feat: expose core identity transport

packages/contracts/src/identity.ts

@@ -1,6 +1,16 @@
 import { z } from "zod";
 
-export const ekklesiaUserIdSchema = z.string().trim().min(1).max(128);
+/**
+ * Opaque at the type level via Zod's nominal `.brand()`: a plain `string` is not assignable to
+ * `EkklesiaUserId` without passing through `parseEkklesiaUserId`/`safeParseEkklesiaUserId`. The
+ * brand exists only in the type system — it adds no runtime tag, wrapper, or field, so a value
+ * still serializes (JSON.stringify, string concatenation, equality) as a plain opaque string.
+ * Ekklesia does not assume any particular format (in particular, not UUID): Phase 4A's identity
+ * schema stores Better Auth's default application-generated id, an opaque base62-ish string, not
+ * a database-generated UUID. Only the constraints Ekklesia itself owns are validated: non-empty
+ * after trimming, and a generous upper bound against unreasonably large values.
+ */
+export const ekklesiaUserIdSchema = z.string().trim().min(1).max(128).brand<"EkklesiaUserId">();
 
 export type EkklesiaUserId = z.infer<typeof ekklesiaUserIdSchema>;