@substrat-run/control-plane-api 0.4.0

package/dist/api.d.ts

@@ -0,0 +1,44 @@
+import { Hono } from 'hono';
+import type { PlatformActorId } from '@substrat-run/contracts';
+import type { ScopeHost } from '@substrat-run/kernel';
+import type { PlatformActorAuth } from './auth.js';
+export interface ControlPlaneApiOptions {
+    host: ScopeHost;
+    /**
+     * Resolves the platform actor from the request. No default: an unauthenticated
+     * control plane is not a sensible fallback, and a package that shipped one
+     * would eventually be deployed with it (control-plane.md §6).
+     */
+    authenticate: PlatformActorAuth;
+}
+type Vars = {
+    actor: PlatformActorId;
+};
+/**
+ * The audited HTTP surface over `HostAdmin` (control-plane.md §4.5).
+ *
+ * This is the OUT-OF-BAND control plane §3 argues for: it is not module code, it
+ * never receives a `ctx`, and it never runs in a scope's serialization domain —
+ * so `boundary-lint` is untouched (§7). It is one router over the kernel seam,
+ * mounted by whichever transport is hosting it (a Node server locally, a Worker
+ * holding the `controlPlane` binding on Cloudflare).
+ *
+ * Two rules hold everywhere below, and they are the reason this can exist at all:
+ *
+ * 1. **The actor comes from the authenticated request, never the body.** §4.4:
+ *    every field of an audit row except before/after is stamped platform-side,
+ *    "never supplied by the caller". A route that read an actor from JSON would
+ *    make the entire trail forgeable, which is the one thing that must not be
+ *    retrofitted (K-20). Note there is no route here that accepts an `actor`
+ *    field at all — it is unrepresentable, not merely ignored.
+ * 2. **Reads are exposed; enforcement writes are not.** defineRole / assignRole /
+ *    grant / grantToOrg / addMember / linkIdentity are on `HostAdmin` but get no
+ *    route: the console's v1 job is the tenant registry, lifecycle, entitlements
+ *    and history. `resolveIdentity` especially stays off — it is the auth
+ *    adapter's read path, not an admin surface.
+ */
+export declare function createControlPlaneApi(options: ControlPlaneApiOptions): Hono<{
+    Variables: Vars;
+}>;
+export {};
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAY5B,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAGnD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;CACjC;AAED,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AAkDvC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAwJhG"}

package/dist/api.js

@@ -0,0 +1,202 @@
+import { Hono } from 'hono';
+import { adminAction, createTenantInput, jurisdiction, scopeId as scopeIdSchema, scopeStatus, storageShape, tenantId as tenantIdSchema, tenantStatus, z, } from '@substrat-run/contracts';
+import { mapError } from './errors.js';
+// -- request schemas ---------------------------------------------------------
+// Parse, don't trust: every input crosses Zod at the boundary. The ids stay
+// CALLER-SUPPLIED rather than minted here, exactly as the contract has them —
+// that is what keeps `createTenant`/`provisionScope` idempotent (§3.3: "safe to
+// re-run"). Minting server-side would be friendlier and would silently turn a
+// retry into a second tenant. This surface is a transport; it does not invent
+// semantics on top of HostAdmin.
+const provisionScopeBody = z.object({
+    tenantId: tenantIdSchema,
+    scopeId: scopeIdSchema,
+    slug: z.string().optional(),
+    kind: z.string().optional(),
+    name: z.string().optional(),
+    vertical: z.string().nullable().optional(),
+    storageShape: storageShape.optional(),
+    jurisdiction: jurisdiction.optional(),
+});
+const setTenantStatusBody = z.object({ status: tenantStatus });
+/** Repeatable query params arrive as `?status=active&status=suspended`. */
+const listScopesQuery = z.object({
+    tenantId: tenantIdSchema.optional(),
+    status: z.array(scopeStatus).optional(),
+    vertical: z.string().optional(),
+});
+const listRolesQuery = z.object({
+    tenantId: tenantIdSchema.optional(),
+    // Free-form: a module id or 'vertical'. Not narrowed to the source union here
+    // — an unknown source should return nothing, not 400. The console offers only
+    // sources it has seen.
+    source: z.string().optional(),
+});
+const auditLogQuery = z.object({
+    tenantId: tenantIdSchema.optional(),
+    scopeId: scopeIdSchema.optional(),
+    actor: z.string().optional(),
+    action: z.array(adminAction).optional(),
+    since: z.string().optional(),
+    until: z.string().optional(),
+    limit: z.coerce.number().int().positive().max(1000).optional(),
+    cursor: z.string().optional(),
+    order: z.enum(['asc', 'desc']).optional(),
+});
+/**
+ * The audited HTTP surface over `HostAdmin` (control-plane.md §4.5).
+ *
+ * This is the OUT-OF-BAND control plane §3 argues for: it is not module code, it
+ * never receives a `ctx`, and it never runs in a scope's serialization domain —
+ * so `boundary-lint` is untouched (§7). It is one router over the kernel seam,
+ * mounted by whichever transport is hosting it (a Node server locally, a Worker
+ * holding the `controlPlane` binding on Cloudflare).
+ *
+ * Two rules hold everywhere below, and they are the reason this can exist at all:
+ *
+ * 1. **The actor comes from the authenticated request, never the body.** §4.4:
+ *    every field of an audit row except before/after is stamped platform-side,
+ *    "never supplied by the caller". A route that read an actor from JSON would
+ *    make the entire trail forgeable, which is the one thing that must not be
+ *    retrofitted (K-20). Note there is no route here that accepts an `actor`
+ *    field at all — it is unrepresentable, not merely ignored.
+ * 2. **Reads are exposed; enforcement writes are not.** defineRole / assignRole /
+ *    grant / grantToOrg / addMember / linkIdentity are on `HostAdmin` but get no
+ *    route: the console's v1 job is the tenant registry, lifecycle, entitlements
+ *    and history. `resolveIdentity` especially stays off — it is the auth
+ *    adapter's read path, not an admin surface.
+ */
+export function createControlPlaneApi(options) {
+    const { host, authenticate } = options;
+    const admin = host.admin;
+    const app = new Hono();
+    // Fail closed, before any route runs: no actor, no reach.
+    app.use('*', async (c, next) => {
+        const actor = await authenticate(c.req.raw);
+        if (!actor)
+            return c.json({ error: 'unauthenticated' }, 401);
+        c.set('actor', actor);
+        await next();
+    });
+    // One error boundary for every route: adapters throw plain Errors, and each
+    // one is a fail-closed refusal that must reach the caller as a status, not a
+    // stack trace.
+    app.onError((err, c) => {
+        if (err instanceof z.ZodError) {
+            return c.json({ error: 'invalid request', issues: err.issues }, 400);
+        }
+        const { status, body } = mapError(err);
+        return c.json(body, status);
+    });
+    // -- tenant registry (§4.1) ------------------------------------------------
+    app.get('/tenants', async (c) => c.json(await admin.listTenants()));
+    app.post('/tenants', async (c) => {
+        const input = createTenantInput.parse(await c.req.json());
+        await admin.createTenant(c.get('actor'), input);
+        // Idempotent (§4.1): re-creating an existing tenant is a no-op, not an error,
+        // so this reads back rather than reporting a create that may not have happened.
+        return c.json(await admin.getTenant(input.id), 201);
+    });
+    app.get('/tenants/:tenantId', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const tenant = await admin.getTenant(tenantId);
+        if (!tenant)
+            return c.json({ error: `unknown tenant: ${tenantId}` }, 404);
+        return c.json(tenant);
+    });
+    app.patch('/tenants/:tenantId/status', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const { status } = setTenantStatusBody.parse(await c.req.json());
+        // The live weapon (§7): `suspended` fails getScope closed for EVERY scope
+        // under the tenant. The blast radius is the console's to show; the audit row
+        // is this layer's to guarantee.
+        await admin.setTenantStatus(c.get('actor'), tenantId, status);
+        return c.json(await admin.getTenant(tenantId));
+    });
+    // -- entitlements (§4.3) ---------------------------------------------------
+    app.get('/tenants/:tenantId/entitlements', async (c) => c.json(await admin.listEntitlements(tenantIdSchema.parse(c.req.param('tenantId')))));
+    app.put('/tenants/:tenantId/entitlements/:key', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        await admin.grantEntitlement(c.get('actor'), tenantId, c.req.param('key'));
+        return c.json(await admin.listEntitlements(tenantId));
+    });
+    app.delete('/tenants/:tenantId/entitlements/:key', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        await admin.revokeEntitlement(c.get('actor'), tenantId, c.req.param('key'));
+        return c.json(await admin.listEntitlements(tenantId));
+    });
+    // -- the scope directory (§3.2/§4.2) ---------------------------------------
+    app.get('/scopes', async (c) => {
+        const filter = listScopesQuery.parse({
+            tenantId: c.req.query('tenantId'),
+            status: c.req.queries('status'),
+            vertical: c.req.query('vertical'),
+        });
+        return c.json(await admin.listScopes(filter));
+    });
+    app.post('/scopes', async (c) => {
+        const input = provisionScopeBody.parse(await c.req.json());
+        await host.provisionScope(c.get('actor'), input);
+        const record = await admin.getScopeRecord(input.tenantId, input.scopeId);
+        return c.json(record, 201);
+    });
+    app.get('/tenants/:tenantId/scopes/:scopeId', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const record = await admin.getScopeRecord(tenantId, scopeId);
+        // Absent, or present under another tenant — indistinguishable on purpose (K-3).
+        if (!record)
+            return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
+        return c.json(record);
+    });
+    // The four lifecycle transitions, one route each — mirroring the four audited
+    // actions rather than collapsing into a PATCH that would accept a target
+    // status the transition graph forbids. The graph is enforced below the seam;
+    // an illegal transition surfaces as a 409.
+    const transitions = {
+        suspend: (a, t, s) => admin.suspendScope(a, t, s),
+        unsuspend: (a, t, s) => admin.unsuspendScope(a, t, s),
+        archive: (a, t, s) => admin.archiveScope(a, t, s),
+        unarchive: (a, t, s) => admin.unarchiveScope(a, t, s),
+    };
+    for (const [action, run] of Object.entries(transitions)) {
+        app.post(`/tenants/:tenantId/scopes/:scopeId/${action}`, async (c) => {
+            const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+            const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+            await run(c.get('actor'), tenantId, scopeId);
+            return c.json(await admin.getScopeRecord(tenantId, scopeId));
+        });
+    }
+    // -- roles, read only (§4.5 console item 4) --------------------------------
+    // The READ lands; `defineRole` deliberately does not. Creating a role over
+    // HTTP is a permission change, and the permission diff is a human checkpoint
+    // (D-22/D-29) — that surface needs its own decision, not a route added because
+    // the verb was adjacent.
+    app.get('/roles', async (c) => {
+        const filter = listRolesQuery.parse({
+            tenantId: c.req.query('tenantId'),
+            source: c.req.query('source'),
+        });
+        return c.json(await admin.listRoles(filter));
+    });
+    // -- the admin log (§4.4/§4.5) ---------------------------------------------
+    app.get('/admin-log', async (c) => {
+        const filter = auditLogQuery.parse({
+            tenantId: c.req.query('tenantId'),
+            scopeId: c.req.query('scopeId'),
+            actor: c.req.query('actor'),
+            action: c.req.queries('action'),
+            since: c.req.query('since'),
+            until: c.req.query('until'),
+            limit: c.req.query('limit'),
+            cursor: c.req.query('cursor'),
+            order: c.req.query('order'),
+        });
+        const entries = await admin.auditLog(filter);
+        // The cursor IS the last entry's id (ULID order is chronological), so the
+        // page carries its own continuation and the console never assembles one.
+        return c.json({ entries, nextCursor: entries.at(-1)?.id ?? null });
+    });
+    return app;
+}
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,OAAO,IAAI,aAAa,EACxB,WAAW,EACX,YAAY,EACZ,QAAQ,IAAI,cAAc,EAC1B,YAAY,EACZ,CAAC,GACF,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcvC,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,iCAAiC;AAEjC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,8EAA8E;IAC9E,8EAA8E;IAC9E,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAuB,CAAC;IAE5C,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,eAAe;IACf,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEpE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAChD,8EAA8E;QAC9E,gFAAgF;QAChF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,0EAA0E;QAC1E,6EAA6E;QAC7E,gCAAgC;QAChC,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACrD,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CACpF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC;YACnC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC/B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAmD,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,gFAAgF;QAChF,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,QAAQ,KAAK,OAAO,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,CAAC,CAAkB,EAAE,CAAW,EAAE,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACrF,SAAS,EAAE,CAAC,CAAkB,EAAE,CAAW,EAAE,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,CAAC,CAAkB,EAAE,CAAW,EAAE,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACrF,SAAS,EAAE,CAAC,CAAkB,EAAE,CAAW,EAAE,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;KACjF,CAAC;IAEX,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,+EAA+E;IAC/E,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC;YAClC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;YACjC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC/B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC7B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAA8C,CAAC,CAAC;QACrF,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,39 @@
+import { type PlatformActorId } from '@substrat-run/contracts';
+/**
+ * The identity seam for the control plane (control-plane.md §6).
+ *
+ * The data model needs to know THAT there is an actor, not HOW it authenticated
+ * — so this whole surface is buildable and testable against a stub while real
+ * staff auth (SSO, MFA, short sessions, a small closed population) is designed.
+ * D-16 commits to identity being a swappable adapter; this is that being cashed
+ * in for platform staff rather than tenant users.
+ *
+ * Returning null means "not authenticated" and the request is refused. There is
+ * no "anonymous actor" — §4.4's whole point is that a surface which can act
+ * without a durable record of WHO acted is worse than no surface, and an actor
+ * the log cannot name is exactly that.
+ */
+export type PlatformActorAuth = (request: Request) => Promise<PlatformActorId | null> | PlatformActorId | null;
+/** Header the dev stub reads. Mirrors the demos' `x-principal` dev affordance. */
+export declare const DEV_ACTOR_HEADER = "x-platform-actor";
+/**
+ * A dev stub that trusts an `x-platform-actor` header verbatim.
+ *
+ * UNSAFE_ by name, deliberately — it is the same convention the kernel uses for
+ * `UNSAFE_allowAllChecker`, and for the same reason: an unsafe default that is
+ * merely *documented* gets shipped, while one that must be typed out in the
+ * caller's own code gets noticed in review.
+ *
+ * **Never expose this on a non-local listener.** control-plane.md §6: real auth
+ * gates EXPOSING the console, not BUILDING it — nothing with cross-tenant reach
+ * goes anywhere non-local on a stub. The demos' `x-principal` header is a dev
+ * affordance for ONE tenant's principal; this header names a subject with reach
+ * across every tenant on the platform, so "a super-admin on top of it is a
+ * liability, not a milestone".
+ *
+ * It still parses: a header that is not a ULID is rejected rather than written
+ * into the audit log, because a malformed actor makes the trail unreadable
+ * exactly when it matters.
+ */
+export declare function UNSAFE_devPlatformActorAuth(): PlatformActorAuth;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE/G,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,IAAI,iBAAiB,CAO/D"}

package/dist/auth.js

@@ -0,0 +1,32 @@
+import { platformActorId } from '@substrat-run/contracts';
+/** Header the dev stub reads. Mirrors the demos' `x-principal` dev affordance. */
+export const DEV_ACTOR_HEADER = 'x-platform-actor';
+/**
+ * A dev stub that trusts an `x-platform-actor` header verbatim.
+ *
+ * UNSAFE_ by name, deliberately — it is the same convention the kernel uses for
+ * `UNSAFE_allowAllChecker`, and for the same reason: an unsafe default that is
+ * merely *documented* gets shipped, while one that must be typed out in the
+ * caller's own code gets noticed in review.
+ *
+ * **Never expose this on a non-local listener.** control-plane.md §6: real auth
+ * gates EXPOSING the console, not BUILDING it — nothing with cross-tenant reach
+ * goes anywhere non-local on a stub. The demos' `x-principal` header is a dev
+ * affordance for ONE tenant's principal; this header names a subject with reach
+ * across every tenant on the platform, so "a super-admin on top of it is a
+ * liability, not a milestone".
+ *
+ * It still parses: a header that is not a ULID is rejected rather than written
+ * into the audit log, because a malformed actor makes the trail unreadable
+ * exactly when it matters.
+ */
+export function UNSAFE_devPlatformActorAuth() {
+    return (request) => {
+        const raw = request.headers.get(DEV_ACTOR_HEADER);
+        if (!raw)
+            return null;
+        const parsed = platformActorId.safeParse(raw);
+        return parsed.success ? parsed.data : null;
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAwB,MAAM,yBAAyB,CAAC;AAkBhF,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,9 @@
+import type { ContentfulStatusCode } from 'hono/utils/http-status';
+export interface ApiError {
+    status: ContentfulStatusCode;
+    body: {
+        error: string;
+    };
+}
+export declare function mapError(err: unknown): ApiError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AA6CnE,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzB;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAM/C"}

package/dist/errors.js

@@ -0,0 +1,51 @@
+/**
+ * Map an adapter throw onto an HTTP status.
+ *
+ * `HostAdmin` throws plain `Error`s — deliberately, so their messages survive
+ * the Cloudflare RPC hop intact (a ZodError would not). That leaves this layer
+ * matching on message text, which is the weakest seam in this package and worth
+ * naming rather than hiding:
+ *
+ * - It is less brittle than it looks. Every pattern below is a message the
+ *   CONTRACT SUITE asserts on (`/unknown tenant/`, `/illegal scope transition/`,
+ *   `/already taken/`, `/not active/`), against both adapters. Changing one
+ *   turns a contract test red, not just this mapping.
+ * - It is still text. The durable fix is typed errors on `HostAdmin` — a tagged
+ *   union the adapters throw and this reads. That is a kernel change, and it is
+ *   not worth blocking the transport on.
+ *
+ * Anything unmatched is a 500 with a GENERIC body: an unrecognised throw is, by
+ * definition, one whose message we have not reviewed for what it discloses, and
+ * this surface has cross-tenant reach.
+ */
+/**
+ * ORDER IS SIGNIFICANT — first match wins, so every specific pattern must precede
+ * the general one it would otherwise be swallowed by. `cannot provision scope
+ * under unknown tenant` contains `unknown tenant:`, and listing the general one
+ * first turned a precondition conflict into a 404 claiming POST /scopes does not
+ * exist. That is the message-matching fragility this file admits to above, caught
+ * by the test below rather than by reading.
+ */
+const STATUS_PATTERNS = [
+    // Well-formed, but conflicts with current state or references something absent.
+    // The addressed collection exists; the request cannot be applied to it.
+    [/cannot provision scope under unknown tenant/, 409],
+    [/already taken/, 409],
+    [/illegal scope transition/, 409],
+    [/non-active tenant/, 409],
+    [/not active \(status:/, 409],
+    // The ADDRESSED resource does not exist — including the K-3 fail-closed case
+    // where it exists under a DIFFERENT tenant and must read as absent.
+    [/unknown tenant:/, 404],
+    [/unknown scope for tenant/, 404],
+    [/scope has no tenant record/, 404],
+];
+export function mapError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    for (const [pattern, status] of STATUS_PATTERNS) {
+        if (pattern.test(message))
+            return { status, body: { error: message } };
+    }
+    return { status: 500, body: { error: 'internal error' } };
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;GAOG;AACH,MAAM,eAAe,GAA8C;IACjE,gFAAgF;IAChF,wEAAwE;IACxE,CAAC,6CAA6C,EAAE,GAAG,CAAC;IACpD,CAAC,eAAe,EAAE,GAAG,CAAC;IACtB,CAAC,0BAA0B,EAAE,GAAG,CAAC;IACjC,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAC1B,CAAC,sBAAsB,EAAE,GAAG,CAAC;IAC7B,6EAA6E;IAC7E,oEAAoE;IACpE,CAAC,iBAAiB,EAAE,GAAG,CAAC;IACxB,CAAC,0BAA0B,EAAE,GAAG,CAAC;IACjC,CAAC,4BAA4B,EAAE,GAAG,CAAC;CACpC,CAAC;AAOF,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;AAC5D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { createControlPlaneApi } from './api.js';
+export type { ControlPlaneApiOptions } from './api.js';
+export { DEV_ACTOR_HEADER, UNSAFE_devPlatformActorAuth } from './auth.js';
+export type { PlatformActorAuth } from './auth.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createControlPlaneApi } from './api.js';
+export { DEV_ACTOR_HEADER, UNSAFE_devPlatformActorAuth } from './auth.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@substrat-run/control-plane-api",
+  "version": "0.4.0",
+  "description": "HTTP surface over HostAdmin — the audited control-plane transport (control-plane.md §4.5)",
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/substrat-run/substrat.git",
+    "directory": "packages/control-plane-api"
+  },
+  "homepage": "https://github.com/substrat-run/substrat",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "dev": "tsx dev/server.mts"
+  },
+  "dependencies": {
+    "@substrat-run/contracts": "workspace:^",
+    "@substrat-run/kernel": "workspace:^",
+    "hono": "^4.6.0"
+  },
+  "devDependencies": {
+    "@hono/node-server": "^1.13.0",
+    "@substrat-run/adapter-sqlite": "workspace:^",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "vitest": "^3.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}