@substrat-run/contracts 0.5.0 → 0.7.0

package/dist/control-plane.d.ts

@@ -5,6 +5,18 @@ export declare const adminAction: z.ZodEnum<{
     grant: "grant";
     grantToOrg: "grantToOrg";
     addMember: "addMember";
+    removeMember: "removeMember";
+    createOrg: "createOrg";
+    registerIdentityPool: "registerIdentityPool";
+    registerVertical: "registerVertical";
+    publishVersion: "publishVersion";
+    admitVersion: "admitVersion";
+    rejectVersion: "rejectVersion";
+    bindScopeVersion: "bindScopeVersion";
+    promoteVersion: "promoteVersion";
+    bindHostname: "bindHostname";
+    setHostnameStatus: "setHostnameStatus";
+    pruneAccessLog: "pruneAccessLog";
     createTenant: "createTenant";
     setTenantStatus: "setTenantStatus";
     provisionScope: "provisionScope";
@@ -33,12 +45,96 @@ export declare const identityLink: z.ZodObject<{
     scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
 }, z.core.$strip>;
 export type IdentityLink = z.infer<typeof identityLink>;
+/**
+ * How an identity pool relates to tenants (K-23) — the fact that decides whether the
+ * same `externalId` seen in two tenants is one human or two.
+ *
+ * `central`: one pool serving many tenants. The same external subject IS the same
+ * person everywhere, which is what lets one login belong to several tenants (§4.3's
+ * staff case, and a branded multi-tenant consumer product like RallyPoint).
+ *
+ * `tenant-bound`: one pool serving exactly one tenant. Subject ids are unique only
+ * within it, so the same `externalId` in another tenant is a DIFFERENT person — the
+ * white-label case, where a consumer of two shops is correctly two accounts.
+ *
+ * Topology, not audience. The audiences in §4.3 are descriptive; this is enforceable.
+ */
+export declare const poolTopology: z.ZodEnum<{
+    central: "central";
+    "tenant-bound": "tenant-bound";
+}>;
+export type PoolTopology = z.infer<typeof poolTopology>;
+/**
+ * A registered identity provider. `provider` names exactly one pool, so separate
+ * per-tenant deployments take distinct provider strings (`oidc:<issuer>`) — which the
+ * `identityLink` comment above already assumed.
+ *
+ * `tenantId` is non-null exactly when `topology` is `tenant-bound`: it is the one
+ * tenant that pool may serve, and linking into any other is refused.
+ */
+export declare const identityPool: z.ZodObject<{
+    provider: z.ZodString;
+    topology: z.ZodEnum<{
+        central: "central";
+        "tenant-bound": "tenant-bound";
+    }>;
+    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
+}, z.core.$strip>;
+export type IdentityPool = z.infer<typeof identityPool>;
+/**
+ * What the directory knows about an authenticated external identity, once the caller
+ * has said WHICH tenant's pool it came from.
+ *
+ * No `tenantId` here on purpose. The lookup takes the tenant as input (§4.3: with one
+ * auth pool per white-label tenant, an external subject id is unique only *within* its
+ * pool), so echoing it back would invite the very mental model this fixes — that the
+ * directory derives the tenant from the identity. You tell it which tenant; it tells
+ * you who.
+ */
 export declare const resolvedIdentity: z.ZodObject<{
     principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
-    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
     scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
 }, z.core.$strip>;
 export type ResolvedIdentity = z.infer<typeof resolvedIdentity>;
+/**
+ * One staff READ of the directory (K-24). Separate from `adminLogEntry` because a
+ * mutation is permanent evidence and a read is operational history — one table would
+ * force one retention policy on both.
+ *
+ * `resultCount` is what separates navigation from an incident: "called listScopes"
+ * against "enumerated 4,000 tenants".
+ *
+ * `drainedAt` marks a row shipped to Tier 2. Only drained rows may be pruned —
+ * expiring on age alone would destroy evidence while calling itself retention.
+ */
+export declare const accessLogEntry: z.ZodObject<{
+    id: z.ZodString;
+    actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
+    method: z.ZodString;
+    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
+    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    params: z.ZodNullable<z.ZodString>;
+    resultCount: z.ZodNumber;
+    drainedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type AccessLogEntry = z.infer<typeof accessLogEntry>;
+/**
+ * One principal's membership of one org, as the directory holds it (K-21).
+ *
+ * `revokedAt` non-null is a **tombstone**: the tuple is still here and still
+ * readable, and the permission walk skips it. Deletion is not an option — an
+ * operated compliance product has to show both that access was revoked and the
+ * trail proving it was once granted (D-32), and a deleted row shows neither.
+ *
+ * Listing defaults to live members only; revoked rows are the evidence view.
+ */
+export declare const orgMembership: z.ZodObject<{
+    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    orgId: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
+    revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+}, z.core.$strip>;
+export type OrgMembership = z.infer<typeof orgMembership>;
 /**
  * An append-only admin audit row (control-plane.md §4.4). Every field except
  * `before`/`after` is stamped platform-side — never supplied by the caller —
@@ -58,6 +154,18 @@ export declare const adminLogEntry: z.ZodObject<{
         grant: "grant";
         grantToOrg: "grantToOrg";
         addMember: "addMember";
+        removeMember: "removeMember";
+        createOrg: "createOrg";
+        registerIdentityPool: "registerIdentityPool";
+        registerVertical: "registerVertical";
+        publishVersion: "publishVersion";
+        admitVersion: "admitVersion";
+        rejectVersion: "rejectVersion";
+        bindScopeVersion: "bindScopeVersion";
+        promoteVersion: "promoteVersion";
+        bindHostname: "bindHostname";
+        setHostnameStatus: "setHostnameStatus";
+        pruneAccessLog: "pruneAccessLog";
         createTenant: "createTenant";
         setTenantStatus: "setTenantStatus";
         provisionScope: "provisionScope";
@@ -69,11 +177,12 @@ export declare const adminLogEntry: z.ZodObject<{
         revokeEntitlement: "revokeEntitlement";
         linkIdentity: "linkIdentity";
     }>;
-    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
     scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
     vertical: z.ZodNullable<z.ZodString>;
     before: z.ZodNullable<z.ZodUnknown>;
     after: z.ZodNullable<z.ZodUnknown>;
+    causedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "EventId", "out">>;
     at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
 }, z.core.$strip>;
 export type AdminLogEntry = z.infer<typeof adminLogEntry>;

package/dist/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAgBtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/control-plane.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { instant, platformActorId, principalId, scopeId, tenantId } from './ids.js';
+import { eventId, instant, orgId, platformActorId, principalId, scopeId, tenantId, } from './ids.js';
 // The control plane — the shared layer across N per-vertical deployments (D-30,
 // control-plane.md). This file carries the audit contract that every effecting
 // mutation writes; the tenant registry, lifecycle, and entitlement store land in
@@ -12,6 +12,18 @@ export const adminAction = z.enum([
     'grant',
     'grantToOrg',
     'addMember',
+    'removeMember', // K-21 — tombstones the membership tuple, never deletes it
+    'createOrg', // K-22 — orgs are a real record, not a free-form string
+    'registerIdentityPool',
+    'registerVertical', // #31 — the vertical + version registry
+    'publishVersion',
+    'admitVersion',
+    'rejectVersion',
+    'bindScopeVersion',
+    'promoteVersion',
+    'bindHostname', // K-26 — the hostname map
+    'setHostnameStatus', // #31 step 2 — where the two human checkpoints fire
+    'pruneAccessLog', // K-24 — deleting drained access rows is itself a mutation // K-23 — a provider declares its topology before it may link
     'createTenant', // §4.1
     'setTenantStatus', // §4.1 — before/after carry the transitioned status
     'provisionScope', // §4.2 — the first scope-lifecycle transition (→ active)
@@ -38,11 +50,89 @@ export const identityLink = z.object({
     tenantId,
     scopeId: scopeId.optional(), // omitted = tenant-level home
 });
+/**
+ * How an identity pool relates to tenants (K-23) — the fact that decides whether the
+ * same `externalId` seen in two tenants is one human or two.
+ *
+ * `central`: one pool serving many tenants. The same external subject IS the same
+ * person everywhere, which is what lets one login belong to several tenants (§4.3's
+ * staff case, and a branded multi-tenant consumer product like RallyPoint).
+ *
+ * `tenant-bound`: one pool serving exactly one tenant. Subject ids are unique only
+ * within it, so the same `externalId` in another tenant is a DIFFERENT person — the
+ * white-label case, where a consumer of two shops is correctly two accounts.
+ *
+ * Topology, not audience. The audiences in §4.3 are descriptive; this is enforceable.
+ */
+export const poolTopology = z.enum(['central', 'tenant-bound']);
+/**
+ * A registered identity provider. `provider` names exactly one pool, so separate
+ * per-tenant deployments take distinct provider strings (`oidc:<issuer>`) — which the
+ * `identityLink` comment above already assumed.
+ *
+ * `tenantId` is non-null exactly when `topology` is `tenant-bound`: it is the one
+ * tenant that pool may serve, and linking into any other is refused.
+ */
+export const identityPool = z
+    .object({
+    provider: z.string().min(1),
+    topology: poolTopology,
+    tenantId: tenantId.nullable(),
+})
+    .refine((p) => (p.topology === 'tenant-bound') === (p.tenantId !== null), {
+    message: 'tenant-bound pools name their tenant; central pools must not',
+});
+/**
+ * What the directory knows about an authenticated external identity, once the caller
+ * has said WHICH tenant's pool it came from.
+ *
+ * No `tenantId` here on purpose. The lookup takes the tenant as input (§4.3: with one
+ * auth pool per white-label tenant, an external subject id is unique only *within* its
+ * pool), so echoing it back would invite the very mental model this fixes — that the
+ * directory derives the tenant from the identity. You tell it which tenant; it tells
+ * you who.
+ */
 export const resolvedIdentity = z.object({
     principal: principalId,
-    tenantId,
     scopeId: scopeId.nullable(),
 });
+/**
+ * One staff READ of the directory (K-24). Separate from `adminLogEntry` because a
+ * mutation is permanent evidence and a read is operational history — one table would
+ * force one retention policy on both.
+ *
+ * `resultCount` is what separates navigation from an incident: "called listScopes"
+ * against "enumerated 4,000 tenants".
+ *
+ * `drainedAt` marks a row shipped to Tier 2. Only drained rows may be pruned —
+ * expiring on age alone would destroy evidence while calling itself retention.
+ */
+export const accessLogEntry = z.object({
+    id: z.string().min(1),
+    actor: platformActorId,
+    method: z.string().min(1),
+    tenantId: tenantId.nullable(),
+    scopeId: scopeId.nullable(),
+    params: z.string().nullable(),
+    resultCount: z.number().int().nonnegative(),
+    drainedAt: instant.nullable(),
+    at: instant,
+});
+/**
+ * One principal's membership of one org, as the directory holds it (K-21).
+ *
+ * `revokedAt` non-null is a **tombstone**: the tuple is still here and still
+ * readable, and the permission walk skips it. Deletion is not an option — an
+ * operated compliance product has to show both that access was revoked and the
+ * trail proving it was once granted (D-32), and a deleted row shows neither.
+ *
+ * Listing defaults to live members only; revoked rows are the evidence view.
+ */
+export const orgMembership = z.object({
+    principal: principalId,
+    orgId,
+    revokedAt: instant.nullable(),
+});
 /**
  * An append-only admin audit row (control-plane.md §4.4). Every field except
  * `before`/`after` is stamped platform-side — never supplied by the caller —
@@ -57,11 +147,29 @@ export const adminLogEntry = z.object({
     id: z.string().min(1), // ULID, stamped host-side; sortable = chronological
     actor: platformActorId,
     action: adminAction,
-    tenantId,
+    // Nullable for PLATFORM-level actions that target no tenant — registering a central
+    // identity pool is the first (K-23). Every tenant-scoped action still carries one;
+    // null means "the platform itself", not "unknown".
+    tenantId: tenantId.nullable(),
     scopeId: scopeId.nullable(),
     vertical: z.string().nullable(),
     before: z.unknown().nullable(), // prior state where cheaply readable (e.g. a redefined role)
     after: z.unknown().nullable(), // the applied payload
+    /**
+     * The domain event that caused this action, when one did (K-22 §4.2).
+     *
+     * The connector seam splits a change across two halves: a module emits inside its
+     * own transaction, and a privileged executor outside module code effects it. That
+     * splits the trail too — control-plane.md §3 named it as the main thing the pattern
+     * worsens. This is the join, and it is the EVENT ID rather than a new correlation
+     * field: the envelope already carries a kernel-stamped unique id that is the
+     * idempotency key downstream, so reusing it avoids widening a frozen contract
+     * (D-5/D-28) to say something it already says.
+     *
+     * Null for the ordinary case — a staff member acting directly caused nothing but
+     * themselves.
+     */
+    causedBy: eventId.nullable(),
     at: instant,
 });
 //# sourceMappingURL=control-plane.js.map

package/dist/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpF,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,oDAAoD;IACvE,gBAAgB,EAAE,yDAAyD;IAC3E,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,uDAAuD;IACzE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;CACnE,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,oDAAoD;IACvE,gBAAgB,EAAE,yDAAyD;IAC3E,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,uDAAuD;IACzE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;CACnE,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}

package/dist/ids.d.ts

@@ -5,6 +5,8 @@ export declare const scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
 export type ScopeId = z.infer<typeof scopeId>;
 export declare const principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
 export type PrincipalId = z.infer<typeof principalId>;
+export declare const orgId: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
+export type OrgId = z.infer<typeof orgId>;
 export declare const platformActorId: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
 export type PlatformActorId = z.infer<typeof platformActorId>;
 export declare const eventId: z.core.$ZodBranded<z.ZodString, "EventId", "out">;

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAKtD,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,OAAO,mDAA2D,CAAC;AAChF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,aAAa,yDAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,QAAQ,oDAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,WAAW,uDAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAMtD,eAAO,MAAM,KAAK,iDAA0C,CAAC;AAC7D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAK1C,eAAO,MAAM,eAAe,2DAAoD,CAAC;AACjF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,OAAO,mDAA4C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,aAAa,yDAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,QAAQ,oDAGC,CAAC;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,OAAO,mDAA2D,CAAC;AAChF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,aAAa,yDAGC,CAAC;AAC5B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,IAAI,aAAwD,CAAC"}

package/dist/ids.js

@@ -6,6 +6,11 @@ const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/;
 export const tenantId = z.string().regex(ULID).brand();
 export const scopeId = z.string().regex(ULID).brand();
 export const principalId = z.string().regex(ULID).brand();
+// An organization inside a tenant — the subject of membership tuples and the target
+// of `grantToOrg` (K-22). Branded like every other id: `orgId` was a free-form string
+// until orgs became a real record, so `acme` and `Acme` silently addressed different
+// orgs and a typo in a grant reached a phantom nothing would ever resolve to.
+export const orgId = z.string().regex(ULID).brand();
 // A platform-staff actor — the subject of every control-plane mutation (D-30, K-20).
 // Branded DISTINCTLY from PrincipalId on purpose: a platform actor is not a principal
 // in any tenant, and the compiler must refuse to confuse the two.

package/dist/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB,gFAAgF;AAChF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;AAGhF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,oFAAoF;AACpF,oEAAoE;AAEpE,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;AAGnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAiB,CAAC;AAGzE,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;AAG7D,qFAAqF;AACrF,sFAAsF;AACtF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAqB,CAAC;AAGjF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,CAAC;AAG7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC;KAC/D,KAAK,EAAc,CAAC;AAGvB,gFAAgF;AAChF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;AAGhF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,yBAAyB,CAAC;KAChC,KAAK,EAAmB,CAAC;AAG5B,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -18,6 +18,8 @@
  */
 export { z } from 'zod';
 export * from './ids.js';
+export * from './registry.js';
+export * from './routing.js';
 export * from './tenancy.js';
 export * from './control-plane.js';
 export * from './permission.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -18,6 +18,8 @@
  */
 export { z } from 'zod';
 export * from './ids.js';
+export * from './registry.js';
+export * from './routing.js';
 export * from './tenancy.js';
 export * from './control-plane.js';
 export * from './permission.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/dist/manifest.js

@@ -55,8 +55,8 @@ export const moduleManifest = z.object({
     // Keyed on operations, never on engine transitions: the kernel sees
     // operations, and must not learn engine internals (star topology). Policy
     // that is CONDITIONAL on vertical data (e.g. "only montage orders need an
-    // egenkontroll") stays vertical-composed glue inside the operation — see
-    // demos/fsm. Guards live here so that adding or DROPPING a compliance gate
+    // self-inspection") stays vertical-composed glue inside the operation — see
+    // demos/callout. Guards live here so that adding or DROPPING a compliance gate
     // lands in the reviewable manifest diff.
     //
     // Optional: every pre-milestone-C manifest still parses unchanged (D-28,

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,0EAA0E;AAC1E,wEAAwE;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,aAAa;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qDAAqD;CACtF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gDAAgD;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;IAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,wBAAwB;CAChF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,QAAQ,EAAE,mCAAmC;IACjD,OAAO,EAAE,aAAa;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4CAA4C;IAC/E,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uDAAuD;KACzF,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;QAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iDAAiD;KACrF,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,cAAc,EAAE,aAAa,EAAE,mDAAmD;KACnF,CAAC,CACH;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,sDAAsD;IACtD,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc;QAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,0CAA0C;IAC1C,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,EAAE;IACF,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACzC,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,mCAAmC;IACnC,EAAE;IACF,0CAA0C;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,yCAAyC;IAC3F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0DAA0D;IACtF,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,gDAAgD;IAChD,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aAClG,QAAQ,EAAE;QACb,GAAG,EAAE,CAAC;aACH,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW;YACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,UAAU,EAAE,aAAa;SAC1B,CAAC,CACH;aACA,QAAQ,EAAE;QACb,wEAAwE;QACxE,WAAW,EAAE,CAAC;aACX,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC3E,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACrG,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACtG,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,0EAA0E;AAC1E,wEAAwE;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,aAAa;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qDAAqD;CACtF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gDAAgD;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;IAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,wBAAwB;CAChF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,QAAQ,EAAE,mCAAmC;IACjD,OAAO,EAAE,aAAa;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4CAA4C;IAC/E,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uDAAuD;KACzF,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;QAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iDAAiD;KACrF,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,cAAc,EAAE,aAAa,EAAE,mDAAmD;KACnF,CAAC,CACH;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,sDAAsD;IACtD,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc;QAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,0CAA0C;IAC1C,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,yCAAyC;IACzC,EAAE;IACF,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACzC,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,mCAAmC;IACnC,EAAE;IACF,0CAA0C;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,yCAAyC;IAC3F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0DAA0D;IACtF,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,gDAAgD;IAChD,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aAClG,QAAQ,EAAE;QACb,GAAG,EAAE,CAAC;aACH,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW;YACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,UAAU,EAAE,aAAa;SAC1B,CAAC,CACH;aACA,QAAQ,EAAE;QACb,wEAAwE;QACxE,WAAW,EAAE,CAAC;aACX,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC3E,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACrG,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACtG,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC"}

package/dist/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAW9D,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAgB9D,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/permission.js

@@ -54,6 +54,11 @@ export const capabilityGrant = z.object({
 // ============================================================================
 // 'principal:<ulid>' | 'org:<ulid>' | 'tenant:<ulid>' | 'scope:<ulid>' |
 // '<entityType>:<entityId>' — namespace:id
+//
+// The regex is deliberately loose on the id half: entity ids are vertical-owned and
+// need not be ULIDs. The kernel-owned namespaces above ARE all branded ULIDs at their
+// own boundary — `org:` became one in K-22, which is when this comment stopped being
+// aspirational.
 export const objectRef = z
     .string()
     .regex(/^[a-z0-9_-]+:[^\s]+$/)

package/dist/permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,gBAAgB;AAChB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,133 @@
+import { z } from 'zod';
+/**
+ * The vertical + version registry (#31 step 1; D-33's milestone one).
+ *
+ * Today a scope carries a nullable `vertical` STRING — a label nothing validates and
+ * nothing can be pinned to. That is enough to say "this scope runs Callout" and not
+ * enough to say *which Callout*, which is what dev/staging/prod and preview
+ * deployments are: the same vertical at different versions.
+ *
+ * The registry makes a version a real record with digests, so promotion can compare
+ * two of them, and an admission status, so **push is not live**.
+ */
+/** Where a vertical came from. `builtin` is one we ship; the others are a customer's. */
+export declare const verticalSource: z.ZodEnum<{
+    builtin: "builtin";
+    git: "git";
+    cli: "cli";
+}>;
+export type VerticalSource = z.infer<typeof verticalSource>;
+export declare const vertical: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+    source: z.ZodEnum<{
+        builtin: "builtin";
+        git: "git";
+        cli: "cli";
+    }>;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type Vertical = z.infer<typeof vertical>;
+export declare const registerVerticalInput: z.ZodObject<{
+    slug: z.ZodString;
+    source: z.ZodEnum<{
+        builtin: "builtin";
+        git: "git";
+        cli: "cli";
+    }>;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type RegisterVerticalInput = z.infer<typeof registerVerticalInput>;
+/**
+ * Whether a version may be bound to a scope.
+ *
+ * `pending` is what a push produces. The admission gates — boundary-lint, the
+ * migration diff and the permission diff — decide the rest, and binding a scope is a
+ * separate, reviewable step. That separation is the whole point: it is what stops a
+ * push being a deploy, and it puts the two human checkpoints where the blast radius
+ * is (promotion) rather than where the typing is (merge).
+ */
+export declare const admissionStatus: z.ZodEnum<{
+    pending: "pending";
+    admitted: "admitted";
+    rejected: "rejected";
+}>;
+export type AdmissionStatus = z.infer<typeof admissionStatus>;
+/**
+ * One published version of a vertical.
+ *
+ * The three digests are what make promotion answerable. "Has the permission surface
+ * changed between the version in prod and the one I am promoting?" is a string
+ * comparison here, where today it is a person remembering to look — and per §4 of the
+ * plan, a checkpoint that can be skipped is not a checkpoint.
+ */
+export declare const verticalVersion: z.ZodObject<{
+    id: z.ZodString;
+    verticalSlug: z.ZodString;
+    version: z.ZodString;
+    manifestDigest: z.ZodString;
+    permissionDigest: z.ZodString;
+    migrationDigest: z.ZodString;
+    deploymentRef: z.ZodNullable<z.ZodString>;
+    admission: z.ZodEnum<{
+        pending: "pending";
+        admitted: "admitted";
+        rejected: "rejected";
+    }>;
+    admissionNote: z.ZodNullable<z.ZodString>;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type VerticalVersion = z.infer<typeof verticalVersion>;
+export declare const publishVersionInput: z.ZodObject<{
+    id: z.ZodString;
+    verticalSlug: z.ZodString;
+    version: z.ZodString;
+    manifestDigest: z.ZodString;
+    permissionDigest: z.ZodString;
+    migrationDigest: z.ZodString;
+    deploymentRef: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type PublishVersionInput = z.infer<typeof publishVersionInput>;
+/**
+ * Where a version is promoted to (#31 step 2).
+ *
+ * A channel is a named pointer per vertical. Promotion moves it. Dev, staging and
+ * prod are therefore the same vertical at different versions, which is the sentence
+ * the registry existed to make sayable.
+ */
+export declare const channelName: z.ZodEnum<{
+    dev: "dev";
+    staging: "staging";
+    prod: "prod";
+}>;
+export type ChannelName = z.infer<typeof channelName>;
+export declare const verticalChannel: z.ZodObject<{
+    verticalSlug: z.ZodString;
+    channel: z.ZodEnum<{
+        dev: "dev";
+        staging: "staging";
+        prod: "prod";
+    }>;
+    versionId: z.ZodString;
+    updatedAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type VerticalChannel = z.infer<typeof verticalChannel>;
+/**
+ * What a promoter must acknowledge, per §4's two human checkpoints.
+ *
+ * Today the migration and permission diffs are a MERGE-time convention: CI renders
+ * them and a human is expected to read them, but nothing connects that reading to
+ * the moment the change reaches anyone. Promotion is that moment — the blast radius
+ * is here, not at the merge.
+ *
+ * So promotion refuses when a digest differs and the corresponding flag is unset,
+ * naming both digests in the error. The flag is one deliberate act rather than a
+ * gate that can be passed by not noticing, and the acknowledgement lands in the
+ * admin log — which turns "someone reviewed it" from a claim into evidence.
+ */
+export declare const promotionAcknowledgement: z.ZodObject<{
+    permissionChange: z.ZodOptional<z.ZodBoolean>;
+    migrationChange: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type PromotionAcknowledgement = z.infer<typeof promotionAcknowledgement>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;iBAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,qBAAqB;;;;;;;;iBAA0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;iBAQ9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;EAAqC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/registry.js

@@ -0,0 +1,95 @@
+import { z } from 'zod';
+import { instant, slug } from './ids.js';
+/**
+ * The vertical + version registry (#31 step 1; D-33's milestone one).
+ *
+ * Today a scope carries a nullable `vertical` STRING — a label nothing validates and
+ * nothing can be pinned to. That is enough to say "this scope runs Callout" and not
+ * enough to say *which Callout*, which is what dev/staging/prod and preview
+ * deployments are: the same vertical at different versions.
+ *
+ * The registry makes a version a real record with digests, so promotion can compare
+ * two of them, and an admission status, so **push is not live**.
+ */
+/** Where a vertical came from. `builtin` is one we ship; the others are a customer's. */
+export const verticalSource = z.enum(['builtin', 'git', 'cli']);
+export const vertical = z.object({
+    slug, // stable, human-readable, and what a scope row denormalizes for display
+    name: z.string().min(1),
+    source: verticalSource,
+    createdAt: instant,
+});
+export const registerVerticalInput = vertical.pick({ slug: true, name: true, source: true });
+/**
+ * Whether a version may be bound to a scope.
+ *
+ * `pending` is what a push produces. The admission gates — boundary-lint, the
+ * migration diff and the permission diff — decide the rest, and binding a scope is a
+ * separate, reviewable step. That separation is the whole point: it is what stops a
+ * push being a deploy, and it puts the two human checkpoints where the blast radius
+ * is (promotion) rather than where the typing is (merge).
+ */
+export const admissionStatus = z.enum(['pending', 'admitted', 'rejected']);
+/**
+ * One published version of a vertical.
+ *
+ * The three digests are what make promotion answerable. "Has the permission surface
+ * changed between the version in prod and the one I am promoting?" is a string
+ * comparison here, where today it is a person remembering to look — and per §4 of the
+ * plan, a checkpoint that can be skipped is not a checkpoint.
+ */
+export const verticalVersion = z.object({
+    id: z.string().min(1), // ULID
+    verticalSlug: slug,
+    version: z.string().min(1), // the builder's label — semver, a git sha, whatever they push
+    manifestDigest: z.string().min(1),
+    permissionDigest: z.string().min(1),
+    migrationDigest: z.string().min(1),
+    /** How to reach the deployment that serves it. Null until something is deployed. */
+    deploymentRef: z.string().min(1).nullable(),
+    admission: admissionStatus,
+    /** Why it was rejected, when it was. Null otherwise. */
+    admissionNote: z.string().nullable(),
+    createdAt: instant,
+});
+export const publishVersionInput = verticalVersion.pick({
+    id: true,
+    verticalSlug: true,
+    version: true,
+    manifestDigest: true,
+    permissionDigest: true,
+    migrationDigest: true,
+    deploymentRef: true,
+});
+/**
+ * Where a version is promoted to (#31 step 2).
+ *
+ * A channel is a named pointer per vertical. Promotion moves it. Dev, staging and
+ * prod are therefore the same vertical at different versions, which is the sentence
+ * the registry existed to make sayable.
+ */
+export const channelName = z.enum(['dev', 'staging', 'prod']);
+export const verticalChannel = z.object({
+    verticalSlug: slug,
+    channel: channelName,
+    versionId: z.string().min(1),
+    updatedAt: instant,
+});
+/**
+ * What a promoter must acknowledge, per §4's two human checkpoints.
+ *
+ * Today the migration and permission diffs are a MERGE-time convention: CI renders
+ * them and a human is expected to read them, but nothing connects that reading to
+ * the moment the change reaches anyone. Promotion is that moment — the blast radius
+ * is here, not at the merge.
+ *
+ * So promotion refuses when a digest differs and the corresponding flag is unset,
+ * naming both digests in the error. The flag is one deliberate act rather than a
+ * gate that can be passed by not noticing, and the acknowledgement lands in the
+ * admin log — which turns "someone reviewed it" from a claim into evidence.
+ */
+export const promotionAcknowledgement = z.object({
+    permissionChange: z.boolean().optional(),
+    migrationChange: z.boolean().optional(),
+});
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,wEAAwE;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,IAAI,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}

package/dist/routing.d.ts

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+/**
+ * The hostname map (K-26; control-plane.md §4.7).
+ *
+ * §4.2 provisions a scope; nothing gave it a URL. This is the directory data a
+ * single environment-wide router resolves against — `hostname → (tenant, scope,
+ * vertical, surface, region)` — before dispatching to the vertical's worker.
+ */
+/**
+ * Which app answers on this hostname.
+ *
+ * §5.5 originally specified one hostname per scope, which is already wrong: the
+ * shop fronts a storefront AND a back office from ONE scope, and RallyPoint a
+ * player app and a manager console. Same data, different audience and chrome — the
+ * split is deliberate and never a second source of truth.
+ *
+ * Vertical vocabulary, deliberately: the kernel never branches on it, exactly as it
+ * never branches on `scope.kind`. It is carried so the router knows where to send
+ * the request, and the vertical decides what that name means.
+ */
+export declare const surfaceName: z.ZodString;
+/**
+ * Where the hostname's traffic may be processed.
+ *
+ * The DO jurisdiction (K-7) pins storage and execution and is fixed at provisioning.
+ * This is the OTHER half: Regional Services pins TLS termination and processing.
+ *
+ * **This column records the region; it does not cause it** (K-30). TLS terminates
+ * before any of our code runs, so nothing read from here can move it — the region is
+ * enforced by a wildcard Regional Hostnames config per jurisdiction
+ * (`*.eu.substrat.run`), and default hostnames carry the jurisdiction in the name.
+ * What this column is for is letting the router detect a CONTRADICTION between the
+ * edge configuration and the directory, and refuse the request.
+ *
+ * Which is also why it should be derived from the scope's jurisdiction rather than
+ * accepted as an independent input: two values that must agree, supplied separately,
+ * eventually disagree — and this is the one an EU claim rests on. `bindHostname` does
+ * not enforce that yet.
+ *
+ * Null means unconstrained. Widening beyond `eu` is additive; Cloudflare also offers
+ * `us` and `fedramp`, and `us` is needed as soon as a second jurisdiction ships.
+ */
+export declare const hostnameRegion: z.ZodNullable<z.ZodEnum<{
+    eu: "eu";
+}>>;
+export type HostnameRegion = z.infer<typeof hostnameRegion>;
+/**
+ * Where a hostname is in its provisioning lifecycle (§4.2).
+ *
+ * Custom domains ride Cloudflare for SaaS, so a hostname is not a string somebody
+ * sets — it is DNS validation and certificate issuance, which take time and can
+ * fail. Treating it as a column would make "the domain does not work yet" and "the
+ * domain is broken" the same state.
+ *
+ * `pending`   — recorded, nothing asked of Cloudflare yet
+ * `verifying` — DNS validation and cert issuance in flight
+ * `active`    — serving
+ * `failed`    — validation or issuance failed; `note` says why
+ */
+export declare const hostnameStatus: z.ZodEnum<{
+    pending: "pending";
+    verifying: "verifying";
+    active: "active";
+    failed: "failed";
+}>;
+export type HostnameStatus = z.infer<typeof hostnameStatus>;
+/**
+ * A hostname, normalized to lower case.
+ *
+ * DNS is case-insensitive, so `ACME.example.com` and `acme.example.com` are the same
+ * name — and if the map stored them as two rows, the global-uniqueness check would
+ * let two different scopes each hold "the same" hostname, and a request would resolve
+ * to whichever casing it happened to arrive in. Normalizing in the schema means both
+ * adapters inherit it rather than each remembering to.
+ *
+ * 253 is the maximum length of a fully-qualified domain name.
+ */
+export declare const hostname: z.ZodString;
+export declare const hostnameBinding: z.ZodObject<{
+    hostname: z.ZodString;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    verticalSlug: z.ZodNullable<z.ZodString>;
+    surface: z.ZodString;
+    region: z.ZodNullable<z.ZodEnum<{
+        eu: "eu";
+    }>>;
+    status: z.ZodEnum<{
+        pending: "pending";
+        verifying: "verifying";
+        active: "active";
+        failed: "failed";
+    }>;
+    statusNote: z.ZodNullable<z.ZodString>;
+    canonical: z.ZodBoolean;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type HostnameBinding = z.infer<typeof hostnameBinding>;
+export declare const bindHostnameInput: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    hostname: z.ZodString;
+    surface: z.ZodString;
+    region: z.ZodNullable<z.ZodEnum<{
+        eu: "eu";
+    }>>;
+    canonical: z.ZodBoolean;
+}, z.core.$strip>;
+export type BindHostnameInput = z.infer<typeof bindHostnameInput>;
+/**
+ * What the router needs to dispatch. Deliberately smaller than the full binding: a
+ * per-request hot path should read what it uses and nothing else.
+ */
+export declare const routeTarget: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    verticalSlug: z.ZodNullable<z.ZodString>;
+    surface: z.ZodString;
+    region: z.ZodNullable<z.ZodEnum<{
+        eu: "eu";
+    }>>;
+}, z.core.$strip>;
+export type RouteTarget = z.infer<typeof routeTarget>;
+//# sourceMappingURL=routing.d.ts.map

package/dist/routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAiB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/routing.js

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+import { instant, scopeId, slug, tenantId } from './ids.js';
+/**
+ * The hostname map (K-26; control-plane.md §4.7).
+ *
+ * §4.2 provisions a scope; nothing gave it a URL. This is the directory data a
+ * single environment-wide router resolves against — `hostname → (tenant, scope,
+ * vertical, surface, region)` — before dispatching to the vertical's worker.
+ */
+/**
+ * Which app answers on this hostname.
+ *
+ * §5.5 originally specified one hostname per scope, which is already wrong: the
+ * shop fronts a storefront AND a back office from ONE scope, and RallyPoint a
+ * player app and a manager console. Same data, different audience and chrome — the
+ * split is deliberate and never a second source of truth.
+ *
+ * Vertical vocabulary, deliberately: the kernel never branches on it, exactly as it
+ * never branches on `scope.kind`. It is carried so the router knows where to send
+ * the request, and the vertical decides what that name means.
+ */
+export const surfaceName = z.string().min(1).max(32);
+/**
+ * Where the hostname's traffic may be processed.
+ *
+ * The DO jurisdiction (K-7) pins storage and execution and is fixed at provisioning.
+ * This is the OTHER half: Regional Services pins TLS termination and processing.
+ *
+ * **This column records the region; it does not cause it** (K-30). TLS terminates
+ * before any of our code runs, so nothing read from here can move it — the region is
+ * enforced by a wildcard Regional Hostnames config per jurisdiction
+ * (`*.eu.substrat.run`), and default hostnames carry the jurisdiction in the name.
+ * What this column is for is letting the router detect a CONTRADICTION between the
+ * edge configuration and the directory, and refuse the request.
+ *
+ * Which is also why it should be derived from the scope's jurisdiction rather than
+ * accepted as an independent input: two values that must agree, supplied separately,
+ * eventually disagree — and this is the one an EU claim rests on. `bindHostname` does
+ * not enforce that yet.
+ *
+ * Null means unconstrained. Widening beyond `eu` is additive; Cloudflare also offers
+ * `us` and `fedramp`, and `us` is needed as soon as a second jurisdiction ships.
+ */
+export const hostnameRegion = z.enum(['eu']).nullable();
+/**
+ * Where a hostname is in its provisioning lifecycle (§4.2).
+ *
+ * Custom domains ride Cloudflare for SaaS, so a hostname is not a string somebody
+ * sets — it is DNS validation and certificate issuance, which take time and can
+ * fail. Treating it as a column would make "the domain does not work yet" and "the
+ * domain is broken" the same state.
+ *
+ * `pending`   — recorded, nothing asked of Cloudflare yet
+ * `verifying` — DNS validation and cert issuance in flight
+ * `active`    — serving
+ * `failed`    — validation or issuance failed; `note` says why
+ */
+export const hostnameStatus = z.enum(['pending', 'verifying', 'active', 'failed']);
+/**
+ * A hostname, normalized to lower case.
+ *
+ * DNS is case-insensitive, so `ACME.example.com` and `acme.example.com` are the same
+ * name — and if the map stored them as two rows, the global-uniqueness check would
+ * let two different scopes each hold "the same" hostname, and a request would resolve
+ * to whichever casing it happened to arrive in. Normalizing in the schema means both
+ * adapters inherit it rather than each remembering to.
+ *
+ * 253 is the maximum length of a fully-qualified domain name.
+ */
+export const hostname = z.string().min(1).max(253).toLowerCase();
+export const hostnameBinding = z.object({
+    hostname,
+    tenantId,
+    scopeId,
+    /** Denormalized from the scope, so the router resolves in one read. */
+    verticalSlug: slug.nullable(),
+    surface: surfaceName,
+    region: hostnameRegion,
+    status: hostnameStatus,
+    /** Why it failed, when it did. Null otherwise. */
+    statusNote: z.string().nullable(),
+    /**
+     * The one hostname a surface redirects to and issues certs for. Exactly one per
+     * (scope, surface) may hold it — the rest are aliases.
+     */
+    canonical: z.boolean(),
+    createdAt: instant,
+});
+export const bindHostnameInput = hostnameBinding.pick({
+    hostname: true,
+    tenantId: true,
+    scopeId: true,
+    surface: true,
+    region: true,
+    canonical: true,
+});
+/**
+ * What the router needs to dispatch. Deliberately smaller than the full binding: a
+ * per-request hot path should read what it uses and nothing else.
+ */
+export const routeTarget = z.object({
+    tenantId,
+    scopeId,
+    verticalSlug: slug.nullable(),
+    surface: surfaceName,
+    region: hostnameRegion,
+});
+//# sourceMappingURL=routing.js.map

package/dist/routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,uEAAuE;IACvE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;CACvB,CAAC,CAAC"}

package/dist/tenancy.d.ts

@@ -23,6 +23,35 @@ export declare const createTenantInput: z.ZodObject<{
     name: z.ZodString;
 }, z.core.$strip>;
 export type CreateTenantInput = z.infer<typeof createTenantInput>;
+/**
+ * An organization inside a tenant (K-22) — who membership tuples point at and what
+ * `grantToOrg` targets. Portal customers, staff groups, partner companies.
+ *
+ * `slug` and `name` are **attributes, not identity**: the id is a ULID, so renaming an
+ * org cannot silently orphan the tuples and grants that reference it. `tenantId` on the
+ * row is also kernel-design §4.3's required `orgId ↔ tenantId` join — *"an explicit,
+ * stable directory row, one per tenant, never reconstructed from names or slugs"* —
+ * which is why the identity adapter's org sync hangs off this record rather than a
+ * string convention.
+ *
+ * No lifecycle status yet, deliberately: nothing consumes one, and adding a nullable
+ * column later is additive. The branded id is the part that is brutal to retrofit.
+ */
+export declare const org: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    slug: z.ZodString;
+    name: z.ZodString;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type Org = z.infer<typeof org>;
+export declare const createOrgInput: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    id: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
+    slug: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type CreateOrgInput = z.infer<typeof createOrgInput>;
 export declare const scopeStatus: z.ZodEnum<{
     active: "active";
     suspended: "suspended";
@@ -40,6 +69,32 @@ export declare const jurisdiction: z.ZodNullable<z.ZodEnum<{
     eu: "eu";
 }>>;
 export type Jurisdiction = z.infer<typeof jurisdiction>;
+/**
+ * A scope's last *failed* migration attempt (kernel-design §5.3), or null when the
+ * last attempt succeeded and when none has run.
+ *
+ * Migrations fail closed per scope: `applyPendingMigrations` rolls back and throws,
+ * so the scope serves nothing. Before this record existed the directory learned
+ * nothing from that — `schemaVersion` is projected only on the success path, so a
+ * half-migrated scope kept a stale value and rendered as healthy.
+ *
+ * Deliberately **not** a `scopeStatus` member: the scope already fails closed at the
+ * migration layer, so nothing about lifecycle gating changes, and the §3.3 machine
+ * (`provisioning → active → suspended ⇄ active → archiving → archived`) has no
+ * sensible transition for it. Structured rather than a flag because the
+ * reconciliation sweep (§5.3) retries with backoff and reports
+ * "487/500 migrated, 13 pending, 0 failed" — which needs the attempt count and the
+ * failing version, not a boolean.
+ *
+ * `attempts` counts *consecutive* failures and resets to 0 on a successful apply.
+ */
+export declare const migrationFailure: z.ZodNullable<z.ZodObject<{
+    version: z.ZodString;
+    error: z.ZodString;
+    attempts: z.ZodNumber;
+    lastAttemptAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>>;
+export type MigrationFailure = z.infer<typeof migrationFailure>;
 export declare const scope: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
     tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
@@ -62,7 +117,14 @@ export declare const scope: z.ZodObject<{
         eu: "eu";
     }>>;
     vertical: z.ZodNullable<z.ZodString>;
+    verticalVersionId: z.ZodNullable<z.ZodString>;
     schemaVersion: z.ZodString;
+    migrationFailure: z.ZodNullable<z.ZodObject<{
+        version: z.ZodString;
+        error: z.ZodString;
+        attempts: z.ZodNumber;
+        lastAttemptAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+    }, z.core.$strip>>;
     createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
 }, z.core.$strip>;
 export type Scope = z.infer<typeof scope>;

package/dist/tenancy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;;EAA8C,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM;;;;;;;;;;iBAMjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAI5C,eAAO,MAAM,iBAAiB;;;;iBAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,WAAW;;;;;;EAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;EAAqB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,YAAY;;GAA4B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;iBAsBhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;;EAA8C,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM;;;;;;;;;;iBAMjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAI5C,eAAO,MAAM,iBAAiB;;;;iBAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,GAAG;;;;;;iBAMd,CAAC;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;AAGtC,eAAO,MAAM,cAAc;;;;;iBAAiE,CAAC;AAC7F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,WAAW;;;;;;EAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;EAAqB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,YAAY;;GAA4B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB;;;;;kBAOhB,CAAC;AACd,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgChB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/dist/tenancy.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { instant, scopeId, slug, tenantId } from './ids.js';
+import { instant, orgId, scopeId, slug, tenantId } from './ids.js';
 export const tenantStatus = z.enum(['active', 'suspended', 'deleting']);
 export const tenant = z.object({
     id: tenantId,
@@ -11,6 +11,29 @@ export const tenant = z.object({
 // What the caller supplies to createTenant (control-plane.md §4.1); `status`
 // (active) and `createdAt` are stamped host-side, never caller-supplied.
 export const createTenantInput = tenant.pick({ id: true, slug: true, name: true });
+/**
+ * An organization inside a tenant (K-22) — who membership tuples point at and what
+ * `grantToOrg` targets. Portal customers, staff groups, partner companies.
+ *
+ * `slug` and `name` are **attributes, not identity**: the id is a ULID, so renaming an
+ * org cannot silently orphan the tuples and grants that reference it. `tenantId` on the
+ * row is also kernel-design §4.3's required `orgId ↔ tenantId` join — *"an explicit,
+ * stable directory row, one per tenant, never reconstructed from names or slugs"* —
+ * which is why the identity adapter's org sync hangs off this record rather than a
+ * string convention.
+ *
+ * No lifecycle status yet, deliberately: nothing consumes one, and adding a nullable
+ * column later is additive. The branded id is the part that is brutal to retrofit.
+ */
+export const org = z.object({
+    id: orgId,
+    tenantId,
+    slug, // unique within the tenant
+    name: z.string().min(1),
+    createdAt: instant,
+});
+// `status`/`createdAt` are stamped host-side, never caller-supplied (as createTenantInput).
+export const createOrgInput = org.pick({ id: true, tenantId: true, slug: true, name: true });
 export const scopeStatus = z.enum([
     'provisioning',
     'active',
@@ -22,6 +45,33 @@ export const scopeStatus = z.enum([
 export const storageShape = z.enum(['A', 'B']);
 // Fixed at provisioning; a DO can never relocate (design K-7)
 export const jurisdiction = z.enum(['eu']).nullable();
+/**
+ * A scope's last *failed* migration attempt (kernel-design §5.3), or null when the
+ * last attempt succeeded and when none has run.
+ *
+ * Migrations fail closed per scope: `applyPendingMigrations` rolls back and throws,
+ * so the scope serves nothing. Before this record existed the directory learned
+ * nothing from that — `schemaVersion` is projected only on the success path, so a
+ * half-migrated scope kept a stale value and rendered as healthy.
+ *
+ * Deliberately **not** a `scopeStatus` member: the scope already fails closed at the
+ * migration layer, so nothing about lifecycle gating changes, and the §3.3 machine
+ * (`provisioning → active → suspended ⇄ active → archiving → archived`) has no
+ * sensible transition for it. Structured rather than a flag because the
+ * reconciliation sweep (§5.3) retries with backoff and reports
+ * "487/500 migrated, 13 pending, 0 failed" — which needs the attempt count and the
+ * failing version, not a boolean.
+ *
+ * `attempts` counts *consecutive* failures and resets to 0 on a successful apply.
+ */
+export const migrationFailure = z
+    .object({
+    version: z.string().min(1), // the `module@version` that threw
+    error: z.string(),
+    attempts: z.number().int().positive(), // ≥1: the record only exists after a failure
+    lastAttemptAt: instant,
+})
+    .nullable();
 export const scope = z.object({
     id: scopeId, // globally unique; APIs still take (tenantId, scopeId) and cross-check (K-3)
     tenantId,
@@ -38,11 +88,21 @@ export const scope = z.object({
     // audit log's `vertical` target real for scope-lifecycle actions, and what
     // console item 1 means by "which vertical each scope runs".
     vertical: z.string().min(1).nullable(),
+    /**
+     * The registered version this scope runs (#31). Null for a scope provisioned
+     * before the registry, or bound to a vertical we ship but have not versioned.
+     *
+     * Kept ALONGSIDE `vertical` rather than replacing it: the slug is what the audit
+     * log's target and the console's filters read, and a denormalized label that
+     * survives a version being superseded is worth more than one join.
+     */
+    verticalVersionId: z.string().min(1).nullable(),
     // The scope's migration state: the count of applied (module, version) pairs,
     // as a string. Written host-side after migrations apply — never caller-supplied.
     // '0' means "provisioned, nothing applied yet". Comparing it against the host's
     // registered migration total is what answers §5.4's "which scopes are behind".
     schemaVersion: z.string(),
+    migrationFailure,
     createdAt: instant,
 });
 //# sourceMappingURL=tenancy.js.map

package/dist/tenancy.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGtD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,OAAO,EAAE,6EAA6E;IAC1F,QAAQ;IACR,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,4DAA4D;IAC/F,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qEAAqE;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,YAAY;IACZ,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC"}
+{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,KAAK;IACT,QAAQ;IACR,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kCAAkC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,6CAA6C;IACpF,aAAa,EAAE,OAAO;CACvB,CAAC;KACD,QAAQ,EAAE,CAAC;AAGd,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,OAAO,EAAE,6EAA6E;IAC1F,QAAQ;IACR,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,4DAA4D;IAC/F,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qEAAqE;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,YAAY;IACZ,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC;;;;;;;OAOG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB;IAChB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {