@substrat-run/contracts 0.6.0 → 0.8.0

package/dist/control-plane.d.ts

@@ -8,6 +8,15 @@ export declare const adminAction: z.ZodEnum<{
     removeMember: "removeMember";
     createOrg: "createOrg";
     registerIdentityPool: "registerIdentityPool";
+    registerVertical: "registerVertical";
+    publishVersion: "publishVersion";
+    admitVersion: "admitVersion";
+    rejectVersion: "rejectVersion";
+    bindScopeVersion: "bindScopeVersion";
+    promoteVersion: "promoteVersion";
+    bindHostname: "bindHostname";
+    setHostnameStatus: "setHostnameStatus";
+    pruneAccessLog: "pruneAccessLog";
     createTenant: "createTenant";
     setTenantStatus: "setTenantStatus";
     provisionScope: "provisionScope";
@@ -87,6 +96,29 @@ export declare const resolvedIdentity: z.ZodObject<{
     scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
 }, z.core.$strip>;
 export type ResolvedIdentity = z.infer<typeof resolvedIdentity>;
+/**
+ * One staff READ of the directory (K-24). Separate from `adminLogEntry` because a
+ * mutation is permanent evidence and a read is operational history — one table would
+ * force one retention policy on both.
+ *
+ * `resultCount` is what separates navigation from an incident: "called listScopes"
+ * against "enumerated 4,000 tenants".
+ *
+ * `drainedAt` marks a row shipped to Tier 2. Only drained rows may be pruned —
+ * expiring on age alone would destroy evidence while calling itself retention.
+ */
+export declare const accessLogEntry: z.ZodObject<{
+    id: z.ZodString;
+    actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
+    method: z.ZodString;
+    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
+    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    params: z.ZodNullable<z.ZodString>;
+    resultCount: z.ZodNumber;
+    drainedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
+    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type AccessLogEntry = z.infer<typeof accessLogEntry>;
 /**
  * One principal's membership of one org, as the directory holds it (K-21).
  *
@@ -125,6 +157,15 @@ export declare const adminLogEntry: z.ZodObject<{
         removeMember: "removeMember";
         createOrg: "createOrg";
         registerIdentityPool: "registerIdentityPool";
+        registerVertical: "registerVertical";
+        publishVersion: "publishVersion";
+        admitVersion: "admitVersion";
+        rejectVersion: "rejectVersion";
+        bindScopeVersion: "bindScopeVersion";
+        promoteVersion: "promoteVersion";
+        bindHostname: "bindHostname";
+        setHostnameStatus: "setHostnameStatus";
+        pruneAccessLog: "pruneAccessLog";
         createTenant: "createTenant";
         setTenantStatus: "setTenantStatus";
         provisionScope: "provisionScope";

package/dist/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;EAmBtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/control-plane.js

@@ -14,7 +14,16 @@ export const adminAction = z.enum([
     'addMember',
     'removeMember', // K-21 — tombstones the membership tuple, never deletes it
     'createOrg', // K-22 — orgs are a real record, not a free-form string
-    'registerIdentityPool', // K-23 — a provider declares its topology before it may link
+    'registerIdentityPool',
+    'registerVertical', // #31 — the vertical + version registry
+    'publishVersion',
+    'admitVersion',
+    'rejectVersion',
+    'bindScopeVersion',
+    'promoteVersion',
+    'bindHostname', // K-26 — the hostname map
+    'setHostnameStatus', // #31 step 2 — where the two human checkpoints fire
+    'pruneAccessLog', // K-24 — deleting drained access rows is itself a mutation // K-23 — a provider declares its topology before it may link
     'createTenant', // §4.1
     'setTenantStatus', // §4.1 — before/after carry the transitioned status
     'provisionScope', // §4.2 — the first scope-lifecycle transition (→ active)
@@ -87,6 +96,28 @@ export const resolvedIdentity = z.object({
     principal: principalId,
     scopeId: scopeId.nullable(),
 });
+/**
+ * One staff READ of the directory (K-24). Separate from `adminLogEntry` because a
+ * mutation is permanent evidence and a read is operational history — one table would
+ * force one retention policy on both.
+ *
+ * `resultCount` is what separates navigation from an incident: "called listScopes"
+ * against "enumerated 4,000 tenants".
+ *
+ * `drainedAt` marks a row shipped to Tier 2. Only drained rows may be pruned —
+ * expiring on age alone would destroy evidence while calling itself retention.
+ */
+export const accessLogEntry = z.object({
+    id: z.string().min(1),
+    actor: platformActorId,
+    method: z.string().min(1),
+    tenantId: tenantId.nullable(),
+    scopeId: scopeId.nullable(),
+    params: z.string().nullable(),
+    resultCount: z.number().int().nonnegative(),
+    drainedAt: instant.nullable(),
+    at: instant,
+});
 /**
  * One principal's membership of one org, as the directory holds it (K-21).
  *

package/dist/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB,EAAE,6DAA6D;IACrF,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,oDAAoD;IACvE,gBAAgB,EAAE,yDAAyD;IAC3E,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,uDAAuD;IACzE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;CACnE,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,oDAAoD;IACvE,gBAAgB,EAAE,yDAAyD;IAC3E,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,uDAAuD;IACzE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;CACnE,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}

package/dist/index.d.ts

@@ -18,6 +18,8 @@
  */
 export { z } from 'zod';
 export * from './ids.js';
+export * from './registry.js';
+export * from './routing.js';
 export * from './tenancy.js';
 export * from './control-plane.js';
 export * from './permission.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -18,6 +18,8 @@
  */
 export { z } from 'zod';
 export * from './ids.js';
+export * from './registry.js';
+export * from './routing.js';
 export * from './tenancy.js';
 export * from './control-plane.js';
 export * from './permission.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/dist/manifest.js

@@ -55,8 +55,8 @@ export const moduleManifest = z.object({
     // Keyed on operations, never on engine transitions: the kernel sees
     // operations, and must not learn engine internals (star topology). Policy
     // that is CONDITIONAL on vertical data (e.g. "only montage orders need an
-    // egenkontroll") stays vertical-composed glue inside the operation — see
-    // demos/fsm. Guards live here so that adding or DROPPING a compliance gate
+    // self-inspection") stays vertical-composed glue inside the operation — see
+    // demos/callout. Guards live here so that adding or DROPPING a compliance gate
     // lands in the reviewable manifest diff.
     //
     // Optional: every pre-milestone-C manifest still parses unchanged (D-28,

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,0EAA0E;AAC1E,wEAAwE;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,aAAa;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qDAAqD;CACtF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gDAAgD;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;IAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,wBAAwB;CAChF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,QAAQ,EAAE,mCAAmC;IACjD,OAAO,EAAE,aAAa;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4CAA4C;IAC/E,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uDAAuD;KACzF,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;QAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iDAAiD;KACrF,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,cAAc,EAAE,aAAa,EAAE,mDAAmD;KACnF,CAAC,CACH;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,sDAAsD;IACtD,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc;QAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,0CAA0C;IAC1C,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,EAAE;IACF,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACzC,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,mCAAmC;IACnC,EAAE;IACF,0CAA0C;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,yCAAyC;IAC3F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0DAA0D;IACtF,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,gDAAgD;IAChD,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aAClG,QAAQ,EAAE;QACb,GAAG,EAAE,CAAC;aACH,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW;YACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,UAAU,EAAE,aAAa;SAC1B,CAAC,CACH;aACA,QAAQ,EAAE;QACb,wEAAwE;QACxE,WAAW,EAAE,CAAC;aACX,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC3E,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACrG,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACtG,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,0EAA0E;AAC1E,wEAAwE;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,aAAa;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qDAAqD;CACtF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gDAAgD;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;IAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,wBAAwB;CAChF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,QAAQ,EAAE,mCAAmC;IACjD,OAAO,EAAE,aAAa;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4CAA4C;IAC/E,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uDAAuD;KACzF,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8CAA8C;QAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iDAAiD;KACrF,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,cAAc,EAAE,aAAa,EAAE,mDAAmD;KACnF,CAAC,CACH;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,sDAAsD;IACtD,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc;QAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,0CAA0C;IAC1C,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,yCAAyC;IACzC,EAAE;IACF,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACzC,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,mCAAmC;IACnC,EAAE;IACF,0CAA0C;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,yCAAyC;IAC3F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0DAA0D;IACtF,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C,CAAC,CACH;SACA,QAAQ,EAAE;IACb,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,gDAAgD;IAChD,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aAClG,QAAQ,EAAE;QACb,GAAG,EAAE,CAAC;aACH,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW;YACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,UAAU,EAAE,aAAa;SAC1B,CAAC,CACH;aACA,QAAQ,EAAE;QACb,wEAAwE;QACxE,WAAW,EAAE,CAAC;aACX,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC3E,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACrG,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;aACtG,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,133 @@
+import { z } from 'zod';
+/**
+ * The vertical + version registry (#31 step 1; D-33's milestone one).
+ *
+ * Today a scope carries a nullable `vertical` STRING — a label nothing validates and
+ * nothing can be pinned to. That is enough to say "this scope runs Callout" and not
+ * enough to say *which Callout*, which is what dev/staging/prod and preview
+ * deployments are: the same vertical at different versions.
+ *
+ * The registry makes a version a real record with digests, so promotion can compare
+ * two of them, and an admission status, so **push is not live**.
+ */
+/** Where a vertical came from. `builtin` is one we ship; the others are a customer's. */
+export declare const verticalSource: z.ZodEnum<{
+    builtin: "builtin";
+    git: "git";
+    cli: "cli";
+}>;
+export type VerticalSource = z.infer<typeof verticalSource>;
+export declare const vertical: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+    source: z.ZodEnum<{
+        builtin: "builtin";
+        git: "git";
+        cli: "cli";
+    }>;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type Vertical = z.infer<typeof vertical>;
+export declare const registerVerticalInput: z.ZodObject<{
+    slug: z.ZodString;
+    source: z.ZodEnum<{
+        builtin: "builtin";
+        git: "git";
+        cli: "cli";
+    }>;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type RegisterVerticalInput = z.infer<typeof registerVerticalInput>;
+/**
+ * Whether a version may be bound to a scope.
+ *
+ * `pending` is what a push produces. The admission gates — boundary-lint, the
+ * migration diff and the permission diff — decide the rest, and binding a scope is a
+ * separate, reviewable step. That separation is the whole point: it is what stops a
+ * push being a deploy, and it puts the two human checkpoints where the blast radius
+ * is (promotion) rather than where the typing is (merge).
+ */
+export declare const admissionStatus: z.ZodEnum<{
+    pending: "pending";
+    admitted: "admitted";
+    rejected: "rejected";
+}>;
+export type AdmissionStatus = z.infer<typeof admissionStatus>;
+/**
+ * One published version of a vertical.
+ *
+ * The three digests are what make promotion answerable. "Has the permission surface
+ * changed between the version in prod and the one I am promoting?" is a string
+ * comparison here, where today it is a person remembering to look — and per §4 of the
+ * plan, a checkpoint that can be skipped is not a checkpoint.
+ */
+export declare const verticalVersion: z.ZodObject<{
+    id: z.ZodString;
+    verticalSlug: z.ZodString;
+    version: z.ZodString;
+    manifestDigest: z.ZodString;
+    permissionDigest: z.ZodString;
+    migrationDigest: z.ZodString;
+    deploymentRef: z.ZodNullable<z.ZodString>;
+    admission: z.ZodEnum<{
+        pending: "pending";
+        admitted: "admitted";
+        rejected: "rejected";
+    }>;
+    admissionNote: z.ZodNullable<z.ZodString>;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type VerticalVersion = z.infer<typeof verticalVersion>;
+export declare const publishVersionInput: z.ZodObject<{
+    id: z.ZodString;
+    verticalSlug: z.ZodString;
+    version: z.ZodString;
+    manifestDigest: z.ZodString;
+    permissionDigest: z.ZodString;
+    migrationDigest: z.ZodString;
+    deploymentRef: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type PublishVersionInput = z.infer<typeof publishVersionInput>;
+/**
+ * Where a version is promoted to (#31 step 2).
+ *
+ * A channel is a named pointer per vertical. Promotion moves it. Dev, staging and
+ * prod are therefore the same vertical at different versions, which is the sentence
+ * the registry existed to make sayable.
+ */
+export declare const channelName: z.ZodEnum<{
+    dev: "dev";
+    staging: "staging";
+    prod: "prod";
+}>;
+export type ChannelName = z.infer<typeof channelName>;
+export declare const verticalChannel: z.ZodObject<{
+    verticalSlug: z.ZodString;
+    channel: z.ZodEnum<{
+        dev: "dev";
+        staging: "staging";
+        prod: "prod";
+    }>;
+    versionId: z.ZodString;
+    updatedAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type VerticalChannel = z.infer<typeof verticalChannel>;
+/**
+ * What a promoter must acknowledge, per §4's two human checkpoints.
+ *
+ * Today the migration and permission diffs are a MERGE-time convention: CI renders
+ * them and a human is expected to read them, but nothing connects that reading to
+ * the moment the change reaches anyone. Promotion is that moment — the blast radius
+ * is here, not at the merge.
+ *
+ * So promotion refuses when a digest differs and the corresponding flag is unset,
+ * naming both digests in the error. The flag is one deliberate act rather than a
+ * gate that can be passed by not noticing, and the acknowledgement lands in the
+ * admin log — which turns "someone reviewed it" from a claim into evidence.
+ */
+export declare const promotionAcknowledgement: z.ZodObject<{
+    permissionChange: z.ZodOptional<z.ZodBoolean>;
+    migrationChange: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type PromotionAcknowledgement = z.infer<typeof promotionAcknowledgement>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;iBAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,qBAAqB;;;;;;;;iBAA0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;iBAQ9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;EAAqC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/registry.js

@@ -0,0 +1,95 @@
+import { z } from 'zod';
+import { instant, slug } from './ids.js';
+/**
+ * The vertical + version registry (#31 step 1; D-33's milestone one).
+ *
+ * Today a scope carries a nullable `vertical` STRING — a label nothing validates and
+ * nothing can be pinned to. That is enough to say "this scope runs Callout" and not
+ * enough to say *which Callout*, which is what dev/staging/prod and preview
+ * deployments are: the same vertical at different versions.
+ *
+ * The registry makes a version a real record with digests, so promotion can compare
+ * two of them, and an admission status, so **push is not live**.
+ */
+/** Where a vertical came from. `builtin` is one we ship; the others are a customer's. */
+export const verticalSource = z.enum(['builtin', 'git', 'cli']);
+export const vertical = z.object({
+    slug, // stable, human-readable, and what a scope row denormalizes for display
+    name: z.string().min(1),
+    source: verticalSource,
+    createdAt: instant,
+});
+export const registerVerticalInput = vertical.pick({ slug: true, name: true, source: true });
+/**
+ * Whether a version may be bound to a scope.
+ *
+ * `pending` is what a push produces. The admission gates — boundary-lint, the
+ * migration diff and the permission diff — decide the rest, and binding a scope is a
+ * separate, reviewable step. That separation is the whole point: it is what stops a
+ * push being a deploy, and it puts the two human checkpoints where the blast radius
+ * is (promotion) rather than where the typing is (merge).
+ */
+export const admissionStatus = z.enum(['pending', 'admitted', 'rejected']);
+/**
+ * One published version of a vertical.
+ *
+ * The three digests are what make promotion answerable. "Has the permission surface
+ * changed between the version in prod and the one I am promoting?" is a string
+ * comparison here, where today it is a person remembering to look — and per §4 of the
+ * plan, a checkpoint that can be skipped is not a checkpoint.
+ */
+export const verticalVersion = z.object({
+    id: z.string().min(1), // ULID
+    verticalSlug: slug,
+    version: z.string().min(1), // the builder's label — semver, a git sha, whatever they push
+    manifestDigest: z.string().min(1),
+    permissionDigest: z.string().min(1),
+    migrationDigest: z.string().min(1),
+    /** How to reach the deployment that serves it. Null until something is deployed. */
+    deploymentRef: z.string().min(1).nullable(),
+    admission: admissionStatus,
+    /** Why it was rejected, when it was. Null otherwise. */
+    admissionNote: z.string().nullable(),
+    createdAt: instant,
+});
+export const publishVersionInput = verticalVersion.pick({
+    id: true,
+    verticalSlug: true,
+    version: true,
+    manifestDigest: true,
+    permissionDigest: true,
+    migrationDigest: true,
+    deploymentRef: true,
+});
+/**
+ * Where a version is promoted to (#31 step 2).
+ *
+ * A channel is a named pointer per vertical. Promotion moves it. Dev, staging and
+ * prod are therefore the same vertical at different versions, which is the sentence
+ * the registry existed to make sayable.
+ */
+export const channelName = z.enum(['dev', 'staging', 'prod']);
+export const verticalChannel = z.object({
+    verticalSlug: slug,
+    channel: channelName,
+    versionId: z.string().min(1),
+    updatedAt: instant,
+});
+/**
+ * What a promoter must acknowledge, per §4's two human checkpoints.
+ *
+ * Today the migration and permission diffs are a MERGE-time convention: CI renders
+ * them and a human is expected to read them, but nothing connects that reading to
+ * the moment the change reaches anyone. Promotion is that moment — the blast radius
+ * is here, not at the merge.
+ *
+ * So promotion refuses when a digest differs and the corresponding flag is unset,
+ * naming both digests in the error. The flag is one deliberate act rather than a
+ * gate that can be passed by not noticing, and the acknowledgement lands in the
+ * admin log — which turns "someone reviewed it" from a claim into evidence.
+ */
+export const promotionAcknowledgement = z.object({
+    permissionChange: z.boolean().optional(),
+    migrationChange: z.boolean().optional(),
+});
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,wEAAwE;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,IAAI,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}

package/dist/routing.d.ts

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+/**
+ * The hostname map (K-26; control-plane.md §4.7).
+ *
+ * §4.2 provisions a scope; nothing gave it a URL. This is the directory data a
+ * single environment-wide router resolves against — `hostname → (tenant, scope,
+ * vertical, surface, region)` — before dispatching to the vertical's worker.
+ */
+/**
+ * Which app answers on this hostname.
+ *
+ * §5.5 originally specified one hostname per scope, which is already wrong: the
+ * shop fronts a storefront AND a back office from ONE scope, and RallyPoint a
+ * player app and a manager console. Same data, different audience and chrome — the
+ * split is deliberate and never a second source of truth.
+ *
+ * Vertical vocabulary, deliberately: the kernel never branches on it, exactly as it
+ * never branches on `scope.kind`. It is carried so the router knows where to send
+ * the request, and the vertical decides what that name means.
+ */
+export declare const surfaceName: z.ZodString;
+/**
+ * Where the hostname's traffic may be processed.
+ *
+ * The DO jurisdiction (K-7) pins storage and execution and is fixed at provisioning.
+ * This is the OTHER half: Regional Services pins TLS termination and processing.
+ *
+ * **This column records the region; it does not cause it** (K-30). TLS terminates
+ * before any of our code runs, so nothing read from here can move it — the region is
+ * enforced by a wildcard Regional Hostnames config per jurisdiction
+ * (`*.eu.substrat.run`), and default hostnames carry the jurisdiction in the name.
+ * What this column is for is letting the router detect a CONTRADICTION between the
+ * edge configuration and the directory, and refuse the request.
+ *
+ * Which is also why it should be derived from the scope's jurisdiction rather than
+ * accepted as an independent input: two values that must agree, supplied separately,
+ * eventually disagree — and this is the one an EU claim rests on. `bindHostname` does
+ * not enforce that yet.
+ *
+ * Null means unconstrained. Widening beyond `eu` is additive; Cloudflare also offers
+ * `us` and `fedramp`, and `us` is needed as soon as a second jurisdiction ships.
+ */
+export declare const hostnameRegion: z.ZodNullable<z.ZodEnum<{
+    eu: "eu";
+}>>;
+export type HostnameRegion = z.infer<typeof hostnameRegion>;
+/**
+ * Where a hostname is in its provisioning lifecycle (§4.2).
+ *
+ * Custom domains ride Cloudflare for SaaS, so a hostname is not a string somebody
+ * sets — it is DNS validation and certificate issuance, which take time and can
+ * fail. Treating it as a column would make "the domain does not work yet" and "the
+ * domain is broken" the same state.
+ *
+ * `pending`   — recorded, nothing asked of Cloudflare yet
+ * `verifying` — DNS validation and cert issuance in flight
+ * `active`    — serving
+ * `failed`    — validation or issuance failed; `note` says why
+ */
+export declare const hostnameStatus: z.ZodEnum<{
+    pending: "pending";
+    verifying: "verifying";
+    active: "active";
+    failed: "failed";
+}>;
+export type HostnameStatus = z.infer<typeof hostnameStatus>;
+/**
+ * A hostname, normalized to lower case.
+ *
+ * DNS is case-insensitive, so `ACME.example.com` and `acme.example.com` are the same
+ * name — and if the map stored them as two rows, the global-uniqueness check would
+ * let two different scopes each hold "the same" hostname, and a request would resolve
+ * to whichever casing it happened to arrive in. Normalizing in the schema means both
+ * adapters inherit it rather than each remembering to.
+ *
+ * 253 is the maximum length of a fully-qualified domain name.
+ */
+export declare const hostname: z.ZodString;
+export declare const hostnameBinding: z.ZodObject<{
+    hostname: z.ZodString;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    verticalSlug: z.ZodNullable<z.ZodString>;
+    surface: z.ZodString;
+    region: z.ZodNullable<z.ZodEnum<{
+        eu: "eu";
+    }>>;
+    status: z.ZodEnum<{
+        pending: "pending";
+        verifying: "verifying";
+        active: "active";
+        failed: "failed";
+    }>;
+    statusNote: z.ZodNullable<z.ZodString>;
+    canonical: z.ZodBoolean;
+    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
+}, z.core.$strip>;
+export type HostnameBinding = z.infer<typeof hostnameBinding>;
+export declare const bindHostnameInput: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    hostname: z.ZodString;
+    surface: z.ZodString;
+    region: z.ZodNullable<z.ZodEnum<{
+        eu: "eu";
+    }>>;
+    canonical: z.ZodBoolean;
+}, z.core.$strip>;
+export type BindHostnameInput = z.infer<typeof bindHostnameInput>;
+/**
+ * What the router needs to dispatch. Deliberately smaller than the full binding: a
+ * per-request hot path should read what it uses and nothing else.
+ */
+export declare const routeTarget: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    verticalSlug: z.ZodNullable<z.ZodString>;
+    surface: z.ZodString;
+    region: z.ZodNullable<z.ZodEnum<{
+        eu: "eu";
+    }>>;
+}, z.core.$strip>;
+export type RouteTarget = z.infer<typeof routeTarget>;
+//# sourceMappingURL=routing.d.ts.map

package/dist/routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAiB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/routing.js

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+import { instant, scopeId, slug, tenantId } from './ids.js';
+/**
+ * The hostname map (K-26; control-plane.md §4.7).
+ *
+ * §4.2 provisions a scope; nothing gave it a URL. This is the directory data a
+ * single environment-wide router resolves against — `hostname → (tenant, scope,
+ * vertical, surface, region)` — before dispatching to the vertical's worker.
+ */
+/**
+ * Which app answers on this hostname.
+ *
+ * §5.5 originally specified one hostname per scope, which is already wrong: the
+ * shop fronts a storefront AND a back office from ONE scope, and RallyPoint a
+ * player app and a manager console. Same data, different audience and chrome — the
+ * split is deliberate and never a second source of truth.
+ *
+ * Vertical vocabulary, deliberately: the kernel never branches on it, exactly as it
+ * never branches on `scope.kind`. It is carried so the router knows where to send
+ * the request, and the vertical decides what that name means.
+ */
+export const surfaceName = z.string().min(1).max(32);
+/**
+ * Where the hostname's traffic may be processed.
+ *
+ * The DO jurisdiction (K-7) pins storage and execution and is fixed at provisioning.
+ * This is the OTHER half: Regional Services pins TLS termination and processing.
+ *
+ * **This column records the region; it does not cause it** (K-30). TLS terminates
+ * before any of our code runs, so nothing read from here can move it — the region is
+ * enforced by a wildcard Regional Hostnames config per jurisdiction
+ * (`*.eu.substrat.run`), and default hostnames carry the jurisdiction in the name.
+ * What this column is for is letting the router detect a CONTRADICTION between the
+ * edge configuration and the directory, and refuse the request.
+ *
+ * Which is also why it should be derived from the scope's jurisdiction rather than
+ * accepted as an independent input: two values that must agree, supplied separately,
+ * eventually disagree — and this is the one an EU claim rests on. `bindHostname` does
+ * not enforce that yet.
+ *
+ * Null means unconstrained. Widening beyond `eu` is additive; Cloudflare also offers
+ * `us` and `fedramp`, and `us` is needed as soon as a second jurisdiction ships.
+ */
+export const hostnameRegion = z.enum(['eu']).nullable();
+/**
+ * Where a hostname is in its provisioning lifecycle (§4.2).
+ *
+ * Custom domains ride Cloudflare for SaaS, so a hostname is not a string somebody
+ * sets — it is DNS validation and certificate issuance, which take time and can
+ * fail. Treating it as a column would make "the domain does not work yet" and "the
+ * domain is broken" the same state.
+ *
+ * `pending`   — recorded, nothing asked of Cloudflare yet
+ * `verifying` — DNS validation and cert issuance in flight
+ * `active`    — serving
+ * `failed`    — validation or issuance failed; `note` says why
+ */
+export const hostnameStatus = z.enum(['pending', 'verifying', 'active', 'failed']);
+/**
+ * A hostname, normalized to lower case.
+ *
+ * DNS is case-insensitive, so `ACME.example.com` and `acme.example.com` are the same
+ * name — and if the map stored them as two rows, the global-uniqueness check would
+ * let two different scopes each hold "the same" hostname, and a request would resolve
+ * to whichever casing it happened to arrive in. Normalizing in the schema means both
+ * adapters inherit it rather than each remembering to.
+ *
+ * 253 is the maximum length of a fully-qualified domain name.
+ */
+export const hostname = z.string().min(1).max(253).toLowerCase();
+export const hostnameBinding = z.object({
+    hostname,
+    tenantId,
+    scopeId,
+    /** Denormalized from the scope, so the router resolves in one read. */
+    verticalSlug: slug.nullable(),
+    surface: surfaceName,
+    region: hostnameRegion,
+    status: hostnameStatus,
+    /** Why it failed, when it did. Null otherwise. */
+    statusNote: z.string().nullable(),
+    /**
+     * The one hostname a surface redirects to and issues certs for. Exactly one per
+     * (scope, surface) may hold it — the rest are aliases.
+     */
+    canonical: z.boolean(),
+    createdAt: instant,
+});
+export const bindHostnameInput = hostnameBinding.pick({
+    hostname: true,
+    tenantId: true,
+    scopeId: true,
+    surface: true,
+    region: true,
+    canonical: true,
+});
+/**
+ * What the router needs to dispatch. Deliberately smaller than the full binding: a
+ * per-request hot path should read what it uses and nothing else.
+ */
+export const routeTarget = z.object({
+    tenantId,
+    scopeId,
+    verticalSlug: slug.nullable(),
+    surface: surfaceName,
+    region: hostnameRegion,
+});
+//# sourceMappingURL=routing.js.map

package/dist/routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5D;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,uEAAuE;IACvE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;CACvB,CAAC,CAAC"}

package/dist/tenancy.d.ts

@@ -117,6 +117,7 @@ export declare const scope: z.ZodObject<{
         eu: "eu";
     }>>;
     vertical: z.ZodNullable<z.ZodString>;
+    verticalVersionId: z.ZodNullable<z.ZodString>;
     schemaVersion: z.ZodString;
     migrationFailure: z.ZodNullable<z.ZodObject<{
         version: z.ZodString;

package/dist/tenancy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;;EAA8C,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM;;;;;;;;;;iBAMjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAI5C,eAAO,MAAM,iBAAiB;;;;iBAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,GAAG;;;;;;iBAMd,CAAC;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;AAGtC,eAAO,MAAM,cAAc;;;;;iBAAiE,CAAC;AAC7F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,WAAW;;;;;;EAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;EAAqB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,YAAY;;GAA4B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB;;;;;kBAOhB,CAAC;AACd,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;;EAA8C,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM;;;;;;;;;;iBAMjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAI5C,eAAO,MAAM,iBAAiB;;;;iBAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,GAAG;;;;;;iBAMd,CAAC;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;AAGtC,eAAO,MAAM,cAAc;;;;;iBAAiE,CAAC;AAC7F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,WAAW;;;;;;EAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;EAAqB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,YAAY;;GAA4B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB;;;;;kBAOhB,CAAC;AACd,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgChB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/dist/tenancy.js

@@ -88,6 +88,15 @@ export const scope = z.object({
     // audit log's `vertical` target real for scope-lifecycle actions, and what
     // console item 1 means by "which vertical each scope runs".
     vertical: z.string().min(1).nullable(),
+    /**
+     * The registered version this scope runs (#31). Null for a scope provisioned
+     * before the registry, or bound to a vertical we ship but have not versioned.
+     *
+     * Kept ALONGSIDE `vertical` rather than replacing it: the slug is what the audit
+     * log's target and the console's filters read, and a denormalized label that
+     * survives a version being superseded is worth more than one join.
+     */
+    verticalVersionId: z.string().min(1).nullable(),
     // The scope's migration state: the count of applied (module, version) pairs,
     // as a string. Written host-side after migrations apply — never caller-supplied.
     // '0' means "provisioned, nothing applied yet". Comparing it against the host's

package/dist/tenancy.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,KAAK;IACT,QAAQ;IACR,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kCAAkC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,6CAA6C;IACpF,aAAa,EAAE,OAAO;CACvB,CAAC;KACD,QAAQ,EAAE,CAAC;AAGd,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,OAAO,EAAE,6EAA6E;IAC1F,QAAQ;IACR,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,4DAA4D;IAC/F,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qEAAqE;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,YAAY;IACZ,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB;IAChB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC"}
+{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,KAAK;IACT,QAAQ;IACR,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kCAAkC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,6CAA6C;IACpF,aAAa,EAAE,OAAO;CACvB,CAAC;KACD,QAAQ,EAAE,CAAC;AAGd,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,OAAO,EAAE,6EAA6E;IAC1F,QAAQ;IACR,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,4DAA4D;IAC/F,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qEAAqE;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,YAAY;IACZ,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC;;;;;;;OAOG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB;IAChB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {