@substrat-run/contracts 0.11.0 → 0.13.0

package/dist/attachments.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export declare const visibility: z.ZodEnum<{
-    internal: "internal";
     customer: "customer";
+    internal: "internal";
 }>;
 export type Visibility = z.infer<typeof visibility>;
 //# sourceMappingURL=attachments.d.ts.map

package/dist/connections.d.ts

@@ -4,8 +4,8 @@ export type ConnectionId = z.infer<typeof connectionId>;
 /** Vertical vocabulary, like `scope.vertical`: 'scrive', 'fortnox', 'visma'. */
 export declare const connectionProvider: z.ZodString;
 export declare const connectionStatus: z.ZodEnum<{
-    error: "error";
     active: "active";
+    error: "error";
     expired: "expired";
     revoked: "revoked";
 }>;
@@ -26,8 +26,8 @@ export declare const connection: z.ZodObject<{
     provider: z.ZodString;
     label: z.ZodString;
     status: z.ZodEnum<{
-        error: "error";
         active: "active";
+        error: "error";
         expired: "expired";
         revoked: "revoked";
     }>;
@@ -64,6 +64,7 @@ export declare const createConnectionInput: z.ZodObject<{
     scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
     secret: z.ZodRecord<z.ZodString, z.ZodString>;
+    createdBy: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type CreateConnectionInput = z.input<typeof createConnectionInput>;
 export declare const connectionFilter: z.ZodObject<{

package/dist/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,YAAY,wDAAiD,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,aAIiC,CAAC;AAEjE,eAAO,MAAM,gBAAgB;;;;;EAS3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;iBA0BrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,uCAA0C,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,eAAO,MAAM,gBAAgB;;;;;iBAM3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,YAAY,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,YAAY,wDAAiD,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,aAIiC,CAAC;AAEjE,eAAO,MAAM,gBAAgB;;;;;EAS3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;iBA0BrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,uCAA0C,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAmBhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,eAAO,MAAM,gBAAgB;;;;;iBAM3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,YAAY,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B"}

package/dist/connections.js

@@ -83,6 +83,15 @@ export const createConnectionInput = z.object({
     scopes: z.array(z.string()).default([]),
     expiresAt: instant.optional(),
     secret: connectionSecret,
+    /**
+     * Who authorized this connection, when that is a tenant principal rather than the
+     * effecting platform actor (connections.md §3.5.1). A self-serve connect is a tenant
+     * admin's in-scope, permission-checked act; the host effects the sealed write with
+     * platform authority, but the connection must record the *principal* who authorized
+     * it — not `STAFF`, which would launder the act (the D-31 defect). Omitted ⇒ the
+     * caller's `actor`, so existing platform-driven callers are unchanged.
+     */
+    createdBy: z.string().min(1).optional(),
 });
 export const connectionFilter = z.object({
     tenantId: tenantId.optional(),

package/dist/connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;GAOG;AAEH,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAkB,CAAC;AAG3E,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,cAAc;IACd,QAAQ;IACR,yEAAyE;IACzE,SAAS;IACT,2EAA2E;IAC3E,SAAS;IACT,6EAA6E;IAC7E,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,YAAY;IAChB,QAAQ;IACR,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,kBAAkB;IAC5B,2DAA2D;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,gBAAgB;IACxB;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,iEAAiE;IACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,YAAY;IAChB,QAAQ;IACR,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvC,gFAAgF;IAChF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC"}
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;GAOG;AAEH,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAkB,CAAC;AAG3E,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,cAAc;IACd,QAAQ;IACR,yEAAyE;IACzE,SAAS;IACT,2EAA2E;IAC3E,SAAS;IACT,6EAA6E;IAC7E,OAAO;CACR,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,YAAY;IAChB,QAAQ;IACR,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,kBAAkB;IAC5B,2DAA2D;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,gBAAgB;IACxB;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,iEAAiE;IACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,YAAY;IAChB,QAAQ;IACR,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,gBAAgB;IACxB;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvC,gFAAgF;IAChF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC"}

package/dist/control-plane.d.ts

@@ -1,37 +1,39 @@
 import { z } from 'zod';
 export declare const adminAction: z.ZodEnum<{
-    defineRole: "defineRole";
+    activateScope: "activateScope";
+    addMember: "addMember";
+    admitVersion: "admitVersion";
+    archiveScope: "archiveScope";
     assignRole: "assignRole";
+    bindHostname: "bindHostname";
+    bindScopeVersion: "bindScopeVersion";
+    createConnection: "createConnection";
+    createOrg: "createOrg";
+    createTenant: "createTenant";
+    defineRole: "defineRole";
     grant: "grant";
+    grantEntitlement: "grantEntitlement";
+    grantToConnection: "grantToConnection";
     grantToOrg: "grantToOrg";
-    addMember: "addMember";
-    removeMember: "removeMember";
-    createOrg: "createOrg";
+    linkIdentity: "linkIdentity";
+    promoteVersion: "promoteVersion";
+    provisionScope: "provisionScope";
+    pruneAccessLog: "pruneAccessLog";
+    publishVersion: "publishVersion";
     registerIdentityPool: "registerIdentityPool";
     registerVertical: "registerVertical";
-    publishVersion: "publishVersion";
-    admitVersion: "admitVersion";
     rejectVersion: "rejectVersion";
-    bindScopeVersion: "bindScopeVersion";
-    promoteVersion: "promoteVersion";
-    bindHostname: "bindHostname";
+    removeMember: "removeMember";
+    revokeConnection: "revokeConnection";
+    revokeEntitlement: "revokeEntitlement";
     setHostnameStatus: "setHostnameStatus";
-    pruneAccessLog: "pruneAccessLog";
-    createTenant: "createTenant";
     setTenantStatus: "setTenantStatus";
-    provisionScope: "provisionScope";
     suspendScope: "suspendScope";
-    unsuspendScope: "unsuspendScope";
-    archiveScope: "archiveScope";
     unarchiveScope: "unarchiveScope";
-    activateScope: "activateScope";
-    grantEntitlement: "grantEntitlement";
-    revokeEntitlement: "revokeEntitlement";
-    linkIdentity: "linkIdentity";
-    createConnection: "createConnection";
+    unassignRole: "unassignRole";
+    unlinkIdentity: "unlinkIdentity";
+    unsuspendScope: "unsuspendScope";
     updateConnectionSecret: "updateConnectionSecret";
-    revokeConnection: "revokeConnection";
-    grantToConnection: "grantToConnection";
 }>;
 export type AdminAction = z.infer<typeof adminAction>;
 /**
@@ -154,38 +156,40 @@ export declare const adminLogEntry: z.ZodObject<{
     id: z.ZodString;
     actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
     action: z.ZodEnum<{
-        defineRole: "defineRole";
+        activateScope: "activateScope";
+        addMember: "addMember";
+        admitVersion: "admitVersion";
+        archiveScope: "archiveScope";
         assignRole: "assignRole";
+        bindHostname: "bindHostname";
+        bindScopeVersion: "bindScopeVersion";
+        createConnection: "createConnection";
+        createOrg: "createOrg";
+        createTenant: "createTenant";
+        defineRole: "defineRole";
         grant: "grant";
+        grantEntitlement: "grantEntitlement";
+        grantToConnection: "grantToConnection";
         grantToOrg: "grantToOrg";
-        addMember: "addMember";
-        removeMember: "removeMember";
-        createOrg: "createOrg";
+        linkIdentity: "linkIdentity";
+        promoteVersion: "promoteVersion";
+        provisionScope: "provisionScope";
+        pruneAccessLog: "pruneAccessLog";
+        publishVersion: "publishVersion";
         registerIdentityPool: "registerIdentityPool";
         registerVertical: "registerVertical";
-        publishVersion: "publishVersion";
-        admitVersion: "admitVersion";
         rejectVersion: "rejectVersion";
-        bindScopeVersion: "bindScopeVersion";
-        promoteVersion: "promoteVersion";
-        bindHostname: "bindHostname";
+        removeMember: "removeMember";
+        revokeConnection: "revokeConnection";
+        revokeEntitlement: "revokeEntitlement";
         setHostnameStatus: "setHostnameStatus";
-        pruneAccessLog: "pruneAccessLog";
-        createTenant: "createTenant";
         setTenantStatus: "setTenantStatus";
-        provisionScope: "provisionScope";
         suspendScope: "suspendScope";
-        unsuspendScope: "unsuspendScope";
-        archiveScope: "archiveScope";
         unarchiveScope: "unarchiveScope";
-        activateScope: "activateScope";
-        grantEntitlement: "grantEntitlement";
-        revokeEntitlement: "revokeEntitlement";
-        linkIdentity: "linkIdentity";
-        createConnection: "createConnection";
+        unassignRole: "unassignRole";
+        unlinkIdentity: "unlinkIdentity";
+        unsuspendScope: "unsuspendScope";
         updateConnectionSecret: "updateConnectionSecret";
-        revokeConnection: "revokeConnection";
-        grantToConnection: "grantToConnection";
     }>;
     tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
     scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;

package/dist/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuCtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/control-plane.js

@@ -9,6 +9,7 @@ import { eventId, instant, orgId, platformActorId, principalId, scopeId, tenantI
 export const adminAction = z.enum([
     'defineRole',
     'assignRole',
+    'unassignRole', // the inverse of assignRole — tombstones the role tuple (K-21)
     'grant',
     'grantToOrg',
     'addMember',
@@ -35,6 +36,7 @@ export const adminAction = z.enum([
     'grantEntitlement', // §4.3 — the SKU flag turned on for a tenant
     'revokeEntitlement', // §4.3
     'linkIdentity', // D-16 — bind an external identity to a principal
+    'unlinkIdentity', // the inverse — sever a principal's login from a tenant
     // #101 — the integrations hub. The credential itself is NEVER in before/after:
     // this log is append-only, so a secret written here could never be removed.
     'createConnection',

package/dist/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,oDAAoD;IACvE,gBAAgB,EAAE,yDAAyD;IAC3E,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB;IAChB,eAAe,EAAE,uDAAuD;IACxE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;IAClE,+EAA+E;IAC/E,4EAA4E;IAC5E,kBAAkB;IAClB,wBAAwB,EAAE,2DAA2D;IACrF,kBAAkB;IAClB,8EAA8E;IAC9E,8BAA8B;IAC9B,mBAAmB;CACpB,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,cAAc,EAAE,+DAA+D;IAC/E,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,oDAAoD;IACvE,gBAAgB,EAAE,yDAAyD;IAC3E,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB;IAChB,eAAe,EAAE,uDAAuD;IACxE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;IAClE,gBAAgB,EAAE,wDAAwD;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,kBAAkB;IAClB,wBAAwB,EAAE,2DAA2D;IACrF,kBAAkB;IAClB,8EAA8E;IAC9E,8BAA8B;IAC9B,mBAAmB;CACpB,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}

package/dist/events.d.ts

@@ -5,9 +5,9 @@ export declare const entityRef: z.ZodObject<{
 }, z.core.$strip>;
 export type EntityRef = z.infer<typeof entityRef>;
 export declare const piiClass: z.ZodEnum<{
+    direct: "direct";
     none: "none";
     pseudonymous: "pseudonymous";
-    direct: "direct";
 }>;
 export type PiiClass = z.infer<typeof piiClass>;
 export declare const eventType: z.ZodString;
@@ -41,9 +41,9 @@ export declare const domainEventInput: z.ZodObject<{
         entityId: z.ZodString;
     }, z.core.$strip>;
     piiClass: z.ZodEnum<{
+        direct: "direct";
         none: "none";
         pseudonymous: "pseudonymous";
-        direct: "direct";
     }>;
     subjectId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">>;
     payload: z.ZodUnknown;
@@ -66,9 +66,9 @@ export declare const domainEvent: z.ZodObject<{
         entityId: z.ZodString;
     }, z.core.$strip>;
     piiClass: z.ZodEnum<{
+        direct: "direct";
         none: "none";
         pseudonymous: "pseudonymous";
-        direct: "direct";
     }>;
     subjectId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">>;
     payload: z.ZodUnknown;

package/dist/ids.d.ts

@@ -20,4 +20,14 @@ export type Instant = z.infer<typeof instant>;
 export declare const permissionKey: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
 export type PermissionKey = z.infer<typeof permissionKey>;
 export declare const slug: z.ZodString;
+/**
+ * A VERTICAL's registry id (builder-plane.md §2). A bare `slug`, optionally prefixed by
+ * an owning tenant's slug: `<tenantSlug>/<name>`. The prefix makes a customer-chosen name
+ * globally unique BY CONSTRUCTION — no claim race on the bare word — while a platform
+ * vertical (owner_tenant = null) stays bare (`callout`). Exactly ONE `/` is allowed: both
+ * halves are plain slugs. A builder never types the prefix; the control plane forms it
+ * from the authenticated tenant (§5). It flows into `deploymentRefFor`, which flattens the
+ * `/` to stay a valid CF script name; hostnames are per-instance and never carry it.
+ */
+export declare const verticalSlug: z.ZodString;
 //# sourceMappingURL=ids.d.ts.map

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMtD,eAAO,MAAM,KAAK,iDAA0C,CAAC;AAC7D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAK1C,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,OAAO,mDAA2D,CAAC;AAChF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,aAAa,yDAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMtD,eAAO,MAAM,KAAK,iDAA0C,CAAC;AAC7D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAK1C,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,OAAO,mDAA2D,CAAC;AAChF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,aAAa,yDAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,aAEwD,CAAC"}

package/dist/ids.js

@@ -30,4 +30,16 @@ export const permissionKey = z
     .regex(/^[a-z0-9-]+:[a-z0-9-]+$/)
     .brand();
 export const slug = z.string().regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
+/**
+ * A VERTICAL's registry id (builder-plane.md §2). A bare `slug`, optionally prefixed by
+ * an owning tenant's slug: `<tenantSlug>/<name>`. The prefix makes a customer-chosen name
+ * globally unique BY CONSTRUCTION — no claim race on the bare word — while a platform
+ * vertical (owner_tenant = null) stays bare (`callout`). Exactly ONE `/` is allowed: both
+ * halves are plain slugs. A builder never types the prefix; the control plane forms it
+ * from the authenticated tenant (§5). It flows into `deploymentRefFor`, which flattens the
+ * `/` to stay a valid CF script name; hostnames are per-instance and never carry it.
+ */
+export const verticalSlug = z
+    .string()
+    .regex(/^([a-z0-9](?:[a-z0-9-]*[a-z0-9])?\/)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
 //# sourceMappingURL=ids.js.map

package/dist/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;AAG7D,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB,gFAAgF;AAChF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;AAGhF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;AAG7D,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB,gFAAgF;AAChF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;AAGhF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CAAC,uEAAuE,CAAC,CAAC"}

package/dist/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;mBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,GAAI,SAAS,YAAY,KAAG,MAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAgB9D,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;mBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,YAAa,YAAY,KAAG,MAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAgB9D,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/registry.d.ts

@@ -13,8 +13,8 @@ import { z } from 'zod';
 /** Where a vertical came from. `builtin` is one we ship; the others are a customer's. */
 export declare const verticalSource: z.ZodEnum<{
     builtin: "builtin";
-    git: "git";
     cli: "cli";
+    git: "git";
 }>;
 export type VerticalSource = z.infer<typeof verticalSource>;
 export declare const vertical: z.ZodObject<{
@@ -22,22 +22,24 @@ export declare const vertical: z.ZodObject<{
     name: z.ZodString;
     source: z.ZodEnum<{
         builtin: "builtin";
-        git: "git";
         cli: "cli";
+        git: "git";
     }>;
+    ownerTenant: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
     createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
 }, z.core.$strip>;
 export type Vertical = z.infer<typeof vertical>;
 export declare const registerVerticalInput: z.ZodObject<{
     slug: z.ZodString;
+    name: z.ZodString;
     source: z.ZodEnum<{
         builtin: "builtin";
-        git: "git";
         cli: "cli";
+        git: "git";
     }>;
-    name: z.ZodString;
+    ownerTenant: z.ZodDefault<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>>;
 }, z.core.$strip>;
-export type RegisterVerticalInput = z.infer<typeof registerVerticalInput>;
+export type RegisterVerticalInput = z.input<typeof registerVerticalInput>;
 /**
  * Whether a version may be bound to a scope.
  *
@@ -48,8 +50,8 @@ export type RegisterVerticalInput = z.infer<typeof registerVerticalInput>;
  * is (promotion) rather than where the typing is (merge).
  */
 export declare const admissionStatus: z.ZodEnum<{
-    pending: "pending";
     admitted: "admitted";
+    pending: "pending";
     rejected: "rejected";
 }>;
 export type AdmissionStatus = z.infer<typeof admissionStatus>;
@@ -70,8 +72,8 @@ export declare const verticalVersion: z.ZodObject<{
     migrationDigest: z.ZodString;
     deploymentRef: z.ZodNullable<z.ZodString>;
     admission: z.ZodEnum<{
-        pending: "pending";
         admitted: "admitted";
+        pending: "pending";
         rejected: "rejected";
     }>;
     admissionNote: z.ZodNullable<z.ZodString>;
@@ -97,16 +99,16 @@ export type PublishVersionInput = z.infer<typeof publishVersionInput>;
  */
 export declare const channelName: z.ZodEnum<{
     dev: "dev";
-    staging: "staging";
     prod: "prod";
+    staging: "staging";
 }>;
 export type ChannelName = z.infer<typeof channelName>;
 export declare const verticalChannel: z.ZodObject<{
     verticalSlug: z.ZodString;
     channel: z.ZodEnum<{
         dev: "dev";
-        staging: "staging";
         prod: "prod";
+        staging: "staging";
     }>;
     versionId: z.ZodString;
     updatedAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;iBAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,qBAAqB;;;;;;;;iBAA0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;iBAQ9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;EAAqC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;iBAYnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,qBAAqB;;;;;;;;;iBAGhC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;iBAQ9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;EAAqC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/registry.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { instant, slug } from './ids.js';
+import { instant, tenantId, verticalSlug } from './ids.js';
 /**
  * The vertical + version registry (#31 step 1; D-33's milestone one).
  *
@@ -14,12 +14,22 @@ import { instant, slug } from './ids.js';
 /** Where a vertical came from. `builtin` is one we ship; the others are a customer's. */
 export const verticalSource = z.enum(['builtin', 'git', 'cli']);
 export const vertical = z.object({
-    slug, // stable, human-readable, and what a scope row denormalizes for display
+    slug: verticalSlug, // stable, human-readable; `<tenantSlug>/<name>` for a builder, bare for platform
     name: z.string().min(1),
     source: verticalSource,
+    /**
+     * The tenant that OWNS this vertical (builder-plane.md). `null` = platform-owned —
+     * a first-party vertical (Callout, the dashboard). A builder-pushed vertical is owned
+     * by the pushing tenant, and its slug is prefixed `<tenant>/<name>`. Ownership is the
+     * gate for who may push new versions of it + manage its non-prod channels (Phase 2).
+     */
+    ownerTenant: tenantId.nullable(),
     createdAt: instant,
 });
-export const registerVerticalInput = vertical.pick({ slug: true, name: true, source: true });
+export const registerVerticalInput = vertical.pick({ slug: true, name: true, source: true }).extend({
+    // Optional on input — a staff/platform push omits it (⇒ platform-owned).
+    ownerTenant: tenantId.nullable().default(null),
+});
 /**
  * Whether a version may be bound to a scope.
  *
@@ -40,7 +50,7 @@ export const admissionStatus = z.enum(['pending', 'admitted', 'rejected']);
  */
 export const verticalVersion = z.object({
     id: z.string().min(1), // ULID
-    verticalSlug: slug,
+    verticalSlug,
     version: z.string().min(1), // the builder's label — semver, a git sha, whatever they push
     manifestDigest: z.string().min(1),
     permissionDigest: z.string().min(1),
@@ -70,7 +80,7 @@ export const publishVersionInput = verticalVersion.pick({
  */
 export const channelName = z.enum(['dev', 'staging', 'prod']);
 export const verticalChannel = z.object({
-    verticalSlug: slug,
+    verticalSlug,
     channel: channelName,
     versionId: z.string().min(1),
     updatedAt: instant,

package/dist/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,wEAAwE;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,IAAI,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,YAAY,EAAE,iFAAiF;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAClG,yEAAyE;IACzE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,IAAI,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}

package/dist/routing.d.ts

@@ -59,9 +59,9 @@ export type HostnameRegion = z.infer<typeof hostnameRegion>;
  */
 export declare const hostnameStatus: z.ZodEnum<{
     active: "active";
+    failed: "failed";
     pending: "pending";
     verifying: "verifying";
-    failed: "failed";
 }>;
 export type HostnameStatus = z.infer<typeof hostnameStatus>;
 /**
@@ -87,9 +87,9 @@ export declare const hostnameBinding: z.ZodObject<{
     }>>;
     status: z.ZodEnum<{
         active: "active";
+        failed: "failed";
         pending: "pending";
         verifying: "verifying";
-        failed: "failed";
     }>;
     statusNote: z.ZodNullable<z.ZodString>;
     canonical: z.ZodBoolean;
@@ -97,9 +97,9 @@ export declare const hostnameBinding: z.ZodObject<{
 }, z.core.$strip>;
 export type HostnameBinding = z.infer<typeof hostnameBinding>;
 export declare const bindHostnameInput: z.ZodObject<{
+    hostname: z.ZodString;
     tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
     scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
-    hostname: z.ZodString;
     surface: z.ZodString;
     region: z.ZodNullable<z.ZodEnum<{
         eu: "eu";
@@ -115,6 +115,7 @@ export declare const routeTarget: z.ZodObject<{
     tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
     scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
     verticalSlug: z.ZodNullable<z.ZodString>;
+    deploymentRef: z.ZodNullable<z.ZodString>;
     surface: z.ZodString;
     region: z.ZodNullable<z.ZodEnum<{
         eu: "eu";

package/dist/routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAiB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAiB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;;iBActB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/routing.js

@@ -102,6 +102,14 @@ export const routeTarget = z.object({
     tenantId,
     scopeId,
     verticalSlug: slug.nullable(),
+    /**
+     * The dispatch script the scope's bound version deploys as (orchestration.md §5.4) —
+     * what the router hands to `env.DISPATCH.get(...)`. Null when the scope has no bound
+     * version, in which case the router has nothing to dispatch and answers 502.
+     * Resolved by the directory read (a join scope → version), so the hot path stays one
+     * DO call.
+     */
+    deploymentRef: z.string().min(1).nullable(),
     surface: surfaceName,
     region: hostnameRegion,
 });

package/dist/routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,uEAAuE;IACvE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;CACvB,CAAC,CAAC"}
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,uEAAuE;IACvE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;CACvB,CAAC,CAAC"}

package/dist/tenancy.d.ts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 export declare const tenantStatus: z.ZodEnum<{
     active: "active";
-    suspended: "suspended";
     deleting: "deleting";
+    suspended: "suspended";
 }>;
 export type TenantStatus = z.infer<typeof tenantStatus>;
 export declare const tenant: z.ZodObject<{
@@ -11,8 +11,8 @@ export declare const tenant: z.ZodObject<{
     name: z.ZodString;
     status: z.ZodEnum<{
         active: "active";
-        suspended: "suspended";
         deleting: "deleting";
+        suspended: "suspended";
     }>;
     createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
 }, z.core.$strip>;
@@ -54,10 +54,10 @@ export declare const createOrgInput: z.ZodObject<{
 export type CreateOrgInput = z.infer<typeof createOrgInput>;
 export declare const scopeStatus: z.ZodEnum<{
     active: "active";
-    suspended: "suspended";
-    provisioning: "provisioning";
-    archiving: "archiving";
     archived: "archived";
+    archiving: "archiving";
+    provisioning: "provisioning";
+    suspended: "suspended";
 }>;
 export type ScopeStatus = z.infer<typeof scopeStatus>;
 export declare const storageShape: z.ZodEnum<{
@@ -67,8 +67,8 @@ export declare const storageShape: z.ZodEnum<{
 export type StorageShape = z.infer<typeof storageShape>;
 export declare const jurisdiction: z.ZodEnum<{
     eu: "eu";
-    us: "us";
     global: "global";
+    us: "us";
 }>;
 export type Jurisdiction = z.infer<typeof jurisdiction>;
 export declare const provisionableJurisdiction: z.ZodEnum<{
@@ -110,10 +110,10 @@ export declare const scope: z.ZodObject<{
     name: z.ZodString;
     status: z.ZodEnum<{
         active: "active";
-        suspended: "suspended";
-        provisioning: "provisioning";
-        archiving: "archiving";
         archived: "archived";
+        archiving: "archiving";
+        provisioning: "provisioning";
+        suspended: "suspended";
     }>;
     storageShape: z.ZodEnum<{
         A: "A";
@@ -121,8 +121,8 @@ export declare const scope: z.ZodObject<{
     }>;
     jurisdiction: z.ZodEnum<{
         eu: "eu";
-        us: "us";
         global: "global";
+        us: "us";
     }>;
     vertical: z.ZodNullable<z.ZodString>;
     verticalVersionId: z.ZodNullable<z.ZodString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {
@@ -25,7 +25,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "typescript": "^5.6.0"
+    "typescript": "^7.0.0"
   },
   "publishConfig": {
     "access": "public"