@contractspec/lib.contracts 1.56.1 → 1.58.0

package/dist/app-config/index.js

@@ -1,9 +1,3113 @@
-import { AppBlueprintRegistry, defineAppConfig, makeAppBlueprintKey } from "./spec.js";
-import { composeAppConfig, resolveAppConfig } from "./runtime.js";
-import { validateBlueprint, validateConfig, validateResolvedConfig, validateTenantConfig } from "./validation.js";
-import { AppConfigCapability } from "./app-config.capability.js";
-import { AppConfigFeature } from "./app-config.feature.js";
-import { ConfigDraftCreatedEvent, ConfigPromotedToPreviewEvent, ConfigPublishedEvent, ConfigRolledBackEvent } from "./events.js";
-import { CreateTenantConfigDraftCommand, GetTenantConfigVersionQuery, ListTenantConfigVersionsQuery, PromoteTenantConfigToPreviewCommand, PublishTenantConfigCommand, RollbackTenantConfigCommand, lifecycleContracts, registerAppConfigLifecycleContracts } from "./lifecycle-contracts.js";
-
-export { AppBlueprintRegistry, AppConfigCapability, AppConfigFeature, ConfigDraftCreatedEvent, ConfigPromotedToPreviewEvent, ConfigPublishedEvent, ConfigRolledBackEvent, CreateTenantConfigDraftCommand, GetTenantConfigVersionQuery, ListTenantConfigVersionsQuery, PromoteTenantConfigToPreviewCommand, PublishTenantConfigCommand, RollbackTenantConfigCommand, composeAppConfig, defineAppConfig, lifecycleContracts, makeAppBlueprintKey, registerAppConfigLifecycleContracts, resolveAppConfig, validateBlueprint, validateConfig, validateResolvedConfig, validateTenantConfig };
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __moduleCache = /* @__PURE__ */ new WeakMap;
+var __toCommonJS = (from) => {
+  var entry = __moduleCache.get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function")
+    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    }));
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: (newValue) => all[name] = () => newValue
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// src/registry-utils.ts
+var exports_registry_utils = {};
+__export(exports_registry_utils, {
+  groupByToArray: () => groupByToArray,
+  groupByMultiple: () => groupByMultiple,
+  groupBy: () => groupBy,
+  getUniqueTags: () => getUniqueTags,
+  getUniqueOwners: () => getUniqueOwners,
+  getUniqueDomains: () => getUniqueDomains,
+  filterBy: () => filterBy,
+  GroupingStrategies: () => GroupingStrategies
+});
+function filterBy(items, filter) {
+  return items.filter((item) => {
+    if (filter.tags?.length) {
+      const hasMatchingTag = filter.tags.some((tag) => item.meta.tags?.includes(tag));
+      if (!hasMatchingTag)
+        return false;
+    }
+    if (filter.owners?.length) {
+      const hasMatchingOwner = filter.owners.some((owner) => item.meta.owners?.includes(owner));
+      if (!hasMatchingOwner)
+        return false;
+    }
+    if (filter.stability?.length) {
+      if (!filter.stability.includes(item.meta.stability ?? "stable")) {
+        return false;
+      }
+    }
+    if (filter.domain) {
+      const itemDomain = GroupingStrategies.byDomain(item);
+      if (itemDomain !== filter.domain)
+        return false;
+    }
+    if (filter.keyPattern) {
+      const name = item.meta.key ?? item.meta.key ?? "";
+      const pattern = filter.keyPattern.replace(/\*/g, ".*").replace(/\?/g, ".");
+      const regex = new RegExp(`^${pattern}$`, "i");
+      if (!regex.test(name))
+        return false;
+    }
+    return true;
+  });
+}
+function groupBy(items, keyFn) {
+  const groups = new Map;
+  for (const item of items) {
+    const key = keyFn(item);
+    const existing = groups.get(key);
+    if (existing) {
+      existing.push(item);
+    } else {
+      groups.set(key, [item]);
+    }
+  }
+  return groups;
+}
+function groupByToArray(items, keyFn) {
+  const map = groupBy(items, keyFn);
+  return Array.from(map.entries()).map(([key, items2]) => ({ key, items: items2 }));
+}
+function groupByMultiple(items, keysFn) {
+  const groups = new Map;
+  for (const item of items) {
+    const keys = keysFn(item);
+    for (const key of keys) {
+      const existing = groups.get(key);
+      if (existing) {
+        existing.push(item);
+      } else {
+        groups.set(key, [item]);
+      }
+    }
+  }
+  return groups;
+}
+function getUniqueTags(items) {
+  const tags = new Set;
+  for (const item of items) {
+    for (const tag of item.meta.tags ?? []) {
+      tags.add(tag);
+    }
+  }
+  return Array.from(tags).sort();
+}
+function getUniqueOwners(items) {
+  const owners = new Set;
+  for (const item of items) {
+    for (const owner of item.meta.owners ?? []) {
+      owners.add(owner);
+    }
+  }
+  return Array.from(owners).sort();
+}
+function getUniqueDomains(items) {
+  const domains = new Set;
+  for (const item of items) {
+    domains.add(GroupingStrategies.byDomain(item));
+  }
+  return Array.from(domains).sort();
+}
+var GroupingStrategies;
+var init_registry_utils = __esm(() => {
+  GroupingStrategies = {
+    byTag: (item) => item.meta.tags?.[0] ?? "untagged",
+    byAllTags: (item) => item.meta.tags?.length ? item.meta.tags : ["untagged"],
+    byOwner: (item) => item.meta.owners?.[0] ?? "unowned",
+    byDomain: (item) => {
+      const name = item.meta.key ?? item.meta.key ?? "";
+      return name.split(".")[0] ?? "default";
+    },
+    byStability: (item) => item.meta.stability ?? "stable",
+    byUrlPath: (level) => (item) => {
+      if (!item.path)
+        return "root";
+      const segments = item.path.split("/").filter(Boolean);
+      return segments.slice(0, level).join("/") || "root";
+    }
+  };
+});
+
+// src/capabilities/capabilities.ts
+import { compareVersions } from "compare-versions";
+var capKey = (key, version) => `${key}.v${version}`;
+
+class CapabilityRegistry {
+  items = new Map;
+  surfaceIndex = null;
+  register(spec) {
+    const key = capKey(spec.meta.key, spec.meta.version);
+    if (this.items.has(key))
+      throw new Error(`Duplicate capability ${key}`);
+    this.items.set(key, spec);
+    this.surfaceIndex = null;
+    return this;
+  }
+  list() {
+    return [...this.items.values()];
+  }
+  get(key, version) {
+    if (version != null)
+      return this.items.get(capKey(key, version));
+    let candidate;
+    for (const spec of this.items.values()) {
+      if (spec.meta.key !== key)
+        continue;
+      if (!candidate || compareVersions(spec.meta.version, candidate.meta.version) > 0) {
+        candidate = spec;
+      }
+    }
+    return candidate;
+  }
+  satisfies(requirement, additional) {
+    if (requirement.optional)
+      return true;
+    if (additional?.some((ref) => matchesRequirement(ref, requirement)))
+      return true;
+    const spec = requirement.version ? this.get(requirement.key, requirement.version) : this.get(requirement.key);
+    if (!spec)
+      return false;
+    if (requirement.kind && spec.meta.kind !== requirement.kind)
+      return false;
+    if (requirement.version != null && spec.meta.version !== requirement.version)
+      return false;
+    return true;
+  }
+  buildSurfaceIndex() {
+    if (this.surfaceIndex)
+      return this.surfaceIndex;
+    this.surfaceIndex = new Map;
+    for (const spec of this.items.values()) {
+      const capabilityKey = capKey(spec.meta.key, spec.meta.version);
+      for (const surface of spec.provides ?? []) {
+        const surfaceKey = `${surface.surface}:${surface.key}`;
+        if (!this.surfaceIndex.has(surfaceKey)) {
+          this.surfaceIndex.set(surfaceKey, new Set);
+        }
+        this.surfaceIndex.get(surfaceKey)?.add(capabilityKey);
+      }
+    }
+    return this.surfaceIndex;
+  }
+  getOperationsFor(capabilityKey, version) {
+    const spec = this.get(capabilityKey, version);
+    if (!spec)
+      return [];
+    return spec.provides?.filter((s) => s.surface === "operation").map((s) => s.key) ?? [];
+  }
+  getEventsFor(capabilityKey, version) {
+    const spec = this.get(capabilityKey, version);
+    if (!spec)
+      return [];
+    return spec.provides?.filter((s) => s.surface === "event").map((s) => s.key) ?? [];
+  }
+  getPresentationsFor(capabilityKey, version) {
+    const spec = this.get(capabilityKey, version);
+    if (!spec)
+      return [];
+    return spec.provides?.filter((s) => s.surface === "presentation").map((s) => s.key) ?? [];
+  }
+  getWorkflowsFor(capabilityKey, version) {
+    const spec = this.get(capabilityKey, version);
+    if (!spec)
+      return [];
+    return spec.provides?.filter((s) => s.surface === "workflow").map((s) => s.key) ?? [];
+  }
+  getResourcesFor(capabilityKey, version) {
+    const spec = this.get(capabilityKey, version);
+    if (!spec)
+      return [];
+    return spec.provides?.filter((s) => s.surface === "resource").map((s) => s.key) ?? [];
+  }
+  getCapabilitiesForOperation(operationKey) {
+    const index = this.buildSurfaceIndex();
+    const capKeys = index.get(`operation:${operationKey}`);
+    if (!capKeys)
+      return [];
+    return [...capKeys].map((k) => {
+      const spec = this.items.get(k);
+      return { key: spec?.meta.key ?? "", version: spec?.meta.version ?? "" };
+    });
+  }
+  getCapabilitiesForEvent(eventKey) {
+    const index = this.buildSurfaceIndex();
+    const capKeys = index.get(`event:${eventKey}`);
+    if (!capKeys)
+      return [];
+    return [...capKeys].map((k) => {
+      const spec = this.items.get(k);
+      return { key: spec?.meta.key ?? "", version: spec?.meta.version ?? "" };
+    });
+  }
+  getCapabilitiesForPresentation(presentationKey) {
+    const index = this.buildSurfaceIndex();
+    const capKeys = index.get(`presentation:${presentationKey}`);
+    if (!capKeys)
+      return [];
+    return [...capKeys].map((k) => {
+      const spec = this.items.get(k);
+      return { key: spec?.meta.key ?? "", version: spec?.meta.version ?? "" };
+    });
+  }
+  getAncestors(capabilityKey, version) {
+    const ancestors = [];
+    const visited = new Set;
+    let current = this.get(capabilityKey, version);
+    while (current?.extends) {
+      const parentKey = capKey(current.extends.key, current.extends.version);
+      if (visited.has(parentKey)) {
+        break;
+      }
+      visited.add(parentKey);
+      const parent = this.get(current.extends.key, current.extends.version);
+      if (!parent)
+        break;
+      ancestors.push(parent);
+      current = parent;
+    }
+    return ancestors;
+  }
+  getEffectiveRequirements(capabilityKey, version) {
+    const spec = this.get(capabilityKey, version);
+    if (!spec)
+      return [];
+    const ancestors = this.getAncestors(capabilityKey, version);
+    const requirementMap = new Map;
+    for (const ancestor of [...ancestors].reverse()) {
+      for (const req of ancestor.requires ?? []) {
+        requirementMap.set(req.key, req);
+      }
+    }
+    for (const req of spec.requires ?? []) {
+      requirementMap.set(req.key, req);
+    }
+    return [...requirementMap.values()];
+  }
+  getEffectiveSurfaces(capabilityKey, version) {
+    const spec = this.get(capabilityKey, version);
+    if (!spec)
+      return [];
+    const ancestors = this.getAncestors(capabilityKey, version);
+    const surfaces = [];
+    for (const ancestor of [...ancestors].reverse()) {
+      surfaces.push(...ancestor.provides ?? []);
+    }
+    surfaces.push(...spec.provides ?? []);
+    return surfaces;
+  }
+}
+function matchesRequirement(ref, requirement) {
+  if (ref.key !== requirement.key)
+    return false;
+  if (requirement.version != null && ref.version !== requirement.version)
+    return false;
+  return true;
+}
+function capabilityKey(spec) {
+  return capKey(spec.meta.key, spec.meta.version);
+}
+function defineCapability(spec) {
+  return spec;
+}
+
+// src/capabilities/validation.ts
+function validateCapabilityConsistency(deps) {
+  const errors = [];
+  const warnings = [];
+  for (const capability of deps.capabilities.list()) {
+    const capKey2 = `${capability.meta.key}.v${capability.meta.version}`;
+    for (const surface of capability.provides ?? []) {
+      const exists = checkSurfaceExists(deps, surface.surface, surface.key);
+      if (!exists) {
+        errors.push({
+          type: "missing_surface_spec",
+          message: `Capability "${capKey2}" provides ${surface.surface} "${surface.key}" but spec not found`,
+          capabilityKey: capKey2,
+          surface: surface.surface,
+          specKey: surface.key
+        });
+      }
+    }
+  }
+  if (deps.operations) {
+    for (const op of deps.operations.list()) {
+      if (op.capability) {
+        const capSpec = deps.capabilities.get(op.capability.key, op.capability.version);
+        if (!capSpec) {
+          errors.push({
+            type: "capability_not_found",
+            message: `Operation "${op.meta.key}" references capability "${op.capability.key}.v${op.capability.version}" but capability not found`,
+            specKey: op.meta.key,
+            capabilityKey: `${op.capability.key}.v${op.capability.version}`,
+            surface: "operation"
+          });
+        } else {
+          const inProvides = capSpec.provides?.some((p) => p.surface === "operation" && p.key === op.meta.key);
+          if (!inProvides) {
+            errors.push({
+              type: "surface_not_in_provides",
+              message: `Operation "${op.meta.key}" claims capability "${op.capability.key}.v${op.capability.version}" but not in capability's provides`,
+              specKey: op.meta.key,
+              capabilityKey: `${op.capability.key}.v${op.capability.version}`,
+              surface: "operation"
+            });
+          }
+        }
+      }
+    }
+  }
+  if (deps.events) {
+    for (const event of deps.events.list()) {
+      if (event.capability) {
+        const capSpec = deps.capabilities.get(event.capability.key, event.capability.version);
+        if (!capSpec) {
+          errors.push({
+            type: "capability_not_found",
+            message: `Event "${event.meta.key}" references capability "${event.capability.key}.v${event.capability.version}" but capability not found`,
+            specKey: event.meta.key,
+            capabilityKey: `${event.capability.key}.v${event.capability.version}`,
+            surface: "event"
+          });
+        } else {
+          const inProvides = capSpec.provides?.some((p) => p.surface === "event" && p.key === event.meta.key);
+          if (!inProvides) {
+            errors.push({
+              type: "surface_not_in_provides",
+              message: `Event "${event.meta.key}" claims capability "${event.capability.key}.v${event.capability.version}" but not in capability's provides`,
+              specKey: event.meta.key,
+              capabilityKey: `${event.capability.key}.v${event.capability.version}`,
+              surface: "event"
+            });
+          }
+        }
+      }
+    }
+  }
+  if (deps.presentations) {
+    for (const pres of deps.presentations.list()) {
+      if (pres.capability) {
+        const capSpec = deps.capabilities.get(pres.capability.key, pres.capability.version);
+        if (!capSpec) {
+          errors.push({
+            type: "capability_not_found",
+            message: `Presentation "${pres.meta.key}" references capability "${pres.capability.key}.v${pres.capability.version}" but capability not found`,
+            specKey: pres.meta.key,
+            capabilityKey: `${pres.capability.key}.v${pres.capability.version}`,
+            surface: "presentation"
+          });
+        } else {
+          const inProvides = capSpec.provides?.some((p) => p.surface === "presentation" && p.key === pres.meta.key);
+          if (!inProvides) {
+            errors.push({
+              type: "surface_not_in_provides",
+              message: `Presentation "${pres.meta.key}" claims capability "${pres.capability.key}.v${pres.capability.version}" but not in capability's provides`,
+              specKey: pres.meta.key,
+              capabilityKey: `${pres.capability.key}.v${pres.capability.version}`,
+              surface: "presentation"
+            });
+          }
+        }
+      }
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}
+function checkSurfaceExists(deps, surface, key) {
+  switch (surface) {
+    case "operation":
+      return deps.operations?.has(key) ?? true;
+    case "event":
+      return deps.events?.has(key) ?? true;
+    case "presentation":
+      return deps.presentations?.has(key) ?? true;
+    case "workflow":
+    case "resource":
+      return true;
+    default:
+      return true;
+  }
+}
+function findOrphanSpecs(deps) {
+  const result = {
+    operations: [],
+    events: [],
+    presentations: []
+  };
+  if (deps.operations) {
+    for (const op of deps.operations.list()) {
+      if (!op.capability) {
+        result.operations.push(op.meta.key);
+      }
+    }
+  }
+  if (deps.events) {
+    for (const event of deps.events.list()) {
+      if (!event.capability) {
+        result.events.push(event.meta.key);
+      }
+    }
+  }
+  if (deps.presentations) {
+    for (const pres of deps.presentations.list()) {
+      if (!pres.capability) {
+        result.presentations.push(pres.meta.key);
+      }
+    }
+  }
+  return result;
+}
+
+// src/capabilities/context.ts
+class CapabilityMissingError extends Error {
+  capabilityKey;
+  requiredVersion;
+  constructor(capabilityKey2, requiredVersion) {
+    const versionSuffix = requiredVersion ? `.v${requiredVersion}` : "";
+    super(`Missing required capability: ${capabilityKey2}${versionSuffix}`);
+    this.name = "CapabilityMissingError";
+    this.capabilityKey = capabilityKey2;
+    this.requiredVersion = requiredVersion;
+  }
+}
+
+class CapabilityContextImpl {
+  capabilities;
+  capabilityVersions;
+  constructor(enabledCapabilities) {
+    const capSet = new Set;
+    const versionMap = new Map;
+    for (const cap of enabledCapabilities) {
+      capSet.add(cap.key);
+      versionMap.set(cap.key, cap.version);
+    }
+    this.capabilities = capSet;
+    this.capabilityVersions = versionMap;
+  }
+  hasCapability(key, version) {
+    if (!this.capabilities.has(key))
+      return false;
+    if (version != null) {
+      const enabledVersion = this.capabilityVersions.get(key);
+      return enabledVersion === version;
+    }
+    return true;
+  }
+  requireCapability(key, version) {
+    if (!this.hasCapability(key, version)) {
+      throw new CapabilityMissingError(key, version);
+    }
+  }
+  hasAllCapabilities(keys) {
+    return keys.every((k) => this.capabilities.has(k));
+  }
+  hasAnyCapability(keys) {
+    return keys.some((k) => this.capabilities.has(k));
+  }
+  getMatchingCapabilities(pattern) {
+    if (!pattern.includes("*")) {
+      return this.capabilities.has(pattern) ? [pattern] : [];
+    }
+    const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    const regex = new RegExp(`^${regexPattern}$`);
+    return [...this.capabilities].filter((key) => regex.test(key));
+  }
+}
+function createCapabilityContext(enabledCapabilities) {
+  return new CapabilityContextImpl(enabledCapabilities);
+}
+function createEmptyCapabilityContext() {
+  return new CapabilityContextImpl([]);
+}
+function createBypassCapabilityContext(allCapabilities) {
+  return new CapabilityContextImpl(allCapabilities);
+}
+
+// src/capabilities/guards.ts
+function checkCapabilityForOperation(ctx, operation) {
+  if (!operation.capability) {
+    return { allowed: true };
+  }
+  const { key, version } = operation.capability;
+  if (ctx.hasCapability(key, version)) {
+    return { allowed: true };
+  }
+  return {
+    allowed: false,
+    missingCapability: { key, version },
+    reason: `Operation "${operation.meta.key}" requires capability "${key}.v${version}"`
+  };
+}
+function assertCapabilityForOperation(ctx, operation) {
+  const result = checkCapabilityForOperation(ctx, operation);
+  if (!result.allowed && result.missingCapability) {
+    throw new CapabilityMissingError(result.missingCapability.key, result.missingCapability.version);
+  }
+}
+function checkCapabilityForEvent(ctx, event) {
+  if (!event.capability) {
+    return { allowed: true };
+  }
+  const { key, version } = event.capability;
+  if (ctx.hasCapability(key, version)) {
+    return { allowed: true };
+  }
+  return {
+    allowed: false,
+    missingCapability: { key, version },
+    reason: `Event "${event.meta.key}" requires capability "${key}.v${version}"`
+  };
+}
+function assertCapabilityForEvent(ctx, event) {
+  const result = checkCapabilityForEvent(ctx, event);
+  if (!result.allowed && result.missingCapability) {
+    throw new CapabilityMissingError(result.missingCapability.key, result.missingCapability.version);
+  }
+}
+function checkCapabilityForPresentation(ctx, presentation) {
+  if (!presentation.capability) {
+    return { allowed: true };
+  }
+  const { key, version } = presentation.capability;
+  if (ctx.hasCapability(key, version)) {
+    return { allowed: true };
+  }
+  return {
+    allowed: false,
+    missingCapability: { key, version },
+    reason: `Presentation "${presentation.meta.key}" requires capability "${key}.v${version}"`
+  };
+}
+function assertCapabilityForPresentation(ctx, presentation) {
+  const result = checkCapabilityForPresentation(ctx, presentation);
+  if (!result.allowed && result.missingCapability) {
+    throw new CapabilityMissingError(result.missingCapability.key, result.missingCapability.version);
+  }
+}
+function filterOperationsByCapability(ctx, operations) {
+  return operations.filter((op) => checkCapabilityForOperation(ctx, op).allowed);
+}
+function filterEventsByCapability(ctx, events) {
+  return events.filter((ev) => checkCapabilityForEvent(ctx, ev).allowed);
+}
+function filterPresentationsByCapability(ctx, presentations) {
+  return presentations.filter((pres) => checkCapabilityForPresentation(ctx, pres).allowed);
+}
+
+// src/ownership.ts
+var StabilityEnum = {
+  Idea: "idea",
+  InCreation: "in_creation",
+  Experimental: "experimental",
+  Beta: "beta",
+  Stable: "stable",
+  Deprecated: "deprecated"
+};
+var OwnersEnum = {
+  PlatformCore: "platform.core",
+  PlatformSigil: "platform.sigil",
+  PlatformMarketplace: "platform.marketplace",
+  PlatformMessaging: "platform.messaging",
+  PlatformContent: "platform.content",
+  PlatformFeatureFlags: "platform.featureflags",
+  PlatformFinance: "platform.finance"
+};
+var Owners = OwnersEnum;
+var TagsEnum = {
+  Spots: "spots",
+  Collectivity: "collectivity",
+  Marketplace: "marketplace",
+  Sellers: "sellers",
+  Auth: "auth",
+  Login: "login",
+  Signup: "signup",
+  Guide: "guide",
+  Docs: "docs",
+  I18n: "i18n",
+  Incident: "incident",
+  Automation: "automation",
+  Hygiene: "hygiene"
+};
+var Tags = TagsEnum;
+
+// src/capabilities/openbanking.ts
+var OWNERS = ["platform.finance"];
+var TAGS = ["open-banking", "finance"];
+var openBankingAccountsReadCapability = {
+  meta: {
+    key: "openbanking.accounts.read",
+    version: "1.0.0",
+    kind: "integration",
+    title: "Open Banking Accounts (Read)",
+    description: "Provides read-only access to linked bank accounts, including account summaries and metadata.",
+    domain: "finance",
+    owners: [...OWNERS],
+    tags: [...TAGS],
+    stability: StabilityEnum.Experimental
+  },
+  provides: [
+    {
+      surface: "operation",
+      key: "openbanking.accounts.list",
+      version: "1.0.0",
+      description: "List bank accounts linked to a Powens open banking connection."
+    },
+    {
+      surface: "operation",
+      key: "openbanking.accounts.get",
+      version: "1.0.0",
+      description: "Retrieve the canonical bank account record for a specific account."
+    },
+    {
+      surface: "operation",
+      key: "openbanking.accounts.sync",
+      version: "1.0.0",
+      description: "Trigger a refresh of bank account metadata from the open banking provider."
+    }
+  ]
+};
+var openBankingTransactionsReadCapability = {
+  meta: {
+    key: "openbanking.transactions.read",
+    version: "1.0.0",
+    kind: "integration",
+    title: "Open Banking Transactions (Read)",
+    description: "Enables retrieval of transaction history for linked bank accounts via open banking providers.",
+    domain: "finance",
+    owners: [...OWNERS],
+    tags: [...TAGS, "transactions"],
+    stability: StabilityEnum.Experimental
+  },
+  provides: [
+    {
+      surface: "operation",
+      key: "openbanking.transactions.list",
+      version: "1.0.0",
+      description: "List transactions for a given bank account with optional date filtering."
+    },
+    {
+      surface: "operation",
+      key: "openbanking.transactions.sync",
+      version: "1.0.0",
+      description: "Synchronise transactions from the open banking provider into the canonical ledger."
+    }
+  ]
+};
+var openBankingBalancesReadCapability = {
+  meta: {
+    key: "openbanking.balances.read",
+    version: "1.0.0",
+    kind: "integration",
+    title: "Open Banking Balances (Read)",
+    description: "Allows querying of current and available balances for linked bank accounts via open banking providers.",
+    domain: "finance",
+    owners: [...OWNERS],
+    tags: [...TAGS, "balances"],
+    stability: StabilityEnum.Experimental
+  },
+  provides: [
+    {
+      surface: "operation",
+      key: "openbanking.balances.get",
+      version: "1.0.0",
+      description: "Retrieve the latest known balances for a specified bank account."
+    },
+    {
+      surface: "operation",
+      key: "openbanking.balances.refresh",
+      version: "1.0.0",
+      description: "Force a balance refresh from the open banking provider."
+    }
+  ]
+};
+function registerOpenBankingCapabilities(registry) {
+  return registry.register(openBankingAccountsReadCapability).register(openBankingTransactionsReadCapability).register(openBankingBalancesReadCapability);
+}
+
+// src/capabilities/meeting-recorder.ts
+var OWNERS2 = ["platform.integrations"];
+var TAGS2 = ["meeting-recorder", "transcripts", "integrations"];
+var meetingRecorderMeetingsReadCapability = {
+  meta: {
+    key: "meeting-recorder.meetings.read",
+    version: "1.0.0",
+    kind: "integration",
+    title: "Meeting Recorder Meetings (Read)",
+    description: "Provides read-only access to recorded meetings and their metadata.",
+    domain: "integrations",
+    owners: [...OWNERS2],
+    tags: [...TAGS2, "meetings"],
+    stability: StabilityEnum.Experimental
+  },
+  provides: [
+    {
+      surface: "operation",
+      key: "meeting-recorder.meetings.list",
+      version: "1.0.0",
+      description: "List meetings available from the recorder provider."
+    },
+    {
+      surface: "operation",
+      key: "meeting-recorder.meetings.get",
+      version: "1.0.0",
+      description: "Fetch detailed metadata for a specific meeting."
+    }
+  ]
+};
+var meetingRecorderTranscriptsReadCapability = {
+  meta: {
+    key: "meeting-recorder.transcripts.read",
+    version: "1.0.0",
+    kind: "integration",
+    title: "Meeting Recorder Transcripts (Read)",
+    description: "Enables retrieval of transcripts for recorded meetings from external providers.",
+    domain: "integrations",
+    owners: [...OWNERS2],
+    tags: [...TAGS2, "transcripts"],
+    stability: StabilityEnum.Experimental
+  },
+  provides: [
+    {
+      surface: "operation",
+      key: "meeting-recorder.transcripts.get",
+      version: "1.0.0",
+      description: "Fetch the transcript for a specific meeting recording."
+    },
+    {
+      surface: "operation",
+      key: "meeting-recorder.transcripts.sync",
+      version: "1.0.0",
+      description: "Trigger a transcript sync from the recorder provider."
+    }
+  ]
+};
+var meetingRecorderWebhooksCapability = {
+  meta: {
+    key: "meeting-recorder.webhooks",
+    version: "1.0.0",
+    kind: "integration",
+    title: "Meeting Recorder Webhooks",
+    description: "Allows processing of webhook events for meeting transcript readiness.",
+    domain: "integrations",
+    owners: [...OWNERS2],
+    tags: [...TAGS2, "webhooks"],
+    stability: StabilityEnum.Experimental
+  },
+  provides: [
+    {
+      surface: "operation",
+      key: "meeting-recorder.webhooks.ingest",
+      version: "1.0.0",
+      description: "Ingest and verify meeting recorder webhook payloads."
+    }
+  ]
+};
+function registerMeetingRecorderCapabilities(registry) {
+  return registry.register(meetingRecorderMeetingsReadCapability).register(meetingRecorderTranscriptsReadCapability).register(meetingRecorderWebhooksCapability);
+}
+// src/app-config/app-config.capability.ts
+var AppConfigCapability = defineCapability({
+  meta: {
+    key: "app-config",
+    version: "1.0.0",
+    title: "App Configuration Capability",
+    description: "Provides tenant app configuration lifecycle management.",
+    domain: "platform",
+    owners: [OwnersEnum.PlatformSigil],
+    tags: [TagsEnum.Hygiene],
+    kind: "api",
+    stability: StabilityEnum.Stable
+  },
+  provides: [],
+  requires: []
+});
+
+// src/operations/operation.ts
+var isEmitDeclRef = (e) => ("ref" in e);
+var defineCommand = (spec) => ({
+  ...spec,
+  meta: { ...spec.meta, kind: "command" },
+  policy: {
+    ...spec.policy,
+    idempotent: spec.policy?.["policy"]?.idempotent ?? false
+  }
+});
+var defineQuery = (spec) => ({
+  ...spec,
+  meta: { ...spec.meta, kind: "query" },
+  policy: { ...spec.policy, idempotent: true }
+});
+
+// src/registry.ts
+init_registry_utils();
+import { compareVersions as compareVersions2 } from "compare-versions";
+var keyOfSpecContract = (spec) => `${spec.meta.key}.v${spec.meta.version}`;
+
+class SpecContractRegistry {
+  contractType;
+  items = new Map;
+  constructor(contractType, items) {
+    this.contractType = contractType;
+    if (items) {
+      items.forEach((p) => this.register(p));
+    }
+  }
+  register(p) {
+    const key = keyOfSpecContract(p);
+    if (this.items.has(key))
+      throw new Error(`Duplicate contract \`${this.contractType}\` ${key}`);
+    this.items.set(key, p);
+    return this;
+  }
+  count() {
+    return this.items.size;
+  }
+  list() {
+    return [...this.items.values()];
+  }
+  get(key, version) {
+    if (version != null)
+      return this.items.get(`${key}.v${version}`);
+    let candidate;
+    for (const [k, p] of this.items.entries()) {
+      if (!k.startsWith(`${key}.v`))
+        continue;
+      if (!candidate || compareVersions2(p.meta.version, candidate.meta.version) > 0) {
+        candidate = p;
+      }
+    }
+    return candidate;
+  }
+  has(key, version) {
+    return !!this.get(key, version);
+  }
+  filter(criteria) {
+    return filterBy(this.list(), criteria);
+  }
+  listByTag(tag) {
+    return this.list().filter((p) => p.meta.tags?.includes(tag));
+  }
+  listByOwner(owner) {
+    return this.list().filter((p) => p.meta.owners?.includes(owner));
+  }
+  groupBy(keyFn) {
+    return groupBy(this.list(), keyFn);
+  }
+  getUniqueTags() {
+    return getUniqueTags(this.list());
+  }
+}
+
+// src/events.ts
+function defineEvent(e) {
+  return e;
+}
+var eventKey = (key, version) => `${key}.v${version}`;
+
+class EventRegistry extends SpecContractRegistry {
+  constructor(items) {
+    super("event", items);
+  }
+}
+
+// src/operations/registry.ts
+function opKey(key, version) {
+  return `${key}.v${version}`;
+}
+
+class OperationSpecRegistry extends SpecContractRegistry {
+  handlers = new Map;
+  constructor(items) {
+    super("operation", items);
+  }
+  bind(spec, handler) {
+    const key = opKey(spec.meta.key, spec.meta.version);
+    if (!this.items.has(key))
+      throw new Error(`Cannot bind; spec not found: ${key}`);
+    if (this.handlers.has(key))
+      throw new Error(`Handler already bound for ${key}`);
+    this.handlers.set(key, handler);
+    return this;
+  }
+  getHandler(key, version) {
+    const spec = this.get(key, version);
+    if (!spec)
+      return;
+    return this.handlers.get(opKey(spec.meta.key, spec.meta.version));
+  }
+  listBound() {
+    const out = [];
+    for (const [k, spec] of this.items.entries()) {
+      const h = this.handlers.get(k);
+      if (h)
+        out.push({ spec, handler: h });
+    }
+    return out;
+  }
+  async execute(key, version, rawInput, ctx) {
+    const baseSpec = this.get(key, version);
+    if (!baseSpec)
+      throw new Error(`Spec not found for ${key}${version ? `.v${version}` : ""}`);
+    const spec = await ctx.specVariantResolver?.resolve({
+      name: baseSpec.meta.key,
+      version: baseSpec.meta.version,
+      kind: baseSpec.meta.kind
+    }, ctx) ?? baseSpec;
+    let handlerKey = opKey(spec.meta.key, spec.meta.version);
+    let handler = this.handlers.get(handlerKey);
+    if (!handler) {
+      const fallbackKey = opKey(baseSpec.meta.key, baseSpec.meta.version);
+      handler = this.handlers.get(fallbackKey);
+      handlerKey = fallbackKey;
+    }
+    if (!handler)
+      throw new Error(`No handler bound for ${handlerKey}`);
+    const parsedInput = spec.io.input?.getZod().parse(rawInput);
+    if (ctx.decide) {
+      const [service, command] = spec.meta.key.split(".");
+      if (!service || !command)
+        throw new Error(`Invalid spec name: ${spec.meta.key}`);
+      const decision = await ctx.decide({
+        service,
+        command,
+        version: spec.meta.version,
+        actor: ctx.actor ?? "anonymous",
+        channel: ctx.channel,
+        roles: ctx.roles,
+        organizationId: ctx.organizationId,
+        userId: ctx.userId,
+        flags: []
+      });
+      if (decision.effect === "deny") {
+        throw new Error(`PolicyDenied: ${spec.meta.key}.v${spec.meta.version}`);
+      }
+      if (decision.rateLimit && ctx.rateLimit) {
+        const key2 = decision.rateLimit.key ?? "default";
+        const rpm = decision.rateLimit.rpm ?? 60;
+        await ctx.rateLimit(key2, 1, rpm);
+      }
+    }
+    const allowedEvents = new Map;
+    if (spec.sideEffects?.emits) {
+      for (const e of spec.sideEffects.emits) {
+        if (isEmitDeclRef(e)) {
+          const eventSpec = ctx.eventSpecResolver?.get(e.ref.key, e.ref.version);
+          if (eventSpec) {
+            allowedEvents.set(`${e.ref.key}.v${e.ref.version}`, eventSpec.payload);
+          }
+        } else {
+          allowedEvents.set(`${e.key}.v${e.version}`, e.payload);
+        }
+      }
+    }
+    const emitGuard = async (eventName, eventVersion, payload) => {
+      const key2 = eventKey(eventName, eventVersion);
+      const schema = allowedEvents.get(key2);
+      if (!schema)
+        throw new Error(`UndeclaredEvent: ${key2} not allowed by ${opKey(spec.meta.key, spec.meta.version)}`);
+      const parsed = schema.getZod().parse(payload);
+      await ctx.eventPublisher?.({
+        key: eventName,
+        version: eventVersion,
+        payload: parsed,
+        traceId: ctx.traceId
+      });
+    };
+    if (ctx.appConfig) {
+      if (!ctx.branding) {
+        ctx.branding = ctx.appConfig.branding;
+      }
+      if (!ctx.translation) {
+        ctx.translation = { config: ctx.appConfig.translation };
+      } else if (!ctx.translation.config) {
+        ctx.translation = {
+          ...ctx.translation,
+          config: ctx.appConfig.translation
+        };
+      }
+    }
+    const telemetryContext = ctx.telemetry;
+    const trackTelemetry = async (trigger, details) => {
+      if (!telemetryContext || !trigger?.event)
+        return;
+      try {
+        const props = trigger.properties?.(details) ?? {};
+        await telemetryContext.track(trigger.event.key, trigger.event.version ?? "1.0.0", props, {
+          tenantId: ctx.organizationId ?? undefined,
+          organizationId: ctx.organizationId,
+          userId: ctx.userId,
+          actor: ctx.actor,
+          channel: ctx.channel,
+          metadata: ctx.traceId ? { traceId: ctx.traceId } : undefined
+        });
+      } catch (_error) {}
+    };
+    let result;
+    try {
+      result = await handler(parsedInput, {
+        ...ctx,
+        __emitGuard__: emitGuard
+      });
+    } catch (error) {
+      if (spec.telemetry?.failure) {
+        await trackTelemetry(spec.telemetry.failure, {
+          input: parsedInput ?? rawInput,
+          error
+        });
+      }
+      throw error;
+    }
+    if (spec.telemetry?.success) {
+      await trackTelemetry(spec.telemetry.success, {
+        input: parsedInput ?? rawInput,
+        output: result
+      });
+    }
+    const outputModel = spec.io.output;
+    if (outputModel?.getZod) {
+      const parsedOutput = outputModel.getZod().parse(result);
+      return parsedOutput;
+    }
+    return result;
+  }
+}
+
+// src/operations/report/getContractVerificationStatus.ts
+import {
+  ScalarTypeEnum,
+  SchemaModel,
+  ZodSchemaType
+} from "@contractspec/lib.schema";
+import * as z from "zod";
+var REPORT_DOMAIN = "report";
+var REPORT_OWNERS = ["platform.core"];
+var REPORT_TAGS = ["report", "drift", "verification"];
+var REPORT_STABILITY = StabilityEnum.Experimental;
+var ContractVerificationStatusModel = new SchemaModel({
+  name: "ContractVerificationStatus",
+  fields: {
+    name: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },
+    lastVerifiedSha: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: true
+    },
+    lastVerifiedDate: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: true
+    },
+    surfaces: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: false,
+      isArray: true
+    },
+    driftMismatches: {
+      type: ScalarTypeEnum.Int_unsecure(),
+      isOptional: false
+    }
+  }
+});
+var GetContractVerificationStatusInput = new SchemaModel({
+  name: "GetContractVerificationStatusInput",
+  fields: {
+    projectPath: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },
+    baseline: { type: ScalarTypeEnum.String_unsecure(), isOptional: true }
+  }
+});
+var GetContractVerificationStatusOutput = new ZodSchemaType(z.object({
+  contracts: z.object({
+    name: z.string(),
+    lastVerifiedSha: z.string().optional(),
+    lastVerifiedDate: z.string().optional(),
+    surfaces: z.string().array(),
+    driftMismatches: z.int()
+  }).array()
+}), {
+  name: "GetContractVerificationStatusOutput"
+});
+var GetContractVerificationStatusQuery = defineQuery({
+  meta: {
+    key: "report.getContractVerificationStatus",
+    title: "Get Contract Verification Status",
+    version: "1.0.0",
+    description: "Retrieves per-contract verification status for the impact report.",
+    goal: "Enable stakeholders to see contract health at a glance.",
+    context: "Part of the impact report domain. Reads from drift check outputs and verified.json to provide a consolidated view of each contract's drift debt and surface coverage.",
+    domain: REPORT_DOMAIN,
+    owners: REPORT_OWNERS,
+    tags: REPORT_TAGS,
+    stability: REPORT_STABILITY
+  },
+  io: {
+    input: GetContractVerificationStatusInput,
+    output: GetContractVerificationStatusOutput,
+    errors: {
+      PROJECT_NOT_FOUND: {
+        description: "Project path does not exist.",
+        http: 404,
+        when: "The provided projectPath does not resolve to a valid directory."
+      }
+    }
+  },
+  policy: {
+    auth: "anonymous",
+    pii: []
+  }
+});
+
+// src/install.ts
+function makeEmit(_spec, ctx) {
+  return {
+    ref: async (ev, payload) => {
+      await ctx.__emitGuard__?.(ev.meta.key, ev.meta.version, payload);
+    },
+    key: async (key, version, payload) => {
+      await ctx.__emitGuard__?.(key, version, payload);
+    },
+    object: async (evt) => {
+      await ctx.__emitGuard__?.(evt.key, evt.version, evt.payload);
+    }
+  };
+}
+function installOp(reg, spec, handler) {
+  return reg.register(spec).bind(spec, handler);
+}
+function op(spec, handler) {
+  return {
+    spec,
+    handler,
+    install: (reg) => installOp(reg, spec, handler)
+  };
+}
+
+// src/data-views/spec.ts
+function defineDataView(spec) {
+  return spec;
+}
+
+// src/data-views/report/contractVerificationTable.ts
+var ContractVerificationTableDataView = defineDataView({
+  meta: {
+    key: "report.contractVerificationTable",
+    title: "Contract Verification Table",
+    version: "1.0.0",
+    description: "Table view of per-contract verification status for the impact report.",
+    domain: "report",
+    owners: ["platform.core"],
+    tags: ["report", "data-view", "verification"],
+    stability: StabilityEnum.Experimental,
+    entity: "contract-verification"
+  },
+  source: {
+    primary: {
+      key: GetContractVerificationStatusQuery.meta.key,
+      version: GetContractVerificationStatusQuery.meta.version
+    }
+  },
+  view: {
+    kind: "table",
+    fields: [
+      {
+        key: "name",
+        label: "Contract / Endpoint / Event",
+        dataPath: "name"
+      },
+      {
+        key: "timeSinceVerified",
+        label: "Time since verified",
+        dataPath: "lastVerifiedDate"
+      },
+      {
+        key: "driftMismatches",
+        label: "Drift debt",
+        dataPath: "driftMismatches",
+        format: "number",
+        sortable: true
+      },
+      {
+        key: "surfaces",
+        label: "Surfaces covered",
+        dataPath: "surfaces",
+        format: "badge"
+      },
+      {
+        key: "lastVerifiedSha",
+        label: "Last verified commit",
+        dataPath: "lastVerifiedSha",
+        width: "sm"
+      }
+    ],
+    primaryField: "name",
+    secondaryFields: ["driftMismatches", "timeSinceVerified"],
+    columns: [
+      { field: "name", width: "lg" },
+      { field: "lastVerifiedSha", width: "sm" },
+      { field: "timeSinceVerified", width: "sm" },
+      { field: "surfaces", width: "md" },
+      { field: "driftMismatches", width: "xs", align: "right" }
+    ]
+  },
+  policy: {
+    flags: [],
+    pii: []
+  }
+});
+
+// src/operations/report/index.ts
+var getContractVerificationStatusHandler = async (input, _ctx) => {
+  try {
+    const cmdProcess = Bun.spawn(["contractspec", "impl", "status", "--format", "json", "--all"], {
+      cwd: input.projectPath
+    });
+    const cmdStdout = await cmdProcess.stdout;
+    const output = await Bun.readableStreamToText(cmdStdout);
+    if (!output) {
+      return { contracts: [] };
+    }
+    const cliOutput = JSON.parse(output);
+    const contracts = [];
+    for (const spec of cliOutput.results || []) {
+      const contract = {
+        name: spec.specKey,
+        lastVerifiedSha: spec.specHash,
+        lastVerifiedDate: spec.specHash ? new Date().toISOString() : undefined,
+        surfaces: spec.implementations.filter((impl) => impl.exists).map((impl) => impl.type),
+        driftMismatches: spec.implementations.filter((impl) => !impl.exists).length
+      };
+      contracts.push(contract);
+    }
+    return { contracts };
+  } catch (error) {
+    console.error("Failed to get contract verification status:", error);
+    return { contracts: [] };
+  }
+};
+function registerReportContracts(registry) {
+  installOp(registry, GetContractVerificationStatusQuery, getContractVerificationStatusHandler);
+  return registry;
+}
+// src/app-config/spec.ts
+var blueprintKey = (meta) => `${meta.key}.v${meta.version}`;
+
+class AppBlueprintRegistry extends SpecContractRegistry {
+  constructor(items) {
+    super("app-config", items);
+  }
+}
+function makeAppBlueprintKey(meta) {
+  return blueprintKey(meta);
+}
+var defineAppConfig = (spec) => spec;
+
+// src/app-config/app-config.feature.ts
+var AppConfigFeature = defineAppConfig({
+  meta: {
+    key: "app-config",
+    version: "1.0.0",
+    title: "App Configuration",
+    description: "Tenant app configuration lifecycle management with draft, preview, and publish stages",
+    domain: "platform",
+    owners: ["@platform.sigil"],
+    tags: ["app-config", "lifecycle", "configuration", "tenant"],
+    stability: "beta"
+  },
+  operations: [],
+  events: [
+    { key: "app_config.draft_created", version: "1.0.0" },
+    { key: "app_config.promoted_to_preview", version: "1.0.0" },
+    { key: "app_config.published", version: "1.0.0" },
+    { key: "app_config.rolled_back", version: "1.0.0" }
+  ],
+  presentations: [],
+  opToPresentation: [],
+  presentationsTargets: [],
+  capabilities: {
+    provides: [{ key: "app-config", version: "1.0.0" }],
+    requires: []
+  }
+});
+// src/app-config/events.ts
+import { SchemaModel as SchemaModel2, ScalarTypeEnum as ScalarTypeEnum2 } from "@contractspec/lib.schema";
+var lifecycleOwnership = {
+  title: "Tenant App Config Lifecycle",
+  description: "Events emitted when tenant app configurations move through lifecycle stages.",
+  domain: "app-config.lifecycle",
+  owners: [OwnersEnum.PlatformSigil],
+  tags: [TagsEnum.Hygiene],
+  stability: StabilityEnum.Beta
+};
+var ConfigDraftCreatedEvent = defineEvent({
+  meta: {
+    ...lifecycleOwnership,
+    key: "app_config.draft_created",
+    version: "1.0.0",
+    description: "A new tenant config draft was created."
+  },
+  payload: new SchemaModel2({
+    name: "ConfigDraftCreatedPayload",
+    fields: {
+      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      version: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
+      blueprintName: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: false
+      },
+      blueprintVersion: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: false
+      },
+      createdBy: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
+      clonedFrom: { type: ScalarTypeEnum2.Int_unsecure(), isOptional: true }
+    }
+  })
+});
+var ConfigPromotedToPreviewEvent = defineEvent({
+  meta: {
+    ...lifecycleOwnership,
+    key: "app_config.promoted_to_preview",
+    version: "1.0.0",
+    description: "A tenant config draft was promoted to preview."
+  },
+  payload: new SchemaModel2({
+    name: "ConfigPromotedToPreviewPayload",
+    fields: {
+      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      version: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
+      promotedBy: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
+      warnings: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: true,
+        isArray: true
+      }
+    }
+  })
+});
+var ConfigPublishedEvent = defineEvent({
+  meta: {
+    ...lifecycleOwnership,
+    key: "app_config.published",
+    version: "1.0.0",
+    description: "A tenant config version was published to production."
+  },
+  payload: new SchemaModel2({
+    name: "ConfigPublishedPayload",
+    fields: {
+      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      version: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
+      previousVersion: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: true
+      },
+      publishedBy: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: false
+      },
+      changeSummary: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: true
+      },
+      changedSections: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: true,
+        isArray: true
+      }
+    }
+  })
+});
+var ConfigRolledBackEvent = defineEvent({
+  meta: {
+    ...lifecycleOwnership,
+    key: "app_config.rolled_back",
+    version: "1.0.0",
+    description: "A tenant config was rolled back to a previous version."
+  },
+  payload: new SchemaModel2({
+    name: "ConfigRolledBackPayload",
+    fields: {
+      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+      newVersion: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
+      rolledBackFrom: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: false
+      },
+      rolledBackTo: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: false
+      },
+      rolledBackBy: {
+        type: ScalarTypeEnum2.String_unsecure(),
+        isOptional: false
+      },
+      reason: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false }
+    }
+  })
+});
+
+// src/app-config/runtime.ts
+function resolveAppConfig(blueprint, tenant, deps = {}) {
+  const capabilities2 = mergeCapabilities(blueprint.capabilities, tenant.capabilities);
+  const features = mergeFeatures(blueprint.features, tenant.features);
+  const dataViews = mergeMappings(blueprint.dataViews ?? {}, tenant.dataViewOverrides);
+  const workflows = mergeMappings(blueprint.workflows ?? {}, tenant.workflowOverrides);
+  const policies = mergePolicies(blueprint.policies ?? [], tenant.additionalPolicies ?? []);
+  const theme = mergeTheme(blueprint.theme, tenant.themeOverride);
+  const telemetry = mergeTelemetry(blueprint.telemetry, tenant.telemetryOverride);
+  const experiments = mergeExperiments(blueprint.experiments, tenant.experiments);
+  const featureFlags = mergeFeatureFlags(blueprint.featureFlags ?? [], tenant.featureFlags ?? []);
+  const routes = mergeRoutes(blueprint.routes ?? [], tenant.routeOverrides ?? []);
+  const { resolved: integrations } = evaluateIntegrationSlots(blueprint.integrationSlots, tenant.integrations, deps.integrationConnections, deps.integrationSpecs);
+  const knowledge = resolveKnowledgeBindings(tenant.knowledge, deps.knowledgeSpaces, deps.knowledgeSources);
+  const branding = resolveBranding(blueprint.branding, tenant);
+  const translation = resolveTranslation(blueprint.translationCatalog, tenant.locales, tenant.translationOverrides);
+  return {
+    appId: blueprint.meta.appId,
+    tenantId: tenant.meta.tenantId,
+    environment: tenant.meta.environment,
+    blueprintName: blueprint.meta.key,
+    blueprintVersion: blueprint.meta.version,
+    configVersion: tenant.meta.version,
+    capabilities: capabilities2,
+    features,
+    dataViews,
+    workflows,
+    policies,
+    theme,
+    telemetry,
+    experiments,
+    featureFlags,
+    routes,
+    integrations,
+    knowledge,
+    translation,
+    branding,
+    notes: tenant.notes ?? blueprint.notes
+  };
+}
+function composeAppConfig(blueprint, tenant, deps, options = {}) {
+  const resolved = resolveAppConfig(blueprint, tenant, deps);
+  const missing = [];
+  const integrationEvaluation = evaluateIntegrationSlots(blueprint.integrationSlots, tenant.integrations, deps.integrationConnections, deps.integrationSpecs);
+  resolved.integrations = integrationEvaluation.resolved;
+  missing.push(...integrationEvaluation.missing);
+  missing.push(...collectMissingKnowledge(tenant.knowledge ?? [], deps.knowledgeSpaces, deps.knowledgeSources));
+  const capabilities2 = resolveCapabilityRefs(resolved.capabilities.enabled, deps.capabilities, missing);
+  const features = resolveFeatureRefs(resolved.features.include, deps.features, missing);
+  const dataViews = resolvePointerRecord(resolved.dataViews, deps.dataViews, "dataView", missing);
+  const workflows = resolvePointerRecord(resolved.workflows, deps.workflows, "workflow", missing);
+  const policies = resolvePolicies(resolved.policies, deps.policies, missing);
+  const { theme, fallbacks, themeMissing } = resolveThemeBinding(resolved.theme, deps.themes);
+  missing.push(...themeMissing);
+  const { telemetry, telemetryMissing } = resolveTelemetryBinding(resolved.telemetry, deps.telemetry);
+  missing.push(...telemetryMissing);
+  const experiments = resolveExperimentsSpecs(resolved.experiments, deps.experiments, missing);
+  if (options.strict && missing.length > 0) {
+    const reasons = missing.map((item) => `${item.type}:${item.identifier}`).join(", ");
+    throw new Error(`composeAppConfig: missing references -> ${reasons}`);
+  }
+  return {
+    resolved,
+    capabilities: capabilities2,
+    features,
+    dataViews,
+    workflows,
+    policies,
+    theme,
+    themeFallbacks: fallbacks,
+    telemetry,
+    experiments,
+    integrations: resolved.integrations,
+    knowledge: resolved.knowledge,
+    missing
+  };
+}
+function mergeCapabilities(blueprint, tenant) {
+  const enabled = dedupeRefs([...blueprint?.enabled ?? [], ...tenant?.enable ?? []], capabilityKey2);
+  const disabled = dedupeRefs([...blueprint?.disabled ?? [], ...tenant?.disable ?? []], capabilityKey2);
+  const disabledKeys = new Set(disabled.map(capabilityKey2));
+  const filteredEnabled = enabled.filter((ref) => !disabledKeys.has(capabilityKey2(ref)));
+  return { enabled: filteredEnabled, disabled };
+}
+function mergeFeatures(blueprint, tenant) {
+  const include = dedupeRefs([...blueprint?.include ?? [], ...tenant?.include ?? []], featureKey);
+  const exclude = dedupeRefs([...blueprint?.exclude ?? [], ...tenant?.exclude ?? []], featureKey);
+  const excludeSet = new Set(exclude.map(featureKey));
+  const filteredInclude = include.filter((ref) => !excludeSet.has(featureKey(ref)));
+  return { include: filteredInclude, exclude };
+}
+function mergeMappings(blueprint, overrides) {
+  const merged = { ...blueprint };
+  if (!overrides)
+    return merged;
+  for (const override of overrides) {
+    if (!override)
+      continue;
+    if (!override.pointer) {
+      delete merged[override.slot];
+    } else {
+      merged[override.slot] = override.pointer;
+    }
+  }
+  return merged;
+}
+function mergePolicies(blueprint, additional) {
+  return dedupeRefs([...blueprint, ...additional], policyKey);
+}
+function mergeTheme(blueprint, override) {
+  if (!blueprint && !override)
+    return;
+  const primary = override?.primary ?? blueprint?.primary;
+  if (!primary)
+    return;
+  const fallbacks = override?.fallbacks ?? blueprint?.fallbacks ?? [];
+  return { primary, fallbacks };
+}
+function mergeTelemetry(blueprint, override) {
+  if (!blueprint && !override)
+    return;
+  const binding = {
+    spec: blueprint?.spec,
+    disabledEvents: blueprint?.disabledEvents ? [...blueprint.disabledEvents] : undefined,
+    samplingOverrides: blueprint?.samplingOverrides ? { ...blueprint.samplingOverrides } : undefined
+  };
+  if (override?.spec !== undefined) {
+    binding.spec = override.spec ?? undefined;
+  }
+  if (override?.disabledEvents) {
+    binding.disabledEvents = dedupeStrings([
+      ...binding.disabledEvents ?? [],
+      ...override.disabledEvents
+    ]);
+  }
+  if (override?.samplingOverrides) {
+    binding.samplingOverrides = {
+      ...binding.samplingOverrides ?? {},
+      ...override.samplingOverrides
+    };
+  }
+  if (!binding.spec && !binding.disabledEvents?.length) {
+    return;
+  }
+  return binding;
+}
+function mergeExperiments(blueprint, tenant) {
+  const defaultActive = blueprint?.active ?? [];
+  const defaultPaused = blueprint?.paused ?? [];
+  const tenantActive = tenant?.active;
+  const tenantPaused = tenant?.paused;
+  const activeSource = tenantActive && tenantActive.length > 0 ? tenantActive : defaultActive;
+  const pausedSource = tenantPaused && tenantPaused.length > 0 ? tenantPaused : defaultPaused;
+  const active = dedupeRefs(activeSource, experimentKey);
+  let paused = dedupeRefs(pausedSource, experimentKey);
+  const activeKeys = new Set(active.map(experimentKey));
+  paused = paused.filter((ref) => !activeKeys.has(experimentKey(ref)));
+  const catalog = dedupeRefs([
+    ...defaultActive,
+    ...defaultPaused,
+    ...tenantActive ?? [],
+    ...tenantPaused ?? []
+  ], experimentKey);
+  return { catalog, active, paused };
+}
+function resolveBranding(defaults, tenant) {
+  const override = tenant.branding;
+  const tenantMeta = tenant.meta;
+  const baseDomain = "app.localhost";
+  const domain = override?.customDomain ?? (override?.subdomain ? `${override.subdomain}.${baseDomain}` : `${tenantMeta.tenantId}.${baseDomain}`);
+  const localePreferenceOrder = [];
+  if (tenant.locales?.defaultLocale) {
+    localePreferenceOrder.push(tenant.locales.defaultLocale);
+  }
+  if (override?.appName) {
+    localePreferenceOrder.push("default", "en");
+  }
+  let appName;
+  if (override?.appName) {
+    for (const key of localePreferenceOrder) {
+      const candidate = override.appName[key];
+      if (candidate) {
+        appName = candidate;
+        break;
+      }
+    }
+    if (!appName) {
+      const [, firstValue] = Object.entries(override.appName)[0] ?? [];
+      if (typeof firstValue === "string") {
+        appName = firstValue;
+      }
+    }
+  }
+  if (!appName) {
+    appName = defaults?.appNameKey ?? tenantMeta.appId;
+  }
+  const assetEntries = new Map;
+  const applyAssets = (assets2) => {
+    if (!assets2)
+      return;
+    for (const asset of assets2) {
+      if (!asset?.type)
+        continue;
+      if ("url" in asset && asset.url) {
+        assetEntries.set(asset.type, asset.url);
+      }
+    }
+  };
+  applyAssets(defaults?.assets);
+  applyAssets(override?.assets);
+  const assets = {
+    logo: assetEntries.get("logo"),
+    logoDark: assetEntries.get("logo-dark"),
+    favicon: assetEntries.get("favicon"),
+    ogImage: assetEntries.get("og-image")
+  };
+  const colors = {
+    primary: override?.colors?.primary ?? defaults?.colorTokens?.primary ?? "#1f2937",
+    secondary: override?.colors?.secondary ?? defaults?.colorTokens?.secondary ?? "#4b5563"
+  };
+  return {
+    appName,
+    assets,
+    colors,
+    domain
+  };
+}
+function resolveTranslation(catalogPointer, locales, overrides) {
+  const defaultLocale = locales?.defaultLocale ?? "en";
+  const enabled = locales?.enabledLocales ?? [];
+  const supportedLocales = dedupeStrings([defaultLocale, ...enabled]);
+  const entries = overrides?.entries ?? [];
+  return {
+    defaultLocale,
+    supportedLocales,
+    blueprintCatalog: catalogPointer,
+    tenantOverrides: entries
+  };
+}
+function mergeFeatureFlags(blueprint, overrides) {
+  const merged = new Map;
+  for (const flag of blueprint) {
+    merged.set(flag.key, { ...flag });
+  }
+  for (const override of overrides) {
+    merged.set(override.key, { ...override });
+  }
+  return [...merged.values()];
+}
+function mergeRoutes(blueprint, overrides) {
+  const routes = new Map;
+  for (const route of blueprint) {
+    routes.set(route.path, { ...route });
+  }
+  for (const override of overrides) {
+    const existing = routes.get(override.path) ?? { path: override.path };
+    if (override.label !== undefined) {
+      if (override.label === null)
+        delete existing.label;
+      else
+        existing.label = override.label;
+    }
+    if (override.dataView !== undefined) {
+      if (override.dataView === null)
+        delete existing.dataView;
+      else
+        existing.dataView = override.dataView;
+    }
+    if (override.workflow !== undefined) {
+      if (override.workflow === null)
+        delete existing.workflow;
+      else
+        existing.workflow = override.workflow;
+    }
+    if (override.guard !== undefined) {
+      if (override.guard === null)
+        delete existing.guard;
+      else
+        existing.guard = override.guard;
+    }
+    if (override.featureFlag !== undefined) {
+      if (override.featureFlag === null)
+        delete existing.featureFlag;
+      else
+        existing.featureFlag = override.featureFlag;
+    }
+    if (override.experiment !== undefined) {
+      if (override.experiment === null)
+        delete existing.experiment;
+      else
+        existing.experiment = override.experiment;
+    }
+    routes.set(existing.path, existing);
+  }
+  return [...routes.values()];
+}
+function evaluateIntegrationSlots(slots, bindings, connections, specs) {
+  const resolved = [];
+  const missing = [];
+  const missingKeys = new Set;
+  const recordMissing = (entry) => {
+    const key = `${entry.type}:${entry.identifier}`;
+    if (missingKeys.has(key))
+      return;
+    missingKeys.add(key);
+    missing.push(entry);
+  };
+  const slotList = slots ?? [];
+  const slotById = new Map;
+  for (const slot of slotList) {
+    slotById.set(slot.slotId, slot);
+  }
+  const bindingsBySlot = new Map;
+  for (const binding of bindings ?? []) {
+    const slot = slotById.get(binding.slotId);
+    if (!slot) {
+      recordMissing({
+        type: "integrationSlot",
+        identifier: `slot:${binding.slotId}`
+      });
+      continue;
+    }
+    const entries = bindingsBySlot.get(binding.slotId);
+    if (entries)
+      entries.push(binding);
+    else
+      bindingsBySlot.set(binding.slotId, [binding]);
+  }
+  for (const slot of slotList) {
+    const slotBindings = bindingsBySlot.get(slot.slotId) ?? [];
+    if (slot.required && slotBindings.length === 0) {
+      recordMissing({
+        type: "integrationSlot",
+        identifier: `slot:${slot.slotId}`
+      });
+    }
+  }
+  if (!connections || !specs) {
+    return { resolved, missing };
+  }
+  const connectionById = new Map;
+  for (const connection of connections) {
+    connectionById.set(connection.meta.id, connection);
+  }
+  for (const slot of slotList) {
+    const slotBindings = bindingsBySlot.get(slot.slotId) ?? [];
+    if (slotBindings.length === 0)
+      continue;
+    const orderedBindings = [...slotBindings].sort((a, b) => {
+      const aPriority = a.priority ?? Number.MAX_SAFE_INTEGER;
+      const bPriority = b.priority ?? Number.MAX_SAFE_INTEGER;
+      if (aPriority === bPriority)
+        return 0;
+      return aPriority < bPriority ? -1 : 1;
+    });
+    let slotResolved = false;
+    for (const binding of orderedBindings) {
+      const connection = connectionById.get(binding.connectionId);
+      if (!connection) {
+        recordMissing({
+          type: "integrationConnection",
+          identifier: `connection:${binding.connectionId}`
+        });
+        continue;
+      }
+      const spec = specs.get(connection.meta.integrationKey, connection.meta.integrationVersion);
+      if (!spec) {
+        recordMissing({
+          type: "integrationSpec",
+          identifier: `spec:${connection.meta.integrationKey}.v${connection.meta.integrationVersion}`
+        });
+        continue;
+      }
+      if (spec.meta.category !== slot.requiredCategory) {
+        recordMissing({
+          type: "integrationSpec",
+          identifier: `spec:${spec.meta.key}.category`
+        });
+        continue;
+      }
+      if (!spec.supportedModes.includes(connection.ownershipMode)) {
+        recordMissing({
+          type: "integrationSpec",
+          identifier: `spec:${spec.meta.key}.mode:${connection.ownershipMode}`
+        });
+        continue;
+      }
+      if (slot.allowedModes && slot.allowedModes.length > 0 && !slot.allowedModes.includes(connection.ownershipMode)) {
+        recordMissing({
+          type: "integrationConnection",
+          identifier: `connection:${connection.meta.id}:mode`
+        });
+        continue;
+      }
+      if (slot.requiredCapabilities && !slot.requiredCapabilities.every((requirement) => integrationProvidesCapability(spec, requirement))) {
+        recordMissing({
+          type: "integrationSpec",
+          identifier: `spec:${spec.meta.key}.capabilities`
+        });
+        continue;
+      }
+      resolved.push({
+        slot,
+        binding,
+        connection,
+        spec
+      });
+      slotResolved = true;
+      break;
+    }
+    if (!slotResolved && slot.required) {
+      recordMissing({
+        type: "integrationSlot",
+        identifier: `slot:${slot.slotId}`
+      });
+    }
+  }
+  return { resolved, missing };
+}
+function integrationProvidesCapability(spec, required) {
+  return spec.capabilities.provides.some((capability) => {
+    if (capability.key !== required.key)
+      return false;
+    if (required.version == null)
+      return true;
+    return capability.version === required.version;
+  });
+}
+function resolveKnowledgeBindings(bindings, spaces, sources) {
+  if (!bindings?.length || !spaces)
+    return [];
+  const sourceList = sources ?? [];
+  return bindings.map((binding) => {
+    const space = spaces.get(binding.spaceKey, binding.spaceVersion);
+    if (!space)
+      return null;
+    const relevantSources = sourceList.filter((source) => {
+      if (source.meta.spaceKey !== binding.spaceKey)
+        return false;
+      if (binding.spaceVersion != null) {
+        return source.meta.spaceVersion === binding.spaceVersion;
+      }
+      return true;
+    });
+    return {
+      binding,
+      space,
+      sources: relevantSources
+    };
+  }).filter((entry) => entry !== null);
+}
+function collectMissingKnowledge(bindings, spaces, sources) {
+  if (!bindings.length || !spaces)
+    return [];
+  const missing = [];
+  const sourceList = sources ?? [];
+  for (const binding of bindings) {
+    const space = spaces.get(binding.spaceKey, binding.spaceVersion);
+    if (!space) {
+      missing.push({
+        type: "knowledgeSpace",
+        identifier: binding.spaceVersion ? `${binding.spaceKey}@${binding.spaceVersion}` : binding.spaceKey
+      });
+      continue;
+    }
+    if (sources) {
+      const relevantSources = sourceList.filter((source) => {
+        if (source.meta.spaceKey !== binding.spaceKey)
+          return false;
+        if (binding.spaceVersion != null) {
+          return source.meta.spaceVersion === binding.spaceVersion;
+        }
+        return true;
+      });
+      if (relevantSources.length === 0) {
+        missing.push({
+          type: "knowledgeSource",
+          identifier: binding.spaceVersion ? `${binding.spaceKey}@${binding.spaceVersion}` : binding.spaceKey
+        });
+      }
+    }
+  }
+  return missing;
+}
+function resolveCapabilityRefs(refs, registry2, missing) {
+  if (!registry2) {
+    if (refs.length > 0) {
+      for (const ref of refs) {
+        missing.push({
+          type: "capability",
+          identifier: capabilityKey2(ref)
+        });
+      }
+    }
+    return [];
+  }
+  const resolved = [];
+  for (const ref of refs) {
+    const spec = registry2.get(ref.key, ref.version);
+    if (!spec) {
+      missing.push({
+        type: "capability",
+        identifier: capabilityKey2(ref)
+      });
+      continue;
+    }
+    resolved.push(spec);
+  }
+  return resolved;
+}
+function resolveFeatureRefs(refs, registry2, missing) {
+  if (!registry2) {
+    if (refs.length > 0) {
+      for (const ref of refs) {
+        missing.push({ type: "feature", identifier: ref.key });
+      }
+    }
+    return [];
+  }
+  const resolved = [];
+  for (const ref of refs) {
+    const spec = registry2.get(ref.key);
+    if (!spec) {
+      missing.push({ type: "feature", identifier: ref.key });
+      continue;
+    }
+    resolved.push(spec);
+  }
+  return resolved;
+}
+function resolvePointerRecord(record, registry2, type, missing) {
+  if (!registry2) {
+    if (Object.keys(record).length > 0) {
+      for (const [slot, pointer] of Object.entries(record)) {
+        missing.push({
+          type,
+          identifier: `${slot} -> ${specPointerKey(pointer)}`
+        });
+      }
+    }
+    return {};
+  }
+  const resolved = {};
+  for (const [slot, pointer] of Object.entries(record)) {
+    const spec = registry2.get(pointer.key, pointer.version);
+    if (!spec) {
+      missing.push({
+        type,
+        identifier: `${slot} -> ${specPointerKey(pointer)}`
+      });
+      continue;
+    }
+    resolved[slot] = spec;
+  }
+  return resolved;
+}
+function resolvePolicies(policies, registry2, missing) {
+  if (!registry2) {
+    if (policies.length > 0) {
+      for (const policy of policies) {
+        missing.push({
+          type: "policy",
+          identifier: policyKey(policy)
+        });
+      }
+    }
+    return [];
+  }
+  const resolved = [];
+  for (const policy of policies) {
+    const spec = registry2.get(policy.key, policy.version);
+    if (!spec) {
+      missing.push({
+        type: "policy",
+        identifier: policyKey(policy)
+      });
+      continue;
+    }
+    resolved.push(spec);
+  }
+  return resolved;
+}
+function resolveThemeBinding(binding, registry2) {
+  const themeMissing = [];
+  if (!binding) {
+    return { theme: undefined, fallbacks: [], themeMissing };
+  }
+  if (!registry2) {
+    themeMissing.push({
+      type: "theme",
+      identifier: `${binding.primary.key}.v${binding.primary.version}`
+    });
+    for (const fallback of binding.fallbacks ?? []) {
+      themeMissing.push({
+        type: "theme",
+        identifier: `${fallback.key}.v${fallback.version}`
+      });
+    }
+    return { theme: undefined, fallbacks: [], themeMissing };
+  }
+  const theme = registry2.get(binding.primary.key, binding.primary.version);
+  if (!theme) {
+    themeMissing.push({
+      type: "theme",
+      identifier: `${binding.primary.key}.v${binding.primary.version}`
+    });
+  }
+  const fallbacks = [];
+  for (const fallback of binding.fallbacks ?? []) {
+    const spec = registry2.get(fallback.key, fallback.version);
+    if (!spec) {
+      themeMissing.push({
+        type: "theme",
+        identifier: `${fallback.key}.v${fallback.version}`
+      });
+      continue;
+    }
+    fallbacks.push(spec);
+  }
+  return { theme: theme ?? undefined, fallbacks, themeMissing };
+}
+function resolveTelemetryBinding(binding, registry2) {
+  const telemetryMissing = [];
+  if (!binding?.spec) {
+    return { telemetry: undefined, telemetryMissing };
+  }
+  if (!registry2) {
+    telemetryMissing.push({
+      type: "telemetry",
+      identifier: specPointerKey(binding.spec)
+    });
+    return { telemetry: undefined, telemetryMissing };
+  }
+  const telemetry = registry2.get(binding.spec.key, binding.spec.version);
+  if (!telemetry) {
+    telemetryMissing.push({
+      type: "telemetry",
+      identifier: specPointerKey(binding.spec)
+    });
+  }
+  return { telemetry: telemetry ?? undefined, telemetryMissing };
+}
+function resolveExperimentsSpecs(experiments, registry2, missing) {
+  const resolveList = (refs) => {
+    if (refs.length === 0)
+      return [];
+    if (!registry2) {
+      for (const ref of refs) {
+        missing.push({
+          type: "experiment",
+          identifier: experimentKey(ref)
+        });
+      }
+      return [];
+    }
+    const resolved = [];
+    for (const ref of refs) {
+      const spec = registry2.get(ref.key, ref.version);
+      if (!spec) {
+        missing.push({
+          type: "experiment",
+          identifier: experimentKey(ref)
+        });
+        continue;
+      }
+      resolved.push(spec);
+    }
+    return resolved;
+  };
+  return {
+    active: resolveList(experiments.active),
+    paused: resolveList(experiments.paused)
+  };
+}
+function capabilityKey2(ref) {
+  return `${ref.key}${ref.version ? `.v${ref.version}` : ""}`;
+}
+function featureKey(ref) {
+  return ref.key;
+}
+function specPointerKey(pointer) {
+  return `${pointer.key}${pointer.version ? `.v${pointer.version}` : ""}`;
+}
+function policyKey(ref) {
+  return `${ref.key}${ref.version ? `.v${ref.version}` : ""}`;
+}
+function experimentKey(ref) {
+  return `${ref.key}${ref.version ? `.v${ref.version}` : ""}`;
+}
+function dedupeRefs(refs, keyFn) {
+  const map = new Map;
+  for (const ref of refs) {
+    map.set(keyFn(ref), ref);
+  }
+  return [...map.values()];
+}
+function dedupeStrings(values) {
+  return [...new Set(values)];
+}
+
+// src/app-config/validation.ts
+class ValidationRuleRegistry {
+  blueprintRules = [];
+  tenantRules = [];
+  resolvedRules = [];
+  register(rule) {
+    if (rule.scope === "blueprint") {
+      this.blueprintRules.push(rule);
+    } else if (rule.scope === "tenant") {
+      this.tenantRules.push(rule);
+    } else {
+      this.resolvedRules.push(rule);
+    }
+    return this;
+  }
+  validateBlueprint(blueprint, context2) {
+    return dedupeIssues(this.blueprintRules.flatMap((rule) => rule.validate(blueprint, context2)));
+  }
+  validateTenant(blueprint, tenant, context2) {
+    return dedupeIssues(this.tenantRules.flatMap((rule) => rule.validate(blueprint, tenant, context2)));
+  }
+  validateResolved(blueprint, resolved, context2) {
+    return dedupeIssues(this.resolvedRules.flatMap((rule) => rule.validate(blueprint, resolved, context2)));
+  }
+}
+var DOMAIN_REGEX = /^(?!:\/\/)([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.[A-Za-z]{2,}$/;
+var HTTPS_URL_REGEX = /^https:\/\//i;
+var ALLOWED_ASSET_EXTENSIONS = {
+  logo: ["png", "svg", "webp"],
+  "logo-dark": ["png", "svg", "webp"],
+  favicon: ["ico", "png", "svg"],
+  "og-image": ["png", "jpg", "jpeg", "webp"]
+};
+var EMPTY_CONTEXT = {};
+var registryInstance;
+function getRegistry() {
+  if (!registryInstance) {
+    registryInstance = createDefaultRegistry();
+  }
+  return registryInstance;
+}
+function validateConfig(blueprint, tenant, context2 = EMPTY_CONTEXT) {
+  const registry2 = getRegistry();
+  const blueprintResult = buildResult(registry2.validateBlueprint(blueprint, context2));
+  const tenantResult = buildResult(registry2.validateTenant(blueprint, tenant, context2));
+  return mergeResults(blueprintResult, tenantResult);
+}
+function validateBlueprint(blueprint, context2 = EMPTY_CONTEXT) {
+  const issues = getRegistry().validateBlueprint(blueprint, context2);
+  return buildResult(issues);
+}
+function validateTenantConfig(blueprint, tenant, context2 = EMPTY_CONTEXT) {
+  const issues = getRegistry().validateTenant(blueprint, tenant, context2);
+  return buildResult(issues);
+}
+function validateResolvedConfig(blueprint, resolved, context2 = EMPTY_CONTEXT) {
+  const issues = getRegistry().validateResolved(blueprint, resolved, context2);
+  return buildResult(issues);
+}
+function buildResult(issues) {
+  const errors = issues.filter((issue) => issue.severity === "error");
+  const warnings = issues.filter((issue) => issue.severity === "warning");
+  const info = issues.filter((issue) => issue.severity === "info");
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings,
+    info
+  };
+}
+function mergeResults(...results) {
+  const errors = results.flatMap((result) => result.errors);
+  const warnings = results.flatMap((result) => result.warnings);
+  const info = results.flatMap((result) => result.info);
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings,
+    info
+  };
+}
+function createDefaultRegistry() {
+  return new ValidationRuleRegistry().register(blueprintIntegrationSlotRule).register(blueprintCapabilityRegistryRule).register(tenantCapabilityRule).register(tenantIntegrationBindingRule).register(tenantKnowledgeRule).register(tenantBrandingRule).register(tenantTranslationRule).register(resolvedIntegrationRule).register(resolvedTranslationRule);
+}
+var blueprintIntegrationSlotRule = {
+  scope: "blueprint",
+  name: "integration.duplicate-slots",
+  category: "integration",
+  validate(blueprint) {
+    const issues = [];
+    const seen = new Set;
+    for (const slot of blueprint.integrationSlots ?? []) {
+      if (seen.has(slot.slotId)) {
+        issues.push(issue({
+          code: "DUPLICATE_SLOT",
+          severity: "error",
+          path: `integrationSlots.${slot.slotId}`,
+          message: `Duplicate integration slot id "${slot.slotId}".`
+        }));
+      } else {
+        seen.add(slot.slotId);
+      }
+      if (slot.allowedModes && slot.allowedModes.length === 0) {
+        issues.push(issue({
+          code: "EMPTY_ALLOWED_MODES",
+          severity: "warning",
+          path: `integrationSlots.${slot.slotId}.allowedModes`,
+          message: "allowedModes is empty; the slot will accept any supported mode."
+        }));
+      }
+    }
+    if (blueprint.branding && !blueprint.branding.appNameKey.trim()) {
+      issues.push(issue({
+        code: "MISSING_APP_NAME_KEY",
+        severity: "warning",
+        path: "branding.appNameKey",
+        message: "branding.appNameKey should reference a translation catalog key."
+      }));
+    }
+    return issues;
+  }
+};
+var blueprintCapabilityRegistryRule = {
+  scope: "blueprint",
+  name: "capability.registry-check",
+  category: "capability",
+  validate(blueprint, context2) {
+    const issues = [];
+    const registry2 = context2.capabilities;
+    if (!registry2)
+      return issues;
+    const required = blueprint.capabilities?.enabled ?? [];
+    required.forEach((ref, index) => {
+      if (!registry2.get(ref.key, ref.version)) {
+        issues.push(issue({
+          code: "MISSING_CAPABILITY",
+          severity: "error",
+          path: `capabilities.enabled[${index}]`,
+          message: `Capability "${ref.key}@${ref.version}" is not registered.`
+        }));
+      }
+    });
+    return issues;
+  }
+};
+var tenantCapabilityRule = {
+  scope: "tenant",
+  name: "capability.required-enabled",
+  category: "capability",
+  validate(blueprint, tenant, context2) {
+    const issues = [];
+    const registry2 = context2.capabilities;
+    const requiredKeys = new Set((blueprint.capabilities?.enabled ?? []).map(capabilityRefKey));
+    const disabled = tenant.capabilities?.disable ?? [];
+    disabled.forEach((ref, index) => {
+      if (requiredKeys.has(capabilityRefKey(ref))) {
+        issues.push(issue({
+          code: "DISABLED_REQUIRED_CAPABILITY",
+          severity: "error",
+          path: `capabilities.disable[${index}]`,
+          message: `Capability "${ref.key}@${ref.version}" is required by the blueprint and cannot be disabled.`
+        }));
+      }
+    });
+    if (registry2) {
+      (tenant.capabilities?.enable ?? []).forEach((ref, index) => {
+        if (!registry2.get(ref.key, ref.version)) {
+          issues.push(issue({
+            code: "UNKNOWN_CAPABILITY_ENABLE",
+            severity: "error",
+            path: `capabilities.enable[${index}]`,
+            message: `Capability "${ref.key}@${ref.version}" is not registered.`
+          }));
+        }
+      });
+      disabled.forEach((ref, index) => {
+        if (!registry2.get(ref.key, ref.version)) {
+          issues.push(issue({
+            code: "UNKNOWN_CAPABILITY_DISABLE",
+            severity: "warning",
+            path: `capabilities.disable[${index}]`,
+            message: `Capability "${ref.key}@${ref.version}" is not registered.`
+          }));
+        }
+      });
+    }
+    return issues;
+  }
+};
+var tenantIntegrationBindingRule = {
+  scope: "tenant",
+  name: "integration.slot-binding",
+  category: "integration",
+  validate(blueprint, tenant, context2) {
+    const issues = [];
+    const slots = new Map((blueprint.integrationSlots ?? []).map((slot) => [slot.slotId, slot]));
+    const bindings = tenant.integrations ?? [];
+    const connections = context2.tenantConnections?.reduce((map, connection) => map.set(connection.meta.id, connection), new Map) ?? new Map;
+    const satisfiedSlots = new Set;
+    bindings.forEach((binding) => {
+      const path = `integrations.${binding.slotId}`;
+      const slot = slots.get(binding.slotId);
+      if (!slot) {
+        issues.push(issue({
+          code: "UNKNOWN_SLOT_BINDING",
+          severity: "error",
+          path,
+          message: `Integration slot "${binding.slotId}" is not defined in the blueprint.`
+        }));
+        return;
+      }
+      let slotValid = true;
+      const connection = connections.get(binding.connectionId);
+      if (!connection) {
+        issues.push(issue({
+          code: "MISSING_INTEGRATION_CONNECTION",
+          severity: "error",
+          path,
+          message: `Integration connection "${binding.connectionId}" was not found for tenant "${tenant.meta.tenantId}".`
+        }));
+        slotValid = false;
+        return;
+      }
+      if (connection.meta.tenantId !== tenant.meta.tenantId) {
+        issues.push(issue({
+          code: "FOREIGN_CONNECTION",
+          severity: "error",
+          path,
+          message: `Connection "${binding.connectionId}" belongs to tenant "${connection.meta.tenantId}", not "${tenant.meta.tenantId}".`
+        }));
+        slotValid = false;
+      }
+      if (slot.allowedModes && slot.allowedModes.length > 0) {
+        if (!slot.allowedModes.includes(connection.ownershipMode)) {
+          issues.push(issue({
+            code: "MODE_MISMATCH",
+            severity: "error",
+            path,
+            message: `Slot "${slot.slotId}" only allows modes [${slot.allowedModes.join(", ")}] but connection is "${connection.ownershipMode}".`
+          }));
+          slotValid = false;
+        }
+      }
+      if (connection.status === "disconnected" || connection.status === "error") {
+        issues.push(issue({
+          code: "CONNECTION_NOT_READY",
+          severity: "error",
+          path,
+          message: `Connection "${connection.meta.label}" is in status "${connection.status}".`
+        }));
+        slotValid = false;
+      } else if (connection.status === "unknown") {
+        issues.push(issue({
+          code: "CONNECTION_STATUS_UNKNOWN",
+          severity: "warning",
+          path,
+          message: `Connection "${connection.meta.label}" has unknown health status.`
+        }));
+      }
+      const spec = lookupIntegrationSpec(context2.integrationSpecs, connection);
+      if (!spec) {
+        issues.push(issue({
+          code: "INTEGRATION_SPEC_NOT_FOUND",
+          severity: "warning",
+          path,
+          message: `Integration spec "${connection.meta.integrationKey}@${connection.meta.integrationVersion}" is not registered.`
+        }));
+        slotValid = false;
+        return;
+      }
+      if (spec.meta.category !== slot.requiredCategory) {
+        issues.push(issue({
+          code: "CATEGORY_MISMATCH",
+          severity: "error",
+          path,
+          message: `Slot "${slot.slotId}" requires category "${slot.requiredCategory}" but connection provides "${spec.meta.category}".`
+        }));
+        slotValid = false;
+      }
+      if (!spec.supportedModes.includes(connection.ownershipMode)) {
+        issues.push(issue({
+          code: "UNSUPPORTED_OWNERSHIP_MODE",
+          severity: "error",
+          path,
+          message: `Integration spec "${spec.meta.key}" does not support ownership mode "${connection.ownershipMode}".`
+        }));
+        slotValid = false;
+      }
+      for (const required of slot.requiredCapabilities ?? []) {
+        if (!integrationProvidesCapability2(spec, required)) {
+          issues.push(issue({
+            code: "CAPABILITY_NOT_PROVIDED",
+            severity: "error",
+            path,
+            message: `Integration "${spec.meta.key}" does not provide required capability "${required.key}@${required.version}".`
+          }));
+          slotValid = false;
+        }
+      }
+      if (slotValid) {
+        satisfiedSlots.add(slot.slotId);
+      }
+    });
+    for (const slot of slots.values()) {
+      if (slot.required && !satisfiedSlots.has(slot.slotId)) {
+        issues.push(issue({
+          code: "MISSING_REQUIRED_SLOT",
+          severity: "error",
+          path: `integrations.${slot.slotId}`,
+          message: `Required integration slot "${slot.slotId}" is not bound.`
+        }));
+      }
+    }
+    return issues;
+  }
+};
+var tenantKnowledgeRule = {
+  scope: "tenant",
+  name: "knowledge.bindings",
+  category: "knowledge",
+  validate(_blueprint, tenant, context2) {
+    const issues = [];
+    const registry2 = context2.knowledgeSpaces;
+    if (!registry2)
+      return issues;
+    const sources = context2.knowledgeSources ?? [];
+    (tenant.knowledge ?? []).forEach((binding, index) => {
+      const path = `knowledge[${index}]`;
+      const space = registry2.get(binding.spaceKey, binding.spaceVersion);
+      if (!space) {
+        issues.push(issue({
+          code: "UNKNOWN_KNOWLEDGE_SPACE",
+          severity: "error",
+          path: `${path}.spaceKey`,
+          message: `Knowledge space "${binding.spaceKey}" is not registered.`
+        }));
+        return;
+      }
+      const hasSources = sources.some((source) => {
+        if (source.meta.spaceKey !== binding.spaceKey)
+          return false;
+        if (binding.spaceVersion != null) {
+          return source.meta.spaceVersion === binding.spaceVersion;
+        }
+        return true;
+      });
+      if (!hasSources) {
+        issues.push(issue({
+          code: "MISSING_KNOWLEDGE_SOURCES",
+          severity: "error",
+          path,
+          message: `Knowledge space "${binding.spaceKey}" has no configured sources for tenant "${tenant.meta.tenantId}".`
+        }));
+      }
+      if (space.meta.category === "external" || space.meta.category === "ephemeral") {
+        issues.push(issue({
+          code: "LOW_TRUST_KNOWLEDGE",
+          severity: "warning",
+          path,
+          message: `Knowledge space "${binding.spaceKey}" has category "${space.meta.category}". Avoid using it for irreversible or policy decisions.`
+        }));
+      }
+    });
+    return issues;
+  }
+};
+var tenantBrandingRule = {
+  scope: "tenant",
+  name: "branding.constraints",
+  category: "branding",
+  validate(_blueprint, tenant, context2) {
+    const issues = [];
+    const branding = tenant.branding;
+    if (!branding)
+      return issues;
+    const domain = branding.customDomain?.trim();
+    if (domain) {
+      if (!DOMAIN_REGEX.test(domain)) {
+        issues.push(issue({
+          code: "INVALID_DOMAIN",
+          severity: "error",
+          path: "branding.customDomain",
+          message: `Custom domain "${domain}" is not a valid hostname.`
+        }));
+      }
+      const conflict = (context2.existingConfigs ?? []).find((config) => {
+        if (config.meta.id === tenant.meta.id)
+          return false;
+        const otherDomain = config.branding?.customDomain?.trim();
+        if (!otherDomain)
+          return false;
+        return otherDomain.toLowerCase() === domain.toLowerCase();
+      });
+      if (conflict) {
+        issues.push(issue({
+          code: "DUPLICATE_DOMAIN",
+          severity: "error",
+          path: "branding.customDomain",
+          message: `Custom domain "${domain}" is already used by tenant "${conflict.meta.tenantId}".`
+        }));
+      }
+    }
+    (branding.assets ?? []).forEach((asset, index) => {
+      const assetPath = `branding.assets[${index}]`;
+      if (!HTTPS_URL_REGEX.test(asset.url)) {
+        issues.push(issue({
+          code: "INSECURE_ASSET_URL",
+          severity: "error",
+          path: `${assetPath}.url`,
+          message: `Branding asset "${asset.type}" must use an HTTPS URL.`
+        }));
+      }
+      const allowed = ALLOWED_ASSET_EXTENSIONS[asset.type] ?? ALLOWED_ASSET_EXTENSIONS.logo;
+      const extension = extractExtension(asset.url);
+      if (extension && allowed && !allowed.includes(extension)) {
+        issues.push(issue({
+          code: "UNEXPECTED_ASSET_TYPE",
+          severity: "warning",
+          path: `${assetPath}.url`,
+          message: `Asset "${asset.type}" should use one of: ${(allowed ?? []).join(", ")}. Detected "${extension}".`
+        }));
+      }
+    });
+    return issues;
+  }
+};
+var tenantTranslationRule = {
+  scope: "tenant",
+  name: "translation.consistency",
+  category: "translation",
+  validate(blueprint, tenant, context2) {
+    const issues = [];
+    const pointer = blueprint.translationCatalog;
+    const catalogs = normalizeCatalogs(context2.translationCatalogs);
+    const blueprintCatalog = pointer ? catalogs.blueprint.find((catalog) => catalog.meta.key === pointer.key && catalog.meta.version === pointer.version) : undefined;
+    if (pointer && !blueprintCatalog) {
+      issues.push(issue({
+        code: "MISSING_BLUEPRINT_CATALOG",
+        severity: "error",
+        path: "translationCatalog",
+        message: `Blueprint translation catalog "${pointer.key}@${pointer.version}" is not loaded in context.`
+      }));
+    }
+    const requiredKeys = new Set;
+    if (blueprint.branding?.appNameKey) {
+      requiredKeys.add(blueprint.branding.appNameKey);
+      if (blueprintCatalog && !hasTranslationEntry(blueprintCatalog.entries, blueprint.branding.appNameKey, blueprintCatalog.defaultLocale)) {
+        issues.push(issue({
+          code: "MISSING_TRANSLATION_KEY",
+          severity: "error",
+          path: "branding.appNameKey",
+          message: `Translation key "${blueprint.branding.appNameKey}" is missing for locale "${blueprintCatalog.defaultLocale}".`
+        }));
+      }
+    }
+    const tenantLocales = tenant.locales;
+    if (tenantLocales) {
+      const { defaultLocale, enabledLocales } = tenantLocales;
+      if (!enabledLocales.includes(defaultLocale)) {
+        issues.push(issue({
+          code: "LOCALE_NOT_ENABLED",
+          severity: "warning",
+          path: "locales.enabledLocales",
+          message: `enabledLocales does not include defaultLocale "${defaultLocale}".`
+        }));
+      }
+      if (blueprintCatalog) {
+        const supported = new Set(blueprintCatalog.supportedLocales);
+        for (const locale of [defaultLocale, ...enabledLocales]) {
+          if (!supported.has(locale)) {
+            issues.push(issue({
+              code: "UNSUPPORTED_LOCALE",
+              severity: "error",
+              path: "locales.enabledLocales",
+              message: `Locale "${locale}" is not supported by blueprint catalog "${blueprintCatalog.meta.key}".`
+            }));
+          }
+        }
+      }
+    }
+    const allowedKeys = new Set;
+    for (const catalog of catalogs.blueprint) {
+      for (const entry of catalog.entries) {
+        allowedKeys.add(entry.key);
+      }
+    }
+    for (const catalog of catalogs.platform) {
+      for (const entry of catalog.entries) {
+        allowedKeys.add(entry.key);
+      }
+    }
+    const overrides = tenant.translationOverrides?.entries ?? [];
+    overrides.forEach((entry, index) => {
+      const path = `translationOverrides.entries[${index}]`;
+      if (!allowedKeys.has(entry.key)) {
+        issues.push(issue({
+          code: "UNKNOWN_TRANSLATION_KEY",
+          severity: "error",
+          path,
+          message: `Override references unknown key "${entry.key}".`
+        }));
+      }
+      if (blueprintCatalog) {
+        const supportedLocales = new Set([
+          ...blueprintCatalog.supportedLocales,
+          ...tenant.locales?.enabledLocales ?? [],
+          tenant.locales?.defaultLocale ?? blueprintCatalog.defaultLocale
+        ]);
+        if (!supportedLocales.has(entry.locale)) {
+          issues.push(issue({
+            code: "UNSUPPORTED_LOCALE_OVERRIDE",
+            severity: "error",
+            path,
+            message: `Locale "${entry.locale}" is not enabled for tenant overrides.`
+          }));
+        }
+      }
+    });
+    return issues;
+  }
+};
+var resolvedIntegrationRule = {
+  scope: "resolved",
+  name: "integration.required-slots",
+  category: "integration",
+  validate(blueprint, resolved) {
+    const issues = [];
+    const requiredSlots = (blueprint.integrationSlots ?? []).filter((slot) => slot.required);
+    for (const slot of requiredSlots) {
+      const satisfied = resolved.integrations.some((integration) => integration.slot.slotId === slot.slotId);
+      if (!satisfied) {
+        issues.push(issue({
+          code: "MISSING_REQUIRED_SLOT",
+          severity: "error",
+          path: `integrations.${slot.slotId}`,
+          message: `Resolved config is missing integration slot "${slot.slotId}".`
+        }));
+      }
+    }
+    for (const integration of resolved.integrations) {
+      if (integration.connection.status === "disconnected" || integration.connection.status === "error") {
+        issues.push(issue({
+          code: "CONNECTION_NOT_READY",
+          severity: "error",
+          path: `integrations.${integration.slot.slotId}`,
+          message: `Resolved integration "${integration.slot.slotId}" uses a connection in status "${integration.connection.status}".`
+        }));
+      }
+    }
+    return issues;
+  }
+};
+var resolvedTranslationRule = {
+  scope: "resolved",
+  name: "translation.default-locale",
+  category: "translation",
+  validate(_blueprint, resolved) {
+    const issues = [];
+    const translation = resolved.translation;
+    if (translation && !translation.supportedLocales.includes(translation.defaultLocale)) {
+      issues.push(issue({
+        code: "DEFAULT_LOCALE_NOT_SUPPORTED",
+        severity: "warning",
+        path: "translation.defaultLocale",
+        message: "supportedLocales should include defaultLocale for consistent fallback behaviour."
+      }));
+    }
+    return issues;
+  }
+};
+function issue(input) {
+  return input;
+}
+function dedupeIssues(issues) {
+  const map = new Map;
+  for (const current of issues) {
+    const key = `${current.code}|${current.path}|${current.severity}`;
+    if (!map.has(key)) {
+      map.set(key, current);
+    }
+  }
+  return [...map.values()];
+}
+function capabilityRefKey(ref) {
+  return `${ref.key}@${ref.version}`;
+}
+function integrationProvidesCapability2(spec, required) {
+  return spec.capabilities.provides.some((provided) => provided.key === required.key && provided.version === required.version);
+}
+function lookupIntegrationSpec(registry2, connection) {
+  if (!registry2)
+    return;
+  return registry2.get(connection.meta.integrationKey, connection.meta.integrationVersion);
+}
+function extractExtension(url) {
+  const [raw] = url.split("?");
+  if (!raw)
+    return;
+  const lastDot = raw.lastIndexOf(".");
+  if (lastDot === -1)
+    return;
+  return raw.slice(lastDot + 1).toLowerCase();
+}
+function normalizeCatalogs(catalogs) {
+  if (!catalogs)
+    return { platform: [], blueprint: [] };
+  const platform = catalogs.platform ? Array.isArray(catalogs.platform) ? catalogs.platform : [catalogs.platform] : [];
+  const blueprint = catalogs.blueprint ? Array.isArray(catalogs.blueprint) ? catalogs.blueprint : [catalogs.blueprint] : [];
+  return { platform, blueprint };
+}
+function hasTranslationEntry(entries, key, locale) {
+  return entries.some((entry) => entry.key === key && entry.locale === locale);
+}
+// src/app-config/lifecycle-contracts.ts
+import { ScalarTypeEnum as ScalarTypeEnum3, SchemaModel as SchemaModel3 } from "@contractspec/lib.schema";
+var LifecyclePolicy = {
+  auth: "admin",
+  policies: [{ key: "platform.app-config.manage", version: "1.0.0" }]
+};
+var LifecycleReadPolicy = {
+  auth: "admin",
+  policies: [{ key: "platform.app-config.read", version: "1.0.0" }]
+};
+var ConfigVersionRecord = new SchemaModel3({
+  name: "ConfigVersionRecord",
+  fields: {
+    meta: { type: ScalarTypeEnum3.JSONObject(), isOptional: false },
+    config: { type: ScalarTypeEnum3.JSONObject(), isOptional: false }
+  }
+});
+var ConfigTransitionRecord = new SchemaModel3({
+  name: "ConfigTransitionRecord",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    fromStatus: {
+      type: ScalarTypeEnum3.String_unsecure(),
+      isOptional: false
+    },
+    toStatus: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    timestamp: { type: ScalarTypeEnum3.DateTime(), isOptional: false },
+    actor: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    reason: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true }
+  }
+});
+var CreateDraftInput = new SchemaModel3({
+  name: "CreateTenantConfigDraftInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    blueprintName: {
+      type: ScalarTypeEnum3.String_unsecure(),
+      isOptional: false
+    },
+    blueprintVersion: {
+      type: ScalarTypeEnum3.Int_unsecure(),
+      isOptional: false
+    },
+    environment: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
+    fromVersion: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
+    createdBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
+  }
+});
+var CreateDraftOutput = new SchemaModel3({
+  name: "CreateTenantConfigDraftOutput",
+  fields: {
+    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    createdAt: { type: ScalarTypeEnum3.DateTime(), isOptional: false }
+  }
+});
+var CreateTenantConfigDraftCommand = defineCommand({
+  meta: {
+    key: "appConfig.lifecycle.createDraft",
+    version: "1.0.0",
+    description: "Creates a new draft tenant config version.",
+    owners: [OwnersEnum.PlatformSigil],
+    tags: [TagsEnum.Hygiene, "app-config"],
+    stability: StabilityEnum.Experimental,
+    goal: "Allow operators to start editing a new tenant config version.",
+    context: "Invoked by the Studio or automation when starting a new configuration run."
+  },
+  io: {
+    input: CreateDraftInput,
+    output: CreateDraftOutput
+  },
+  policy: LifecyclePolicy,
+  sideEffects: {
+    emits: [
+      {
+        ref: ConfigDraftCreatedEvent.meta,
+        when: "after successful draft creation"
+      }
+    ]
+  }
+});
+var PromotePreviewInput = new SchemaModel3({
+  name: "PromoteTenantConfigPreviewInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    promotedBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
+  }
+});
+var PromotePreviewOutput = new SchemaModel3({
+  name: "PromoteTenantConfigPreviewOutput",
+  fields: {
+    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    warnings: {
+      type: ScalarTypeEnum3.String_unsecure(),
+      isOptional: true,
+      isArray: true
+    }
+  }
+});
+var PromoteTenantConfigToPreviewCommand = defineCommand({
+  meta: {
+    key: "appConfig.lifecycle.promoteToPreview",
+    version: "1.0.0",
+    description: "Promotes a draft tenant config to preview/testing state.",
+    owners: [OwnersEnum.PlatformSigil],
+    tags: [TagsEnum.Hygiene, "app-config"],
+    stability: StabilityEnum.Experimental,
+    goal: "Enable validation and testing of draft configurations.",
+    context: "Called when a draft passes initial checks and should be exposed to preview environments."
+  },
+  io: {
+    input: PromotePreviewInput,
+    output: PromotePreviewOutput
+  },
+  policy: LifecyclePolicy,
+  sideEffects: {
+    emits: [
+      {
+        ref: ConfigPromotedToPreviewEvent.meta,
+        when: "after promotion to preview"
+      }
+    ]
+  }
+});
+var PublishConfigInput = new SchemaModel3({
+  name: "PublishTenantConfigInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    environment: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
+    publishedBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    changeSummary: {
+      type: ScalarTypeEnum3.String_unsecure(),
+      isOptional: true
+    }
+  }
+});
+var PublishConfigOutput = new SchemaModel3({
+  name: "PublishTenantConfigOutput",
+  fields: {
+    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    previousVersion: {
+      type: ScalarTypeEnum3.String_unsecure(),
+      isOptional: true
+    },
+    publishedAt: { type: ScalarTypeEnum3.DateTime(), isOptional: false }
+  }
+});
+var PublishTenantConfigCommand = defineCommand({
+  meta: {
+    key: "appConfig.lifecycle.publish",
+    version: "1.0.0",
+    description: "Publishes a preview tenant config to production.",
+    owners: [OwnersEnum.PlatformSigil],
+    tags: [TagsEnum.Hygiene, "app-config"],
+    stability: StabilityEnum.Experimental,
+    goal: "Promote tested configurations to production safely.",
+    context: "Triggered after validation passes and change management approvals are complete."
+  },
+  io: {
+    input: PublishConfigInput,
+    output: PublishConfigOutput
+  },
+  policy: LifecyclePolicy,
+  sideEffects: {
+    emits: [
+      {
+        ref: ConfigPublishedEvent.meta,
+        when: "after publish succeeds"
+      }
+    ]
+  }
+});
+var RollbackConfigInput = new SchemaModel3({
+  name: "RollbackTenantConfigInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    toVersion: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    environment: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
+    rolledBackBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    reason: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
+  }
+});
+var RollbackConfigOutput = new SchemaModel3({
+  name: "RollbackTenantConfigOutput",
+  fields: {
+    newVersion: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
+    rolledBackFrom: { type: ScalarTypeEnum3.Int_unsecure(), isOptional: false }
+  }
+});
+var RollbackTenantConfigCommand = defineCommand({
+  meta: {
+    key: "appConfig.lifecycle.rollback",
+    version: "1.0.0",
+    description: "Rolls back to a previously published tenant config version.",
+    owners: [OwnersEnum.PlatformSigil],
+    tags: [TagsEnum.Hygiene, "app-config"],
+    stability: StabilityEnum.Experimental,
+    goal: "Provide rapid recovery when new configs regress production.",
+    context: "Called manually or automatically when monitoring detects regression and a rollback is required."
+  },
+  io: {
+    input: RollbackConfigInput,
+    output: RollbackConfigOutput
+  },
+  policy: LifecyclePolicy,
+  sideEffects: {
+    emits: [
+      {
+        ref: ConfigRolledBackEvent.meta,
+        when: "after rollback completes"
+      }
+    ]
+  }
+});
+var ListVersionsInput = new SchemaModel3({
+  name: "ListTenantConfigVersionsInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    appId: { type: ScalarTypeEnum3.ID(), isOptional: false }
+  }
+});
+var ListVersionsOutput = new SchemaModel3({
+  name: "ListTenantConfigVersionsOutput",
+  fields: {
+    versions: { type: ConfigVersionRecord, isOptional: false, isArray: true },
+    transitions: {
+      type: ConfigTransitionRecord,
+      isOptional: true,
+      isArray: true
+    }
+  }
+});
+var ListTenantConfigVersionsQuery = defineQuery({
+  meta: {
+    key: "appConfig.lifecycle.listVersions",
+    version: "1.0.0",
+    description: "Lists all versions of a tenant configuration.",
+    owners: [OwnersEnum.PlatformSigil],
+    tags: ["app-config", TagsEnum.Hygiene],
+    stability: StabilityEnum.Experimental,
+    goal: "Support lifecycle views and change audit tooling.",
+    context: "Used by the Studio to render history timelines and by automation for change tracking."
+  },
+  io: {
+    input: ListVersionsInput,
+    output: ListVersionsOutput
+  },
+  policy: LifecycleReadPolicy
+});
+var GetVersionInput = new SchemaModel3({
+  name: "GetTenantConfigVersionInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
+  }
+});
+var GetVersionOutput = new SchemaModel3({
+  name: "GetTenantConfigVersionOutput",
+  fields: {
+    version: { type: ConfigVersionRecord, isOptional: false }
+  }
+});
+var GetTenantConfigVersionQuery = defineQuery({
+  meta: {
+    key: "appConfig.lifecycle.getVersion",
+    version: "1.0.0",
+    description: "Fetches a single tenant config version by id.",
+    owners: [OwnersEnum.PlatformSigil],
+    tags: ["app-config", TagsEnum.Hygiene],
+    stability: StabilityEnum.Experimental,
+    goal: "Allow detail drill-down for lifecycle entries.",
+    context: "Used by automation to fetch config payloads for comparison or export."
+  },
+  io: {
+    input: GetVersionInput,
+    output: GetVersionOutput
+  },
+  policy: LifecycleReadPolicy
+});
+var lifecycleContracts = {
+  CreateTenantConfigDraftCommand,
+  PromoteTenantConfigToPreviewCommand,
+  PublishTenantConfigCommand,
+  RollbackTenantConfigCommand,
+  ListTenantConfigVersionsQuery,
+  GetTenantConfigVersionQuery
+};
+function registerAppConfigLifecycleContracts(registry2) {
+  return registry2.register(CreateTenantConfigDraftCommand).register(PromoteTenantConfigToPreviewCommand).register(PublishTenantConfigCommand).register(RollbackTenantConfigCommand).register(ListTenantConfigVersionsQuery).register(GetTenantConfigVersionQuery);
+}
+export {
+  validateTenantConfig,
+  validateResolvedConfig,
+  validateConfig,
+  validateBlueprint,
+  resolveAppConfig,
+  registerAppConfigLifecycleContracts,
+  makeAppBlueprintKey,
+  lifecycleContracts,
+  defineAppConfig,
+  composeAppConfig,
+  RollbackTenantConfigCommand,
+  PublishTenantConfigCommand,
+  PromoteTenantConfigToPreviewCommand,
+  ListTenantConfigVersionsQuery,
+  GetTenantConfigVersionQuery,
+  CreateTenantConfigDraftCommand,
+  ConfigRolledBackEvent,
+  ConfigPublishedEvent,
+  ConfigPromotedToPreviewEvent,
+  ConfigDraftCreatedEvent,
+  AppConfigFeature,
+  AppConfigCapability,
+  AppBlueprintRegistry
+};