rcf-lite 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0, breaking changes are signalled by a minor version bump.
 
+## [0.13.0] - 2026-08-31
+
+WSD-readiness packaging release. Five focused fixes so a first-time operator's very first commands succeed on the shipped tarball, not on a source clone.
+
+- **Blueprint shelf is now inside the tarball.** The 14 first-party blueprints (`application-spa`, `application-api-rest`, `ci-pipeline`, `deploy-cloudflare-workers`, `email-smtp-resend`, `observability-essentials`, `observability-probe-endpoints`, `persistence-data-d1`, `persistence-data-sqlite`, `security-auth-clerk`, `security-auth-keycloak`, `security-auth-magic-link`, `security-auth-oauth2`, `security-secrets-management`) ship inside the package. Pre-0.13 tarballs were missing the shelf entirely (`npm pack --dry-run` reported 390 files with zero blueprints), so any doc pointing at a `blueprints/<slug>` path was dead on install. Wired via `files: [ "blueprints" ]` plus a `prepack` script that stages the repo-root shelf into the package before pack runs.
+- **Bare-slug and `@stock/<slug>` resolution on `rcf define blueprint add`.** `rcf define blueprint add deploy-cloudflare-workers` and `rcf define blueprint add @stock/deploy-cloudflare-workers` both resolve against the packaged shelf; local / absolute paths (starting with `.`, `/`, `~`, or containing a separator) keep the pre-0.13 pass-through behaviour byte-for-byte. Any `@<library>/<slug>` other than `@stock` is refused with a message pointing at the phase-2 external-libraries reservation, so the phase-2 registry can land without a breaking rename.
+- **Preinstall hard-fail on Node < 24.** The `engines` block in `package.json` only asks npm to warn; recent npm defaults ignore the warning, and a session on Node 22 silently resolved the last publish that advertised support for it (the `0.0.1` placeholder stub) instead of the current release. `scripts/preinstall-node-check.mjs` now refuses the install outright with a message that names the version detected. Maintainer bypass: `RCF_LITE_SKIP_NODE_CHECK=1`. The README's start-here section also names the Node prereq up front.
+- **Phantom `AC-N-1` seed no longer pollutes coverage on the first real AC.** `rcf define create us` still seeds one placeholder AC (the schema demands `acceptanceCriteria` minItems:1), but the operator's first `rcf define create ac --parent US-N` now REPLACES that placeholder in place instead of appending, so the first real acceptance criterion lands at `AC-N-1` and `audit coverage --strict` / `audit trace` no longer count the seed as an unmet criterion. Detection is strict: replacement only fires when the parent US carries exactly one AC, its id is `AC-<us>-1`, its description matches the exact seed sentinel, `testable === true`, and no `given` / `when` / `then` / `scope` / `provenance` fields are set - any operator edit disqualifies replacement and the append path runs as before.
+- **`.mcp.json` uses portable `npx rcf-lite mcp`.** `rcf init` now writes the rcf server entry as `{ "command": "npx", "args": ["rcf-lite", "mcp"] }` instead of an absolute `node <installPath>` path, so a project imported on a different machine or moved between checkouts keeps working without a re-init. Test / pinned-deployment callers can still pass an absolute `binPath` to `writeMcpConfig` to force the legacy shape.
+- **`rcf init` completion now points at `rcf doctor`.** The last line of a successful init tells the operator to run `rcf doctor` for ongoing drift detection.
+
+## [0.12.0] - 2026-08-28
+
+Adopts `@stravica-ai/rcf-schemas@0.5.0` and retires the local `testPointer` strictness overlay (`w-2026-07-28-005`). The `testPointer`-required rule now comes from the shared schema and is expressed conditionally by TC status: REQUIRED for `passing` and `failing`, OPTIONAL for `pending` and `skipped` (`w-2026-08-27-dave-001`, Baz ratified 2026-08-27). Pre-0.12 rcf-lite required a pointer on every TC regardless of status; 0.12 relaxes pending and skipped TCs to schema-legit-without-pointer, which is the honest shape ("no executable has landed yet"). Existing test-suite documents that already carried a pointer on every TC continue to validate unchanged.
+
+### Changed (BREAKING)
+
+- **`@stravica-ai/rcf-schemas` pin**: `0.4.5` → `0.5.0` (exact). The schema bump is a minor version because it tightens `testPointer` requiredness for `passing`/`failing` TCs and adds `minLength: 1` on the field when present. Docs that shipped `passing`/`failing` TCs without `testPointer` (dishonest coverage) stop validating; docs with only `pending`/`skipped` TCs without pointers remain valid, and are additionally now legitimate under the schema (they were rejected by the pre-0.12 overlay).
+- **`src/core/store/validator.js`**: the local strictness overlay is removed. The `testSuite` schema is registered from the raw import (`testSuiteSchema`), not a `structuredClone`d strict copy. Validation of TCs now inherits the schema's conditional-required rule unmodified.
+- **`src/ruleset/ruleset.json`**: `scopeTagVocabulary.schemaRef` URL bumped `v0.4.0` → `v0.5.0` in lock-step with the schemas release. Documentation reference only; no runtime behaviour change.
+
+### Added
+
+- **`packages/rcf-lite/test/core/store/validator.test.js`**: the pre-0.12 overlay-driven `rejects TC without testPointer` case is replaced by four cases covering every branch of the new rule (passing rejected, failing rejected, pending accepted, skipped accepted). The empty-string testPointer case is retained; the `minLength: 1` guard is preserved by the shared schema.
+
+### Migration
+
+- **rcf-lite consumers on 0.11**: no code change required. Existing chains with a `testPointer` on every TC keep validating. Chains that shipped pointer-less `pending` or `skipped` TCs (which the pre-0.12 overlay would have rejected on load) now validate on 0.12.
+- **Downstream chains with dishonest `passing`/`failing` TCs (no pointer)**: were rejected on load by the pre-0.12 overlay and continue to be rejected on 0.12 by the shared schema. The fix is unchanged: add the real pointer or downgrade the TC to `pending`/`skipped`.
+
 ## [0.11.0] - 2026-08-27
 
 Guidance-only release: the agent-side driving playbook. No CLI, schema, or runtime behaviour changes.

package/README.md

@@ -15,6 +15,8 @@ It is the tooling for the [Requirements Confidence Framework (RCF)](https://stra
 
 ## Start here
 
+**Node 24 or newer is required.** The preinstall gate rejects older majors so the CLI never lands half-wired; check with `node --version` first.
+
 Three steps before you start your coding agent, then one prompt inside the session.
 
 1. Install the CLI:

package/blueprints/application-api-rest/README.md

@@ -0,0 +1,40 @@
+# REST API blueprint (v1.0.0)
+
+The second content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 3 of the blueprint programme). Scope: a REST service, single deployable, versioned wire contract, no UI in scope. Composes with the application-spa blueprint by design, including two deliberate scope:global conflicts.
+
+## Apply
+
+```
+rcf define blueprint add <path-to>/blueprints/application-api-rest
+```
+
+Phase 1 resolves local path sources only; registry and git-ref resolution is a mechanism follow-up. Apply is idempotent; `rcf define blueprint list` shows the applied entry; `rcf define blueprint remove application-api-rest` cleanly removes an unreferenced application.
+
+## Anatomy
+
+| Piece | Where | What |
+|---|---|---|
+| Metadata | `blueprint.json` | Slug, version, and the 50 contributions with scope/topic on the four global ADRs |
+| Doc set | `contributions/` | 16 REQs, 20 USs (117 ACs), 6 TACs, 8 ADRs, all schema-valid against rcf-schemas 0.4.4 and namespaced (`application-api-rest-REQ-001` prefix family; `ADR-301-application-api-rest-error-envelope` suffix family) |
+| OpenAPI skeleton | `assets/openapi/openapi-skeleton.yaml` | The anatomy the generated spec must exhibit: probe endpoints, problem-details schema, pagination envelope, 429 shape, x-auth-class extension, idempotency-key declaration |
+| Auth-class reference | `assets/middleware/auth-classes.md` | Behaviour contracts for the four middleware slots (public, user, admin, service) |
+| Sample pairs | `assets/samples/request-response-pairs.md` | Request-response realisations per verb class, error shapes, and probe shapes |
+| Sample data | `assets/sample-data/sample-resources.json` | Neutral resources for fixtures and documentation examples |
+| Guide | `guide/application-api-rest.md` | Operator-facing: when to use it, when not, what stays your call |
+| Coordination vocabulary | `docs/topics.md` | The global-topic strings this blueprint contributes, id number bands, and expectations for future composing blueprints |
+
+The doc set is contributions (copied into the project tree by `rcf define blueprint add`); the guide, assets, and docs are package-resident references. Guide rendering into `rcf/knowledge/docs/blueprint-guides/` and asset ingestion are mechanism follow-ups; until they land, the working agent reads them from the applied blueprint's source path recorded in `manifest.blueprints[].source`.
+
+## What it contributes, and what it deliberately does not
+
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+
+No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+
+## The four global decisions
+
+ADR-301 errorEnvelope, ADR-302 authModel, ADR-303 apiVersioning, ADR-304 logging ship `scope: global`. The first two reuse the application-spa vocabulary's exact topic strings on purpose: applying this blueprint alongside the application-spa blueprint surfaces two deliberate conflicts (`errorEnvelope`, `authModel`) for operator resolution, which is the composition mechanism doing its job. `apiVersioning` and `logging` are minted here and were pre-cleared as unclaimed in the application-spa vocabulary. See `docs/topics.md` for exact strings, expected resolutions, and the AC id band allocation (application-api-rest owns 2101-2899).
+
+## Quality bar
+
+OpenAPI 3.1 generated from source with three-axis drift validation in the build; three k8s probes with specified schemas, security-auth-magic-link and log-noise exclusions, and documented failure modes; four auth classes enforced in middleware with x-auth-class contract validation; RFC 7807 on every failure path including pre-routing ones; cursor pagination with write-stability; strict unknown-parameter rejection; idempotency-key replay semantics with declared TTL; per-class rate limits with honest Retry-After; structured JSON logs, RED metrics, and OpenTelemetry spans off one shared request context; forward-only migrations with named reverts and a live /v1/_meta report; secrets never logged, PII redacted by stated policy, TLS outside development, CORS deny-by-default. Every bar is carried by ACs in the doc set, not by this README.

package/blueprints/application-api-rest/assets/middleware/auth-classes.md

@@ -0,0 +1,45 @@
+# Auth-class middleware slots: the four contracts
+
+Reference for the working agent implementing TAC-302-application-api-rest-auth-middleware. This is a behaviour specification, not code: it enumerates the four slots, what each must and must not do, and the properties the acceptance criteria verify. Every endpoint routes into exactly one slot via its declared `x-auth-class` (application-api-rest-REQ-005); the slot list is closed, and a project needing a different shape supersedes ADR-302-application-api-rest-auth-model rather than adding a bespoke path.
+
+## Slot summary
+
+| Class | Credential | Identity resolved | Rate-limit key | Audit log | Typical endpoints |
+|---|---|---|---|---|---|
+| `public` | None processed | None | Client address | No | Landing data, docs, probes-adjacent reads |
+| `user` | Session or bearer token | User identity | User identity | No (standard request logging only) | The product surface |
+| `admin` | Session or bearer token + admin role | User identity with role | User identity | Yes, every request | Back-office, configuration, user management |
+| `service` | mTLS or signed request | Service principal (no user) | Service principal | Yes, every request | Peer services, schedulers, /v1/_meta |
+
+## Contracts per slot
+
+### public
+
+- Processes no auth headers: a request with credentials behaves identically to one without (AC-2107-1). Do not "helpfully" resolve identity when a token happens to be present; that turns cache keys and logs into identity leaks on the class that promised none.
+- Rate-limited on the public class budget keyed by client address (AC-2107-2, AC-2113-3).
+- Emits `authClass=public` to telemetry; never a user attribute.
+
+### user
+
+- Resolves identity from the project's chosen transport (bearer token or cookie session per the project-level auth reconciliation) and exposes it read-only to the handler (AC-2107-3).
+- Missing, expired, or invalid credentials: 401 with the problem-details envelope. Valid credentials are the entry ticket; authorisation beyond class membership stays in the handler.
+- Rate-limited per identity on the user budget.
+
+### admin
+
+- Everything `user` does, then requires the admin role; an authenticated non-admin receives 403, not 404-style concealment, unless the project explicitly decides otherwise in its own decision record (AC-2107-4).
+- Audit-logs every request, success or rejection: acting identity, endpoint, outcome, request id (AC-2107-5).
+- Elevated rate budget per identity.
+
+### service
+
+- Authenticates the calling service by mTLS or request signature; resolves a service principal and never a user identity (AC-2107-6).
+- User and admin tokens are rejected here with 403: classes do not substitute for each other (AC-2107-8).
+- Audit-logs every request with the service principal; counts against the service budget, independent of user traffic (AC-2107-7).
+
+## Cross-cutting rules
+
+- Enforcement position: the slot runs inside the shared pipeline before any handler code; a request failing its slot never reaches the handler (AC-2106-3).
+- Single declaration: the slot is selected by the same metadata that publishes `x-auth-class` in the generated spec; changing the declaration changes enforcement with no second edit site (AC-2106-4).
+- Closed set: these four slots are the only auth code paths in the service (AC-2106-6). The probes are declared `public` and additionally exempt from rate limiting per application-api-rest-REQ-006.
+- Rejection shapes: 401 for unresolvable credentials, 403 for resolved-but-insufficient, always with the problem-details envelope (AC-2106-5).

package/blueprints/application-api-rest/assets/openapi/openapi-skeleton.yaml

@@ -0,0 +1,322 @@
+# OpenAPI 3.1 skeleton for the application-api-rest blueprint.
+#
+# This is a reference shape, not the project's spec: the project's spec is
+# GENERATED FROM SOURCE at build time (application-api-rest-REQ-004, ADR-307-application-api-rest-openapi-generation).
+# The working agent uses this skeleton as the target anatomy the generator's
+# output must exhibit: the probe endpoints, the problem-details schema, the
+# pagination envelope, the 429 shape, and the x-auth-class extension are
+# pre-populated here exactly as the acceptance criteria expect them.
+#
+# Everything under paths/ with an x-blueprint-note is illustrative; the
+# /healthz/* and /v1/_meta entries are normative shapes.
+
+openapi: 3.1.0
+info:
+  title: Service API
+  version: 1.0.0
+  description: >
+    Replace with the project's service description. Business endpoints live
+    under /v1 (application-api-rest-REQ-003); probes and documentation endpoints sit outside
+    the version prefix.
+
+paths:
+  /healthz/live:
+    get:
+      operationId: probeLiveness
+      summary: Liveness probe. 200 while the process can serve any request. No dependency checks.
+      x-auth-class: public
+      x-probe: live
+      responses:
+        "200":
+          description: Process is alive.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProbeLive"
+
+  /healthz/ready:
+    get:
+      operationId: probeReadiness
+      summary: Readiness probe. 200 only when every declared downstream check passes.
+      x-auth-class: public
+      x-probe: ready
+      responses:
+        "200":
+          description: All declared dependency checks pass.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProbeReady"
+        "503":
+          description: One or more declared checks failing; body enumerates them.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProbeReady"
+
+  /healthz/startup:
+    get:
+      operationId: probeStartup
+      summary: Startup probe. 200 once initialisation (migrations, cache warm, config load) completes.
+      x-auth-class: public
+      x-probe: startup
+      responses:
+        "200":
+          description: Initialisation complete.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProbeStartup"
+        "503":
+          description: Initialisation still in progress; body names pending steps.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProbeStartup"
+
+  /v1/_meta:
+    get:
+      operationId: getMeta
+      summary: Reports the running application version and current schema version.
+      x-auth-class: service
+      responses:
+        "200":
+          description: Version report.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Meta"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  /v1/widgets:
+    get:
+      operationId: listWidgets
+      summary: Illustrative collection endpoint showing pagination, filtering, and sorting anatomy.
+      x-auth-class: user
+      x-blueprint-note: Illustrative. Replace with the project's resources; keep the parameter and envelope anatomy.
+      parameters:
+        - name: cursor
+          in: query
+          schema: { type: string }
+          description: Opaque cursor from a previous page's next or prev.
+        - name: limit
+          in: query
+          schema: { type: integer, minimum: 1, maximum: 100, default: 25 }
+          description: Page size; the declared maximum is enforced with a 400 beyond it.
+        - name: includeTotal
+          in: query
+          schema: { type: boolean, default: false }
+          description: Totals are expensive and off by default (AC-2109-6).
+        - name: status
+          in: query
+          schema: { type: string, enum: [active, archived] }
+          description: Illustrative declared filter; undeclared parameters are rejected with 400.
+        - name: sort
+          in: query
+          schema: { type: string }
+          description: "Comma-separated keys, leading minus for descending: sort=name,-createdAt"
+      responses:
+        "200":
+          description: One page of widgets.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WidgetPage"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "429":
+          $ref: "#/components/responses/TooManyRequests"
+    post:
+      operationId: createWidget
+      summary: Illustrative creation endpoint showing idempotency-key anatomy.
+      x-auth-class: user
+      x-idempotency-required: true
+      x-blueprint-note: Illustrative. Duplicate-harmful mutations declare the key required (application-api-rest-REQ-010).
+      parameters:
+        - name: Idempotency-Key
+          in: header
+          required: true
+          schema: { type: string, maxLength: 255 }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/WidgetCreate"
+      responses:
+        "201":
+          description: Created; body carries the resulting representation, Location resolves to it.
+          headers:
+            Location:
+              schema: { type: string }
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Widget"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "409":
+          description: Same Idempotency-Key still processing (AC-2112-5).
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
+        "422":
+          description: Idempotency-Key reused with a different body (AC-2112-4).
+          content:
+            application/problem+json:
+              schema:
+                $ref: "#/components/schemas/ProblemDetails"
+        "429":
+          $ref: "#/components/responses/TooManyRequests"
+
+components:
+  schemas:
+    ProblemDetails:
+      type: object
+      description: RFC 7807 problem details; the only error body the service emits (application-api-rest-REQ-009).
+      required: [type, title, status, detail, instance]
+      properties:
+        type:
+          type: string
+          format: uri
+          description: URI identifying the problem type; dereferences to human documentation.
+        title:
+          type: string
+          description: Short human-readable summary, stable per type.
+        status:
+          type: integer
+          description: Always equals the HTTP status of the carrying response (AC-2111-3).
+        detail:
+          type: string
+          description: Occurrence-specific, actionable for 4xx; never internals for 5xx.
+        instance:
+          type: string
+          description: Correlation handle; carries the request id (AC-2117-5).
+      # Service-specific extensions are declared here, never ad-hoc (AC-2111-2).
+
+    PageInfo:
+      type: object
+      description: Pagination envelope fields shared by every collection (application-api-rest-REQ-007).
+      required: [next, prev]
+      properties:
+        next:
+          type: [string, "null"]
+          description: Opaque cursor for the next page; null on the last page.
+        prev:
+          type: [string, "null"]
+          description: Opaque cursor for the previous page; null on the first page.
+        total:
+          type: integer
+          description: Present only when includeTotal=true was requested.
+
+    ProbeLive:
+      type: object
+      required: [status]
+      properties:
+        status:
+          type: string
+          enum: [ok]
+
+    ProbeReady:
+      type: object
+      required: [status, checks]
+      properties:
+        status:
+          type: string
+          enum: [ok, failing]
+        checks:
+          type: array
+          items:
+            type: object
+            required: [name, status]
+            properties:
+              name: { type: string }
+              status: { type: string, enum: [ok, failing] }
+              detail: { type: string }
+
+    ProbeStartup:
+      type: object
+      required: [status, pending]
+      properties:
+        status:
+          type: string
+          enum: [ok, initialising]
+        pending:
+          type: array
+          description: Initialisation steps not yet complete; empty when status is ok.
+          items: { type: string }
+
+    Meta:
+      type: object
+      required: [appVersion, schemaVersion]
+      properties:
+        appVersion: { type: string }
+        schemaVersion: { type: string }
+
+    Widget:
+      type: object
+      x-blueprint-note: Illustrative resource representation; note camelCase and RFC-3339 UTC timestamps (application-api-rest-REQ-002).
+      required: [id, name, status, createdAt, updatedAt]
+      properties:
+        id: { type: string }
+        name: { type: string }
+        status: { type: string, enum: [active, archived] }
+        createdAt: { type: string, format: date-time }
+        updatedAt: { type: string, format: date-time }
+
+    WidgetCreate:
+      type: object
+      required: [name]
+      properties:
+        name: { type: string, minLength: 1 }
+
+    WidgetPage:
+      type: object
+      required: [items, next, prev]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/Widget"
+        next:
+          type: [string, "null"]
+        prev:
+          type: [string, "null"]
+        total:
+          type: integer
+
+  responses:
+    BadRequest:
+      description: Request violates the contract; body names the violation (application-api-rest-REQ-008).
+      content:
+        application/problem+json:
+          schema:
+            $ref: "#/components/schemas/ProblemDetails"
+    Unauthorized:
+      description: Missing or invalid credentials (AC-2106-5).
+      content:
+        application/problem+json:
+          schema:
+            $ref: "#/components/schemas/ProblemDetails"
+    Forbidden:
+      description: Valid credentials lacking the endpoint's declared class (AC-2106-5).
+      content:
+        application/problem+json:
+          schema:
+            $ref: "#/components/schemas/ProblemDetails"
+    TooManyRequests:
+      description: Rate limit exceeded for the caller's class or the endpoint's override (application-api-rest-REQ-011).
+      headers:
+        Retry-After:
+          schema: { type: integer }
+          description: Seconds until the caller's budget refills; honest per AC-2113-5.
+      content:
+        application/problem+json:
+          schema:
+            $ref: "#/components/schemas/ProblemDetails"

package/blueprints/application-api-rest/assets/sample-data/sample-resources.json

@@ -0,0 +1,53 @@
+{
+  "description": "Neutral sample resources for contract examples, conformance fixtures, and documentation. Shapes follow the wire contract: camelCase properties, RFC-3339 UTC timestamps, opaque string ids.",
+  "widgets": [
+    {
+      "id": "wgt_01j5xq",
+      "name": "Alpha widget",
+      "status": "active",
+      "createdAt": "2026-08-19T09:14:07Z",
+      "updatedAt": "2026-08-19T09:14:07Z"
+    },
+    {
+      "id": "wgt_01j5xr",
+      "name": "Beta widget",
+      "status": "active",
+      "createdAt": "2026-08-18T16:02:33Z",
+      "updatedAt": "2026-08-19T08:41:12Z"
+    },
+    {
+      "id": "wgt_01j5xs",
+      "name": "Gamma widget",
+      "status": "archived",
+      "createdAt": "2026-07-30T11:55:20Z",
+      "updatedAt": "2026-08-02T14:08:59Z"
+    }
+  ],
+  "users": [
+    {
+      "id": "usr_01h2ab",
+      "displayName": "Sample Admin",
+      "email": "admin@example.com",
+      "roles": ["admin"],
+      "createdAt": "2026-06-01T08:00:00Z",
+      "updatedAt": "2026-08-10T09:30:00Z"
+    },
+    {
+      "id": "usr_01h2ac",
+      "displayName": "Sample User",
+      "email": "user@example.com",
+      "roles": [],
+      "createdAt": "2026-06-15T10:12:00Z",
+      "updatedAt": "2026-06-15T10:12:00Z"
+    }
+  ],
+  "servicePrincipals": [
+    {
+      "id": "svc_scheduler",
+      "displayName": "Nightly scheduler",
+      "authMethod": "mtls",
+      "createdAt": "2026-06-01T08:00:00Z",
+      "updatedAt": "2026-06-01T08:00:00Z"
+    }
+  ]
+}