// crubal.com/party: who acts. The three caller kinds, what any adopter needs of them, and the facets that
// access reads. Authentication stays in the host; roles and presets stay in the adopter's package.
package: party /2026-10-16
  owner: crubal.com
  label: Parties
  crubal: 2
  licence: CC-BY-4.0
  prefixes:
    schema: https://schema.org/

kind: person
  levels: person
  base: Person
  schema:
    person: schema:Person
kind: organization
  levels: organization
  base: Organization
  schema:
    organization: schema:Organization
kind: system
  levels: system
  base: System
  schema:
    system: schema:SoftwareApplication

// Any party
!name$200 =schema:name
image^ =schema:image
url$ =schema:url
email$ =schema:email
phone$ =schema:telephone
description$ =schema:description
roles&role*
memberOf&organization* =schema:memberOf

// People
givenName$ =schema:givenName
familyName$ =schema:familyName
locale$                                  // BCP 47: en-GB
timezone$                                // IANA: Europe/London
signedUp@ymdhm

// Organizations
legalName$ =schema:legalName
domain$ unique                           // the owner domain when the organization is one
taxId$ =schema:taxID
facet: address
  type: compound
  same-as: schema:address
  facets:
    street$ =schema:streetAddress
    locality$ =schema:addressLocality
    region$ =schema:addressRegion
    postalCode$ =schema:postalCode
    country$ =schema:addressCountry        // ISO 3166-1 alpha-2

// Systems
operator&organization                    // who runs it
systemKind{utility|partner|agent}
scheme{oauth2|apikey|basic|none}
scopes$*                                 // what was granted
requests$*                               // the menu items it asked for (14.9)
connection{connected|expired|revoked}
connectedAt@ymdhm
version$

class: Person
  for: person
  facets:
    !name
    givenName
    familyName
    image
    email
    phone
    locale
    timezone
    roles
    memberOf
    signedUp
class: Organization
  for: organization
  facets:
    !name
    legalName
    domain
    url
    email
    phone
    address
    image
    description
    taxId
class: System
  for: system
  facets:
    !name
    operator
    systemKind
    url
    scheme
    scopes
    requests
    connection
    connectedAt
    version
    roles

// Contact details and tax identity are for the owner's people, never for the public or other members.
rule: emailIsPrivate
  for: everywhere
  strength: must
  then: email shown to staff
rule: phoneIsPrivate
  for: everywhere
  strength: must
  then: phone shown to staff
rule: addressIsPrivate
  for: everywhere
  strength: must
  then: address shown to staff
rule: taxIdIsPrivate
  for: everywhere
  strength: must
  then: taxId shown to staff

// The host writes the connection through this form (host.md). The form is the party package's so every host
// writes the same record; the edge that grants what the system asked for is the adopter's (14.9).
contract: connect
  kind: form
  origin: observed
  needs:
    !name
    scheme
    scopes
    requests
    connection
    connectedAt

// A person keeps their own details. Who may run it is the adopter's edge (consume on their own record).
contract: profile
  kind: form
  origin: declared
  needs:
    !name
    givenName
    familyName
    image
    email
    phone
    locale
    timezone