@substrat-run/contracts 0.2.1 → 0.4.0

package/dist/permission.d.ts

@@ -1,257 +1,93 @@
 import { z } from 'zod';
 export declare const node: z.ZodObject<{
-    tenantId: z.ZodBranded<z.ZodString, "TenantId">;
-    scopeId: z.ZodNullable<z.ZodBranded<z.ZodString, "ScopeId">>;
-}, "strip", z.ZodTypeAny, {
-    tenantId: string & z.BRAND<"TenantId">;
-    scopeId: (string & z.BRAND<"ScopeId">) | null;
-}, {
-    tenantId: string;
-    scopeId: string | null;
-}>;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+}, z.core.$strip>;
 export type Node = z.infer<typeof node>;
 export declare const roleKey: z.ZodString;
 export declare const roleDefinition: z.ZodObject<{
     key: z.ZodString;
-    permissions: z.ZodArray<z.ZodBranded<z.ZodString, "PermissionKey">, "many">;
-    source: z.ZodUnion<[z.ZodBranded<z.ZodString, "ModuleId">, z.ZodLiteral<"vertical">]>;
-}, "strip", z.ZodTypeAny, {
-    key: string;
-    permissions: (string & z.BRAND<"PermissionKey">)[];
-    source: (string & z.BRAND<"ModuleId">) | "vertical";
-}, {
-    key: string;
-    permissions: string[];
-    source: string;
-}>;
+    permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+    source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
+}, z.core.$strip>;
 export type RoleDefinition = z.infer<typeof roleDefinition>;
+/**
+ * A role as the directory holds it — the definition plus the tenant it belongs
+ * to (control-plane.md §4.5's roles surface). `RoleDefinition` is what a caller
+ * AUTHORS, and a tenant is ambient at that point (`defineRole(actor, tenantId,
+ * role)`); this is what a caller READS back, where the tenant is the answer to
+ * "where does this role apply?" and has to travel with it.
+ */
+export declare const tenantRole: z.ZodObject<{
+    key: z.ZodString;
+    permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+    source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+}, z.core.$strip>;
+export type TenantRole = z.infer<typeof tenantRole>;
 export declare const roleAssignment: z.ZodObject<{
-    principalId: z.ZodBranded<z.ZodString, "PrincipalId">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
     roleKey: z.ZodString;
     node: z.ZodObject<{
-        tenantId: z.ZodBranded<z.ZodString, "TenantId">;
-        scopeId: z.ZodNullable<z.ZodBranded<z.ZodString, "ScopeId">>;
-    }, "strip", z.ZodTypeAny, {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    }, {
-        tenantId: string;
-        scopeId: string | null;
-    }>;
-}, "strip", z.ZodTypeAny, {
-    principalId: string & z.BRAND<"PrincipalId">;
-    roleKey: string;
-    node: {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    };
-}, {
-    principalId: string;
-    roleKey: string;
-    node: {
-        tenantId: string;
-        scopeId: string | null;
-    };
-}>;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export type RoleAssignment = z.infer<typeof roleAssignment>;
 export declare const capabilityGrant: z.ZodObject<{
-    principalId: z.ZodBranded<z.ZodString, "PrincipalId">;
-    permission: z.ZodBranded<z.ZodString, "PermissionKey">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
     node: z.ZodObject<{
-        tenantId: z.ZodBranded<z.ZodString, "TenantId">;
-        scopeId: z.ZodNullable<z.ZodBranded<z.ZodString, "ScopeId">>;
-    }, "strip", z.ZodTypeAny, {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    }, {
-        tenantId: string;
-        scopeId: string | null;
-    }>;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    }, z.core.$strip>;
     entity: z.ZodOptional<z.ZodObject<{
         entityType: z.ZodString;
         entityId: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        entityType: string;
-        entityId: string;
-    }, {
-        entityType: string;
-        entityId: string;
-    }>>;
-    expiresAt: z.ZodOptional<z.ZodBranded<z.ZodString, "Instant">>;
-    grantedBy: z.ZodBranded<z.ZodString, "PrincipalId">;
-}, "strip", z.ZodTypeAny, {
-    principalId: string & z.BRAND<"PrincipalId">;
-    node: {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    };
-    permission: string & z.BRAND<"PermissionKey">;
-    grantedBy: string & z.BRAND<"PrincipalId">;
-    entity?: {
-        entityType: string;
-        entityId: string;
-    } | undefined;
-    expiresAt?: (string & z.BRAND<"Instant">) | undefined;
-}, {
-    principalId: string;
-    node: {
-        tenantId: string;
-        scopeId: string | null;
-    };
-    permission: string;
-    grantedBy: string;
-    entity?: {
-        entityType: string;
-        entityId: string;
-    } | undefined;
-    expiresAt?: string | undefined;
-}>;
+    }, z.core.$strip>>;
+    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    grantedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+}, z.core.$strip>;
 export type CapabilityGrant = z.infer<typeof capabilityGrant>;
-export declare const objectRef: z.ZodBranded<z.ZodString, "ObjectRef">;
+export declare const objectRef: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
 export type ObjectRef = z.infer<typeof objectRef>;
 export declare const relationName: z.ZodString;
 export declare const relationTuple: z.ZodObject<{
-    subject: z.ZodBranded<z.ZodString, "ObjectRef">;
+    subject: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
     relation: z.ZodString;
-    object: z.ZodBranded<z.ZodString, "ObjectRef">;
-}, "strip", z.ZodTypeAny, {
-    object: string & z.BRAND<"ObjectRef">;
-    subject: string & z.BRAND<"ObjectRef">;
-    relation: string;
-}, {
-    object: string;
-    subject: string;
-    relation: string;
-}>;
+    object: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
+}, z.core.$strip>;
 export type RelationTuple = z.infer<typeof relationTuple>;
-export declare const decision: z.ZodDiscriminatedUnion<"allowed", [z.ZodObject<{
+export declare const decision: z.ZodDiscriminatedUnion<[z.ZodObject<{
     allowed: z.ZodLiteral<true>;
     proof: z.ZodArray<z.ZodObject<{
-        subject: z.ZodBranded<z.ZodString, "ObjectRef">;
+        subject: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
         relation: z.ZodString;
-        object: z.ZodBranded<z.ZodString, "ObjectRef">;
-    }, "strip", z.ZodTypeAny, {
-        object: string & z.BRAND<"ObjectRef">;
-        subject: string & z.BRAND<"ObjectRef">;
-        relation: string;
-    }, {
-        object: string;
-        subject: string;
-        relation: string;
-    }>, "many">;
-}, "strip", z.ZodTypeAny, {
-    allowed: true;
-    proof: {
-        object: string & z.BRAND<"ObjectRef">;
-        subject: string & z.BRAND<"ObjectRef">;
-        relation: string;
-    }[];
-}, {
-    allowed: true;
-    proof: {
-        object: string;
-        subject: string;
-        relation: string;
-    }[];
-}>, z.ZodObject<{
+        object: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
     allowed: z.ZodLiteral<false>;
-    checked: z.ZodBranded<z.ZodString, "PermissionKey">;
+    checked: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
     node: z.ZodObject<{
-        tenantId: z.ZodBranded<z.ZodString, "TenantId">;
-        scopeId: z.ZodNullable<z.ZodBranded<z.ZodString, "ScopeId">>;
-    }, "strip", z.ZodTypeAny, {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    }, {
-        tenantId: string;
-        scopeId: string | null;
-    }>;
-}, "strip", z.ZodTypeAny, {
-    node: {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    };
-    allowed: false;
-    checked: string & z.BRAND<"PermissionKey">;
-}, {
-    node: {
-        tenantId: string;
-        scopeId: string | null;
-    };
-    allowed: false;
-    checked: string;
-}>]>;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    }, z.core.$strip>;
+}, z.core.$strip>], "allowed">;
 export type Decision = z.infer<typeof decision>;
 export declare const effectivePermissions: z.ZodObject<{
-    principalId: z.ZodBranded<z.ZodString, "PrincipalId">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
     node: z.ZodObject<{
-        tenantId: z.ZodBranded<z.ZodString, "TenantId">;
-        scopeId: z.ZodNullable<z.ZodBranded<z.ZodString, "ScopeId">>;
-    }, "strip", z.ZodTypeAny, {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    }, {
-        tenantId: string;
-        scopeId: string | null;
-    }>;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    }, z.core.$strip>;
     permissions: z.ZodArray<z.ZodObject<{
-        permission: z.ZodBranded<z.ZodString, "PermissionKey">;
+        permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
         proof: z.ZodArray<z.ZodObject<{
-            subject: z.ZodBranded<z.ZodString, "ObjectRef">;
+            subject: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
             relation: z.ZodString;
-            object: z.ZodBranded<z.ZodString, "ObjectRef">;
-        }, "strip", z.ZodTypeAny, {
-            object: string & z.BRAND<"ObjectRef">;
-            subject: string & z.BRAND<"ObjectRef">;
-            relation: string;
-        }, {
-            object: string;
-            subject: string;
-            relation: string;
-        }>, "many">;
-    }, "strip", z.ZodTypeAny, {
-        permission: string & z.BRAND<"PermissionKey">;
-        proof: {
-            object: string & z.BRAND<"ObjectRef">;
-            subject: string & z.BRAND<"ObjectRef">;
-            relation: string;
-        }[];
-    }, {
-        permission: string;
-        proof: {
-            object: string;
-            subject: string;
-            relation: string;
-        }[];
-    }>, "many">;
-}, "strip", z.ZodTypeAny, {
-    permissions: {
-        permission: string & z.BRAND<"PermissionKey">;
-        proof: {
-            object: string & z.BRAND<"ObjectRef">;
-            subject: string & z.BRAND<"ObjectRef">;
-            relation: string;
-        }[];
-    }[];
-    principalId: string & z.BRAND<"PrincipalId">;
-    node: {
-        tenantId: string & z.BRAND<"TenantId">;
-        scopeId: (string & z.BRAND<"ScopeId">) | null;
-    };
-}, {
-    permissions: {
-        permission: string;
-        proof: {
-            object: string;
-            subject: string;
-            relation: string;
-        }[];
-    }[];
-    principalId: string;
-    node: {
-        tenantId: string;
-        scopeId: string | null;
-    };
-}>;
+            object: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type EffectivePermissions = z.infer<typeof effectivePermissions>;
 //# sourceMappingURL=permission.d.ts.map

package/dist/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,IAAI;;;;;;;;;EAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;;;;;;;;;EAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAW9D,eAAO,MAAM,SAAS,wCAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;;;;;;;;;EAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAW9D,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/permission.js

@@ -13,8 +13,22 @@ export const roleKey = z.string().regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
 export const roleDefinition = z.object({
     key: roleKey,
     permissions: z.array(permissionKey).min(1),
+    // Who declared this role. Both members mean "declared in CODE" — an engine's
+    // manifest or a vertical's provisioning constants. There is deliberately no
+    // value for "an operator created this against a live deployment": nothing can
+    // create one yet (role writes are not on the control-plane HTTP surface), and
+    // an enum member no code path can produce is the same promise-with-no-mechanism
+    // this codebase keeps finding. It lands with whatever writes it.
     source: z.union([moduleId, z.literal('vertical')]),
 });
+/**
+ * A role as the directory holds it — the definition plus the tenant it belongs
+ * to (control-plane.md §4.5's roles surface). `RoleDefinition` is what a caller
+ * AUTHORS, and a tenant is ambient at that point (`defineRole(actor, tenantId,
+ * role)`); this is what a caller READS back, where the tenant is the answer to
+ * "where does this role apply?" and has to travel with it.
+ */
+export const tenantRole = roleDefinition.extend({ tenantId });
 export const roleAssignment = z.object({
     principalId,
     roleKey,

package/dist/permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}

package/dist/tenancy.d.ts

@@ -1,84 +1,69 @@
 import { z } from 'zod';
-export declare const tenantStatus: z.ZodEnum<["active", "suspended", "deleting"]>;
+export declare const tenantStatus: z.ZodEnum<{
+    active: "active";
+    suspended: "suspended";
+    deleting: "deleting";
+}>;
 export type TenantStatus = z.infer<typeof tenantStatus>;
 export declare const tenant: z.ZodObject<{
-    id: z.ZodBranded<z.ZodString, "TenantId">;
+    id: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
     slug: z.ZodString;
     name: z.ZodString;
-    status: z.ZodEnum<["active", "suspended", "deleting"]>;
-    createdAt: z.ZodBranded<z.ZodString, "Instant">;
-}, "strip", z.ZodTypeAny, {
-    status: "active" | "suspended" | "deleting";
-    id: string & z.BRAND<"TenantId">;
-    slug: string;
-    name: string;
-    createdAt: string & z.BRAND<"Instant">;
-}, {
-    status: "active" | "suspended" | "deleting";
-    id: string;
-    slug: string;
-    name: string;
-    createdAt: string;
-}>;
+    status: z.ZodEnum<{
+        active: "active";
+        suspended: "suspended";
+        deleting: "deleting";
+    }>;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
 export type Tenant = z.infer<typeof tenant>;
-export declare const createTenantInput: z.ZodObject<Pick<{
-    id: z.ZodBranded<z.ZodString, "TenantId">;
+export declare const createTenantInput: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
     slug: z.ZodString;
     name: z.ZodString;
-    status: z.ZodEnum<["active", "suspended", "deleting"]>;
-    createdAt: z.ZodBranded<z.ZodString, "Instant">;
-}, "id" | "slug" | "name">, "strip", z.ZodTypeAny, {
-    id: string & z.BRAND<"TenantId">;
-    slug: string;
-    name: string;
-}, {
-    id: string;
-    slug: string;
-    name: string;
-}>;
+}, z.core.$strip>;
 export type CreateTenantInput = z.infer<typeof createTenantInput>;
-export declare const scopeStatus: z.ZodEnum<["provisioning", "active", "suspended", "archiving", "archived"]>;
+export declare const scopeStatus: z.ZodEnum<{
+    active: "active";
+    suspended: "suspended";
+    provisioning: "provisioning";
+    archiving: "archiving";
+    archived: "archived";
+}>;
 export type ScopeStatus = z.infer<typeof scopeStatus>;
-export declare const storageShape: z.ZodEnum<["A", "B"]>;
+export declare const storageShape: z.ZodEnum<{
+    A: "A";
+    B: "B";
+}>;
 export type StorageShape = z.infer<typeof storageShape>;
-export declare const jurisdiction: z.ZodNullable<z.ZodEnum<["eu"]>>;
+export declare const jurisdiction: z.ZodNullable<z.ZodEnum<{
+    eu: "eu";
+}>>;
 export type Jurisdiction = z.infer<typeof jurisdiction>;
 export declare const scope: z.ZodObject<{
-    id: z.ZodBranded<z.ZodString, "ScopeId">;
-    tenantId: z.ZodBranded<z.ZodString, "TenantId">;
-    parentScopeId: z.ZodNullable<z.ZodBranded<z.ZodString, "ScopeId">>;
+    id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    parentScopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
     slug: z.ZodString;
     kind: z.ZodString;
     name: z.ZodString;
-    status: z.ZodEnum<["provisioning", "active", "suspended", "archiving", "archived"]>;
-    storageShape: z.ZodEnum<["A", "B"]>;
-    jurisdiction: z.ZodNullable<z.ZodEnum<["eu"]>>;
+    status: z.ZodEnum<{
+        active: "active";
+        suspended: "suspended";
+        provisioning: "provisioning";
+        archiving: "archiving";
+        archived: "archived";
+    }>;
+    storageShape: z.ZodEnum<{
+        A: "A";
+        B: "B";
+    }>;
+    jurisdiction: z.ZodNullable<z.ZodEnum<{
+        eu: "eu";
+    }>>;
+    vertical: z.ZodNullable<z.ZodString>;
     schemaVersion: z.ZodString;
-    createdAt: z.ZodBranded<z.ZodString, "Instant">;
-}, "strip", z.ZodTypeAny, {
-    status: "active" | "suspended" | "provisioning" | "archiving" | "archived";
-    tenantId: string & z.BRAND<"TenantId">;
-    id: string & z.BRAND<"ScopeId">;
-    schemaVersion: string;
-    slug: string;
-    name: string;
-    createdAt: string & z.BRAND<"Instant">;
-    parentScopeId: (string & z.BRAND<"ScopeId">) | null;
-    kind: string;
-    storageShape: "A" | "B";
-    jurisdiction: "eu" | null;
-}, {
-    status: "active" | "suspended" | "provisioning" | "archiving" | "archived";
-    tenantId: string;
-    id: string;
-    schemaVersion: string;
-    slug: string;
-    name: string;
-    createdAt: string;
-    parentScopeId: string | null;
-    kind: string;
-    storageShape: "A" | "B";
-    jurisdiction: "eu" | null;
-}>;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
 export type Scope = z.infer<typeof scope>;
 //# sourceMappingURL=tenancy.d.ts.map

package/dist/tenancy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY,gDAA8C,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;EAMjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAI5C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;EAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,WAAW,6EAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY,uBAAqB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,YAAY,kCAA4B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;;EAA8C,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM;;;;;;;;;;iBAMjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAI5C,eAAO,MAAM,iBAAiB;;;;iBAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,WAAW;;;;;;EAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;EAAqB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,YAAY;;GAA4B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;iBAsBhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/dist/tenancy.js

@@ -32,6 +32,16 @@ export const scope = z.object({
     status: scopeStatus,
     storageShape,
     jurisdiction,
+    // Which vertical's deployment executes this scope (control-plane.md §1: the DO
+    // class is the app binary). Nullable — a scope provisioned before the caller
+    // names one, and the bare hosts in tests, carry null. It is what makes the
+    // audit log's `vertical` target real for scope-lifecycle actions, and what
+    // console item 1 means by "which vertical each scope runs".
+    vertical: z.string().min(1).nullable(),
+    // The scope's migration state: the count of applied (module, version) pairs,
+    // as a string. Written host-side after migrations apply — never caller-supplied.
+    // '0' means "provisioned, nothing applied yet". Comparing it against the host's
+    // registered migration total is what answers §5.4's "which scopes are behind".
     schemaVersion: z.string(),
     createdAt: instant,
 });

package/dist/tenancy.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGtD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,OAAO,EAAE,6EAA6E;IAC1F,QAAQ;IACR,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,4DAA4D;IAC/F,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qEAAqE;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,YAAY;IACZ,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC"}
+{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGtD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,OAAO,EAAE,6EAA6E;IAC1F,QAAQ;IACR,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,4DAA4D;IAC/F,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qEAAqE;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,YAAY;IACZ,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {
@@ -22,7 +22,7 @@
     "dist"
   ],
   "dependencies": {
-    "zod": "^3.25.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "typescript": "^5.6.0"