@substrat-run/contracts 0.48.1 → 0.50.0

package/dist/control-plane.d.ts

@@ -33,6 +33,7 @@ export declare const adminAction: z.ZodEnum<{
     rejectVersion: "rejectVersion";
     removeMember: "removeMember";
     requestPublish: "requestPublish";
+    restoreDirectory: "restoreDirectory";
     restoreScope: "restoreScope";
     revokeConnection: "revokeConnection";
     revokeEntitlement: "revokeEntitlement";
@@ -282,6 +283,7 @@ export declare const adminLogEntry: z.ZodObject<{
         rejectVersion: "rejectVersion";
         removeMember: "removeMember";
         requestPublish: "requestPublish";
+        restoreDirectory: "restoreDirectory";
         restoreScope: "restoreScope";
         revokeConnection: "revokeConnection";
         revokeEntitlement: "revokeEntitlement";
@@ -334,4 +336,262 @@ export declare const emailRelayRequest: z.ZodObject<{
     fromName: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type EmailRelayRequest = z.infer<typeof emailRelayRequest>;
+/**
+ * A whole tenant, exported (#36) — GDPR Art. 20 portability, and the escrow handover.
+ *
+ * Deliberately a DIFFERENT shape from `directoryDump` (#40), because they answer
+ * different questions and one format cannot serve both honestly:
+ *
+ * - A **directory dump** is for RECOVERY. It is raw tables for one deployment's whole
+ *   directory, complete and byte-faithful so it can be replayed back into a control
+ *   plane. It is unreadable to a customer and useless as an answer to "give me my data".
+ * - A **tenant export** is for PORTABILITY. It is one tenant's slice, in the platform's
+ *   own documented vocabulary (`tenant`, `scope`, `org`, `role`, …) rather than in
+ *   SQLite's, so the receiving party can read it without knowing the schema — plus each
+ *   scope's data as a `scopeDump`, which is the one part that IS raw, because that is
+ *   what makes it reloadable.
+ *
+ * It is assembled from the SANCTIONED reads (`listScopes`, `listOrgs`, `listRoles`,
+ * `listEntitlements`, `listIdentityLinks`, `exportScope`, …), never from a back door
+ * into the directory database — control-plane.md §7 forbids the control plane acquiring
+ * one, and an export that quietly opened it would be exactly that.
+ *
+ * `masked` says which fidelity this file is. Masked is the default (the same posture as
+ * `scope pull`), so a full-fidelity export is a deliberate, audited act — and an Art. 20
+ * fulfilment is deliberate by definition.
+ */
+export declare const tenantExport: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    capturedAt: z.ZodString;
+    masked: z.ZodBoolean;
+    tenant: z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        slug: z.ZodString;
+        name: z.ZodString;
+        status: z.ZodEnum<{
+            active: "active";
+            deleting: "deleting";
+            reaped: "reaped";
+            suspended: "suspended";
+        }>;
+        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+        deletingAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        provisionedByTenant: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
+    }, z.core.$strip>;
+    scopes: z.ZodArray<z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        parentScopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+        slug: z.ZodString;
+        kind: z.ZodString;
+        name: z.ZodString;
+        status: z.ZodEnum<{
+            active: "active";
+            archived: "archived";
+            archiving: "archiving";
+            provisioning: "provisioning";
+            reaped: "reaped";
+            suspended: "suspended";
+        }>;
+        storageShape: z.ZodEnum<{
+            A: "A";
+            B: "B";
+        }>;
+        jurisdiction: z.ZodEnum<{
+            eu: "eu";
+            global: "global";
+            us: "us";
+        }>;
+        vertical: z.ZodNullable<z.ZodString>;
+        verticalVersionId: z.ZodNullable<z.ZodString>;
+        schemaVersion: z.ZodString;
+        migrationFailure: z.ZodNullable<z.ZodObject<{
+            version: z.ZodString;
+            error: z.ZodString;
+            attempts: z.ZodNumber;
+            lastAttemptAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+        }, z.core.$strip>>;
+        forkedFrom: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+        forkedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        servingRef: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        archivedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    }, z.core.$strip>>;
+    orgs: z.ZodArray<z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        slug: z.ZodString;
+        name: z.ZodString;
+        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    }, z.core.$strip>>;
+    members: z.ZodArray<z.ZodObject<{
+        principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        orgId: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
+        revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    }, z.core.$strip>>;
+    roles: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
+        source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    }, z.core.$strip>>;
+    entitlements: z.ZodArray<z.ZodObject<{
+        entitlementKey: z.ZodString;
+        expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        quota: z.ZodNullable<z.ZodNumber>;
+        plan: z.ZodNullable<z.ZodString>;
+        grantedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        grantedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">>;
+    }, z.core.$strip>>;
+    identityLinks: z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        externalId: z.ZodString;
+        principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    }, z.core.$strip>>;
+    hostnames: z.ZodArray<z.ZodObject<{
+        hostname: z.ZodString;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+        verticalSlug: z.ZodNullable<z.ZodString>;
+        surface: z.ZodString;
+        region: z.ZodNullable<z.ZodEnum<{
+            eu: "eu";
+        }>>;
+        status: z.ZodEnum<{
+            active: "active";
+            failed: "failed";
+            pending: "pending";
+            verifying: "verifying";
+        }>;
+        statusNote: z.ZodNullable<z.ZodString>;
+        canonical: z.ZodBoolean;
+        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+        customHostnameId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        validationRecords: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<{
+                hostname: "hostname";
+                txt: "txt";
+            }>;
+            name: z.ZodString;
+            value: z.ZodString;
+            status: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    stores: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            blob: "blob";
+            relational: "relational";
+        }>;
+        vertical: z.ZodString;
+        binding: z.ZodString;
+        ref: z.ZodString;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+    connections: z.ZodArray<z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+        vertical: z.ZodString;
+        provider: z.ZodString;
+        label: z.ZodString;
+        status: z.ZodEnum<{
+            active: "active";
+            error: "error";
+            expired: "expired";
+            revoked: "revoked";
+        }>;
+        externalAccountRef: z.ZodNullable<z.ZodString>;
+        scopes: z.ZodArray<z.ZodString>;
+        expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        lastOkAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        lastError: z.ZodNullable<z.ZodString>;
+        lastErrorAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+        createdBy: z.ZodString;
+        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+        revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    }, z.core.$strip>>;
+    adminLog: z.ZodNullable<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
+        action: z.ZodEnum<{
+            activateScope: "activateScope";
+            addMember: "addMember";
+            admitVersion: "admitVersion";
+            archiveScope: "archiveScope";
+            assignRole: "assignRole";
+            bindHostname: "bindHostname";
+            bindScopeVersion: "bindScopeVersion";
+            createConnection: "createConnection";
+            createOrg: "createOrg";
+            createTenant: "createTenant";
+            defineRole: "defineRole";
+            deleteSnapshot: "deleteSnapshot";
+            deleteVertical: "deleteVertical";
+            grant: "grant";
+            grantEntitlement: "grantEntitlement";
+            grantToConnection: "grantToConnection";
+            grantToOrg: "grantToOrg";
+            grantToSystem: "grantToSystem";
+            importScope: "importScope";
+            linkIdentity: "linkIdentity";
+            promoteVersion: "promoteVersion";
+            provisionBlobStore: "provisionBlobStore";
+            provisionScope: "provisionScope";
+            provisionTenantStore: "provisionTenantStore";
+            pruneAccessLog: "pruneAccessLog";
+            publishVersion: "publishVersion";
+            reapScope: "reapScope";
+            reapTenant: "reapTenant";
+            registerIdentityPool: "registerIdentityPool";
+            registerVertical: "registerVertical";
+            rejectVersion: "rejectVersion";
+            removeMember: "removeMember";
+            requestPublish: "requestPublish";
+            restoreDirectory: "restoreDirectory";
+            restoreScope: "restoreScope";
+            revokeConnection: "revokeConnection";
+            revokeEntitlement: "revokeEntitlement";
+            rewindScope: "rewindScope";
+            setHostnameIssuance: "setHostnameIssuance";
+            setHostnameStatus: "setHostnameStatus";
+            setScopeExpiresAt: "setScopeExpiresAt";
+            setScopeServingRef: "setScopeServingRef";
+            setTenantName: "setTenantName";
+            setTenantStatus: "setTenantStatus";
+            setVerticalEmailSender: "setVerticalEmailSender";
+            setVerticalInstallsBlocked: "setVerticalInstallsBlocked";
+            setVerticalListed: "setVerticalListed";
+            setVerticalServing: "setVerticalServing";
+            setVerticalTenantProvisioner: "setVerticalTenantProvisioner";
+            suspendScope: "suspendScope";
+            unarchiveScope: "unarchiveScope";
+            unassignRole: "unassignRole";
+            unbindHostname: "unbindHostname";
+            unlinkIdentity: "unlinkIdentity";
+            unsuspendScope: "unsuspendScope";
+            updateConnectionSecret: "updateConnectionSecret";
+        }>;
+        tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
+        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+        vertical: z.ZodNullable<z.ZodString>;
+        before: z.ZodNullable<z.ZodUnknown>;
+        after: z.ZodNullable<z.ZodUnknown>;
+        causedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "EventId", "out">>;
+        at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    }, z.core.$strip>>>;
+    data: z.ZodArray<z.ZodObject<{
+        tenantId: z.ZodString;
+        scopeId: z.ZodString;
+        capturedAt: z.ZodString;
+        tables: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            ddl: z.ZodString;
+            columns: z.ZodArray<z.ZodString>;
+            rows: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type TenantExport = z.infer<typeof tenantExport>;
 //# sourceMappingURL=control-plane.d.ts.map

package/dist/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0EtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB;;;;;;;iBAa3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;iBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;;iBAAwC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0BxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgFtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB;;;;;;;iBAa3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;iBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;;iBAAwC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6CvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/control-plane.js

@@ -1,5 +1,13 @@
 import { z } from 'zod';
 import { eventId, instant, orgId, platformActorId, principalId, scopeId, tenantId, } from './ids.js';
+// #36's tenant export speaks the platform's own vocabulary rather than restating it, so
+// it composes the schemas that already define these shapes. One-way imports only —
+// none of these modules imports this one, so no cycle.
+import { org, scope, tenant } from './tenancy.js';
+import { tenantRole } from './permission.js';
+import { hostnameBinding } from './routing.js';
+import { connection } from './connections.js';
+import { scopeDump } from './introspection.js';
 // The control plane — the shared layer across N per-vertical deployments (D-30,
 // control-plane.md). This file carries the audit contract that every effecting
 // mutation writes; the tenant registry, lifecycle, and entitlement store land in
@@ -80,6 +88,12 @@ export const adminAction = z.enum([
     // #383 — a module's system principal may hold a permission (for scheduled work),
     // so granting one is a named, audited mutation like every other grant.
     'grantToSystem',
+    // #40 — the directory's own disaster-recovery write: replace THE DIRECTORY (tenants,
+    // scopes, hostnames, verticals, identities) with a stored dump. Carries no tenant,
+    // because its blast radius is every tenant. The entry lands in the log it just
+    // replaced, which is exactly right: the restored log is the pre-restore history, and
+    // this row is the first thing after it — the seam is legible instead of silent.
+    'restoreDirectory',
 ]);
 /**
  * One entitlement grant, widened from a bare SKU flag to express a plan (#33):
@@ -311,4 +325,72 @@ export const emailRelayRequest = z.object({
     /** Optional display name for the FROM (e.g. "Substrat Auth"); the address stays platform-owned. */
     fromName: z.string().min(1).optional(),
 });
+/**
+ * A whole tenant, exported (#36) — GDPR Art. 20 portability, and the escrow handover.
+ *
+ * Deliberately a DIFFERENT shape from `directoryDump` (#40), because they answer
+ * different questions and one format cannot serve both honestly:
+ *
+ * - A **directory dump** is for RECOVERY. It is raw tables for one deployment's whole
+ *   directory, complete and byte-faithful so it can be replayed back into a control
+ *   plane. It is unreadable to a customer and useless as an answer to "give me my data".
+ * - A **tenant export** is for PORTABILITY. It is one tenant's slice, in the platform's
+ *   own documented vocabulary (`tenant`, `scope`, `org`, `role`, …) rather than in
+ *   SQLite's, so the receiving party can read it without knowing the schema — plus each
+ *   scope's data as a `scopeDump`, which is the one part that IS raw, because that is
+ *   what makes it reloadable.
+ *
+ * It is assembled from the SANCTIONED reads (`listScopes`, `listOrgs`, `listRoles`,
+ * `listEntitlements`, `listIdentityLinks`, `exportScope`, …), never from a back door
+ * into the directory database — control-plane.md §7 forbids the control plane acquiring
+ * one, and an export that quietly opened it would be exactly that.
+ *
+ * `masked` says which fidelity this file is. Masked is the default (the same posture as
+ * `scope pull`), so a full-fidelity export is a deliberate, audited act — and an Art. 20
+ * fulfilment is deliberate by definition.
+ */
+export const tenantExport = z.object({
+    tenantId,
+    /** ISO 8601 — when the export was assembled. */
+    capturedAt: z.string().min(1),
+    /** False only for a `?full=true` break-glass export; true means PII was redacted. */
+    masked: z.boolean(),
+    /** The tenant record itself. */
+    tenant,
+    /** Every scope, including archived and reaped ones — the tombstones are part of the history. */
+    scopes: z.array(scope),
+    orgs: z.array(org),
+    /** Org membership across every org, revoked rows included (K-21 tombstones are the record). */
+    members: z.array(orgMembership),
+    roles: z.array(tenantRole),
+    entitlements: z.array(entitlementGrant),
+    /** External login links (D-16) — which identity provider subject maps to which principal. */
+    identityLinks: z.array(identityLink),
+    hostnames: z.array(hostnameBinding),
+    /**
+     * Inventory, NOT contents: the per-tenant relational and blob stores this tenant has.
+     * Their bytes are not in this file, and saying so explicitly is the point — an export
+     * that silently omitted them would misrepresent itself as complete.
+     */
+    stores: z.array(z.object({
+        kind: z.enum(['relational', 'blob']),
+        vertical: z.string(),
+        binding: z.string(),
+        ref: z.string(),
+        createdAt: z.string(),
+    })),
+    /** Third-party connections as metadata only — a sealed credential is never exported. */
+    connections: z.array(connection),
+    /**
+     * The tenant's admin-log entries — present only in a FULL export.
+     *
+     * Excluded from the masked default on purpose: this is the platform's record of what
+     * STAFF did, not data the customer provided, so it is not Art. 20 material, and it
+     * carries staff actor ids and internal action vocabulary. It is exactly what an escrow
+     * or a dispute needs, so break-glass keeps it reachable — and audited.
+     */
+    adminLog: z.array(adminLogEntry).nullable(),
+    /** Each scope's database, as the same `scopeDump` a fork or a pull produces. */
+    data: z.array(scopeDump),
+});
 //# sourceMappingURL=control-plane.js.map

package/dist/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,cAAc,EAAE,+DAA+D;IAC/E,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,mBAAmB,EAAE,0EAA0E;IAC/F,gBAAgB,EAAE,iFAAiF;IACnG,4BAA4B,EAAE,mEAAmE;IACjG,8BAA8B,EAAE,4EAA4E;IAC5G,wBAAwB,EAAE,mFAAmF;IAC7G,gBAAgB,EAAE,8EAA8E;IAChG,kBAAkB;IAClB,gBAAgB;IAChB,kFAAkF;IAClF,sFAAsF;IACtF,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB,EAAE,6FAA6F;IAClH,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,qBAAqB,EAAE,uEAAuE;IAC9F,gBAAgB,EAAE,uEAAuE;IACzF,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,oFAAoF;IACpF,uFAAuF;IACvF,oFAAoF;IACpF,iBAAiB;IACjB,eAAe,EAAE,qEAAqE;IACtF,wFAAwF;IACxF,qFAAqF;IACrF,0FAA0F;IAC1F,yBAAyB;IACzB,YAAY;IACZ,gBAAgB,EAAE,yDAAyD;IAC3E,sBAAsB,EAAE,kEAAkE;IAC1F,oBAAoB,EAAE,2DAA2D;IACjF,aAAa,EAAE,uEAAuE;IACtF,cAAc,EAAE,2FAA2F;IAC3G,aAAa,EAAE,qFAAqF;IACpG,gBAAgB,EAAE,8EAA8E;IAChG,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB;IAChB,wFAAwF;IACxF,sFAAsF;IACtF,8FAA8F;IAC9F,WAAW;IACX,eAAe,EAAE,uDAAuD;IACxE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;IAClE,gBAAgB,EAAE,wDAAwD;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,kBAAkB;IAClB,wBAAwB,EAAE,2DAA2D;IACrF,kBAAkB;IAClB,8EAA8E;IAC9E,8BAA8B;IAC9B,mBAAmB;IACnB,iFAAiF;IACjF,uEAAuE;IACvE,eAAe;CAChB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,+EAA+E;IAC/E,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,+BAA+B;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,2FAA2F;IAC3F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,mGAAmG;IACnG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,qGAAqG;IACrG,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAG3E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ;IACR,OAAO;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,wFAAwF;AACxF,mFAAmF;AACnF,uDAAuD;AACvD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,cAAc,EAAE,+DAA+D;IAC/E,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,mBAAmB,EAAE,0EAA0E;IAC/F,gBAAgB,EAAE,iFAAiF;IACnG,4BAA4B,EAAE,mEAAmE;IACjG,8BAA8B,EAAE,4EAA4E;IAC5G,wBAAwB,EAAE,mFAAmF;IAC7G,gBAAgB,EAAE,8EAA8E;IAChG,kBAAkB;IAClB,gBAAgB;IAChB,kFAAkF;IAClF,sFAAsF;IACtF,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB,EAAE,6FAA6F;IAClH,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,qBAAqB,EAAE,uEAAuE;IAC9F,gBAAgB,EAAE,uEAAuE;IACzF,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,oFAAoF;IACpF,uFAAuF;IACvF,oFAAoF;IACpF,iBAAiB;IACjB,eAAe,EAAE,qEAAqE;IACtF,wFAAwF;IACxF,qFAAqF;IACrF,0FAA0F;IAC1F,yBAAyB;IACzB,YAAY;IACZ,gBAAgB,EAAE,yDAAyD;IAC3E,sBAAsB,EAAE,kEAAkE;IAC1F,oBAAoB,EAAE,2DAA2D;IACjF,aAAa,EAAE,uEAAuE;IACtF,cAAc,EAAE,2FAA2F;IAC3G,aAAa,EAAE,qFAAqF;IACpG,gBAAgB,EAAE,8EAA8E;IAChG,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB;IAChB,wFAAwF;IACxF,sFAAsF;IACtF,8FAA8F;IAC9F,WAAW;IACX,eAAe,EAAE,uDAAuD;IACxE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;IAClE,gBAAgB,EAAE,wDAAwD;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,kBAAkB;IAClB,wBAAwB,EAAE,2DAA2D;IACrF,kBAAkB;IAClB,8EAA8E;IAC9E,8BAA8B;IAC9B,mBAAmB;IACnB,iFAAiF;IACjF,uEAAuE;IACvE,eAAe;IACf,qFAAqF;IACrF,mFAAmF;IACnF,+EAA+E;IAC/E,qFAAqF;IACrF,gFAAgF;IAChF,kBAAkB;CACnB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,+EAA+E;IAC/E,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,+BAA+B;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,2FAA2F;IAC3F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,mGAAmG;IACnG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,qGAAqG;IACrG,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAG3E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ;IACR,OAAO;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ;IACR,gDAAgD;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,qFAAqF;IACrF,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,gCAAgC;IAChC,MAAM;IACN,gGAAgG;IAChG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;IAClB,+FAA+F;IAC/F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACvC,6FAA6F;IAC7F,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACnC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CACH;IACD,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;CACzB,CAAC,CAAC"}

package/dist/deploy.d.ts

@@ -102,6 +102,65 @@ export type BlobStoreHandle = z.infer<typeof blobStoreHandle>;
  * `D1Database`. On the pure adapter there is no binding to name.
  */
 export declare function blobStoreBindingName(binding: string, tenantId: string): string;
+/**
+ * How the runtime routes a request between the vertical's STATIC files and its worker
+ * (#340) — the substrate-vocabulary form of Cloudflare's `assets.config`. Every field is
+ * optional with a runtime default, so a vertical that only wants "serve my SPA" declares
+ * a directory and nothing else.
+ *
+ * The two that matter for a Substrat vertical, and why:
+ * - `notFoundHandling: 'single-page-application'` — a deep client route (`/jobs/123`) is
+ *   not a file, and must resolve to `index.html` rather than 404. This is the inline
+ *   `serveAsset` fallback, expressed as configuration.
+ * - `runWorkerFirst` — SPA fallback would otherwise swallow the vertical's OWN routes,
+ *   which are not files either. Listing `/api/*` + `/internal/*` keeps the worker in
+ *   front of exactly the paths it owns while everything else is served from the edge
+ *   without invoking it. `true` runs the worker in front of every request (asset serving
+ *   still happens behind it) — correct only for a vertical that inspects every path.
+ */
+export declare const assetRouting: z.ZodObject<{
+    htmlHandling: z.ZodOptional<z.ZodEnum<{
+        "auto-trailing-slash": "auto-trailing-slash";
+        "drop-trailing-slash": "drop-trailing-slash";
+        "force-trailing-slash": "force-trailing-slash";
+        none: "none";
+    }>>;
+    notFoundHandling: z.ZodOptional<z.ZodEnum<{
+        "404-page": "404-page";
+        none: "none";
+        "single-page-application": "single-page-application";
+    }>>;
+    runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+}, z.core.$strip>;
+export type AssetRouting = z.infer<typeof assetRouting>;
+/**
+ * The vertical's STATIC files, as a NEED (#340): a directory of built bytes the platform
+ * uploads to the runtime's own asset store, served from the edge without invoking the
+ * worker. Native assets are not a binding — they are a top-level upload path — so this is
+ * a `runtimeNeeds` need and never rides the §4 binding allowlist (see
+ * {@link ADMISSIBLE_BINDING_TYPES}); the platform's own hash verification is what makes
+ * accepting builder-supplied bytes safe (self-serve-deploy.md §4.1).
+ *
+ * Replaces the inline-into-the-worker workaround every demo carried while WfP dispatch had
+ * no asset path: base64 in the bundle costs ~+33 % against the script-size limit, is
+ * re-parsed on every cold start, and invokes the worker for every image.
+ */
+export declare const assetsNeed: z.ZodObject<{
+    htmlHandling: z.ZodOptional<z.ZodEnum<{
+        "auto-trailing-slash": "auto-trailing-slash";
+        "drop-trailing-slash": "drop-trailing-slash";
+        "force-trailing-slash": "force-trailing-slash";
+        none: "none";
+    }>>;
+    notFoundHandling: z.ZodOptional<z.ZodEnum<{
+        "404-page": "404-page";
+        none: "none";
+        "single-page-application": "single-page-application";
+    }>>;
+    runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+    directory: z.ZodString;
+}, z.core.$strip>;
+export type AssetsNeed = z.infer<typeof assetsNeed>;
 /**
  * What a vertical needs from the runtime, in substrate vocabulary (package.json
  * `substrat.runtimeNeeds`). A vertical authored with this section never writes deploy
@@ -127,6 +186,21 @@ export declare const runtimeNeeds: z.ZodObject<{
         binding: z.ZodString;
         kind: z.ZodDefault<z.ZodLiteral<"blob">>;
     }, z.core.$strip>>>;
+    assets: z.ZodOptional<z.ZodObject<{
+        htmlHandling: z.ZodOptional<z.ZodEnum<{
+            "auto-trailing-slash": "auto-trailing-slash";
+            "drop-trailing-slash": "drop-trailing-slash";
+            "force-trailing-slash": "force-trailing-slash";
+            none: "none";
+        }>>;
+        notFoundHandling: z.ZodOptional<z.ZodEnum<{
+            "404-page": "404-page";
+            none: "none";
+            "single-page-application": "single-page-application";
+        }>>;
+        runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+        directory: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type RuntimeNeeds = z.infer<typeof runtimeNeeds>;
 /**
@@ -145,6 +219,14 @@ export type RuntimeNeeds = z.infer<typeof runtimeNeeds>;
  *   `mtls_certificate`) — the outside world is a connector concern, and outbound policy is an
  *   open question (§6 / #303); least-privilege means these are refused until decided.
  *
+ * NOT on this list because it is not a binding at all: **native static assets** (#340). They
+ * are a top-level upload path (`assets: { jwt, config }` in the script metadata), so they can
+ * neither be allowed nor refused here. They are admitted by a separate, narrower rule written
+ * down in self-serve-deploy.md §4.1: the bytes are inert and public — no code, no authority,
+ * no cross-tenant reach — but their content-address is a namespace-wide dedup key, so the
+ * platform RE-DERIVES every hash from the uploaded bytes ({@link assetHash}) and refuses a
+ * mismatch. What is trusted is the bytes; what is verified is the key.
+ *
  * Caveat on `d1`: admissible as an own relational store (e.g. a Better-Auth `AUTH_DB`), but
  * the check does not yet PROVE the declared `database_id` is the vertical's own rather than
  * another tenant's — trusted under model-B human admission; platform provisioning closes that
@@ -253,6 +335,81 @@ export declare function definePermissions(input: PermissionsInput): PermissionsI
  * of declaration order.
  */
 export declare function buildPermissionRegistry(input: PermissionsInput): PermissionRegistry;
+/**
+ * One static file in the shipped manifest (#340). The trio Cloudflare's asset store keys
+ * on — content-addressed `hash`, `size` — plus the `contentType` the platform attaches at
+ * upload and the runtime serves back.
+ *
+ * `hash` is the platform's DEDUP KEY, and the reason it is re-derived at the trust boundary
+ * rather than trusted: the asset store dedups by hash across the whole dispatch namespace,
+ * so bytes accepted under a hash they do not have would let one push decide what a DIFFERENT
+ * vertical's identical-hash asset serves. The bytes themselves are inert and public; the
+ * *key* is not. The control plane recomputes every hash from the uploaded bytes and refuses
+ * a mismatch (self-serve-deploy.md §4.1).
+ *
+ * The recipe is Cloudflare's, and must stay byte-identical on both ends or nothing dedups:
+ * `sha256(base64(content) + extension)`, first 32 hex chars ({@link assetHash}).
+ */
+export declare const assetEntry: z.ZodObject<{
+    path: z.ZodString;
+    hash: z.ZodString;
+    size: z.ZodNumber;
+    contentType: z.ZodString;
+}, z.core.$strip>;
+export type AssetEntry = z.infer<typeof assetEntry>;
+/**
+ * The multipart part-name prefix static files ride under in a push (#340) —
+ * `asset:/index.html`. Here, with the manifest schema, for the reason this file exists:
+ * both ends must speak the same shape. The prefix is what separates the two kinds of part
+ * in one body — anything unprefixed is a worker module — so an asset called `worker.js`
+ * can never be uploaded as code, and a served path is never constrained to be a legal
+ * module name.
+ */
+export declare const ASSET_PART_PREFIX = "asset:";
+/**
+ * The content-address of one static file — **Cloudflare's recipe, not ours**:
+ * `sha256(base64(content) + extension)` (extension without the dot), first 32 hex chars.
+ * It is reproduced here rather than imported because both ends must compute it identically:
+ * the CLI to build the manifest it ships, the control plane to VERIFY that manifest against
+ * the bytes before either reaches the asset store (see {@link assetEntry}). A divergence
+ * would not merely fail — it would silently defeat dedup, or store bytes under a key that
+ * is not theirs.
+ *
+ * Web Crypto (`globalThis.crypto.subtle`), so the one implementation runs unchanged in node,
+ * workerd, and the browser.
+ */
+export declare function assetHash(content: Uint8Array, path: string): Promise<string>;
+/**
+ * The static-file half of a push (#340): the routing config, plus the full file manifest.
+ *
+ * The manifest is retained (it rides `manifest_json` like the rest of the deploy manifest)
+ * for a load-bearing reason: a promote re-uploads a version onto the STABLE serving script
+ * from its archive (#286), and an asset upload session is driven by the manifest, not by
+ * bytes — content already in the namespace's asset store is skipped, so the retained
+ * manifest is what lets a promote re-attach the same assets without the builder re-pushing.
+ * It is also what the dashboard renders as the per-version asset list.
+ */
+export declare const deployAssets: z.ZodObject<{
+    htmlHandling: z.ZodOptional<z.ZodEnum<{
+        "auto-trailing-slash": "auto-trailing-slash";
+        "drop-trailing-slash": "drop-trailing-slash";
+        "force-trailing-slash": "force-trailing-slash";
+        none: "none";
+    }>>;
+    notFoundHandling: z.ZodOptional<z.ZodEnum<{
+        "404-page": "404-page";
+        none: "none";
+        "single-page-application": "single-page-application";
+    }>>;
+    runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        hash: z.ZodString;
+        size: z.ZodNumber;
+        contentType: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DeployAssets = z.infer<typeof deployAssets>;
 /** The JSON part a `substrat push` sends alongside the module files. */
 export declare const deployManifest: z.ZodObject<{
     version: z.ZodString;
@@ -276,6 +433,26 @@ export declare const deployManifest: z.ZodObject<{
         binding: z.ZodString;
         kind: z.ZodDefault<z.ZodLiteral<"blob">>;
     }, z.core.$strip>>>;
+    assets: z.ZodOptional<z.ZodObject<{
+        htmlHandling: z.ZodOptional<z.ZodEnum<{
+            "auto-trailing-slash": "auto-trailing-slash";
+            "drop-trailing-slash": "drop-trailing-slash";
+            "force-trailing-slash": "force-trailing-slash";
+            none: "none";
+        }>>;
+        notFoundHandling: z.ZodOptional<z.ZodEnum<{
+            "404-page": "404-page";
+            none: "none";
+            "single-page-application": "single-page-application";
+        }>>;
+        runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+        files: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            hash: z.ZodString;
+            size: z.ZodNumber;
+            contentType: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     envSpec: z.ZodOptional<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         label: z.ZodOptional<z.ZodString>;
@@ -348,6 +525,26 @@ export declare const storedDeployManifest: z.ZodObject<{
         binding: z.ZodString;
         kind: z.ZodDefault<z.ZodLiteral<"blob">>;
     }, z.core.$strip>>>;
+    assets: z.ZodOptional<z.ZodObject<{
+        htmlHandling: z.ZodOptional<z.ZodEnum<{
+            "auto-trailing-slash": "auto-trailing-slash";
+            "drop-trailing-slash": "drop-trailing-slash";
+            "force-trailing-slash": "force-trailing-slash";
+            none: "none";
+        }>>;
+        notFoundHandling: z.ZodOptional<z.ZodEnum<{
+            "404-page": "404-page";
+            none: "none";
+            "single-page-application": "single-page-application";
+        }>>;
+        runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+        files: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            hash: z.ZodString;
+            size: z.ZodNumber;
+            contentType: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     envSpec: z.ZodOptional<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         label: z.ZodOptional<z.ZodString>;