@contractspec/bundle.library 3.8.10 → 3.8.12

package/dist/node/components/docs/safety/SafetyPDPPage.js

@@ -1,189 +1,4 @@
-// src/components/docs/safety/SafetyPDPPage.tsx
-import Link from "@contractspec/lib.ui-link";
-import { ChevronRight } from "lucide-react";
-import { jsx, jsxs } from "react/jsx-runtime";
-function SafetyPDPPage() {
-  return /* @__PURE__ */ jsxs("div", {
-    className: "space-y-8",
-    children: [
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h1", {
-            className: "font-bold text-4xl",
-            children: "Policy Decision Points"
-          }),
-          /* @__PURE__ */ jsxs("p", {
-            className: "text-muted-foreground",
-            children: [
-              "A ",
-              /* @__PURE__ */ jsx("strong", {
-                children: "Policy Decision Point (PDP)"
-              }),
-              " is a centralized component that evaluates access control policies and makes authorization decisions. According to",
-              " ",
-              /* @__PURE__ */ jsx("a", {
-                href: "https://www.strongdm.com/blog/policy-decision-point",
-                target: "_blank",
-                rel: "noopener noreferrer",
-                className: "text-violet-400 hover:text-violet-300",
-                children: "StrongDM"
-              }),
-              ', the PDP "receives requests for access to resources, evaluates them against policies, and returns a decision (permit or deny)."'
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "How the PDP works in ContractSpec"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "In ContractSpec, the PDP is invoked on every operation—whether it's rendering a UI component, executing a capability, or querying a data view. The flow is:"
-          }),
-          /* @__PURE__ */ jsxs("ol", {
-            className: "list-inside list-decimal space-y-3 text-muted-foreground",
-            children: [
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Request evaluation"
-                  }),
-                  " – The runtime sends a request to the PDP containing:",
-                  /* @__PURE__ */ jsxs("ul", {
-                    className: "mt-2 ml-6 list-inside list-disc space-y-1",
-                    children: [
-                      /* @__PURE__ */ jsx("li", {
-                        children: "The user's identity and attributes (roles, groups, location, etc.)"
-                      }),
-                      /* @__PURE__ */ jsx("li", {
-                        children: "The resource being accessed (capability, field, workflow step)"
-                      }),
-                      /* @__PURE__ */ jsx("li", {
-                        children: "The action being performed (read, write, execute)"
-                      }),
-                      /* @__PURE__ */ jsx("li", {
-                        children: "Contextual information (time of day, device type, IP address)"
-                      })
-                    ]
-                  })
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Policy evaluation"
-                  }),
-                  " – The PDP evaluates the request against all applicable ",
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "PolicySpecs"
-                  }),
-                  ". These specs define rules using attribute-based access control (ABAC) and can reference:",
-                  /* @__PURE__ */ jsxs("ul", {
-                    className: "mt-2 ml-6 list-inside list-disc space-y-1",
-                    children: [
-                      /* @__PURE__ */ jsx("li", {
-                        children: `User attributes (e.g., "role == 'admin'")`
-                      }),
-                      /* @__PURE__ */ jsx("li", {
-                        children: `Resource attributes (e.g., "field.sensitivity == 'PII'")`
-                      }),
-                      /* @__PURE__ */ jsx("li", {
-                        children: 'Environmental attributes (e.g., "time.hour >= 9 AND time.hour < 17")'
-                      })
-                    ]
-                  })
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Decision return"
-                  }),
-                  " – The PDP returns one of:",
-                  /* @__PURE__ */ jsxs("ul", {
-                    className: "mt-2 ml-6 list-inside list-disc space-y-1",
-                    children: [
-                      /* @__PURE__ */ jsxs("li", {
-                        children: [
-                          /* @__PURE__ */ jsx("code", {
-                            className: "rounded bg-background/50 px-2 py-1",
-                            children: "PERMIT"
-                          }),
-                          " ",
-                          "– The operation is allowed."
-                        ]
-                      }),
-                      /* @__PURE__ */ jsxs("li", {
-                        children: [
-                          /* @__PURE__ */ jsx("code", {
-                            className: "rounded bg-background/50 px-2 py-1",
-                            children: "DENY"
-                          }),
-                          " ",
-                          "– The operation is blocked."
-                        ]
-                      }),
-                      /* @__PURE__ */ jsxs("li", {
-                        children: [
-                          /* @__PURE__ */ jsx("code", {
-                            className: "rounded bg-background/50 px-2 py-1",
-                            children: "REDACT"
-                          }),
-                          " ",
-                          "– The operation is allowed, but sensitive fields are masked."
-                        ]
-                      })
-                    ]
-                  })
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Enforcement"
-                  }),
-                  " – The runtime enforces the decision. If denied, the operation fails with a clear error message. If redacted, sensitive fields are replaced with placeholders."
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Auditing"
-                  }),
-                  " – Every PDP decision is logged to the",
-                  " ",
-                  /* @__PURE__ */ jsx(Link, {
-                    href: "/docs/safety/auditing",
-                    className: "text-violet-400 hover:text-violet-300",
-                    children: "audit log"
-                  }),
-                  ", including the request, decision, and reasoning."
-                ]
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Example PolicySpec"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "Here's a simple policy that restricts access to PII fields:"
-          }),
-          /* @__PURE__ */ jsx("div", {
-            className: "overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",
-            children: /* @__PURE__ */ jsx("pre", {
-              children: `policyId: pii-access-control
+import A from"@contractspec/lib.ui-link";import{ChevronRight as B}from"lucide-react";import{jsx as q,jsxs as z}from"react/jsx-runtime";function G(){return z("div",{className:"space-y-8",children:[z("div",{className:"space-y-4",children:[q("h1",{className:"font-bold text-4xl",children:"Policy Decision Points"}),z("p",{className:"text-muted-foreground",children:["A ",q("strong",{children:"Policy Decision Point (PDP)"})," is a centralized component that evaluates access control policies and makes authorization decisions. According to"," ",q("a",{href:"https://www.strongdm.com/blog/policy-decision-point",target:"_blank",rel:"noopener noreferrer",className:"text-violet-400 hover:text-violet-300",children:"StrongDM"}),', the PDP "receives requests for access to resources, evaluates them against policies, and returns a decision (permit or deny)."']})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"How the PDP works in ContractSpec"}),q("p",{className:"text-muted-foreground",children:"In ContractSpec, the PDP is invoked on every operation—whether it's rendering a UI component, executing a capability, or querying a data view. The flow is:"}),z("ol",{className:"list-inside list-decimal space-y-3 text-muted-foreground",children:[z("li",{children:[q("strong",{children:"Request evaluation"})," – The runtime sends a request to the PDP containing:",z("ul",{className:"mt-2 ml-6 list-inside list-disc space-y-1",children:[q("li",{children:"The user's identity and attributes (roles, groups, location, etc.)"}),q("li",{children:"The resource being accessed (capability, field, workflow step)"}),q("li",{children:"The action being performed (read, write, execute)"}),q("li",{children:"Contextual information (time of day, device type, IP address)"})]})]}),z("li",{children:[q("strong",{children:"Policy evaluation"})," – The PDP evaluates the request against all applicable ",q("strong",{children:"PolicySpecs"}),". These specs define rules using attribute-based access control (ABAC) and can reference:",z("ul",{className:"mt-2 ml-6 list-inside list-disc space-y-1",children:[q("li",{children:`User attributes (e.g., "role == 'admin'")`}),q("li",{children:`Resource attributes (e.g., "field.sensitivity == 'PII'")`}),q("li",{children:'Environmental attributes (e.g., "time.hour >= 9 AND time.hour < 17")'})]})]}),z("li",{children:[q("strong",{children:"Decision return"})," – The PDP returns one of:",z("ul",{className:"mt-2 ml-6 list-inside list-disc space-y-1",children:[z("li",{children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"PERMIT"})," ","– The operation is allowed."]}),z("li",{children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"DENY"})," ","– The operation is blocked."]}),z("li",{children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"REDACT"})," ","– The operation is allowed, but sensitive fields are masked."]})]})]}),z("li",{children:[q("strong",{children:"Enforcement"})," – The runtime enforces the decision. If denied, the operation fails with a clear error message. If redacted, sensitive fields are replaced with placeholders."]}),z("li",{children:[q("strong",{children:"Auditing"})," – Every PDP decision is logged to the"," ",q(A,{href:"/docs/safety/auditing",className:"text-violet-400 hover:text-violet-300",children:"audit log"}),", including the request, decision, and reasoning."]})]})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Example PolicySpec"}),q("p",{className:"text-muted-foreground",children:"Here's a simple policy that restricts access to PII fields:"}),q("div",{className:"overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",children:q("pre",{children:`policyId: pii-access-control
 version: '1.0.0'.0.0
 rules:
   - id: allow-admin-full-access
@@ -201,118 +16,4 @@ rules:
     effect: DENY
     condition: |
       user.role NOT IN ['admin', 'support'] AND
-      field.sensitivity == 'PII'`
-            })
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "With this policy, admins see all data, support staff see redacted PII, and other users cannot access PII at all."
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Benefits of centralized decision-making"
-          }),
-          /* @__PURE__ */ jsxs("ul", {
-            className: "list-inside list-disc space-y-2 text-muted-foreground",
-            children: [
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Consistency"
-                  }),
-                  " – Policies are enforced uniformly across all surfaces (API, UI, workflows)."
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Auditability"
-                  }),
-                  " – Every decision is logged, making it easy to trace why access was granted or denied."
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Flexibility"
-                  }),
-                  " – Policies can be updated without changing application code."
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Security"
-                  }),
-                  " – Reduces the risk of authorization bugs by removing ad-hoc checks scattered throughout the codebase."
-                ]
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Performance considerations"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "Because the PDP is invoked on every operation, performance is critical. ContractSpec optimizes this by:"
-          }),
-          /* @__PURE__ */ jsxs("ul", {
-            className: "list-inside list-disc space-y-2 text-muted-foreground",
-            children: [
-              /* @__PURE__ */ jsx("li", {
-                children: "Caching policy decisions for identical requests"
-              }),
-              /* @__PURE__ */ jsx("li", {
-                children: "Compiling policies into efficient bytecode"
-              }),
-              /* @__PURE__ */ jsx("li", {
-                children: "Evaluating only the minimal set of rules needed for each request"
-              }),
-              /* @__PURE__ */ jsx("li", {
-                children: "Running the PDP in-process to avoid network latency"
-              })
-            ]
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "In practice, PDP overhead is typically less than 1ms per request."
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "flex items-center gap-4 pt-4",
-        children: [
-          /* @__PURE__ */ jsx(Link, {
-            href: "/docs/safety/signing",
-            className: "btn-ghost",
-            children: "Previous: Spec Signing"
-          }),
-          /* @__PURE__ */ jsxs(Link, {
-            href: "/docs/safety/auditing",
-            className: "btn-primary",
-            children: [
-              "Next: Audit Logs ",
-              /* @__PURE__ */ jsx(ChevronRight, {
-                size: 16
-              })
-            ]
-          })
-        ]
-      })
-    ]
-  });
-}
-export {
-  SafetyPDPPage
-};
+      field.sensitivity == 'PII'`})}),q("p",{className:"text-muted-foreground",children:"With this policy, admins see all data, support staff see redacted PII, and other users cannot access PII at all."})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Benefits of centralized decision-making"}),z("ul",{className:"list-inside list-disc space-y-2 text-muted-foreground",children:[z("li",{children:[q("strong",{children:"Consistency"})," – Policies are enforced uniformly across all surfaces (API, UI, workflows)."]}),z("li",{children:[q("strong",{children:"Auditability"})," – Every decision is logged, making it easy to trace why access was granted or denied."]}),z("li",{children:[q("strong",{children:"Flexibility"})," – Policies can be updated without changing application code."]}),z("li",{children:[q("strong",{children:"Security"})," – Reduces the risk of authorization bugs by removing ad-hoc checks scattered throughout the codebase."]})]})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Performance considerations"}),q("p",{className:"text-muted-foreground",children:"Because the PDP is invoked on every operation, performance is critical. ContractSpec optimizes this by:"}),z("ul",{className:"list-inside list-disc space-y-2 text-muted-foreground",children:[q("li",{children:"Caching policy decisions for identical requests"}),q("li",{children:"Compiling policies into efficient bytecode"}),q("li",{children:"Evaluating only the minimal set of rules needed for each request"}),q("li",{children:"Running the PDP in-process to avoid network latency"})]}),q("p",{className:"text-muted-foreground",children:"In practice, PDP overhead is typically less than 1ms per request."})]}),z("div",{className:"flex items-center gap-4 pt-4",children:[q(A,{href:"/docs/safety/signing",className:"btn-ghost",children:"Previous: Spec Signing"}),z(A,{href:"/docs/safety/auditing",className:"btn-primary",children:["Next: Audit Logs ",q(B,{size:16})]})]})]})}export{G as SafetyPDPPage};

package/dist/node/components/docs/safety/SafetySecurityTrustPage.js

@@ -1,206 +1 @@
-// src/components/docs/safety/SafetySecurityTrustPage.tsx
-import Link from "@contractspec/lib.ui-link";
-import { ChevronRight } from "lucide-react";
-import { jsx, jsxs } from "react/jsx-runtime";
-function SafetySecurityTrustPage() {
-  return /* @__PURE__ */ jsxs("div", {
-    className: "space-y-8",
-    children: [
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h1", {
-            className: "font-bold text-4xl",
-            children: "Security & Trust"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "ContractSpec focuses on deterministic, auditable software delivery. This page summarizes our security posture and trust commitments so teams can adopt with clarity."
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "card-subtle space-y-4 p-6",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Security policy"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground text-sm",
-            children: "We publish a dedicated security policy that explains how to report vulnerabilities and how we respond."
-          }),
-          /* @__PURE__ */ jsxs(Link, {
-            href: "/SECURITY.md",
-            className: "btn-primary",
-            children: [
-              "Read the security policy ",
-              /* @__PURE__ */ jsx(ChevronRight, {
-                size: 16
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "grid gap-4 md:grid-cols-2",
-        children: [
-          /* @__PURE__ */ jsxs("div", {
-            className: "card-subtle space-y-3 p-6",
-            children: [
-              /* @__PURE__ */ jsx("h3", {
-                className: "font-semibold text-lg",
-                children: "Release hygiene"
-              }),
-              /* @__PURE__ */ jsx("p", {
-                className: "text-muted-foreground text-sm",
-                children: "We ship with deterministic CI, changesets, and contract validation so teams can trust every release."
-              }),
-              /* @__PURE__ */ jsxs("ul", {
-                className: "space-y-2 text-muted-foreground text-sm",
-                children: [
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Changesets required for published packages."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "CI gate for contract validation and drift detection."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Rollback-friendly release process."
-                  })
-                ]
-              })
-            ]
-          }),
-          /* @__PURE__ */ jsxs("div", {
-            className: "card-subtle space-y-3 p-6",
-            children: [
-              /* @__PURE__ */ jsx("h3", {
-                className: "font-semibold text-lg",
-                children: "Data handling"
-              }),
-              /* @__PURE__ */ jsx("p", {
-                className: "text-muted-foreground text-sm",
-                children: "ContractSpec promotes strict data classification and policy-driven access. Specs can tag sensitive fields for enforcement."
-              }),
-              /* @__PURE__ */ jsxs("ul", {
-                className: "space-y-2 text-muted-foreground text-sm",
-                children: [
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Schema-level sensitivity tags."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Policy Decision Point enforcement."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Audit logs for operational traceability."
-                  })
-                ]
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "grid gap-4 md:grid-cols-2",
-        children: [
-          /* @__PURE__ */ jsxs("div", {
-            className: "card-subtle space-y-3 p-6",
-            children: [
-              /* @__PURE__ */ jsx("h3", {
-                className: "font-semibold text-lg",
-                children: "Supply chain"
-              }),
-              /* @__PURE__ */ jsx("p", {
-                className: "text-muted-foreground text-sm",
-                children: "We track dependency updates and keep the monorepo build reproducible."
-              }),
-              /* @__PURE__ */ jsxs("ul", {
-                className: "space-y-2 text-muted-foreground text-sm",
-                children: [
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Dependabot + Renovate-style updates where available."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Signed release artifacts planned for Studio release cycles."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Transparent changelogs for every package."
-                  })
-                ]
-              })
-            ]
-          }),
-          /* @__PURE__ */ jsxs("div", {
-            className: "card-subtle space-y-3 p-6",
-            children: [
-              /* @__PURE__ */ jsx("h3", {
-                className: "font-semibold text-lg",
-                children: "Responsible disclosure"
-              }),
-              /* @__PURE__ */ jsx("p", {
-                className: "text-muted-foreground text-sm",
-                children: "We respond quickly to security reports and coordinate fixes before public disclosure."
-              }),
-              /* @__PURE__ */ jsxs("ul", {
-                className: "space-y-2 text-muted-foreground text-sm",
-                children: [
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Security response within 5 business days."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Private disclosure via security@contractspec.io."
-                  }),
-                  /* @__PURE__ */ jsx("li", {
-                    children: "Credit for researchers (with permission)."
-                  })
-                ]
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Next steps"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "Explore the broader safety controls or read the roadmap to see upcoming trust investments."
-          }),
-          /* @__PURE__ */ jsxs("div", {
-            className: "flex flex-wrap gap-4 pt-4",
-            children: [
-              /* @__PURE__ */ jsxs(Link, {
-                href: "/docs/safety",
-                className: "btn-ghost",
-                children: [
-                  "Safety overview ",
-                  /* @__PURE__ */ jsx(ChevronRight, {
-                    size: 16
-                  })
-                ]
-              }),
-              /* @__PURE__ */ jsxs(Link, {
-                href: "/ROADMAP.md",
-                className: "btn-ghost",
-                children: [
-                  "Roadmap ",
-                  /* @__PURE__ */ jsx(ChevronRight, {
-                    size: 16
-                  })
-                ]
-              })
-            ]
-          })
-        ]
-      })
-    ]
-  });
-}
-export {
-  SafetySecurityTrustPage
-};
+import a from"@contractspec/lib.ui-link";import{ChevronRight as i}from"lucide-react";import{jsx as e,jsxs as t}from"react/jsx-runtime";function s(){return t("div",{className:"space-y-8",children:[t("div",{className:"space-y-4",children:[e("h1",{className:"font-bold text-4xl",children:"Security & Trust"}),e("p",{className:"text-muted-foreground",children:"ContractSpec focuses on deterministic, auditable software delivery. This page summarizes our security posture and trust commitments so teams can adopt with clarity."})]}),t("div",{className:"card-subtle space-y-4 p-6",children:[e("h2",{className:"font-bold text-2xl",children:"Security policy"}),e("p",{className:"text-muted-foreground text-sm",children:"We publish a dedicated security policy that explains how to report vulnerabilities and how we respond."}),t(a,{href:"/SECURITY.md",className:"btn-primary",children:["Read the security policy ",e(i,{size:16})]})]}),t("div",{className:"grid gap-4 md:grid-cols-2",children:[t("div",{className:"card-subtle space-y-3 p-6",children:[e("h3",{className:"font-semibold text-lg",children:"Release hygiene"}),e("p",{className:"text-muted-foreground text-sm",children:"We ship with deterministic CI, changesets, and contract validation so teams can trust every release."}),t("ul",{className:"space-y-2 text-muted-foreground text-sm",children:[e("li",{children:"Changesets required for published packages."}),e("li",{children:"CI gate for contract validation and drift detection."}),e("li",{children:"Rollback-friendly release process."})]})]}),t("div",{className:"card-subtle space-y-3 p-6",children:[e("h3",{className:"font-semibold text-lg",children:"Data handling"}),e("p",{className:"text-muted-foreground text-sm",children:"ContractSpec promotes strict data classification and policy-driven access. Specs can tag sensitive fields for enforcement."}),t("ul",{className:"space-y-2 text-muted-foreground text-sm",children:[e("li",{children:"Schema-level sensitivity tags."}),e("li",{children:"Policy Decision Point enforcement."}),e("li",{children:"Audit logs for operational traceability."})]})]})]}),t("div",{className:"grid gap-4 md:grid-cols-2",children:[t("div",{className:"card-subtle space-y-3 p-6",children:[e("h3",{className:"font-semibold text-lg",children:"Supply chain"}),e("p",{className:"text-muted-foreground text-sm",children:"We track dependency updates and keep the monorepo build reproducible."}),t("ul",{className:"space-y-2 text-muted-foreground text-sm",children:[e("li",{children:"Dependabot + Renovate-style updates where available."}),e("li",{children:"Signed release artifacts planned for Studio release cycles."}),e("li",{children:"Transparent changelogs for every package."})]})]}),t("div",{className:"card-subtle space-y-3 p-6",children:[e("h3",{className:"font-semibold text-lg",children:"Responsible disclosure"}),e("p",{className:"text-muted-foreground text-sm",children:"We respond quickly to security reports and coordinate fixes before public disclosure."}),t("ul",{className:"space-y-2 text-muted-foreground text-sm",children:[e("li",{children:"Security response within 5 business days."}),e("li",{children:"Private disclosure via security@contractspec.io."}),e("li",{children:"Credit for researchers (with permission)."})]})]})]}),t("div",{className:"space-y-4",children:[e("h2",{className:"font-bold text-2xl",children:"Next steps"}),e("p",{className:"text-muted-foreground",children:"Explore the broader safety controls or read the roadmap to see upcoming trust investments."}),t("div",{className:"flex flex-wrap gap-4 pt-4",children:[t(a,{href:"/docs/safety",className:"btn-ghost",children:["Safety overview ",e(i,{size:16})]}),t(a,{href:"/ROADMAP.md",className:"btn-ghost",children:["Roadmap ",e(i,{size:16})]})]})]})]})}export{s as SafetySecurityTrustPage};

package/dist/node/components/docs/safety/SafetySigningPage.js

@@ -1,92 +1,5 @@
-// src/components/docs/safety/SafetySigningPage.tsx
-import Link from "@contractspec/lib.ui-link";
-import { ChevronRight } from "lucide-react";
-import { jsx, jsxs } from "react/jsx-runtime";
-function SafetySigningPage() {
-  return /* @__PURE__ */ jsxs("div", {
-    className: "space-y-8",
-    children: [
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-2",
-        children: [
-          /* @__PURE__ */ jsx("h1", {
-            className: "font-bold text-4xl",
-            children: "Spec Signing"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-lg text-muted-foreground",
-            children: "Signing ensures specs haven't been tampered with and provides an audit trail of all changes."
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-6",
-        children: [
-          /* @__PURE__ */ jsxs("div", {
-            className: "space-y-3",
-            children: [
-              /* @__PURE__ */ jsx("h2", {
-                className: "font-bold text-2xl",
-                children: "How it works"
-              }),
-              /* @__PURE__ */ jsx("p", {
-                className: "text-muted-foreground",
-                children: "Every spec is cryptographically signed before deployment. The signature proves that the spec hasn't been modified since it was signed and creates a permanent record of who deployed it and when."
-              })
-            ]
-          }),
-          /* @__PURE__ */ jsxs("div", {
-            className: "space-y-3",
-            children: [
-              /* @__PURE__ */ jsx("h2", {
-                className: "font-bold text-2xl",
-                children: "Signing a spec"
-              }),
-              /* @__PURE__ */ jsx("div", {
-                className: "overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",
-                children: /* @__PURE__ */ jsx("pre", {
-                  children: `contractspec sign app.spec.ts --key ~/.contractspec/key.pem
-contractspec deploy --signed app.spec.ts.signed`
-                })
-              })
-            ]
-          }),
-          /* @__PURE__ */ jsxs("div", {
-            className: "space-y-3",
-            children: [
-              /* @__PURE__ */ jsx("h2", {
-                className: "font-bold text-2xl",
-                children: "Verifying signatures"
-              }),
-              /* @__PURE__ */ jsx("div", {
-                className: "overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",
-                children: /* @__PURE__ */ jsx("pre", {
-                  children: `contractspec verify app.spec.ts.signed
+import z from"@contractspec/lib.ui-link";import{ChevronRight as A}from"lucide-react";import{jsx as f,jsxs as q}from"react/jsx-runtime";function E(){return q("div",{className:"space-y-8",children:[q("div",{className:"space-y-2",children:[f("h1",{className:"font-bold text-4xl",children:"Spec Signing"}),f("p",{className:"text-lg text-muted-foreground",children:"Signing ensures specs haven't been tampered with and provides an audit trail of all changes."})]}),q("div",{className:"space-y-6",children:[q("div",{className:"space-y-3",children:[f("h2",{className:"font-bold text-2xl",children:"How it works"}),f("p",{className:"text-muted-foreground",children:"Every spec is cryptographically signed before deployment. The signature proves that the spec hasn't been modified since it was signed and creates a permanent record of who deployed it and when."})]}),q("div",{className:"space-y-3",children:[f("h2",{className:"font-bold text-2xl",children:"Signing a spec"}),f("div",{className:"overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",children:f("pre",{children:`contractspec sign app.spec.ts --key ~/.contractspec/key.pem
+contractspec deploy --signed app.spec.ts.signed`})})]}),q("div",{className:"space-y-3",children:[f("h2",{className:"font-bold text-2xl",children:"Verifying signatures"}),f("div",{className:"overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",children:f("pre",{children:`contractspec verify app.spec.ts.signed
 # Output: ✓ Signature valid
 # Signed by: alice@example.com
-# Timestamp: 2024-11-08T10:30:00Z`
-                })
-              })
-            ]
-          }),
-          /* @__PURE__ */ jsx("div", {
-            className: "flex items-center gap-4 pt-4",
-            children: /* @__PURE__ */ jsxs(Link, {
-              href: "/docs/safety/pdp",
-              className: "btn-primary",
-              children: [
-                "Next: Policy Decision Points ",
-                /* @__PURE__ */ jsx(ChevronRight, {
-                  size: 16
-                })
-              ]
-            })
-          })
-        ]
-      })
-    ]
-  });
-}
-export {
-  SafetySigningPage
-};
+# Timestamp: 2024-11-08T10:30:00Z`})})]}),f("div",{className:"flex items-center gap-4 pt-4",children:q(z,{href:"/docs/safety/pdp",className:"btn-primary",children:["Next: Policy Decision Points ",f(A,{size:16})]})})]})]})}export{E as SafetySigningPage};