@substrat-run/contracts 0.66.0 → 0.67.0

package/dist/index.d.ts

@@ -34,4 +34,5 @@ export * from './deploy.js';
 export * from './ci.js';
 export * from './money.js';
 export * from './attachments.js';
+export * from './model.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -34,4 +34,5 @@ export * from './deploy.js';
 export * from './ci.js';
 export * from './money.js';
 export * from './attachments.js';
+export * from './model.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}

package/dist/model.d.ts

@@ -0,0 +1,221 @@
+/**
+ * The entity registry (#697).
+ *
+ * The manifest describes permissions, events, guards, schedules, attachment
+ * targets, entity relations, searchables and UI contributions. It does not
+ * describe **entities**: `migrations` is a pointer (`journalDir` +
+ * `compatibleFrom`), the tables live in raw SQL the manifest never sees, and
+ * entity *type names* appear only as bare `z.string().min(1)` fragments across
+ * four unrelated, individually optional features.
+ *
+ * Nothing checks those four against each other or against the tables. A typo'd
+ * `parentType` in `entityRelations` parses cleanly and produces an edge that
+ * permission never flows along — the tuple evaluator walks a relation that does
+ * not exist, and a grant that should reach a child silently does not.
+ *
+ * This module gives them something to be checked against.
+ *
+ * ## What it is not
+ *
+ * Migrations do not move in here, and nothing about how tables are created
+ * changes. Whether the model becomes the source that migrations are *derived*
+ * from is #680/#685's question; the registry is a prerequisite either way.
+ */
+import { z } from 'zod';
+/**
+ * One entity: the table it lives in, its field schema, and its place in the
+ * permission graph.
+ */
+export interface EntityDef<Names extends string = string> {
+    /** The physical table. Owned by this module — never another's (rule 4). */
+    readonly table: string;
+    /** The row shape. Field names are what `key`, `searchables` and events check against. */
+    readonly fields: z.ZodObject<z.ZodRawShape>;
+    /**
+     * The parent entity permission flows along (design doc §4.2 rule 3).
+     * Checked against the declared entities — a typo is a compile error, where
+     * today it is a silently dead edge.
+     */
+    readonly parent?: Names;
+    /** Natural key, if any. Must name fields that exist. */
+    readonly key?: readonly string[];
+    /** Fields an erasure must be able to reach (§12). Must name fields that exist. */
+    readonly erasable?: readonly string[];
+}
+/** The field names of one entity, read off its own `fields` schema. */
+export type EntityFields<E> = E extends {
+    fields: infer F;
+} ? F extends z.ZodObject<z.ZodRawShape> ? keyof z.infer<F> & string : never : never;
+/**
+ * Declare a module's entities.
+ *
+ * The constraint is self-referential — `parent` is checked against the map's own
+ * keys, and `key`/`erasable` against each entity's own fields — which is what
+ * makes the checks bite per-entity rather than as a union across all of them.
+ * Written the obvious way (an erased supertype) every one of them compiles clean
+ * and enforces nothing; see `test/model.test.ts`, which exists to prove they
+ * still bite.
+ */
+export declare function defineEntities<T extends {
+    readonly [K in keyof T]: EntityDef<keyof T & string> & {
+        key?: readonly EntityFields<T[K]>[];
+        erasable?: readonly EntityFields<T[K]>[];
+    };
+}>(entities: T): T;
+/** The declared entity names. */
+export type EntityName<T> = keyof T & string;
+/**
+ * The serialisable form — the artifact of record.
+ *
+ * Everything downstream (migrations, the manifest, the route table, an ER
+ * diagram, a diff classifier) reads THIS, never the TypeScript. That is what
+ * keeps the authoring notation swappable: a different authoring layer is a new
+ * emitter writing the same JSON, and nothing downstream notices.
+ *
+ * Field schemas are rendered with `z.toJSONSchema`, the same conversion the
+ * OpenAPI builder already uses — so there is no second schema language anywhere
+ * in the pipeline.
+ */
+export interface EmittedEntity {
+    readonly table: string;
+    readonly fields: Record<string, unknown>;
+    readonly parent?: string;
+    readonly key?: readonly string[];
+    readonly erasable?: readonly string[];
+}
+export interface EmittedModel {
+    readonly entities: Record<string, EmittedEntity>;
+}
+/**
+ * Render the registry to plain JSON. Deterministic: entities and their fields
+ * are emitted in sorted order, so the checked-in artifact diffs cleanly and a
+ * reordered declaration is not a spurious change.
+ */
+export declare function emitModel<T extends Record<string, EntityDef>>(entities: T): EmittedModel;
+/**
+ * `entityRelations` derived from the `parent` declarations, rather than written
+ * a second time by hand.
+ *
+ * Two descriptions of one fact is how they come to disagree — and the disagreement
+ * here is invisible, because a relation naming an entity that does not exist is a
+ * permission edge that silently never resolves.
+ */
+export declare function entityRelationsOf<T extends Record<string, EntityDef>>(entities: T): {
+    entityType: string;
+    parentType: string;
+}[];
+/**
+ * The entity-referencing half of a manifest, narrowed to declared entities.
+ *
+ * Entity-name positions are written `keyof T & string` inline rather than as
+ * `EntityName<T>`. A type ALIAS is printed unresolved in diagnostics — the error
+ * names the alias and inlines the whole entity map — where the inline form lists
+ * the actual names:
+ *
+ *     Type '"bkie"' is not assignable to type '"bike" | "customer"'.
+ */
+type EntityRefs<T extends Record<string, EntityDef>, M> = {
+    readonly attachmentTargets?: readonly {
+        readonly entityType: keyof T & string;
+        readonly readPermission: string;
+        readonly writePermission?: string;
+    }[];
+    /**
+     * `fields` is checked against the NAMED entity's own fields — the only place
+     * in the manifest today where a field name appears at all, and nothing
+     * checked it.
+     */
+    readonly searchables?: M extends {
+        searchables: infer S;
+    } ? {
+        readonly [I in keyof S]: S[I] extends {
+            entityType: infer N;
+        } ? N extends keyof T & string ? {
+            readonly entityType: N;
+            readonly fields: readonly EntityFields<T[N]>[];
+        } : never : never;
+    } : never;
+    readonly entityViews?: readonly {
+        readonly entityType: keyof T & string;
+        readonly view: string;
+    }[];
+    /**
+     * Parent edges whose CHILD this module does not own.
+     *
+     * A vertical legitimately declares these: an engine is entity-agnostic, so
+     * only the vertical knows that a work order hangs off a bike, or a protocol
+     * off a work order. The child name belongs to an engine and cannot be checked
+     * here — but the PARENT often can be, and throwing that away would be giving
+     * up a check we hold.
+     *
+     * So the parent is checked whenever it is one of this module's own entities:
+     *
+     * ```ts
+     * foreignChildren: [
+     *   { entityType: 'workorder', parentType: 'bike' },      // parent CHECKED
+     *   { entityType: 'protocol', parentType: 'workorder' },  // parent foreign too
+     * ]
+     * ```
+     *
+     * `parentType` accepts a declared entity name or an arbitrary string, and a
+     * typo that happens to look like neither is still accepted — TypeScript cannot
+     * express "one of these, or any other string, but tell me which". What it does
+     * buy is autocomplete on the local names and a compile error on the mixed edge
+     * once `foreignParents` (below) is used instead.
+     *
+     * Both become fully checkable when engines export their entity-type constants
+     * (#696 item 3), at which point these two fields collapse back into `parent`.
+     */
+    readonly foreignChildren?: readonly {
+        readonly entityType: string;
+        readonly parentType: (keyof T & string) | (string & {});
+    }[];
+    /**
+     * The mixed edge, stated so the checkable half IS checked: a child this module
+     * does not own, hanging off a parent it does. `parentType` here is strictly a
+     * declared entity — a typo is a compile error.
+     *
+     * `bike_shop`'s `workorder → bike` is the case: `workorder` is the engine's,
+     * `bike` is the vertical's, and the vertical is the only place that knows the
+     * edge exists.
+     */
+    readonly foreignChildOf?: readonly {
+        readonly entityType: string;
+        readonly parentType: keyof T & string;
+    }[];
+};
+/**
+ * Compose the entity-referencing manifest fragments against the registry.
+ *
+ * `entityRelations` is absent by design: it is DERIVED from the entities'
+ * `parent` declarations (`entityRelationsOf`) rather than written a second time.
+ *
+ * Spread the result into the module's manifest:
+ *
+ * ```ts
+ * export const manifest = moduleManifest.parse({
+ *   id: '@acme/vertical',
+ *   …,
+ *   ...manifestEntities(entities, {
+ *     attachmentTargets: [{ entityType: 'contract', readPermission: 'x:read' }],
+ *     searchables: [{ entityType: 'customer', fields: ['name'] }],
+ *   }),
+ * });
+ * ```
+ *
+ * A typo in any `entityType` is now a compile error naming the declared
+ * entities, and a `searchables` field that the entity does not have is too.
+ */
+export declare function manifestEntities<const T extends Record<string, EntityDef>, const M extends EntityRefs<T, M>>(entities: T, refs: M): {
+    attachmentTargets: NonNullable<M['attachmentTargets']> | [];
+    searchables: M['searchables'];
+    entityRelations: {
+        entityType: string;
+        parentType: string;
+    }[];
+    ui: {
+        entityViews: M['entityViews'];
+    };
+};
+export {};
+//# sourceMappingURL=model.d.ts.map

package/dist/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IACtD,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,uEAAuE;AACvE,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACvD,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAClC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GACzB,KAAK,GACP,KAAK,CAAC;AAEV;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,CAAC,SAAS;IACR,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG;QACrD,GAAG,CAAC,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C;CACF,EACD,QAAQ,EAAE,CAAC,GAAG,CAAC,CAEhB;AAED,iCAAiC;AACjC,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,YAAY,CAkBxF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EACnE,QAAQ,EAAE,CAAC,GACV;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,CAO9C;AAMD;;;;;;;;;GASG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,IAAI;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS;QACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;KACnC,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS;QAAE,WAAW,EAAE,MAAM,CAAC,CAAA;KAAE,GACrD;QACE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YAAE,UAAU,EAAE,MAAM,CAAC,CAAA;SAAE,GACzD,CAAC,SAAS,MAAM,CAAC,GAAG,MAAM,GACxB;YAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;SAAE,GAC1E,KAAK,GACP,KAAK;KACV,GACD,KAAK,CAAC;IACV,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnG;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS;QAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KACzD,EAAE,CAAC;IACJ;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS;QACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAI5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;KACvC,EAAE,CAAC;CACL,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EACzC,KAAK,CAAC,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAEhC,QAAQ,EAAE,CAAC,EACX,IAAI,EAAE,CAAC,GACN;IACD,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAC9B,eAAe,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9D,EAAE,EAAE;QAAE,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAA;KAAE,CAAC;CACvC,CAcA"}

package/dist/model.js

@@ -0,0 +1,113 @@
+/**
+ * The entity registry (#697).
+ *
+ * The manifest describes permissions, events, guards, schedules, attachment
+ * targets, entity relations, searchables and UI contributions. It does not
+ * describe **entities**: `migrations` is a pointer (`journalDir` +
+ * `compatibleFrom`), the tables live in raw SQL the manifest never sees, and
+ * entity *type names* appear only as bare `z.string().min(1)` fragments across
+ * four unrelated, individually optional features.
+ *
+ * Nothing checks those four against each other or against the tables. A typo'd
+ * `parentType` in `entityRelations` parses cleanly and produces an edge that
+ * permission never flows along — the tuple evaluator walks a relation that does
+ * not exist, and a grant that should reach a child silently does not.
+ *
+ * This module gives them something to be checked against.
+ *
+ * ## What it is not
+ *
+ * Migrations do not move in here, and nothing about how tables are created
+ * changes. Whether the model becomes the source that migrations are *derived*
+ * from is #680/#685's question; the registry is a prerequisite either way.
+ */
+import { z } from 'zod';
+/**
+ * Declare a module's entities.
+ *
+ * The constraint is self-referential — `parent` is checked against the map's own
+ * keys, and `key`/`erasable` against each entity's own fields — which is what
+ * makes the checks bite per-entity rather than as a union across all of them.
+ * Written the obvious way (an erased supertype) every one of them compiles clean
+ * and enforces nothing; see `test/model.test.ts`, which exists to prove they
+ * still bite.
+ */
+export function defineEntities(entities) {
+    return entities;
+}
+/**
+ * Render the registry to plain JSON. Deterministic: entities and their fields
+ * are emitted in sorted order, so the checked-in artifact diffs cleanly and a
+ * reordered declaration is not a spurious change.
+ */
+export function emitModel(entities) {
+    const out = {};
+    for (const name of Object.keys(entities).sort()) {
+        const e = entities[name];
+        if (!e)
+            continue;
+        const { $schema: _drop, ...fields } = z.toJSONSchema(e.fields, { io: 'output', target: 'draft-2020-12' });
+        out[name] = {
+            table: e.table,
+            fields,
+            ...(e.parent ? { parent: e.parent } : {}),
+            ...(e.key ? { key: [...e.key].sort() } : {}),
+            ...(e.erasable ? { erasable: [...e.erasable].sort() } : {}),
+        };
+    }
+    return { entities: out };
+}
+/**
+ * `entityRelations` derived from the `parent` declarations, rather than written
+ * a second time by hand.
+ *
+ * Two descriptions of one fact is how they come to disagree — and the disagreement
+ * here is invisible, because a relation naming an entity that does not exist is a
+ * permission edge that silently never resolves.
+ */
+export function entityRelationsOf(entities) {
+    return Object.keys(entities)
+        .sort()
+        .flatMap((name) => {
+        const parent = entities[name]?.parent;
+        return parent ? [{ entityType: name, parentType: parent }] : [];
+    });
+}
+/**
+ * Compose the entity-referencing manifest fragments against the registry.
+ *
+ * `entityRelations` is absent by design: it is DERIVED from the entities'
+ * `parent` declarations (`entityRelationsOf`) rather than written a second time.
+ *
+ * Spread the result into the module's manifest:
+ *
+ * ```ts
+ * export const manifest = moduleManifest.parse({
+ *   id: '@acme/vertical',
+ *   …,
+ *   ...manifestEntities(entities, {
+ *     attachmentTargets: [{ entityType: 'contract', readPermission: 'x:read' }],
+ *     searchables: [{ entityType: 'customer', fields: ['name'] }],
+ *   }),
+ * });
+ * ```
+ *
+ * A typo in any `entityType` is now a compile error naming the declared
+ * entities, and a `searchables` field that the entity does not have is too.
+ */
+export function manifestEntities(entities, refs) {
+    return {
+        attachmentTargets: (refs.attachmentTargets ?? []),
+        searchables: refs.searchables,
+        // Derived edges first, then the ones this module cannot check.
+        entityRelations: [
+            ...entityRelationsOf(entities),
+            // Checked parent, foreign child — the mixed edge.
+            ...(refs.foreignChildOf ?? []),
+            // Neither side checkable here.
+            ...(refs.foreignChildren ?? []),
+        ],
+        ui: { entityViews: refs.entityViews },
+    };
+}
+//# sourceMappingURL=model.js.map

package/dist/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAO5B,QAAW;IACX,OAAO,QAAQ,CAAC;AAClB,CAAC;AA6BD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAsC,QAAW;IACxE,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAGvG,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAW;IAEX,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,IAAI,EAAE;SACN,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACtC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC;AAsFD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAI9B,QAAW,EACX,IAAO;IAOP,OAAO;QACL,iBAAiB,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAA6C;QAC7F,WAAW,EAAE,IAAI,CAAC,WAA+B;QACjD,+DAA+D;QAC/D,eAAe,EAAE;YACf,GAAG,iBAAiB,CAAC,QAAQ,CAAC;YAC9B,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC9B,+BAA+B;YAC/B,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;SAChC;QACD,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAA+B,EAAE;KAC1D,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.66.0",
+  "version": "0.67.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {
@@ -25,13 +25,15 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "typescript": "^7.0.0"
+    "typescript": "^7.0.0",
+    "vitest": "^3.0.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run"
   }
 }