@spacefast/common 0.0.24 → 0.2.1

package/dist/contracts/superadmin-tenants.js

@@ -1,15 +1,16 @@
 import { z } from "zod";
+import { ApiKeySchema } from "./api-keys.js";
 import { makeOffsetListSchema } from "./common.js";
-import { providerClientStatus, tenantKind, tenantStatus } from "./enums.js";
+import { providerClientStatus, tenantKind, tenantMode, tenantStatus } from "./enums.js";
 import { superadminPaginationSchema } from "./superadmin.js";
-// ProviderClient (`pvc_`) = one WP.Cloud API client identity sites are
-// provisioned under (internal-docs/platform.md "ProviderClient"). Operator-only
-// resource. Each row is a tenant-owned BYO account; the first-party client is
-// configured separately as the platform context. The API token is write-only;
-// responses expose only a masked hint, never the secret.
+// One WP.Cloud API client identity sites are provisioned under. Each row is a
+// tenant-owned BYO account; the first-party client is configured separately.
+// The API token is write-only: responses expose only a masked hint.
 export const SuperadminProviderClientSchema = z.object({
     id: z.string().describe("ProviderClient id (`pvc_`)."),
-    provider: z.literal("wpcloud").describe("Hosting provider this client identity belongs to."),
+    provider: z
+        .enum(["wpcloud", "simulated"])
+        .describe("Hosting provider this client identity belongs to. `simulated` is a linked test tenant's synthetic provider (no real wp.cloud account)."),
     tenantId: z.string().describe("Tenant that owns this WP.Cloud account."),
     name: z.string().describe("The WP.Cloud client/account name used as the {client} path param."),
     label: z.string().describe("Human-readable operator label."),
@@ -18,10 +19,6 @@ export const SuperadminProviderClientSchema = z.object({
         .string()
         .nullable()
         .describe("Default datacenter for sites provisioned under this client."),
-    defaultPhpVersion: z
-        .string()
-        .nullable()
-        .describe("Default PHP version for sites provisioned under this client."),
     status: providerClientStatus.describe("Whether this client identity can provision sites."),
     tokenHint: z
         .string()
@@ -47,7 +44,6 @@ export const superadminProviderClientCreateSchema = z.object({
     apiToken: z.string().trim().min(1),
     apiBase: z.string().url().optional(),
     defaultDatacenter: z.string().trim().min(1).optional(),
-    defaultPhpVersion: z.string().trim().min(1).optional(),
     tenantId: z.string().trim().min(1),
 });
 export const superadminProviderClientPatchSchema = z.object({
@@ -56,7 +52,6 @@ export const superadminProviderClientPatchSchema = z.object({
     apiToken: z.string().trim().min(1).optional(),
     apiBase: z.string().url().nullable().optional(),
     defaultDatacenter: z.string().trim().min(1).nullable().optional(),
-    defaultPhpVersion: z.string().trim().min(1).nullable().optional(),
     status: providerClientStatus.optional(),
     tenantId: z.string().trim().min(1).optional(),
 });
@@ -72,6 +67,11 @@ export const superadminProviderClientTestResponseSchema = z.object({
 export const SuperadminTenantSchema = z.object({
     id: z.string().describe("Tenant id (`ten_`); the main tenant is `ten_main`."),
     kind: tenantKind,
+    mode: tenantMode.describe("`test` for a linked test tenant (a sandbox twin), `live` otherwise."),
+    liveTenantId: z
+        .string()
+        .nullable()
+        .describe("For a test tenant, the live tenant it is linked to; null on live tenants."),
     name: z.string(),
     status: tenantStatus,
     servingGraceUntil: z
@@ -110,3 +110,22 @@ export const superadminTenantPatchSchema = z.object({
     defaultRegion: z.string().trim().min(1).nullable().optional(),
     metadata: z.record(z.string(), z.string()).nullable().optional(),
 });
+// A tenant-rooted `partner_admin` credential minted for a partner tenant. This
+// is the one-time bootstrap: the secret is returned here and never again, and
+// the holder can then mint its own scoped keys for its customers.
+export const SuperadminBootstrapKeySchema = ApiKeySchema.describe("A freshly minted tenant-rooted partner_admin API key. Its `secret` is returned once, here only.");
+// One side of a partner pair: the tenant plus its one-time bootstrap key.
+export const SuperadminTenantWithBootstrapKeySchema = z.object({
+    tenant: SuperadminTenantSchema,
+    bootstrapKey: SuperadminBootstrapKeySchema,
+});
+// Creating a partner mints a live+test PAIR: a live tenant and its linked test
+// twin, each with its own tenant-rooted `partner_admin` bootstrap key. The two
+// secrets are the partner's `sk_live` / `sk_test` separation — returned once,
+// here only. `test.tenant.liveTenantId` points back at `live.tenant.id`.
+export const SuperadminTenantPairSchema = z
+    .object({
+    live: SuperadminTenantWithBootstrapKeySchema,
+    test: SuperadminTenantWithBootstrapKeySchema,
+})
+    .describe("A newly onboarded partner: the live tenant and its linked test twin, each with its bootstrap key.");

package/dist/contracts/superadmin.d.ts

@@ -10,20 +10,24 @@ export declare const SuperadminAccessSchema: z.ZodObject<{
     userId: z.ZodNullable<z.ZodString>;
     role: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * `stattic_auth_user.role` is Better Auth's admin-plugin column: a
+ * comma-separated list, so "superadmin" is one role among others rather than a
+ * separate grant table.
+ */
+export declare const SUPERADMIN_ROLE = "superadmin";
+export declare function parseUserRoles(roleValue: string | null | undefined): string[];
 export declare const SuperadminUserProfileSchema: z.ZodObject<{
     tenantId: z.ZodString;
     analyticsId: z.ZodString;
     image: z.ZodNullable<z.ZodString>;
-    username: z.ZodNullable<z.ZodString>;
-    displayUsername: z.ZodNullable<z.ZodString>;
     emailVerified: z.ZodBoolean;
     isAutomattician: z.ZodBoolean;
-    wpcom: z.ZodBoolean;
+    automatticBetaGrant: z.ZodBoolean;
+    wpcomLinked: z.ZodBoolean;
     betaEnrolledAt: z.ZodNullable<z.ZodString>;
-    stripeCustomerId: z.ZodNullable<z.ZodString>;
     twoFactorEnabled: z.ZodBoolean;
     theme: z.ZodString;
-    wpcomProfileJson: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export declare const SuperadminUserTeamSchema: z.ZodObject<{
     membershipId: z.ZodString;
@@ -49,16 +53,13 @@ export declare const SuperadminUserSchema: z.ZodObject<{
         tenantId: z.ZodString;
         analyticsId: z.ZodString;
         image: z.ZodNullable<z.ZodString>;
-        username: z.ZodNullable<z.ZodString>;
-        displayUsername: z.ZodNullable<z.ZodString>;
         emailVerified: z.ZodBoolean;
         isAutomattician: z.ZodBoolean;
-        wpcom: z.ZodBoolean;
+        automatticBetaGrant: z.ZodBoolean;
+        wpcomLinked: z.ZodBoolean;
         betaEnrolledAt: z.ZodNullable<z.ZodString>;
-        stripeCustomerId: z.ZodNullable<z.ZodString>;
         twoFactorEnabled: z.ZodBoolean;
         theme: z.ZodString;
-        wpcomProfileJson: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>;
     teams: z.ZodArray<z.ZodObject<{
         membershipId: z.ZodString;
@@ -71,6 +72,87 @@ export declare const SuperadminUserSchema: z.ZodObject<{
         teamCreatedAt: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/** One verified address the person owns. Unverified addresses have no row. */
+export declare const SuperadminUserEmailSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    primary: z.ZodBoolean;
+    verifiedAt: z.ZodString;
+    verificationMethod: z.ZodString;
+    verificationSourceAccountId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/** One linked sign-in method. `profileJson` is the provider's own snapshot. */
+export declare const SuperadminUserAccountSchema: z.ZodObject<{
+    id: z.ZodString;
+    providerId: z.ZodString;
+    accountId: z.ZodString;
+    emailObserved: z.ZodNullable<z.ZodString>;
+    emailVerifiedByProvider: z.ZodNullable<z.ZodBoolean>;
+    profileJson: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Everything the list row carries plus the per-person collections. Kept off the
+ * list because provider profile blobs are unbounded.
+ */
+export declare const SuperadminUserDetailSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    email: z.ZodString;
+    role: z.ZodNullable<z.ZodString>;
+    banned: z.ZodBoolean;
+    banReason: z.ZodNullable<z.ZodString>;
+    banExpires: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    profile: z.ZodObject<{
+        tenantId: z.ZodString;
+        analyticsId: z.ZodString;
+        image: z.ZodNullable<z.ZodString>;
+        emailVerified: z.ZodBoolean;
+        isAutomattician: z.ZodBoolean;
+        automatticBetaGrant: z.ZodBoolean;
+        wpcomLinked: z.ZodBoolean;
+        betaEnrolledAt: z.ZodNullable<z.ZodString>;
+        twoFactorEnabled: z.ZodBoolean;
+        theme: z.ZodString;
+    }, z.core.$strip>;
+    teams: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        membershipRole: z.ZodString;
+        membershipCreatedAt: z.ZodString;
+        teamId: z.ZodString;
+        teamSlug: z.ZodString;
+        teamName: z.ZodString;
+        teamTenantId: z.ZodString;
+        teamCreatedAt: z.ZodString;
+    }, z.core.$strip>>;
+    emails: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        primary: z.ZodBoolean;
+        verifiedAt: z.ZodString;
+        verificationMethod: z.ZodString;
+        verificationSourceAccountId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    accounts: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        providerId: z.ZodString;
+        accountId: z.ZodString;
+        emailObserved: z.ZodNullable<z.ZodString>;
+        emailVerifiedByProvider: z.ZodNullable<z.ZodBoolean>;
+        profileJson: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+    pendingDeletionAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The submitted list replaces the stored one, so the caller carries forward
+ * whatever it means to keep, including roles its UI does not know about.
+ */
+export declare const superadminUserRoleUpdateSchema: z.ZodObject<{
+    roles: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
 export declare const superadminUserListQuerySchema: z.ZodObject<{
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -91,16 +173,13 @@ export declare const SuperadminUserListSchema: z.ZodObject<{
             tenantId: z.ZodString;
             analyticsId: z.ZodString;
             image: z.ZodNullable<z.ZodString>;
-            username: z.ZodNullable<z.ZodString>;
-            displayUsername: z.ZodNullable<z.ZodString>;
             emailVerified: z.ZodBoolean;
             isAutomattician: z.ZodBoolean;
-            wpcom: z.ZodBoolean;
+            automatticBetaGrant: z.ZodBoolean;
+            wpcomLinked: z.ZodBoolean;
             betaEnrolledAt: z.ZodNullable<z.ZodString>;
-            stripeCustomerId: z.ZodNullable<z.ZodString>;
             twoFactorEnabled: z.ZodBoolean;
             theme: z.ZodString;
-            wpcomProfileJson: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>;
         teams: z.ZodArray<z.ZodObject<{
             membershipId: z.ZodString;
@@ -139,11 +218,21 @@ export declare const superadminBuildInventoryQuerySchema: z.ZodObject<{
         e2b: "e2b";
     }>>;
     repository: z.ZodOptional<z.ZodString>;
+    spaceId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const SuperadminBuildInventoryItemSchema: z.ZodObject<{
     id: z.ZodString;
     ref: z.ZodString;
-    status: z.ZodString;
+    status: z.ZodEnum<{
+        failed: "failed";
+        canceled: "canceled";
+        waiting_for_source: "waiting_for_source";
+        uploading_source: "uploading_source";
+        queued: "queued";
+        running: "running";
+        succeeded: "succeeded";
+        skipped: "skipped";
+    }>;
     spaceId: z.ZodString;
     spaceSlug: z.ZodNullable<z.ZodString>;
     teamId: z.ZodNullable<z.ZodString>;
@@ -161,24 +250,25 @@ export declare const SuperadminBuildInventoryItemSchema: z.ZodObject<{
     failureMessage: z.ZodNullable<z.ZodString>;
     durationMs: z.ZodNullable<z.ZodNumber>;
     outputBytes: z.ZodNullable<z.ZodNumber>;
-    updatedAt: z.ZodString;
-}, z.core.$strip>;
-export declare const SuperadminWebhookDeliverySchema: z.ZodObject<{
-    id: z.ZodString;
-    deliveryId: z.ZodString;
-    eventName: z.ZodString;
-    action: z.ZodNullable<z.ZodString>;
-    repositoryFullName: z.ZodNullable<z.ZodString>;
-    status: z.ZodString;
-    statusMessage: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
+    startedAt: z.ZodNullable<z.ZodString>;
+    finishedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
 }, z.core.$strip>;
-export declare const SuperadminBuildInventorySchema: z.ZodObject<{
-    builds: z.ZodArray<z.ZodObject<{
+export declare const SuperadminBuildDetailSchema: z.ZodObject<{
+    build: z.ZodObject<{
         id: z.ZodString;
         ref: z.ZodString;
-        status: z.ZodString;
+        status: z.ZodEnum<{
+            failed: "failed";
+            canceled: "canceled";
+            waiting_for_source: "waiting_for_source";
+            uploading_source: "uploading_source";
+            queued: "queued";
+            running: "running";
+            succeeded: "succeeded";
+            skipped: "skipped";
+        }>;
         spaceId: z.ZodString;
         spaceSlug: z.ZodNullable<z.ZodString>;
         teamId: z.ZodNullable<z.ZodString>;
@@ -196,20 +286,122 @@ export declare const SuperadminBuildInventorySchema: z.ZodObject<{
         failureMessage: z.ZodNullable<z.ZodString>;
         durationMs: z.ZodNullable<z.ZodNumber>;
         outputBytes: z.ZodNullable<z.ZodNumber>;
+        createdAt: z.ZodString;
+        startedAt: z.ZodNullable<z.ZodString>;
+        finishedAt: z.ZodNullable<z.ZodString>;
         updatedAt: z.ZodString;
+        inputKind: z.ZodString;
+        command: z.ZodNullable<z.ZodString>;
+        retryOfBuildId: z.ZodNullable<z.ZodString>;
+        producedVersionId: z.ZodNullable<z.ZodString>;
+        reusedVersionId: z.ZodNullable<z.ZodString>;
+        settings: z.ZodObject<{
+            rootDirectory: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            installDirectory: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            installCommand: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            buildCommand: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            outputDirectory: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            ignoredBuildCommand: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            frameworkPreset: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            platformPreset: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            allowUnsupportedPlatformFeatures: z.ZodDefault<z.ZodBoolean>;
+            timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>;
+        target: z.ZodObject<{
+            channel: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            preview: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    execution: z.ZodNullable<z.ZodObject<{
+        logOffset: z.ZodNullable<z.ZodNumber>;
+        exitCode: z.ZodNullable<z.ZodNumber>;
+        terminationReason: z.ZodNullable<z.ZodEnum<{
+            command: "command";
+            timeout: "timeout";
+        }>>;
+        artifactDeadlineAt: z.ZodNullable<z.ZodString>;
+        launch: z.ZodNullable<z.ZodObject<{
+            state: z.ZodEnum<{
+                started: "started";
+                starting: "starting";
+                rejected: "rejected";
+            }>;
+            requestedAt: z.ZodString;
+            startedAt: z.ZodNullable<z.ZodString>;
+            pid: z.ZodNullable<z.ZodNumber>;
+            rejectedReason: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        phases: z.ZodArray<z.ZodObject<{
+            phase: z.ZodString;
+            at: z.ZodString;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
-    webhookDeliveries: z.ZodArray<z.ZodObject<{
+    diagnostics: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        severity: z.ZodEnum<{
+            info: "info";
+            warning: "warning";
+            error: "error";
+        }>;
+        message: z.ZodString;
+        path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            registrar: "registrar";
+            infra: "infra";
+            dns: "dns";
+            runtime: "runtime";
+        }>>>;
+        details: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        fix: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        retryable: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+    logs: z.ZodArray<z.ZodObject<{
+        timestamp: z.ZodString;
+        level: z.ZodString;
+        code: z.ZodString;
+        message: z.ZodString;
+    }, z.core.$strip>>;
+    logCount: z.ZodNumber;
+}, z.core.$strip>;
+export declare const SuperadminBuildInventorySchema: z.ZodObject<{
+    builds: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
-        deliveryId: z.ZodString;
-        eventName: z.ZodString;
-        action: z.ZodNullable<z.ZodString>;
-        repositoryFullName: z.ZodNullable<z.ZodString>;
-        status: z.ZodString;
-        statusMessage: z.ZodNullable<z.ZodString>;
+        ref: z.ZodString;
+        status: z.ZodEnum<{
+            failed: "failed";
+            canceled: "canceled";
+            waiting_for_source: "waiting_for_source";
+            uploading_source: "uploading_source";
+            queued: "queued";
+            running: "running";
+            succeeded: "succeeded";
+            skipped: "skipped";
+        }>;
+        spaceId: z.ZodString;
+        spaceSlug: z.ZodNullable<z.ZodString>;
+        teamId: z.ZodNullable<z.ZodString>;
+        repository: z.ZodNullable<z.ZodString>;
+        branch: z.ZodNullable<z.ZodString>;
+        pullRequestNumber: z.ZodNullable<z.ZodNumber>;
+        commitSha: z.ZodNullable<z.ZodString>;
+        driver: z.ZodNullable<z.ZodString>;
+        sandboxId: z.ZodNullable<z.ZodString>;
+        runnerJobId: z.ZodNullable<z.ZodString>;
+        region: z.ZodNullable<z.ZodString>;
+        executionMetadataKeys: z.ZodArray<z.ZodString>;
+        e2bTemplateId: z.ZodNullable<z.ZodString>;
+        failureCode: z.ZodNullable<z.ZodString>;
+        failureMessage: z.ZodNullable<z.ZodString>;
+        durationMs: z.ZodNullable<z.ZodNumber>;
+        outputBytes: z.ZodNullable<z.ZodNumber>;
         createdAt: z.ZodString;
+        startedAt: z.ZodNullable<z.ZodString>;
+        finishedAt: z.ZodNullable<z.ZodString>;
         updatedAt: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+export type SuperadminBuildInventoryItem = z.infer<typeof SuperadminBuildInventoryItemSchema>;
+export type SuperadminBuildDetail = z.infer<typeof SuperadminBuildDetailSchema>;
 export declare const superadminPlanGrantCreateSchema: z.ZodObject<{
     team: z.ZodString;
     plan: z.ZodEnum<{
@@ -268,9 +460,9 @@ export declare const SuperadminPlanGrantListSchema: z.ZodObject<{
 export declare const superadminAddonCreateSchema: z.ZodObject<{
     team: z.ZodString;
     limit: z.ZodEnum<{
+        storageBytes: "storageBytes";
         teamMembers: "teamMembers";
         subTeams: "subTeams";
-        storageBytes: "storageBytes";
         externalDomainGroups: "externalDomainGroups";
     }>;
     amount: z.ZodNumber;
@@ -538,4 +730,7 @@ export declare const SuperadminAnonymousPoolListSchema: z.ZodObject<{
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type SuperadminUser = z.infer<typeof SuperadminUserSchema>;
+export type SuperadminUserDetail = z.infer<typeof SuperadminUserDetailSchema>;
+export type SuperadminUserEmail = z.infer<typeof SuperadminUserEmailSchema>;
+export type SuperadminUserAccount = z.infer<typeof SuperadminUserAccountSchema>;
 export type SuperadminUserList = z.infer<typeof SuperadminUserListSchema>;

package/dist/contracts/superadmin.js

@@ -1,8 +1,12 @@
 import { z } from "zod";
+import { BuildSettingsSchema, BuildTargetSchema } from "./builds.js";
+import { baseDiagnosticSchema } from "./common.js";
 import { makeOffsetListSchema } from "./common.js";
 import { buildStatus } from "./enums.js";
-// Operator-only offset pagination. The platform API uses opaque cursors exclusively
-// (contracts/common.ts); the superadmin surface is the one sanctioned exception.
+import { PLAN_CODES } from "./features.js";
+import { versionLogEntrySchema } from "./spaces.js";
+// Operator-only offset pagination. The platform API uses opaque cursors
+// (contracts/common.ts); this is the one exception.
 export const superadminPaginationSchema = z.object({
     count: z.number().int().nonnegative(),
     next: z.number().int().nonnegative().nullable(),
@@ -13,20 +17,33 @@ export const SuperadminAccessSchema = z.object({
     userId: z.string().nullable(),
     role: z.string().nullable(),
 });
+/**
+ * `stattic_auth_user.role` is Better Auth's admin-plugin column: a
+ * comma-separated list, so "superadmin" is one role among others rather than a
+ * separate grant table.
+ */
+export const SUPERADMIN_ROLE = "superadmin";
+export function parseUserRoles(roleValue) {
+    return (roleValue ?? "").split(",").flatMap((entry) => {
+        const role = entry.trim();
+        return role ? [role] : [];
+    });
+}
 export const SuperadminUserProfileSchema = z.object({
     tenantId: z.string(),
     analyticsId: z.string(),
     image: z.string().nullable(),
-    username: z.string().nullable(),
-    displayUsername: z.string().nullable(),
     emailVerified: z.boolean(),
     isAutomattician: z.boolean(),
-    wpcom: z.boolean(),
+    automatticBetaGrant: z.boolean(),
+    /**
+     * A live linked wp.com account row — distinct from beta-admission
+     * provenance, which survives unlinking. Gates the superadmin grant.
+     */
+    wpcomLinked: z.boolean(),
     betaEnrolledAt: z.string().datetime().nullable(),
-    stripeCustomerId: z.string().nullable(),
     twoFactorEnabled: z.boolean(),
     theme: z.string(),
-    wpcomProfileJson: z.record(z.string(), z.unknown()).nullable(),
 });
 export const SuperadminUserTeamSchema = z.object({
     membershipId: z.string(),
@@ -51,6 +68,42 @@ export const SuperadminUserSchema = z.object({
     profile: SuperadminUserProfileSchema,
     teams: z.array(SuperadminUserTeamSchema),
 });
+/** One verified address the person owns. Unverified addresses have no row. */
+export const SuperadminUserEmailSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    primary: z.boolean(),
+    verifiedAt: z.string().datetime(),
+    verificationMethod: z.string(),
+    verificationSourceAccountId: z.string().nullable(),
+});
+/** One linked sign-in method. `profileJson` is the provider's own snapshot. */
+export const SuperadminUserAccountSchema = z.object({
+    id: z.string(),
+    providerId: z.string(),
+    accountId: z.string(),
+    emailObserved: z.string().nullable(),
+    emailVerifiedByProvider: z.boolean().nullable(),
+    profileJson: z.record(z.string(), z.unknown()).nullable(),
+    createdAt: z.string().datetime(),
+});
+/**
+ * Everything the list row carries plus the per-person collections. Kept off the
+ * list because provider profile blobs are unbounded.
+ */
+export const SuperadminUserDetailSchema = SuperadminUserSchema.extend({
+    emails: z.array(SuperadminUserEmailSchema),
+    accounts: z.array(SuperadminUserAccountSchema),
+    /** Non-null while a self-serve close request is queued or running. */
+    pendingDeletionAt: z.string().datetime().nullable(),
+});
+/**
+ * The submitted list replaces the stored one, so the caller carries forward
+ * whatever it means to keep, including roles its UI does not know about.
+ */
+export const superadminUserRoleUpdateSchema = z.object({
+    roles: z.array(z.string().trim().min(1)).min(1).max(16),
+});
 export const superadminUserListQuerySchema = z.object({
     limit: z.coerce.number().int().min(1).max(100).default(25),
     offset: z.coerce.number().int().min(0).default(0),
@@ -61,11 +114,12 @@ export const superadminBuildInventoryQuerySchema = z.object({
     status: z.union([z.literal("all"), buildStatus]).default("all"),
     driver: z.enum(["all", "e2b", "local"]).default("all"),
     repository: z.string().trim().optional(),
+    spaceId: z.string().trim().min(1).optional(),
 });
 export const SuperadminBuildInventoryItemSchema = z.object({
     id: z.string(),
     ref: z.string(),
-    status: z.string(),
+    status: buildStatus,
     spaceId: z.string(),
     spaceSlug: z.string().nullable(),
     teamId: z.string().nullable(),
@@ -83,28 +137,58 @@ export const SuperadminBuildInventoryItemSchema = z.object({
     failureMessage: z.string().nullable(),
     durationMs: z.number().nullable(),
     outputBytes: z.number().nullable(),
-    updatedAt: z.string().datetime(),
-});
-export const SuperadminWebhookDeliverySchema = z.object({
-    id: z.string(),
-    deliveryId: z.string(),
-    eventName: z.string(),
-    action: z.string().nullable(),
-    repositoryFullName: z.string().nullable(),
-    status: z.string(),
-    statusMessage: z.string().nullable(),
     createdAt: z.string().datetime(),
+    startedAt: z.string().datetime().nullable(),
+    finishedAt: z.string().datetime().nullable(),
     updatedAt: z.string().datetime(),
 });
+export const SuperadminBuildDetailSchema = z.object({
+    build: SuperadminBuildInventoryItemSchema.extend({
+        inputKind: z.string(),
+        command: z.string().nullable(),
+        retryOfBuildId: z.string().nullable(),
+        producedVersionId: z.string().nullable(),
+        reusedVersionId: z.string().nullable(),
+        settings: BuildSettingsSchema,
+        target: BuildTargetSchema,
+    }),
+    execution: z
+        .object({
+        logOffset: z.number().int().nonnegative().nullable(),
+        exitCode: z.number().int().min(0).max(255).nullable(),
+        terminationReason: z.enum(["command", "timeout"]).nullable(),
+        artifactDeadlineAt: z.string().datetime().nullable(),
+        launch: z
+            .object({
+            state: z.enum(["starting", "started", "rejected"]),
+            requestedAt: z.string().datetime(),
+            startedAt: z.string().datetime().nullable(),
+            pid: z.number().int().nullable(),
+            rejectedReason: z.string().nullable(),
+        })
+            .nullable(),
+        phases: z.array(z.object({
+            phase: z.string(),
+            at: z.string().datetime(),
+        })),
+    })
+        .nullable(),
+    diagnostics: z.array(baseDiagnosticSchema),
+    // Newest first, capped server-side; logCount is the uncapped total.
+    logs: z.array(versionLogEntrySchema),
+    logCount: z.number().int().nonnegative(),
+});
 export const SuperadminBuildInventorySchema = z.object({
     builds: z.array(SuperadminBuildInventoryItemSchema),
-    webhookDeliveries: z.array(SuperadminWebhookDeliverySchema),
 });
-// Superadmin-assigned subscriptions ("plan grants"): operator-issued plan
-// entitlements with no payment provider and no transactions behind them.
+// Plan grants: operator-issued plan entitlements with no payment provider and
+// no transactions behind them. `free` is the default every team already has, so
+// there is nothing to grant; the rest of the plan vocabulary comes from the
+// contract rather than a second list.
+const GRANTABLE_PLAN_CODES = PLAN_CODES.filter((code) => code !== "free");
 export const superadminPlanGrantCreateSchema = z.object({
     team: z.string().trim().min(1).describe("Team id or slug."),
-    plan: z.enum(["personal", "work", "enterprise", "internal"]),
+    plan: z.enum(GRANTABLE_PLAN_CODES),
     note: z.string().trim().max(500).optional(),
     /** Omit for a non-expiring grant. */
     expiresAt: z.string().datetime().optional(),