@substrat-run/contracts 0.2.0 → 0.3.0

package/README.md

@@ -9,6 +9,8 @@ boundary. The schemas are written in [Zod](https://zod.dev), so the reviewed art
 *is* the runtime validator: OpenAPI and JSON Schema documents are emitted from this
 package, never hand-maintained beside it.
 
+**Full documentation: https://substrat.ahlstrand.es/reference/contracts**
+
 ## What's inside
 
 - **IDs** — branded ULID types (`TenantId`, `ScopeId`, `PrincipalId`, `EventId`, …):

package/dist/attachments.d.ts

@@ -1,4 +1,7 @@
 import { z } from 'zod';
-export declare const visibility: z.ZodEnum<["internal", "customer"]>;
+export declare const visibility: z.ZodEnum<{
+    internal: "internal";
+    customer: "customer";
+}>;
 export type Visibility = z.infer<typeof visibility>;
 //# sourceMappingURL=attachments.d.ts.map

package/dist/attachments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,UAAU,qCAAmC,CAAC;AAC3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC"}
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,UAAU;;;EAAmC,CAAC;AAC3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/control-plane.d.ts

@@ -0,0 +1,80 @@
+import { z } from 'zod';
+export declare const adminAction: z.ZodEnum<{
+    defineRole: "defineRole";
+    assignRole: "assignRole";
+    grant: "grant";
+    grantToOrg: "grantToOrg";
+    addMember: "addMember";
+    createTenant: "createTenant";
+    setTenantStatus: "setTenantStatus";
+    provisionScope: "provisionScope";
+    suspendScope: "suspendScope";
+    unsuspendScope: "unsuspendScope";
+    archiveScope: "archiveScope";
+    unarchiveScope: "unarchiveScope";
+    grantEntitlement: "grantEntitlement";
+    revokeEntitlement: "revokeEntitlement";
+    linkIdentity: "linkIdentity";
+}>;
+export type AdminAction = z.infer<typeof adminAction>;
+/**
+ * The neutral identity seam (D-16; control-plane.md §6 "principal derivation").
+ * An auth adapter at the edge (Better Auth, an OIDC issuer, …) authenticates a
+ * user and maps its external identity to a Substrat principal + home node. The
+ * kernel never learns HOW a caller authenticated, only WHO they are — the
+ * mechanism stays a swappable adapter. Authentication only: authorization is
+ * roles/grants, and `provider` keeps N adapters (and OIDC upstreams) distinct.
+ */
+export declare const identityLink: z.ZodObject<{
+    provider: z.ZodString;
+    externalId: z.ZodString;
+    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+}, z.core.$strip>;
+export type IdentityLink = z.infer<typeof identityLink>;
+export declare const resolvedIdentity: z.ZodObject<{
+    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+}, z.core.$strip>;
+export type ResolvedIdentity = z.infer<typeof resolvedIdentity>;
+/**
+ * An append-only admin audit row (control-plane.md §4.4). Every field except
+ * `before`/`after` is stamped platform-side — never supplied by the caller —
+ * for the same reason the kernel is trusted at all (K-4): a surface that can act
+ * without a durable record of who acted is worse than no surface.
+ *
+ * `target` is `(tenantId, scopeId?, vertical?)`. `scopeId`/`vertical` are null
+ * for tenant-wide actions; `vertical` stays null until §4.2 lifecycle actions
+ * (provision/suspend) that name one.
+ */
+export declare const adminLogEntry: z.ZodObject<{
+    id: z.ZodString;
+    actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
+    action: z.ZodEnum<{
+        defineRole: "defineRole";
+        assignRole: "assignRole";
+        grant: "grant";
+        grantToOrg: "grantToOrg";
+        addMember: "addMember";
+        createTenant: "createTenant";
+        setTenantStatus: "setTenantStatus";
+        provisionScope: "provisionScope";
+        suspendScope: "suspendScope";
+        unsuspendScope: "unsuspendScope";
+        archiveScope: "archiveScope";
+        unarchiveScope: "unarchiveScope";
+        grantEntitlement: "grantEntitlement";
+        revokeEntitlement: "revokeEntitlement";
+        linkIdentity: "linkIdentity";
+    }>;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    vertical: z.ZodNullable<z.ZodString>;
+    before: z.ZodNullable<z.ZodUnknown>;
+    after: z.ZodNullable<z.ZodUnknown>;
+    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type AdminLogEntry = z.infer<typeof adminLogEntry>;
+//# sourceMappingURL=control-plane.d.ts.map

package/dist/control-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAgBtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/control-plane.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+import { instant, platformActorId, principalId, scopeId, tenantId } from './ids.js';
+// The control plane — the shared layer across N per-vertical deployments (D-30,
+// control-plane.md). This file carries the audit contract that every effecting
+// mutation writes; the tenant registry, lifecycle, and entitlement store land in
+// later slices (control-plane.md §4.1–4.3).
+// One row per control-plane mutation. Extended additively as §4.2/§4.3 add
+// lifecycle and entitlement actions (new enum members are additive — D-28).
+export const adminAction = z.enum([
+    'defineRole',
+    'assignRole',
+    'grant',
+    'grantToOrg',
+    'addMember',
+    'createTenant', // §4.1
+    'setTenantStatus', // §4.1 — before/after carry the transitioned status
+    'provisionScope', // §4.2 — the first scope-lifecycle transition (→ active)
+    'suspendScope', // §4.2
+    'unsuspendScope', // §4.2
+    'archiveScope', // §4.2
+    'unarchiveScope', // §4.2 — an explicit restore, never a silent flag flip
+    'grantEntitlement', // §4.3 — the SKU flag turned on for a tenant
+    'revokeEntitlement', // §4.3
+    'linkIdentity', // D-16 — bind an external identity to a principal
+]);
+/**
+ * The neutral identity seam (D-16; control-plane.md §6 "principal derivation").
+ * An auth adapter at the edge (Better Auth, an OIDC issuer, …) authenticates a
+ * user and maps its external identity to a Substrat principal + home node. The
+ * kernel never learns HOW a caller authenticated, only WHO they are — the
+ * mechanism stays a swappable adapter. Authentication only: authorization is
+ * roles/grants, and `provider` keeps N adapters (and OIDC upstreams) distinct.
+ */
+export const identityLink = z.object({
+    provider: z.string().min(1), // 'better-auth' | 'oidc:<issuer>' | …
+    externalId: z.string().min(1), // the provider's stable user id (e.g. the OIDC `sub`)
+    principal: principalId,
+    tenantId,
+    scopeId: scopeId.optional(), // omitted = tenant-level home
+});
+export const resolvedIdentity = z.object({
+    principal: principalId,
+    tenantId,
+    scopeId: scopeId.nullable(),
+});
+/**
+ * An append-only admin audit row (control-plane.md §4.4). Every field except
+ * `before`/`after` is stamped platform-side — never supplied by the caller —
+ * for the same reason the kernel is trusted at all (K-4): a surface that can act
+ * without a durable record of who acted is worse than no surface.
+ *
+ * `target` is `(tenantId, scopeId?, vertical?)`. `scopeId`/`vertical` are null
+ * for tenant-wide actions; `vertical` stays null until §4.2 lifecycle actions
+ * (provision/suspend) that name one.
+ */
+export const adminLogEntry = z.object({
+    id: z.string().min(1), // ULID, stamped host-side; sortable = chronological
+    actor: platformActorId,
+    action: adminAction,
+    tenantId,
+    scopeId: scopeId.nullable(),
+    vertical: z.string().nullable(),
+    before: z.unknown().nullable(), // prior state where cheaply readable (e.g. a redefined role)
+    after: z.unknown().nullable(), // the applied payload
+    at: instant,
+});
+//# sourceMappingURL=control-plane.js.map

package/dist/control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpF,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,oDAAoD;IACvE,gBAAgB,EAAE,yDAAyD;IAC3E,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,uDAAuD;IACzE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;CACnE,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}

package/dist/events.d.ts

@@ -2,185 +2,59 @@ import { z } from 'zod';
 export declare const entityRef: z.ZodObject<{
     entityType: z.ZodString;
     entityId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    entityType: string;
-    entityId: string;
-}, {
-    entityType: string;
-    entityId: string;
-}>;
+}, z.core.$strip>;
 export type EntityRef = z.infer<typeof entityRef>;
-export declare const piiClass: z.ZodEnum<["none", "pseudonymous", "direct"]>;
+export declare const piiClass: z.ZodEnum<{
+    none: "none";
+    pseudonymous: "pseudonymous";
+    direct: "direct";
+}>;
 export type PiiClass = z.infer<typeof piiClass>;
 export declare const eventType: z.ZodString;
 export declare const systemActor: z.ZodObject<{
-    system: z.ZodBranded<z.ZodString, "ModuleId">;
-}, "strip", z.ZodTypeAny, {
-    system: string & z.BRAND<"ModuleId">;
-}, {
-    system: string;
-}>;
-export declare const actor: z.ZodUnion<[z.ZodBranded<z.ZodString, "PrincipalId">, z.ZodObject<{
-    system: z.ZodBranded<z.ZodString, "ModuleId">;
-}, "strip", z.ZodTypeAny, {
-    system: string & z.BRAND<"ModuleId">;
-}, {
-    system: string;
-}>]>;
+    system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+}, z.core.$strip>;
+export declare const actor: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
+    system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+}, z.core.$strip>]>;
 export type Actor = z.infer<typeof actor>;
-export declare const domainEventInput: z.ZodEffects<z.ZodObject<{
+export declare const domainEventInput: z.ZodObject<{
     type: z.ZodString;
     schemaVersion: z.ZodNumber;
     entity: z.ZodObject<{
         entityType: z.ZodString;
         entityId: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        entityType: string;
-        entityId: string;
-    }, {
-        entityType: string;
-        entityId: string;
+    }, z.core.$strip>;
+    piiClass: z.ZodEnum<{
+        none: "none";
+        pseudonymous: "pseudonymous";
+        direct: "direct";
     }>;
-    piiClass: z.ZodEnum<["none", "pseudonymous", "direct"]>;
-    subjectId: z.ZodOptional<z.ZodBranded<z.ZodString, "DataSubjectId">>;
+    subjectId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">>;
     payload: z.ZodUnknown;
-}, "strip", z.ZodTypeAny, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    subjectId?: (string & z.BRAND<"DataSubjectId">) | undefined;
-    payload?: unknown;
-}, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    subjectId?: string | undefined;
-    payload?: unknown;
-}>, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    subjectId?: (string & z.BRAND<"DataSubjectId">) | undefined;
-    payload?: unknown;
-}, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    subjectId?: string | undefined;
-    payload?: unknown;
-}>;
+}, z.core.$strip>;
 export type DomainEventInput = z.infer<typeof domainEventInput>;
-export declare const domainEvent: z.ZodEffects<z.ZodObject<{
-    id: z.ZodBranded<z.ZodString, "EventId">;
+export declare const domainEvent: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "EventId", "out">;
     type: z.ZodString;
     schemaVersion: z.ZodNumber;
-    occurredAt: z.ZodBranded<z.ZodString, "Instant">;
-    tenantId: z.ZodBranded<z.ZodString, "TenantId">;
-    scopeId: z.ZodBranded<z.ZodString, "ScopeId">;
-    actor: z.ZodUnion<[z.ZodBranded<z.ZodString, "PrincipalId">, z.ZodObject<{
-        system: z.ZodBranded<z.ZodString, "ModuleId">;
-    }, "strip", z.ZodTypeAny, {
-        system: string & z.BRAND<"ModuleId">;
-    }, {
-        system: string;
-    }>]>;
+    occurredAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    actor: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
+        system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
+    }, z.core.$strip>]>;
     entity: z.ZodObject<{
         entityType: z.ZodString;
         entityId: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        entityType: string;
-        entityId: string;
-    }, {
-        entityType: string;
-        entityId: string;
+    }, z.core.$strip>;
+    piiClass: z.ZodEnum<{
+        none: "none";
+        pseudonymous: "pseudonymous";
+        direct: "direct";
     }>;
-    piiClass: z.ZodEnum<["none", "pseudonymous", "direct"]>;
-    subjectId: z.ZodOptional<z.ZodBranded<z.ZodString, "DataSubjectId">>;
+    subjectId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">>;
     payload: z.ZodUnknown;
-}, "strip", z.ZodTypeAny, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    id: string & z.BRAND<"EventId">;
-    occurredAt: string & z.BRAND<"Instant">;
-    tenantId: string & z.BRAND<"TenantId">;
-    scopeId: string & z.BRAND<"ScopeId">;
-    actor: (string & z.BRAND<"PrincipalId">) | {
-        system: string & z.BRAND<"ModuleId">;
-    };
-    subjectId?: (string & z.BRAND<"DataSubjectId">) | undefined;
-    payload?: unknown;
-}, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    id: string;
-    occurredAt: string;
-    tenantId: string;
-    scopeId: string;
-    actor: string | {
-        system: string;
-    };
-    subjectId?: string | undefined;
-    payload?: unknown;
-}>, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    id: string & z.BRAND<"EventId">;
-    occurredAt: string & z.BRAND<"Instant">;
-    tenantId: string & z.BRAND<"TenantId">;
-    scopeId: string & z.BRAND<"ScopeId">;
-    actor: (string & z.BRAND<"PrincipalId">) | {
-        system: string & z.BRAND<"ModuleId">;
-    };
-    subjectId?: (string & z.BRAND<"DataSubjectId">) | undefined;
-    payload?: unknown;
-}, {
-    type: string;
-    schemaVersion: number;
-    entity: {
-        entityType: string;
-        entityId: string;
-    };
-    piiClass: "none" | "pseudonymous" | "direct";
-    id: string;
-    occurredAt: string;
-    tenantId: string;
-    scopeId: string;
-    actor: string | {
-        system: string;
-    };
-    subjectId?: string | undefined;
-    payload?: unknown;
-}>;
+}, z.core.$strip>;
 export type DomainEvent = z.infer<typeof domainEvent>;
 //# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,SAAS;;;;;;;;;EAGpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD,eAAO,MAAM,QAAQ,+CAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,SAAS,aAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW;;;;;;EAAiC,CAAC;AAC1D,eAAO,MAAM,KAAK;;;;;;IAAsC,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAiB1C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASD,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGhE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcI,CAAC;AAC7B,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD,eAAO,MAAM,QAAQ;;;;EAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,SAAS,aAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW;;iBAAiC,CAAC;AAC1D,eAAO,MAAM,KAAK;;mBAAsC,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAiB1C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBASD,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGhE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;iBAcI,CAAC;AAC7B,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/ids.d.ts

@@ -1,19 +1,21 @@
 import { z } from 'zod';
-export declare const tenantId: z.ZodBranded<z.ZodString, "TenantId">;
+export declare const tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
 export type TenantId = z.infer<typeof tenantId>;
-export declare const scopeId: z.ZodBranded<z.ZodString, "ScopeId">;
+export declare const scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
 export type ScopeId = z.infer<typeof scopeId>;
-export declare const principalId: z.ZodBranded<z.ZodString, "PrincipalId">;
+export declare const principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
 export type PrincipalId = z.infer<typeof principalId>;
-export declare const eventId: z.ZodBranded<z.ZodString, "EventId">;
+export declare const platformActorId: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
+export type PlatformActorId = z.infer<typeof platformActorId>;
+export declare const eventId: z.core.$ZodBranded<z.ZodString, "EventId", "out">;
 export type EventId = z.infer<typeof eventId>;
-export declare const dataSubjectId: z.ZodBranded<z.ZodString, "DataSubjectId">;
+export declare const dataSubjectId: z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">;
 export type DataSubjectId = z.infer<typeof dataSubjectId>;
-export declare const moduleId: z.ZodBranded<z.ZodString, "ModuleId">;
+export declare const moduleId: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
 export type ModuleId = z.infer<typeof moduleId>;
-export declare const instant: z.ZodBranded<z.ZodString, "Instant">;
+export declare const instant: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
 export type Instant = z.infer<typeof instant>;
-export declare const permissionKey: z.ZodBranded<z.ZodString, "PermissionKey">;
+export declare const permissionKey: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
 export type PermissionKey = z.infer<typeof permissionKey>;
 export declare const slug: z.ZodString;
 //# sourceMappingURL=ids.d.ts.map

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,uCAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,sCAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,0CAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,OAAO,sCAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,aAAa,4CAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,uCAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,OAAO,sCAA2D,CAAC;AAChF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,aAAa,4CAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAKtD,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,OAAO,mDAA2D,CAAC;AAChF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,aAAa,yDAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC"}

package/dist/ids.js

@@ -6,6 +6,10 @@ const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/;
 export const tenantId = z.string().regex(ULID).brand();
 export const scopeId = z.string().regex(ULID).brand();
 export const principalId = z.string().regex(ULID).brand();
+// A platform-staff actor — the subject of every control-plane mutation (D-30, K-20).
+// Branded DISTINCTLY from PrincipalId on purpose: a platform actor is not a principal
+// in any tenant, and the compiler must refuse to confuse the two.
+export const platformActorId = z.string().regex(ULID).brand();
 export const eventId = z.string().regex(ULID).brand();
 export const dataSubjectId = z.string().regex(ULID).brand();
 // npm-package-shaped, e.g. '@substrat-run/engine-workorder'

package/dist/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB,gFAAgF;AAChF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;AAGhF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB,gFAAgF;AAChF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;AAGhF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,25 @@
+/**
+ * The Zod instance these schemas were built with.
+ *
+ * Import `z` FROM HERE, not from 'zod', whenever you compose a contracts schema
+ * into your own — `z.object({ facility: entityRef, unitPrice: money })` is the
+ * pattern the engines themselves use, and it is what "parse, don't trust" asks
+ * of every operation input.
+ *
+ * Zod schemas do not compose across copies or majors: the mix fails at RUNTIME
+ * with `Invalid element at key "…": expected a Zod schema`, an error that points
+ * nowhere near the cause. We are on Zod 4, which is what `pnpm add zod` gives
+ * you today — so the trap is currently dormant, not gone. It re-arms the day Zod
+ * 5 ships, and it bit us once already (the packages were Zod 3 while the docs
+ * told users to install the then-current Zod 4).
+ *
+ * Importing `z` from here means the consumer never installs zod at all, so the
+ * versions cannot diverge no matter what the registry's `latest` becomes.
+ */
+export { z } from 'zod';
 export * from './ids.js';
 export * from './tenancy.js';
+export * from './control-plane.js';
 export * from './permission.js';
 export * from './events.js';
 export * from './manifest.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,5 +1,25 @@
+/**
+ * The Zod instance these schemas were built with.
+ *
+ * Import `z` FROM HERE, not from 'zod', whenever you compose a contracts schema
+ * into your own — `z.object({ facility: entityRef, unitPrice: money })` is the
+ * pattern the engines themselves use, and it is what "parse, don't trust" asks
+ * of every operation input.
+ *
+ * Zod schemas do not compose across copies or majors: the mix fails at RUNTIME
+ * with `Invalid element at key "…": expected a Zod schema`, an error that points
+ * nowhere near the cause. We are on Zod 4, which is what `pnpm add zod` gives
+ * you today — so the trap is currently dormant, not gone. It re-arms the day Zod
+ * 5 ships, and it bit us once already (the packages were Zod 3 while the docs
+ * told users to install the then-current Zod 4).
+ *
+ * Importing `z` from here means the consumer never installs zod at all, so the
+ * versions cannot diverge no matter what the registry's `latest` becomes.
+ */
+export { z } from 'zod';
 export * from './ids.js';
 export * from './tenancy.js';
+export * from './control-plane.js';
 export * from './permission.js';
 export * from './events.js';
 export * from './manifest.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}