation\", \"wip\", \"experimental\"]),\n    /** `GET health` → @nebutra/health HealthCheckResult. */\n    health: UrlPathSchema,\n    /** `GET audit?…` → audit events (nebutra.audit/v1). */\n    audit: UrlPathSchema.optional(),\n    domains: z.array(AdminDomainSchema).min(1),\n  })\n  .superRefine((m, ctx) => {\n    for (const d of m.domains) {\n      const actionIds = new Set(d.actions.map((a) => a.id));\n      const resourceIds = new Set(d.resources.map((r) => r.id));\n      for (const r of d.resources) {\n        for (const a of r.actions) {\n          if (!actionIds.has(a)) {\n            ctx.addIssue({\n              code: \"custom\",\n              message: `resource ${r.id} references unknown action ${a}`,\n            });\n          }\n        }\n      }\n      for (const s of d.signals) {\n        if (s.action && !actionIds.has(s.action)) {\n          ctx.addIssue({\n            code: \"custom\",\n            message: `signal ${s.id} references unknown action ${s.action}`,\n          });\n        }\n        if (s.resource && !resourceIds.has(s.resource)) {\n          ctx.addIssue({\n            code: \"custom\",\n            message: `signal ${s.id} references unknown resource ${s.resource}`,\n          });\n        }\n      }\n      for (const p of d.policies) {\n        if (!actionIds.has(p.runs)) {\n          ctx.addIssue({ code: \"custom\", message: `policy ${p.id} runs unknown action ${p.runs}` });\n        }\n      }\n    }\n  });\nexport type AdminManifest = z.infer<typeof AdminManifestSchema>;\n\n// -----------------------------------------------------------------------------\n// Wire envelopes\n// -----------------------------------------------------------------------------\n\nexport const ResourceListSchema = z.object({\n  items: z.array(z.record(z.string(), z.unknown())),\n  total: z.number().int().min(0),\n  /** When the list was produced from live probes; omitted for pure reads. */\n  probedAt: z.string().datetime().optional(),\n});\nexport type ResourceList = z.infer<typeof ResourceListSchema>;\n\nexport const ActionRequestSchema = z.discriminatedUnion(\"mode\", [\n  z.object({ mode: z.literal(\"plan\"), input: z.record(z.string(), z.unknown()).default({}) }),\n  z.object({\n    mode: z.literal(\"apply\"),\n    input: z.record(z.string(), z.unknown()).default({}),\n    /** Required when the action is destructive; ties the apply to a reviewed plan. */\n    planId: z.string().min(1).optional(),\n  }),\n]);\nexport type ActionRequest = z.infer<typeof ActionRequestSchema>;\n\nexport const PlanDiffEntrySchema = z.object({\n  op: z.enum([\"add\", \"remove\", \"change\"]),\n  path: z.string().min(1),\n  from: z.unknown().optional(),\n  to: z.unknown().optional(),\n});\nexport const ActionPlanSchema = z.object({\n  planId: z.string().min(1),\n  summary: z.string().min(1),\n  diff: z.array(PlanDiffEntrySchema),\n  affected: z\n    .array(z.object({ resource: IdSchema, id: z.string(), label: z.string().optional() }))\n    .default([]),\n  warnings: z.array(z.string()).default([]),\n  /** Plans expire; an apply after this is refused. */\n  expiresAt: z.string().datetime(),\n});\nexport type ActionPlan = z.infer<typeof ActionPlanSchema>;\n\nexport const ActionResultSchema = z.object({\n  /** Audit event id written by the product for this apply. */\n  auditId: z.string().min(1),\n  summary: z.string().min(1),\n  result: z.record(z.string(), z.unknown()).optional(),\n});\nexport type ActionResult = z.infer<typeof ActionResultSchema>;\n\nexport const SignalReadingSchema = z.object({\n  id: IdSchema,\n  status: z.enum([\"ok\", \"raised\", \"unknown\"]),\n  severity: AdminSeveritySchema,\n  probedAt: z.string().datetime(),\n  title: z.string().optional(),\n  detail: z.string().optional(),\n  resource: IdSchema.optional(),\n  action: IdSchema.optional(),\n  data: z.record(z.string(), z.unknown()).optional(),\n});\nexport type SignalReading = z.infer<typeof SignalReadingSchema>;\n\n/** Standard error body for contract endpoints. */\nexport const AdminErrorSchema = z.object({\n  error: z.object({\n    code: z.enum([\n      \"unauthenticated\",\n      \"forbidden\",\n      \"not_found\",\n      \"invalid_input\",\n      \"plan_required\",\n      \"plan_expired\",\n      \"upstream_unavailable\",\n      \"internal\",\n    ]),\n    message: z.string(),\n  }),\n});\nexport type AdminError = z.infer<typeof AdminErrorSchema>;\n\n/** Validate an apply against its action: destructive applies must reference a plan. */\nexport function assertApplyAllowed(action: AdminAction, request: ActionRequest): AdminError | null {\n  if (request.mode !== \"apply\") return null;\n  if ((action.destructive || action.plan) && !request.planId) {\n    return {\n      error: {\n        code: \"plan_required\",\n        message: `${action.id} requires a reviewed plan before apply`,\n      },\n    };\n  }\n  return null;\n}\n\n/** Resolve a contract path against the manifest origin. */\nexport function resolveContractUrl(manifest: Pick<AdminManifest, \"origin\">, path: string): string {\n  return new URL(path, manifest.origin).toString();\n}\n\n/**\n * The HTTP status an admin error travels as.\n *\n * Cloudflare sits in front of every admin and product host, and it replaces an\n * origin's `502` or `504` with its own branded HTML error page. The body we\n * wrote — the code and the message the operator needs — is discarded before the\n * browser sees it, so the console can only report `network · HTTP 502`. A\n * contract endpoint therefore never answers with a gateway status: an upstream\n * that failed is `503`, and a fault of our own is `500`. Both reach the client\n * with their JSON envelope intact.\n */\nexport const ADMIN_ERROR_STATUS: Record<AdminError[\"error\"][\"code\"], number> = {\n  unauthenticated: 401,\n  forbidden: 403,\n  not_found: 404,\n  invalid_input: 400,\n  plan_required: 409,\n  plan_expired: 409,\n  upstream_unavailable: 503,\n  internal: 500,\n};\n\n/**\n * Narrow an arbitrary status to one that survives the CDN, preserving anything\n * already safe. Use it when echoing an upstream contract call's status.\n */\nexport function cdnSafeStatus(status: number | undefined, fallback = 503): number {\n  if (!status || status === 502 || status === 504 || status < 400 || status > 599) return fallback;\n  return status;\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAcX,IAAM,yBAAyB;AAG/B,IAAM,oBAAoB,EAAE,KAAK,CAAC,WAAW,YAAY,QAAQ,SAAS,CAAC;AAI3E,IAAM,kBAAkB,EAAE,KAAK;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,kBAA6C;AAAA,EACxD,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,gBAAgB;AAClB;AACO,SAAS,YAAY,MAAiB,UAA8B;AACzE,SAAO,gBAAgB,IAAI,KAAK,gBAAgB,QAAQ;AAC1D;AAEO,IAAM,sBAAsB,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,CAAC;AAI/D,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AACF,CAAC;AAGD,IAAM,WAAW,EACd,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,uBAAuB,sCAAsC;AACtE,IAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,OAAO,yCAAyC;AAEvF,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,SAAS,UAAU,QAAQ,MAAM,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA,EAE1F,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,QAAQ,OAAO;AACjD,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,MAAM;AAAA;AAAA,EAEN,QAAQ,cAAc,SAAS;AAAA,EAC/B,SAAS,EAAE,MAAM,iBAAiB,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,IAAI;AAAA,EACnC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEjC,SAAS,EAAE,MAAM,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAU,SAAS,SAAS;AAAA;AAAA,EAE5B,MAAM;AAAA;AAAA,EAEN,KAAK;AAAA;AAAA,EAEL,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC9B,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEtC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAClD,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,UAAU;AAAA;AAAA,EAEV,OAAO;AAAA,EACP,UAAU,SAAS,SAAS;AAAA;AAAA,EAE5B,QAAQ,SAAS,SAAS;AAC5B,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM;AAAA,EACN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,WAAW,EAAE,MAAM,mBAAmB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClD,SAAS,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,SAAS,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,UAAU,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAE/C,MAAM,cAAc,SAAS;AAC/B,CAAC;AAGM,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,UAAU,EAAE,QAAQ,sBAAsB;AAAA,EAC1C,SAAS;AAAA,EACT,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,OAAO,EAAE,KAAK,CAAC,QAAQ,WAAW,MAAM,CAAC;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,UAAU,cAAc,OAAO,cAAc,CAAC;AAAA;AAAA,EAE9D,QAAQ;AAAA;AAAA,EAER,OAAO,cAAc,SAAS;AAAA,EAC9B,SAAS,EAAE,MAAM,iBAAiB,EAAE,IAAI,CAAC;AAC3C,CAAC,EACA,YAAY,CAAC,GAAG,QAAQ;AACvB,aAAW,KAAK,EAAE,SAAS;AACzB,UAAM,YAAY,IAAI,IAAI,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACpD,UAAM,cAAc,IAAI,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACxD,eAAW,KAAK,EAAE,WAAW;AAC3B,iBAAW,KAAK,EAAE,SAAS;AACzB,YAAI,CAAC,UAAU,IAAI,CAAC,GAAG;AACrB,cAAI,SAAS;AAAA,YACX,MAAM;AAAA,YACN,SAAS,YAAY,EAAE,EAAE,8BAA8B,CAAC;AAAA,UAC1D,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,eAAW,KAAK,EAAE,SAAS;AACzB,UAAI,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,MAAM,GAAG;AACxC,YAAI,SAAS;AAAA,UACX,MAAM;AAAA,UACN,SAAS,UAAU,EAAE,EAAE,8BAA8B,EAAE,MAAM;AAAA,QAC/D,CAAC;AAAA,MACH;AACA,UAAI,EAAE,YAAY,CAAC,YAAY,IAAI,EAAE,QAAQ,GAAG;AAC9C,YAAI,SAAS;AAAA,UACX,MAAM;AAAA,UACN,SAAS,UAAU,EAAE,EAAE,gCAAgC,EAAE,QAAQ;AAAA,QACnE,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,KAAK,EAAE,UAAU;AAC1B,UAAI,CAAC,UAAU,IAAI,EAAE,IAAI,GAAG;AAC1B,YAAI,SAAS,EAAE,MAAM,UAAU,SAAS,UAAU,EAAE,EAAE,wBAAwB,EAAE,IAAI,GAAG,CAAC;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAOI,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA;AAAA,EAE7B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,sBAAsB,EAAE,mBAAmB,QAAQ;AAAA,EAC9D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;AAAA,EAC1F,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,IAEnD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,CAAC;AACH,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,KAAK,CAAC,OAAO,UAAU,QAAQ,CAAC;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAM,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC3B,IAAI,EAAE,QAAQ,EAAE,SAAS;AAC3B,CAAC;AACM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,MAAM,EAAE,MAAM,mBAAmB;AAAA,EACjC,UAAU,EACP,MAAM,EAAE,OAAO,EAAE,UAAU,UAAU,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EACpF,QAAQ,CAAC,CAAC;AAAA,EACb,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAExC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,qBAAqB,EAAE,OAAO;AAAA;AAAA,EAEzC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,IAAI;AAAA,EACJ,QAAQ,EAAE,KAAK,CAAC,MAAM,UAAU,SAAS,CAAC;AAAA,EAC1C,UAAU;AAAA,EACV,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,UAAU,SAAS,SAAS;AAAA,EAC5B,QAAQ,SAAS,SAAS;AAAA,EAC1B,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACnD,CAAC;AAIM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,SAAS,EAAE,OAAO;AAAA,EACpB,CAAC;AACH,CAAC;AAIM,SAAS,mBAAmB,QAAqB,SAA2C;AACjG,MAAI,QAAQ,SAAS,QAAS,QAAO;AACrC,OAAK,OAAO,eAAe,OAAO,SAAS,CAAC,QAAQ,QAAQ;AAC1D,WAAO;AAAA,MACL,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,GAAG,OAAO,EAAE;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,UAAyC,MAAsB;AAChG,SAAO,IAAI,IAAI,MAAM,SAAS,MAAM,EAAE,SAAS;AACjD;AAaO,IAAM,qBAAkE;AAAA,EAC7E,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,eAAe;AAAA,EACf,eAAe;AAAA,EACf,cAAc;AAAA,EACd,sBAAsB;AAAA,EACtB,UAAU;AACZ;AAMO,SAAS,cAAc,QAA4B,WAAW,KAAa;AAChF,MAAI,CAAC,UAAU,WAAW,OAAO,WAAW,OAAO,SAAS,OAAO,SAAS,IAAK,QAAO;AACxF,SAAO;AACT;","names":[]}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { ADMIN_CONTRACT_VERSION, ActionPlan, ActionPlanSchema, ActionRequest, ActionRequestSchema, ActionResult, ActionResultSchema, AdminAction, AdminActionSchema, AdminColumn, AdminColumnSchema, AdminDomain, AdminDomainId, AdminDomainIdSchema, AdminDomainSchema, AdminError, AdminErrorSchema, AdminManifest, AdminManifestSchema, AdminPolicy, AdminPolicySchema, AdminResource, AdminResourceSchema, AdminSeverity, AdminSeveritySchema, AdminSignal, AdminSignalSchema, AdminStatus, AdminStatusSchema, PlanDiffEntrySchema, ResourceList, ResourceListSchema, STAFF_ROLE_RANK, SignalReading, SignalReadingSchema, StaffRole, StaffRoleSchema, assertApplyAllowed, resolveContractUrl, roleAtLeast } from './admin.js';
+export { ADMIN_CONTRACT_VERSION, ADMIN_ERROR_STATUS, ActionPlan, ActionPlanSchema, ActionRequest, ActionRequestSchema, ActionResult, ActionResultSchema, AdminAction, AdminActionSchema, AdminColumn, AdminColumnSchema, AdminDomain, AdminDomainId, AdminDomainIdSchema, AdminDomainSchema, AdminError, AdminErrorSchema, AdminManifest, AdminManifestSchema, AdminPolicy, AdminPolicySchema, AdminResource, AdminResourceSchema, AdminSeverity, AdminSeveritySchema, AdminSignal, AdminSignalSchema, AdminStatus, AdminStatusSchema, PlanDiffEntrySchema, ResourceList, ResourceListSchema, STAFF_ROLE_RANK, SignalReading, SignalReadingSchema, StaffRole, StaffRoleSchema, assertApplyAllowed, cdnSafeStatus, resolveContractUrl, roleAtLeast } from './admin.js';
 export { PricingCatalogVersion, PricingCatalogVersionSchema, UsageLedgerEntryInput, UsageLedgerEntryInputSchema, UsageLedgerSourceContract, UsageLedgerSourceContractSchema, UsageTypeContract, UsageTypeContractSchema } from './billing.js';
 export { EventContext, EventContextSchema, EventEnvelope, EventEnvelopeSchema } from './events.js';
 export { AuthProvider, AuthProviderSchema, CanonicalIdentity, CanonicalIdentitySchema, CanonicalPlan, CanonicalPlanSchema, CanonicalRole, CanonicalRoleSchema, ExternalAccountLink, ExternalAccountLinkSchema, NebutraOAuthScope, NebutraOAuthScopeSchema, OAuthClientRegistration, OAuthClientRegistrationSchema, OAuthClientType, OAuthClientTypeSchema, TenantHeaderContract, TenantHeaderContractSchema } from './identity.js';

package/dist/index.js

@@ -1,5 +1,6 @@
 import {
   ADMIN_CONTRACT_VERSION,
+  ADMIN_ERROR_STATUS,
   ActionPlanSchema,
   ActionRequestSchema,
   ActionResultSchema,
@@ -20,9 +21,10 @@ import {
   SignalReadingSchema,
   StaffRoleSchema,
   assertApplyAllowed,
+  cdnSafeStatus,
   resolveContractUrl,
   roleAtLeast
-} from "./chunk-ERZTZ3PW.js";
+} from "./chunk-G65TWQGE.js";
 import {
   PricingCatalogVersionSchema,
   UsageLedgerEntryInputSchema,
@@ -57,7 +59,7 @@ import {
   NotificationSettingsUpdateRequestContractSchema,
   NotificationSettingsUpdateResponseContractSchema,
   NotificationUnreadCountResponseContractSchema
-} from "./chunk-F4BR76CX.js";
+} from "./chunk-BX2ZIODN.js";
 import {
   DEFAULT_RESUME_MARGINS,
   ExperienceKindSchema,
@@ -90,6 +92,7 @@ import {
 } from "./chunk-PU65L2HQ.js";
 export {
   ADMIN_CONTRACT_VERSION,
+  ADMIN_ERROR_STATUS,
   ActionPlanSchema,
   ActionRequestSchema,
   ActionResultSchema,
@@ -165,6 +168,7 @@ export {
   UsageTypeContractSchema,
   VentureStageSchema,
   assertApplyAllowed,
+  cdnSafeStatus,
   resolveContractUrl,
   roleAtLeast
 };

package/dist/notifications.d.ts

@@ -17,13 +17,10 @@ declare const NotificationFrequencyContractSchema: z.ZodEnum<{
 type NotificationFrequencyContract = z.infer<typeof NotificationFrequencyContractSchema>;
 declare const NotificationRuntimeStatusContractSchema: z.ZodObject<{
     provider: z.ZodEnum<{
-        novu: "novu";
         direct: "direct";
     }>;
     providerLabel: z.ZodString;
     mode: z.ZodEnum<{
-        degraded: "degraded";
-        managed: "managed";
         self_hosted: "self_hosted";
         preview: "preview";
     }>;

package/dist/notifications.js

@@ -11,7 +11,7 @@ import {
   NotificationSettingsUpdateRequestContractSchema,
   NotificationSettingsUpdateResponseContractSchema,
   NotificationUnreadCountResponseContractSchema
-} from "./chunk-F4BR76CX.js";
+} from "./chunk-BX2ZIODN.js";
 export {
   NotificationChannelContractSchema,
   NotificationFrequencyContractSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebutra/contracts",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Canonical API/event/domain contracts for Nebutra superstarter",
   "private": false,
   "nebutra": {

package/src/admin.ts

@@ -295,3 +295,34 @@ export function assertApplyAllowed(action: AdminAction, request: ActionRequest):
 export function resolveContractUrl(manifest: Pick<AdminManifest, "origin">, path: string): string {
   return new URL(path, manifest.origin).toString();
 }
+
+/**
+ * The HTTP status an admin error travels as.
+ *
+ * Cloudflare sits in front of every admin and product host, and it replaces an
+ * origin's `502` or `504` with its own branded HTML error page. The body we
+ * wrote — the code and the message the operator needs — is discarded before the
+ * browser sees it, so the console can only report `network · HTTP 502`. A
+ * contract endpoint therefore never answers with a gateway status: an upstream
+ * that failed is `503`, and a fault of our own is `500`. Both reach the client
+ * with their JSON envelope intact.
+ */
+export const ADMIN_ERROR_STATUS: Record<AdminError["error"]["code"], number> = {
+  unauthenticated: 401,
+  forbidden: 403,
+  not_found: 404,
+  invalid_input: 400,
+  plan_required: 409,
+  plan_expired: 409,
+  upstream_unavailable: 503,
+  internal: 500,
+};
+
+/**
+ * Narrow an arbitrary status to one that survives the CDN, preserving anything
+ * already safe. Use it when echoing an upstream contract call's status.
+ */
+export function cdnSafeStatus(status: number | undefined, fallback = 503): number {
+  if (!status || status === 502 || status === 504 || status < 400 || status > 599) return fallback;
+  return status;
+}

package/src/notifications.ts

@@ -12,9 +12,9 @@ export const NotificationFrequencyContractSchema = z.enum([
 export type NotificationFrequencyContract = z.infer<typeof NotificationFrequencyContractSchema>;
 
 export const NotificationRuntimeStatusContractSchema = z.object({
-  provider: z.enum(["novu", "direct"]),
+  provider: z.enum(["direct"]),
   providerLabel: z.string().min(1),
-  mode: z.enum(["managed", "self_hosted", "preview", "degraded"]),
+  mode: z.enum(["self_hosted", "preview"]),
   canManagePreferences: z.boolean(),
   canViewInbox: z.boolean(),
   canMarkInboxRead: z.boolean(),

package/dist/chunk-F4BR76CX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/notifications.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const NotificationChannelContractSchema = z.enum([\"in_app\", \"email\", \"push\", \"sms\", \"chat\"]);\nexport type NotificationChannelContract = z.infer<typeof NotificationChannelContractSchema>;\n\nexport const NotificationFrequencyContractSchema = z.enum([\n  \"immediate\",\n  \"daily\",\n  \"weekly\",\n  \"never\",\n]);\nexport type NotificationFrequencyContract = z.infer<typeof NotificationFrequencyContractSchema>;\n\nexport const NotificationRuntimeStatusContractSchema = z.object({\n  provider: z.enum([\"novu\", \"direct\"]),\n  providerLabel: z.string().min(1),\n  mode: z.enum([\"managed\", \"self_hosted\", \"preview\", \"degraded\"]),\n  canManagePreferences: z.boolean(),\n  canViewInbox: z.boolean(),\n  canMarkInboxRead: z.boolean(),\n  summary: z.string().min(1),\n  reason: z.string().optional(),\n  missing: z.array(z.string()),\n});\nexport type NotificationRuntimeStatusContract = z.infer<\n  typeof NotificationRuntimeStatusContractSchema\n>;\n\nexport const NotificationPreferenceContractSchema = z.object({\n  userId: z.string().min(1),\n  tenantId: z.string().min(1).optional(),\n  channel: NotificationChannelContractSchema,\n  enabled: z.boolean(),\n  disabledCategories: z.array(z.string()).optional(),\n  frequency: NotificationFrequencyContractSchema,\n  updatedAt: z.string().datetime().optional(),\n});\nexport type NotificationPreferenceContract = z.infer<typeof NotificationPreferenceContractSchema>;\n\nexport const NotificationItemContractSchema = z.object({\n  id: z.string().min(1),\n  userId: z.string().min(1),\n  tenantId: z.string().min(1).optional(),\n  type: z.string().min(1),\n  title: z.string(),\n  body: z.string(),\n  data: z.record(z.string(), z.unknown()).optional(),\n  read: z.boolean(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\nexport type NotificationItemContract = z.infer<typeof NotificationItemContractSchema>;\n\nexport const NotificationListQueryContractSchema = z.object({\n  limit: z.coerce.number().int().min(1).max(100).default(50),\n  offset: z.coerce.number().int().min(0).default(0),\n  unreadOnly: z.coerce.boolean().optional(),\n});\nexport type NotificationListQueryContract = z.infer<typeof NotificationListQueryContractSchema>;\n\nexport const NotificationListResponseContractSchema = z.object({\n  items: z.array(NotificationItemContractSchema),\n  total: z.number().int().nonnegative(),\n  unreadCount: z.number().int().nonnegative(),\n});\nexport type NotificationListResponseContract = z.infer<\n  typeof NotificationListResponseContractSchema\n>;\n\nexport const NotificationUnreadCountResponseContractSchema = z.object({\n  count: z.number().int().nonnegative(),\n});\nexport type NotificationUnreadCountResponseContract = z.infer<\n  typeof NotificationUnreadCountResponseContractSchema\n>;\n\nexport const NotificationMarkReadRequestContractSchema = z.object({\n  ids: z.array(z.string().min(1)).min(1).max(100),\n});\nexport type NotificationMarkReadRequestContract = z.infer<\n  typeof NotificationMarkReadRequestContractSchema\n>;\n\nexport const NotificationMutationCountResponseContractSchema = z.object({\n  count: z.number().int().nonnegative(),\n});\nexport type NotificationMutationCountResponseContract = z.infer<\n  typeof NotificationMutationCountResponseContractSchema\n>;\n\nexport const NotificationSettingsUpdateRequestContractSchema = z.object({\n  type: z.string().min(1),\n  channel: NotificationChannelContractSchema,\n  enabled: z.boolean(),\n});\nexport type NotificationSettingsUpdateRequestContract = z.infer<\n  typeof NotificationSettingsUpdateRequestContractSchema\n>;\n\nexport const NotificationSettingsUpdateResponseContractSchema = z.object({\n  ok: z.literal(true),\n  preference: NotificationPreferenceContractSchema,\n});\nexport type NotificationSettingsUpdateResponseContract = z.infer<\n  typeof NotificationSettingsUpdateResponseContractSchema\n>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,oCAAoC,EAAE,KAAK,CAAC,UAAU,SAAS,QAAQ,OAAO,MAAM,CAAC;AAG3F,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0CAA0C,EAAE,OAAO;AAAA,EAC9D,UAAU,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,MAAM,EAAE,KAAK,CAAC,WAAW,eAAe,WAAW,UAAU,CAAC;AAAA,EAC9D,sBAAsB,EAAE,QAAQ;AAAA,EAChC,cAAc,EAAE,QAAQ;AAAA,EACxB,kBAAkB,EAAE,QAAQ;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAC7B,CAAC;AAKM,IAAM,uCAAuC,EAAE,OAAO;AAAA,EAC3D,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,SAAS;AAAA,EACT,SAAS,EAAE,QAAQ;AAAA,EACnB,oBAAoB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACjD,WAAW;AAAA,EACX,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,QAAQ;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAChD,YAAY,EAAE,OAAO,QAAQ,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,OAAO,EAAE,MAAM,8BAA8B;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAKM,IAAM,gDAAgD,EAAE,OAAO;AAAA,EACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACtC,CAAC;AAKM,IAAM,4CAA4C,EAAE,OAAO;AAAA,EAChE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAChD,CAAC;AAKM,IAAM,kDAAkD,EAAE,OAAO;AAAA,EACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACtC,CAAC;AAKM,IAAM,kDAAkD,EAAE,OAAO;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,SAAS;AAAA,EACT,SAAS,EAAE,QAAQ;AACrB,CAAC;AAKM,IAAM,mDAAmD,EAAE,OAAO;AAAA,EACvE,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY;AACd,CAAC;","names":[]}