Data models

packages/shared (@redline/shared) is the single source of truth for the domain. Every schema is a Zod definition: MCP tools use <Schema>.shape as their input schema, the REST API validates with <Schema>.parse(), the persistence layer maps rows to the inferred types, and the static site mirrors them in schema.org JSON-LD. Change a shape here and it propagates everywhere.

Schema files

File	Domain objects & enums
vehicle.ts	VehicleType, FuelType, Transmission, Condition, ListingStatus, ModerationStatus, Currency, search/create/update inputs, VehicleListing
seller.ts	SellerType, ContactMethod, Language, SellerPlan, profile + location inputs, Seller
organization.ts	OrgRole, org core/create/update inputs, Organization, OrganizationMember
account.ts	account profile, Favorite, SavedSearch, NotificationChannel
review.ts	review input, Review, ReviewList (RATING_MIN=1, RATING_MAX=5)
audit.ts	AuditAction, audit log input/entry/query
scopes.ts	LISTINGS_READ, LISTINGS_WRITE, LISTINGS_MODERATE, ALL_SCOPES
brand.ts	BRAND_NAME (A-Market), BRAND_DOMAIN (amrkt.ch), MCP_RESOURCE_NAME

Key enums

Enum	Values
Vehicle types	car, motorcycle, scooter, other
Fuel types	petrol, diesel, electric, hybrid, plugin_hybrid, lpg, cng, hydrogen, other
Transmissions	manual, automatic, semi_automatic
Conditions	new, used
Listing status	active, sold, draft
Moderation status	approved, pending, rejected
Seller types	private, dealer, brand_dealer
Contact methods	phone, email, whatsapp, form
Languages	de, fr, it, en
Org roles	owner, member
Audit actions	listing.create, listing.update, listing.delete, listing.restore, listing.moderate

OAuth scopes

Scope	Grants
listings:read	Search/read listings; manage your own account, favorites, saved searches, reviews
listings:write	Create/update/delete listings; manage your seller profile, locations, and organizations
listings:moderate	Moderation queue, soft-delete restore, audit log, review moderation (staff-only)

Identity

A user's identity is the Keycloak subject (sub). It is stored as sellers.id / accounts.id and as dealer_id on a listing. The token must carry a sub, or it is rejected — see the cross-account-leak fix in Architecture.