@velora-cms/api-schemas 0.9.0

package/dist/marketplace-listing-api.schema.js

@@ -0,0 +1,115 @@
+import { z } from "zod";
+export const MarketplaceListingVersionSchema = z.object({
+    version: z.string(),
+    supportedDialects: z.array(z.string()),
+    permissions: z.record(z.string(), z.boolean()),
+    license: z.string(),
+    cmsVersion: z.string(),
+    verified: z.boolean(),
+    createdAt: z.string(),
+});
+export const MarketplaceListingSchema = z.object({
+    pluginId: z.string(),
+    name: z.string(),
+    type: z.string(),
+    description: z.string(),
+    author: z.string(),
+    priceCents: z.number().int(),
+    coverImagePath: z.string().nullable(),
+    latestVersion: MarketplaceListingVersionSchema.nullable(),
+    // Computed SERVER-SIDE against this CMS's active dialect — the admin
+    // client never guesses compatibility from raw dialect lists.
+    compatible: z.boolean(),
+});
+// S148: a starter frontend the marketplace hosts as a versioned archive
+// (Global Constraints — a bundledTemplate WITHOUT an archive stays legal,
+// hence hasArchive rather than always assuming a download exists) and the
+// document types a template/section listing provisions on install. Both
+// are projected server-side by the marketplace (starter-projection.ts) and
+// only ever appear on the DETAIL surface, never on browse — see
+// MarketplaceListingDetailVersionSchema below.
+export const MarketplaceStarterSchema = z.object({
+    name: z.string(),
+    description: z.string().nullable(),
+    repository: z.string().nullable(),
+    hasArchive: z.boolean(),
+});
+export const MarketplaceDocumentTypeSummarySchema = z.object({
+    name: z.string(),
+    fields: z.array(z.string()),
+});
+// S153: a bundle's enriched member projection — snapshotted at ingest by
+// the marketplace (bundle-members.ts), detail-only like the S148 starter
+// fields (same extend-don't-widen browse protection below).
+export const MarketplaceBundleMemberSchema = z.object({
+    pluginId: z.string(),
+    name: z.string(),
+    description: z.string().nullable(),
+    type: z.string(),
+    priceCents: z.number().int(),
+});
+// Extends the base version shape rather than widening it: browse
+// (MarketplaceListingSchema.latestVersion, MarketplaceListResponseSchema)
+// keeps using MarketplaceListingVersionSchema untouched, so starter/
+// documentTypesSummary can never leak onto the browse screen even though
+// the upstream marketplace's JSON carries them on every version row.
+export const MarketplaceListingDetailVersionSchema = MarketplaceListingVersionSchema.extend({
+    starter: MarketplaceStarterSchema.nullable().optional(),
+    documentTypesSummary: z.array(MarketplaceDocumentTypeSummarySchema).nullable().optional(),
+    bundledMembers: z.array(MarketplaceBundleMemberSchema).nullable().optional(),
+});
+export const MarketplaceListingDetailSchema = MarketplaceListingSchema.extend({
+    latestVersion: MarketplaceListingDetailVersionSchema.nullable(),
+    versions: z.array(MarketplaceListingDetailVersionSchema),
+    activeDialect: z.string(),
+    marketplaceBaseUrl: z.string(),
+});
+export const MarketplaceListQuerySchema = z.object({
+    q: z.string().optional(),
+    type: z.string().optional(),
+    db: z.string().optional(),
+    cursor: z.string().uuid().optional(),
+    limit: z.coerce.number().int().min(1).max(50).default(24),
+});
+export const MarketplaceListResponseSchema = z.object({
+    items: z.array(MarketplaceListingSchema),
+    nextCursor: z.string().nullable(),
+    activeDialect: z.string(),
+    marketplaceBaseUrl: z.string(),
+});
+export const MarketplacePluginIdParamsSchema = z.object({ pluginId: z.string().min(1) });
+// Path-safety gate, mirroring install-built-package.ts's own reverse-domain
+// id regex (its manifest.json id check, run before that id becomes a
+// managed-store directory name): pluginId reaches removePluginPackages,
+// which builds a path from it and does a recursive, forced rmSync. Without
+// this, a bare `z.string().min(1)` would let a traversal-shaped id
+// (`"../../etc"`) all the way to that filesystem call.
+const PLUGIN_ID_PATTERN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i;
+export const MarketplaceInstallBodySchema = z.object({
+    pluginId: z
+        .string()
+        .min(1)
+        .regex(PLUGIN_ID_PATTERN, "pluginId must be a reverse-domain identifier (e.g. com.example.plugin)"),
+    version: z.string().min(1),
+    licenseKey: z.string().min(1).optional(),
+});
+// S152: a bundle install reports what its fan-out did per member —
+// "installed" (this operation installed it, ownership recorded) or
+// "already-installed" (pre-existing, skipped, never claimed). Optional
+// and absent for every non-bundle install, so single-plugin clients are
+// untouched.
+export const MarketplaceInstallMemberSchema = z.object({
+    pluginId: z.string(),
+    version: z.string(),
+    outcome: z.enum(["installed", "already-installed"]),
+});
+// trustTier is a literal, not the broader TrustTier union — this door
+// (S138) only ever answers 201 for a "verified" result; a non-"verified"
+// verdict is a 422 failure response (ApiErrorSchema), never this shape.
+export const MarketplaceInstallResponseSchema = z.object({
+    pluginId: z.string(),
+    version: z.string(),
+    trustTier: z.literal("verified"),
+    licensed: z.boolean(),
+    members: z.array(MarketplaceInstallMemberSchema).optional(),
+});

package/dist/media-api.schema.d.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+export declare const MediaFileResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    filename: z.ZodString;
+    mimeType: z.ZodString;
+    size: z.ZodNumber;
+    url: z.ZodString;
+    uploadedBy: z.ZodString;
+    uploadedAt: z.ZodString;
+    downloadUrl: z.ZodString;
+}, z.core.$strip>;
+export type MediaFileResponse = z.infer<typeof MediaFileResponseSchema>;
+export declare const MediaDeleteResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type MediaDeleteResponse = z.infer<typeof MediaDeleteResponseSchema>;
+export declare const MediaListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MediaListQuery = z.infer<typeof MediaListQuerySchema>;
+export declare const MediaListResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        filename: z.ZodString;
+        mimeType: z.ZodString;
+        size: z.ZodNumber;
+        url: z.ZodString;
+        uploadedBy: z.ZodString;
+        uploadedAt: z.ZodString;
+        downloadUrl: z.ZodString;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type MediaListResponse = z.infer<typeof MediaListResponseSchema>;

package/dist/media-api.schema.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { MediaFileSchema } from "./media.schema.js";
+// downloadUrl is generated per response (time-limited presigned GET) —
+// it is never the persisted canonical `url` and must not be stored.
+export const MediaFileResponseSchema = MediaFileSchema.extend({
+    downloadUrl: z.string().url(),
+});
+export const MediaDeleteResponseSchema = z.object({
+    success: z.literal(true),
+});
+// GET /api/media — newest-first pages; cursor = id of the previous
+// page's last item. `search` filters by filename substring,
+// case-insensitive.
+export const MediaListQuerySchema = z.object({
+    cursor: z.string().uuid().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(24),
+    search: z.string().min(1).optional(),
+});
+export const MediaListResponseSchema = z.object({
+    items: z.array(MediaFileResponseSchema),
+    // null = no more pages.
+    nextCursor: z.string().uuid().nullable(),
+});

package/dist/media.schema.d.ts

@@ -0,0 +1,11 @@
+import { z } from "zod";
+export declare const MediaFileSchema: z.ZodObject<{
+    id: z.ZodString;
+    filename: z.ZodString;
+    mimeType: z.ZodString;
+    size: z.ZodNumber;
+    url: z.ZodString;
+    uploadedBy: z.ZodString;
+    uploadedAt: z.ZodString;
+}, z.core.$strip>;
+export type MediaFile = z.infer<typeof MediaFileSchema>;

package/dist/media.schema.js

@@ -0,0 +1,10 @@
+import { z } from "zod";
+export const MediaFileSchema = z.object({
+    id: z.string().uuid(),
+    filename: z.string().min(1),
+    mimeType: z.string().min(1),
+    size: z.number().int().nonnegative(),
+    url: z.string().url(),
+    uploadedBy: z.string().uuid(),
+    uploadedAt: z.string().datetime(),
+});

package/dist/plugin-management-api.schema.d.ts

@@ -0,0 +1,145 @@
+import { z } from "zod";
+export declare const ManagedPluginSchema: z.ZodObject<{
+    pluginId: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodString;
+    version: z.ZodString;
+    trustTier: z.ZodEnum<{
+        verified: "verified";
+        unverified: "unverified";
+    }>;
+    storageType: z.ZodEnum<{
+        simple: "simple";
+        structured: "structured";
+    }>;
+    enabled: z.ZodBoolean;
+    licenseStatus: z.ZodNullable<z.ZodString>;
+    licenseReason: z.ZodNullable<z.ZodString>;
+    licenseLastValidatedAt: z.ZodNullable<z.ZodString>;
+    licenseLastAttemptError: z.ZodNullable<z.ZodString>;
+    boundDomain: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ManagedPlugin = z.infer<typeof ManagedPluginSchema>;
+export declare const ManagedPluginListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export declare const ManagedPluginListResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        pluginId: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodString;
+        version: z.ZodString;
+        trustTier: z.ZodEnum<{
+            verified: "verified";
+            unverified: "unverified";
+        }>;
+        storageType: z.ZodEnum<{
+            simple: "simple";
+            structured: "structured";
+        }>;
+        enabled: z.ZodBoolean;
+        licenseStatus: z.ZodNullable<z.ZodString>;
+        licenseReason: z.ZodNullable<z.ZodString>;
+        licenseLastValidatedAt: z.ZodNullable<z.ZodString>;
+        licenseLastAttemptError: z.ZodNullable<z.ZodString>;
+        boundDomain: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const PluginIdParamsSchema: z.ZodObject<{
+    pluginId: z.ZodString;
+}, z.core.$strip>;
+export declare const UninstallPluginBodySchema: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+    confirmStructuredDataCleanup: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>>>;
+export declare const UninstallConfirmationRequiredSchema: z.ZodObject<{
+    requiresConfirmation: z.ZodLiteral<true>;
+    snapshotGroupId: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>;
+export declare const BundleUninstallConfirmationRequiredSchema: z.ZodObject<{
+    requiresConfirmation: z.ZodLiteral<true>;
+    memberSnapshots: z.ZodArray<z.ZodObject<{
+        pluginId: z.ZodString;
+        snapshotGroupId: z.ZodString;
+    }, z.core.$strip>>;
+    message: z.ZodString;
+}, z.core.$strip>;
+export declare const UninstallSucceededSchema: z.ZodObject<{
+    snapshotGroupId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type UninstallSucceeded = z.infer<typeof UninstallSucceededSchema>;
+export declare const BundleUninstallSucceededSchema: z.ZodObject<{
+    memberSnapshots: z.ZodArray<z.ZodObject<{
+        pluginId: z.ZodString;
+        snapshotGroupId: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type BundleUninstallSucceeded = z.infer<typeof BundleUninstallSucceededSchema>;
+export declare const LicenseRecheckResponseSchema: z.ZodObject<{
+    pluginId: z.ZodString;
+    checked: z.ZodBoolean;
+    status: z.ZodNullable<z.ZodString>;
+    reason: z.ZodNullable<z.ZodString>;
+    lastValidatedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type LicenseRecheckResponse = z.infer<typeof LicenseRecheckResponseSchema>;
+export declare const SnapshotGroupSchema: z.ZodObject<{
+    snapshotGroupId: z.ZodString;
+    takenAt: z.ZodString;
+    trigger: z.ZodNullable<z.ZodString>;
+    tableNames: z.ZodArray<z.ZodString>;
+    totalTableCount: z.ZodNumber;
+    status: z.ZodEnum<{
+        complete: "complete";
+        partial: "partial";
+    }>;
+}, z.core.$strip>;
+export type SnapshotGroup = z.infer<typeof SnapshotGroupSchema>;
+export declare const SnapshotGroupListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export declare const SnapshotGroupListResponseSchema: z.ZodObject<{
+    pluginId: z.ZodString;
+    items: z.ZodArray<z.ZodObject<{
+        snapshotGroupId: z.ZodString;
+        takenAt: z.ZodString;
+        trigger: z.ZodNullable<z.ZodString>;
+        tableNames: z.ZodArray<z.ZodString>;
+        totalTableCount: z.ZodNumber;
+        status: z.ZodEnum<{
+            complete: "complete";
+            partial: "partial";
+        }>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SnapshotGroupListResponse = z.infer<typeof SnapshotGroupListResponseSchema>;
+export declare const RestorePlanEntrySchema: z.ZodObject<{
+    tableName: z.ZodString;
+    snapshotGroupId: z.ZodString;
+    groupTakenAt: z.ZodString;
+}, z.core.$strip>;
+export type RestorePlanEntry = z.infer<typeof RestorePlanEntrySchema>;
+export declare const RestoreConfirmationRequiredSchema: z.ZodObject<{
+    requiresConfirmation: z.ZodLiteral<true>;
+    plan: z.ZodArray<z.ZodObject<{
+        tableName: z.ZodString;
+        snapshotGroupId: z.ZodString;
+        groupTakenAt: z.ZodString;
+    }, z.core.$strip>>;
+    planHash: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>;
+export type RestoreConfirmationRequired = z.infer<typeof RestoreConfirmationRequiredSchema>;
+export declare const RestoreSucceededSchema: z.ZodObject<{
+    preRestoreSnapshotGroupId: z.ZodNullable<z.ZodString>;
+    restoredTables: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type RestoreSucceeded = z.infer<typeof RestoreSucceededSchema>;
+export declare const RestoreBodySchema: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+    confirmRestore: z.ZodOptional<z.ZodBoolean>;
+    planHash: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>>;

package/dist/plugin-management-api.schema.js

@@ -0,0 +1,186 @@
+import { z } from "zod";
+// The ADMIN management view of the registry (S135): unlike the public
+// GET /api/plugins (enabled-only, boot-loader metadata), this surface
+// lists every installed plugin, disabled included. licenseStatus reflects
+// the PluginLicense row's last verdict ("valid" | "revoked" |
+// "domain_mismatch" | "unknown"), or null when the plugin has no license
+// row at all (free plugins, or a paid plugin never validated yet,
+// S138/S139). The three fields below (S139 Task 5) ride along so the
+// admin's license cell can render an honest state without a second
+// request per row: licenseReason mirrors PluginLicense.lastReason (the
+// server's explanation for a non-valid verdict), licenseLastValidatedAt
+// mirrors lastValidatedAt (the last SUCCESSFUL verdict), and
+// licenseLastAttemptError mirrors lastAttemptError (why the most recent
+// ATTEMPT — successful or not — failed to reach a verdict; null when it
+// didn't). Together the last two let the cell compute "unreachable since"
+// itself. boundDomain mirrors PluginLicense.boundDomain (the domain this
+// site bound the license to at S138 install; never mutated by later
+// revalidation — see revalidate-license.ts) so a domain_mismatch warning
+// can name the actual bound domain instead of the raw upstream reason
+// token (S139 fix wave, spec section 6). Never add `key` here — see the
+// route's comment on the same prisma select.
+export const ManagedPluginSchema = z.object({
+    pluginId: z.string(),
+    name: z.string(),
+    type: z.string(),
+    version: z.string(),
+    trustTier: z.enum(["verified", "unverified"]),
+    storageType: z.enum(["simple", "structured"]),
+    enabled: z.boolean(),
+    licenseStatus: z.string().nullable(),
+    licenseReason: z.string().nullable(),
+    licenseLastValidatedAt: z.string().nullable(),
+    licenseLastAttemptError: z.string().nullable(),
+    boundDomain: z.string().nullable(),
+});
+export const ManagedPluginListQuerySchema = z.object({
+    cursor: z.string().uuid().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(50),
+});
+export const ManagedPluginListResponseSchema = z.object({
+    items: z.array(ManagedPluginSchema),
+    nextCursor: z.string().uuid().nullable(),
+});
+export const PluginIdParamsSchema = z.object({
+    pluginId: z.string().min(1),
+});
+// Fastify substitutes `null` for a genuinely absent body before handing it
+// to the validator (lib/validation.js's validateParam: `isUndefined ? null
+// : request[paramName]`) — a DELETE sent with no payload at all lands here
+// as `null`, not `undefined`. `.nullish()` (not `.optional()`) is required
+// so an absent body validates; `request.body?.confirmStructuredDataCleanup`
+// in the route handler already tolerates both null and undefined.
+export const UninstallPluginBodySchema = z
+    .object({
+    confirmStructuredDataCleanup: z.boolean().optional(),
+})
+    .nullish();
+// 409 payload when a structured plugin's uninstall needs confirmation —
+// the snapshot has ALREADY been taken (S87's safe-to-retry design).
+export const UninstallConfirmationRequiredSchema = z.object({
+    requiresConfirmation: z.literal(true),
+    snapshotGroupId: z.string(),
+    message: z.string(),
+});
+// S152: the BUNDLE uninstall's aggregated 409 — one snapshot group per
+// structured plugin in the removal set (owned members, and the bundle
+// itself if structured). A separate schema rather than widening
+// UninstallConfirmationRequiredSchema: the single-plugin contract
+// (snapshotGroupId, required) stays byte-identical for existing clients.
+// Every snapshot is ALREADY taken when this is sent (S87's safe-to-retry
+// property, kept cross-plugin).
+export const BundleUninstallConfirmationRequiredSchema = z.object({
+    requiresConfirmation: z.literal(true),
+    memberSnapshots: z.array(z.object({
+        pluginId: z.string(),
+        snapshotGroupId: z.string(),
+    })),
+    message: z.string(),
+});
+// Task 6: the 200 success body for a single-plugin DELETE — the CONFIRMED
+// pass's freshly-minted snapshotGroupId (the gate site already took it;
+// this just stops discarding it), null for a simple-storage plugin (never
+// snapshotted) or for the earlier PluginRegistry.uninstall() callers that
+// route around the HTTP layer entirely.
+export const UninstallSucceededSchema = z.object({
+    snapshotGroupId: z.string().nullable(),
+});
+// Task 6: the 200 success body for a BUNDLE DELETE — one entry per
+// structured plugin in the cascade (owned members, and the bundle itself
+// if structured) that got a fresh snapshot on this confirmed pass. Simple-
+// storage members never appear here, same as the 409 aggregate above.
+export const BundleUninstallSucceededSchema = z.object({
+    memberSnapshots: z.array(z.object({
+        pluginId: z.string(),
+        snapshotGroupId: z.string(),
+    })),
+});
+// The manual re-check route's response (S139): mirrors revalidateLicense's
+// RevalidationOutcome, flattened for the wire. `checked: false` covers
+// every fail-open case that still has a license row to report on
+// (unreachable license server, no VELORA_SITE_DOMAIN, no marketplace
+// configured) — `status` and `lastValidatedAt` stay null in that shape
+// since nothing was verified. A plugin with no license row at all gets a
+// 404 instead of this body (ApiErrorSchema) — there's nothing to recheck.
+export const LicenseRecheckResponseSchema = z.object({
+    pluginId: z.string(),
+    checked: z.boolean(),
+    status: z.string().nullable(),
+    reason: z.string().nullable(),
+    lastValidatedAt: z.string().nullable(),
+});
+// S154 Task 4: a plugin's structured-data snapshot GROUPS, derived from
+// PluginStructuredSnapshot (GROUP BY snapshotGroupId) rather than tracked
+// by their own table — see apps/server/src/plugins/snapshot-groups.ts for
+// the derivation. takenAt is the group's earliest row's createdAt (every
+// row in a group is written in one snapshotPluginTables() call, so in
+// practice they're all within the same transaction-ish burst — min is a
+// defensive, not load-bearing, choice). trigger rides along from Task 3's
+// column ("uninstall", "restore", or null for pre-Task-3 rows). status
+// compares the group's own tableNames against totalTableCount — the
+// UNION of distinct tableNames across ALL of the plugin's snapshot rows,
+// the only denominator that survives an uninstall (which deletes the
+// PluginStructuredTable tracking rows, never the snapshots themselves).
+export const SnapshotGroupSchema = z.object({
+    snapshotGroupId: z.string(),
+    takenAt: z.string(),
+    trigger: z.string().nullable(),
+    tableNames: z.array(z.string()),
+    totalTableCount: z.number().int(),
+    status: z.enum(["complete", "partial"]),
+});
+export const SnapshotGroupListQuerySchema = z.object({
+    cursor: z.string().uuid().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(50),
+});
+export const SnapshotGroupListResponseSchema = z.object({
+    pluginId: z.string(),
+    items: z.array(SnapshotGroupSchema), // newest first
+    nextCursor: z.string().nullable(),
+});
+// S154 Task 5: the UNION restore plan — the newest available snapshot copy
+// of each DISTINCT table this plugin has ever snapshotted, chosen
+// independently per table across every group (not "pick one group and use
+// only its tables"). This is what makes restore recover from the S87
+// retry wedge: no single group need be complete for a full restore to be
+// possible, as long as every table appears in SOME group.
+export const RestorePlanEntrySchema = z.object({
+    tableName: z.string(),
+    snapshotGroupId: z.string(),
+    groupTakenAt: z.string(),
+});
+// 409 payload for an unconfirmed restore — nothing has been touched yet,
+// the plan is offered for the admin to review before confirming. planHash
+// (S161, S154 rider) is a stable digest of this exact plan: the confirm
+// request must echo it back, and the handler refuses to proceed if a fresh
+// re-plan hashes differently (a snapshot landed between the operator
+// seeing this plan and confirming it) — closing the requestRestorePlan ->
+// confirmRestore TOCTOU. A mismatch response reuses this same schema, with
+// a fresh plan/planHash and a message explaining the plan changed.
+export const RestoreConfirmationRequiredSchema = z.object({
+    requiresConfirmation: z.literal(true),
+    plan: z.array(RestorePlanEntrySchema),
+    planHash: z.string(),
+    message: z.string(),
+});
+export const RestoreSucceededSchema = z.object({
+    // The pre-restore safety snapshot's group id — null only when the
+    // plugin had no live tracked tables to protect (restoring onto empty).
+    preRestoreSnapshotGroupId: z.string().nullable(),
+    restoredTables: z.array(z.string()),
+});
+// Same DELETE-body-null convention as UninstallPluginBodySchema above: an
+// absent POST body lands as `null` (not `undefined`) once Fastify's
+// validator substitutes for a genuinely missing payload, so `.nullish()`
+// (not `.optional()`) is required for an absent body to validate at all.
+// planHash (S161, S154 rider) is optional at the schema level only
+// because the SAME body shape covers the unconfirmed call (`{}`, no plan
+// to hash yet) — the route handler enforces it as effectively required
+// whenever confirmRestore is true: a confirm with a missing or stale
+// planHash is refused exactly the same way (409, fresh plan reissued).
+export const RestoreBodySchema = z
+    .object({
+    confirmRestore: z.boolean().optional(),
+    planHash: z.string().optional(),
+})
+    .nullish();

package/dist/plugin-registry-api.schema.d.ts

@@ -0,0 +1,31 @@
+import { z } from "zod";
+export declare const PluginSchema: z.ZodObject<{
+    pluginId: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodString;
+    version: z.ZodString;
+    trustTier: z.ZodString;
+    storageType: z.ZodString;
+    enabled: z.ZodBoolean;
+    remoteUrl: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type Plugin = z.infer<typeof PluginSchema>;
+export declare const PluginListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type PluginListQuery = z.infer<typeof PluginListQuerySchema>;
+export declare const PluginListResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        pluginId: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodString;
+        version: z.ZodString;
+        trustTier: z.ZodString;
+        storageType: z.ZodString;
+        enabled: z.ZodBoolean;
+        remoteUrl: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type PluginListResponse = z.infer<typeof PluginListResponseSchema>;

package/dist/plugin-registry-api.schema.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+// Read-side shape of a plugin_registry row — the ONLY consumer today is
+// the admin's boot-time remote loader (velora-dev, Session 79), but this
+// is real, permanent infrastructure: any dynamically-installed plugin
+// needs a way for the admin to discover it at boot, sandbox or not.
+export const PluginSchema = z.object({
+    pluginId: z.string(),
+    name: z.string(),
+    type: z.string(),
+    version: z.string(),
+    trustTier: z.string(),
+    storageType: z.string(),
+    enabled: z.boolean(),
+    remoteUrl: z.string().nullable(),
+});
+// Cursor-paginated per the non-negotiable list-endpoint rule, mirroring
+// DataTypeListResponseSchema's exact shape (data-type-api.schema.ts).
+export const PluginListQuerySchema = z.object({
+    cursor: z.string().uuid().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(50),
+});
+export const PluginListResponseSchema = z.object({
+    items: z.array(PluginSchema),
+    nextCursor: z.string().uuid().nullable(),
+});

package/dist/plugin-storage-api.schema.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+export declare const PluginStorageParamsSchema: z.ZodObject<{
+    pluginId: z.ZodString;
+    contentId: z.ZodString;
+    fieldId: z.ZodString;
+}, z.core.$strip>;
+export type PluginStorageParams = z.infer<typeof PluginStorageParamsSchema>;
+export declare const SetPluginFieldValueRequestSchema: z.ZodObject<{
+    value: z.ZodUnknown;
+}, z.core.$strict>;
+export type SetPluginFieldValueRequest = z.infer<typeof SetPluginFieldValueRequestSchema>;
+export declare const PluginFieldValueResponseSchema: z.ZodObject<{
+    value: z.ZodUnknown;
+}, z.core.$strip>;
+export type PluginFieldValueResponse = z.infer<typeof PluginFieldValueResponseSchema>;

package/dist/plugin-storage-api.schema.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+// SimpleStorageAPI's HTTP surface (Session 68) — mirrors PROJECT_CONTEXT.md's
+// SimpleStorageAPI interface (get(contentId, fieldId) / set(contentId,
+// fieldId, value)) with pluginId made explicit as a required 3rd param:
+// this is the lower-level adapter/HTTP surface, not the plugin-facing SDK
+// ergonomics (usePluginValue(), Session 70, resolves pluginId from React
+// context and never asks a plugin author to pass it by hand).
+// Matches FieldDefinition.id's shape (document-type.schema.ts) — same
+// stable key, just scoped to one plugin's stored value for that field.
+const FieldIdSchema = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/);
+// Deliberately NOT plugin-sdk's stricter reverse-DNS pluginIdSchema:
+// plugin-sdk depends on api-schemas, not the reverse, so it can't be
+// imported here without a cycle.
+const PluginIdSchema = z.string().min(1);
+export const PluginStorageParamsSchema = z.object({
+    pluginId: PluginIdSchema,
+    contentId: z.string().uuid(),
+    fieldId: FieldIdSchema,
+});
+// `value` is z.unknown(), not a record — PROJECT_CONTEXT.md types
+// SimpleStorageAPI's value as `any`; a plugin can store a string, number,
+// array, or object, not only key-value maps.
+export const SetPluginFieldValueRequestSchema = z.object({ value: z.unknown() }).strict();
+export const PluginFieldValueResponseSchema = z.object({ value: z.unknown() });