@contractspec/lib.contracts 1.62.0 → 1.63.0

package/dist/app-config/index.js

@@ -1,3113 +0,0 @@
-// @bun
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __moduleCache = /* @__PURE__ */ new WeakMap;
-var __toCommonJS = (from) => {
-  var entry = __moduleCache.get(from), desc;
-  if (entry)
-    return entry;
-  entry = __defProp({}, "__esModule", { value: true });
-  if (from && typeof from === "object" || typeof from === "function")
-    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    }));
-  __moduleCache.set(from, entry);
-  return entry;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: (newValue) => all[name] = () => newValue
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
-
-// src/registry-utils.ts
-var exports_registry_utils = {};
-__export(exports_registry_utils, {
-  groupByToArray: () => groupByToArray,
-  groupByMultiple: () => groupByMultiple,
-  groupBy: () => groupBy,
-  getUniqueTags: () => getUniqueTags,
-  getUniqueOwners: () => getUniqueOwners,
-  getUniqueDomains: () => getUniqueDomains,
-  filterBy: () => filterBy,
-  GroupingStrategies: () => GroupingStrategies
-});
-function filterBy(items, filter) {
-  return items.filter((item) => {
-    if (filter.tags?.length) {
-      const hasMatchingTag = filter.tags.some((tag) => item.meta.tags?.includes(tag));
-      if (!hasMatchingTag)
-        return false;
-    }
-    if (filter.owners?.length) {
-      const hasMatchingOwner = filter.owners.some((owner) => item.meta.owners?.includes(owner));
-      if (!hasMatchingOwner)
-        return false;
-    }
-    if (filter.stability?.length) {
-      if (!filter.stability.includes(item.meta.stability ?? "stable")) {
-        return false;
-      }
-    }
-    if (filter.domain) {
-      const itemDomain = GroupingStrategies.byDomain(item);
-      if (itemDomain !== filter.domain)
-        return false;
-    }
-    if (filter.keyPattern) {
-      const name = item.meta.key ?? item.meta.key ?? "";
-      const pattern = filter.keyPattern.replace(/\*/g, ".*").replace(/\?/g, ".");
-      const regex = new RegExp(`^${pattern}$`, "i");
-      if (!regex.test(name))
-        return false;
-    }
-    return true;
-  });
-}
-function groupBy(items, keyFn) {
-  const groups = new Map;
-  for (const item of items) {
-    const key = keyFn(item);
-    const existing = groups.get(key);
-    if (existing) {
-      existing.push(item);
-    } else {
-      groups.set(key, [item]);
-    }
-  }
-  return groups;
-}
-function groupByToArray(items, keyFn) {
-  const map = groupBy(items, keyFn);
-  return Array.from(map.entries()).map(([key, items2]) => ({ key, items: items2 }));
-}
-function groupByMultiple(items, keysFn) {
-  const groups = new Map;
-  for (const item of items) {
-    const keys = keysFn(item);
-    for (const key of keys) {
-      const existing = groups.get(key);
-      if (existing) {
-        existing.push(item);
-      } else {
-        groups.set(key, [item]);
-      }
-    }
-  }
-  return groups;
-}
-function getUniqueTags(items) {
-  const tags = new Set;
-  for (const item of items) {
-    for (const tag of item.meta.tags ?? []) {
-      tags.add(tag);
-    }
-  }
-  return Array.from(tags).sort();
-}
-function getUniqueOwners(items) {
-  const owners = new Set;
-  for (const item of items) {
-    for (const owner of item.meta.owners ?? []) {
-      owners.add(owner);
-    }
-  }
-  return Array.from(owners).sort();
-}
-function getUniqueDomains(items) {
-  const domains = new Set;
-  for (const item of items) {
-    domains.add(GroupingStrategies.byDomain(item));
-  }
-  return Array.from(domains).sort();
-}
-var GroupingStrategies;
-var init_registry_utils = __esm(() => {
-  GroupingStrategies = {
-    byTag: (item) => item.meta.tags?.[0] ?? "untagged",
-    byAllTags: (item) => item.meta.tags?.length ? item.meta.tags : ["untagged"],
-    byOwner: (item) => item.meta.owners?.[0] ?? "unowned",
-    byDomain: (item) => {
-      const name = item.meta.key ?? item.meta.key ?? "";
-      return name.split(".")[0] ?? "default";
-    },
-    byStability: (item) => item.meta.stability ?? "stable",
-    byUrlPath: (level) => (item) => {
-      if (!item.path)
-        return "root";
-      const segments = item.path.split("/").filter(Boolean);
-      return segments.slice(0, level).join("/") || "root";
-    }
-  };
-});
-
-// src/capabilities/capabilities.ts
-import { compareVersions } from "compare-versions";
-var capKey = (key, version) => `${key}.v${version}`;
-
-class CapabilityRegistry {
-  items = new Map;
-  surfaceIndex = null;
-  register(spec) {
-    const key = capKey(spec.meta.key, spec.meta.version);
-    if (this.items.has(key))
-      throw new Error(`Duplicate capability ${key}`);
-    this.items.set(key, spec);
-    this.surfaceIndex = null;
-    return this;
-  }
-  list() {
-    return [...this.items.values()];
-  }
-  get(key, version) {
-    if (version != null)
-      return this.items.get(capKey(key, version));
-    let candidate;
-    for (const spec of this.items.values()) {
-      if (spec.meta.key !== key)
-        continue;
-      if (!candidate || compareVersions(spec.meta.version, candidate.meta.version) > 0) {
-        candidate = spec;
-      }
-    }
-    return candidate;
-  }
-  satisfies(requirement, additional) {
-    if (requirement.optional)
-      return true;
-    if (additional?.some((ref) => matchesRequirement(ref, requirement)))
-      return true;
-    const spec = requirement.version ? this.get(requirement.key, requirement.version) : this.get(requirement.key);
-    if (!spec)
-      return false;
-    if (requirement.kind && spec.meta.kind !== requirement.kind)
-      return false;
-    if (requirement.version != null && spec.meta.version !== requirement.version)
-      return false;
-    return true;
-  }
-  buildSurfaceIndex() {
-    if (this.surfaceIndex)
-      return this.surfaceIndex;
-    this.surfaceIndex = new Map;
-    for (const spec of this.items.values()) {
-      const capabilityKey = capKey(spec.meta.key, spec.meta.version);
-      for (const surface of spec.provides ?? []) {
-        const surfaceKey = `${surface.surface}:${surface.key}`;
-        if (!this.surfaceIndex.has(surfaceKey)) {
-          this.surfaceIndex.set(surfaceKey, new Set);
-        }
-        this.surfaceIndex.get(surfaceKey)?.add(capabilityKey);
-      }
-    }
-    return this.surfaceIndex;
-  }
-  getOperationsFor(capabilityKey, version) {
-    const spec = this.get(capabilityKey, version);
-    if (!spec)
-      return [];
-    return spec.provides?.filter((s) => s.surface === "operation").map((s) => s.key) ?? [];
-  }
-  getEventsFor(capabilityKey, version) {
-    const spec = this.get(capabilityKey, version);
-    if (!spec)
-      return [];
-    return spec.provides?.filter((s) => s.surface === "event").map((s) => s.key) ?? [];
-  }
-  getPresentationsFor(capabilityKey, version) {
-    const spec = this.get(capabilityKey, version);
-    if (!spec)
-      return [];
-    return spec.provides?.filter((s) => s.surface === "presentation").map((s) => s.key) ?? [];
-  }
-  getWorkflowsFor(capabilityKey, version) {
-    const spec = this.get(capabilityKey, version);
-    if (!spec)
-      return [];
-    return spec.provides?.filter((s) => s.surface === "workflow").map((s) => s.key) ?? [];
-  }
-  getResourcesFor(capabilityKey, version) {
-    const spec = this.get(capabilityKey, version);
-    if (!spec)
-      return [];
-    return spec.provides?.filter((s) => s.surface === "resource").map((s) => s.key) ?? [];
-  }
-  getCapabilitiesForOperation(operationKey) {
-    const index = this.buildSurfaceIndex();
-    const capKeys = index.get(`operation:${operationKey}`);
-    if (!capKeys)
-      return [];
-    return [...capKeys].map((k) => {
-      const spec = this.items.get(k);
-      return { key: spec?.meta.key ?? "", version: spec?.meta.version ?? "" };
-    });
-  }
-  getCapabilitiesForEvent(eventKey) {
-    const index = this.buildSurfaceIndex();
-    const capKeys = index.get(`event:${eventKey}`);
-    if (!capKeys)
-      return [];
-    return [...capKeys].map((k) => {
-      const spec = this.items.get(k);
-      return { key: spec?.meta.key ?? "", version: spec?.meta.version ?? "" };
-    });
-  }
-  getCapabilitiesForPresentation(presentationKey) {
-    const index = this.buildSurfaceIndex();
-    const capKeys = index.get(`presentation:${presentationKey}`);
-    if (!capKeys)
-      return [];
-    return [...capKeys].map((k) => {
-      const spec = this.items.get(k);
-      return { key: spec?.meta.key ?? "", version: spec?.meta.version ?? "" };
-    });
-  }
-  getAncestors(capabilityKey, version) {
-    const ancestors = [];
-    const visited = new Set;
-    let current = this.get(capabilityKey, version);
-    while (current?.extends) {
-      const parentKey = capKey(current.extends.key, current.extends.version);
-      if (visited.has(parentKey)) {
-        break;
-      }
-      visited.add(parentKey);
-      const parent = this.get(current.extends.key, current.extends.version);
-      if (!parent)
-        break;
-      ancestors.push(parent);
-      current = parent;
-    }
-    return ancestors;
-  }
-  getEffectiveRequirements(capabilityKey, version) {
-    const spec = this.get(capabilityKey, version);
-    if (!spec)
-      return [];
-    const ancestors = this.getAncestors(capabilityKey, version);
-    const requirementMap = new Map;
-    for (const ancestor of [...ancestors].reverse()) {
-      for (const req of ancestor.requires ?? []) {
-        requirementMap.set(req.key, req);
-      }
-    }
-    for (const req of spec.requires ?? []) {
-      requirementMap.set(req.key, req);
-    }
-    return [...requirementMap.values()];
-  }
-  getEffectiveSurfaces(capabilityKey, version) {
-    const spec = this.get(capabilityKey, version);
-    if (!spec)
-      return [];
-    const ancestors = this.getAncestors(capabilityKey, version);
-    const surfaces = [];
-    for (const ancestor of [...ancestors].reverse()) {
-      surfaces.push(...ancestor.provides ?? []);
-    }
-    surfaces.push(...spec.provides ?? []);
-    return surfaces;
-  }
-}
-function matchesRequirement(ref, requirement) {
-  if (ref.key !== requirement.key)
-    return false;
-  if (requirement.version != null && ref.version !== requirement.version)
-    return false;
-  return true;
-}
-function capabilityKey(spec) {
-  return capKey(spec.meta.key, spec.meta.version);
-}
-function defineCapability(spec) {
-  return spec;
-}
-
-// src/capabilities/validation.ts
-function validateCapabilityConsistency(deps) {
-  const errors = [];
-  const warnings = [];
-  for (const capability of deps.capabilities.list()) {
-    const capKey2 = `${capability.meta.key}.v${capability.meta.version}`;
-    for (const surface of capability.provides ?? []) {
-      const exists = checkSurfaceExists(deps, surface.surface, surface.key);
-      if (!exists) {
-        errors.push({
-          type: "missing_surface_spec",
-          message: `Capability "${capKey2}" provides ${surface.surface} "${surface.key}" but spec not found`,
-          capabilityKey: capKey2,
-          surface: surface.surface,
-          specKey: surface.key
-        });
-      }
-    }
-  }
-  if (deps.operations) {
-    for (const op of deps.operations.list()) {
-      if (op.capability) {
-        const capSpec = deps.capabilities.get(op.capability.key, op.capability.version);
-        if (!capSpec) {
-          errors.push({
-            type: "capability_not_found",
-            message: `Operation "${op.meta.key}" references capability "${op.capability.key}.v${op.capability.version}" but capability not found`,
-            specKey: op.meta.key,
-            capabilityKey: `${op.capability.key}.v${op.capability.version}`,
-            surface: "operation"
-          });
-        } else {
-          const inProvides = capSpec.provides?.some((p) => p.surface === "operation" && p.key === op.meta.key);
-          if (!inProvides) {
-            errors.push({
-              type: "surface_not_in_provides",
-              message: `Operation "${op.meta.key}" claims capability "${op.capability.key}.v${op.capability.version}" but not in capability's provides`,
-              specKey: op.meta.key,
-              capabilityKey: `${op.capability.key}.v${op.capability.version}`,
-              surface: "operation"
-            });
-          }
-        }
-      }
-    }
-  }
-  if (deps.events) {
-    for (const event of deps.events.list()) {
-      if (event.capability) {
-        const capSpec = deps.capabilities.get(event.capability.key, event.capability.version);
-        if (!capSpec) {
-          errors.push({
-            type: "capability_not_found",
-            message: `Event "${event.meta.key}" references capability "${event.capability.key}.v${event.capability.version}" but capability not found`,
-            specKey: event.meta.key,
-            capabilityKey: `${event.capability.key}.v${event.capability.version}`,
-            surface: "event"
-          });
-        } else {
-          const inProvides = capSpec.provides?.some((p) => p.surface === "event" && p.key === event.meta.key);
-          if (!inProvides) {
-            errors.push({
-              type: "surface_not_in_provides",
-              message: `Event "${event.meta.key}" claims capability "${event.capability.key}.v${event.capability.version}" but not in capability's provides`,
-              specKey: event.meta.key,
-              capabilityKey: `${event.capability.key}.v${event.capability.version}`,
-              surface: "event"
-            });
-          }
-        }
-      }
-    }
-  }
-  if (deps.presentations) {
-    for (const pres of deps.presentations.list()) {
-      if (pres.capability) {
-        const capSpec = deps.capabilities.get(pres.capability.key, pres.capability.version);
-        if (!capSpec) {
-          errors.push({
-            type: "capability_not_found",
-            message: `Presentation "${pres.meta.key}" references capability "${pres.capability.key}.v${pres.capability.version}" but capability not found`,
-            specKey: pres.meta.key,
-            capabilityKey: `${pres.capability.key}.v${pres.capability.version}`,
-            surface: "presentation"
-          });
-        } else {
-          const inProvides = capSpec.provides?.some((p) => p.surface === "presentation" && p.key === pres.meta.key);
-          if (!inProvides) {
-            errors.push({
-              type: "surface_not_in_provides",
-              message: `Presentation "${pres.meta.key}" claims capability "${pres.capability.key}.v${pres.capability.version}" but not in capability's provides`,
-              specKey: pres.meta.key,
-              capabilityKey: `${pres.capability.key}.v${pres.capability.version}`,
-              surface: "presentation"
-            });
-          }
-        }
-      }
-    }
-  }
-  return {
-    valid: errors.length === 0,
-    errors,
-    warnings
-  };
-}
-function checkSurfaceExists(deps, surface, key) {
-  switch (surface) {
-    case "operation":
-      return deps.operations?.has(key) ?? true;
-    case "event":
-      return deps.events?.has(key) ?? true;
-    case "presentation":
-      return deps.presentations?.has(key) ?? true;
-    case "workflow":
-    case "resource":
-      return true;
-    default:
-      return true;
-  }
-}
-function findOrphanSpecs(deps) {
-  const result = {
-    operations: [],
-    events: [],
-    presentations: []
-  };
-  if (deps.operations) {
-    for (const op of deps.operations.list()) {
-      if (!op.capability) {
-        result.operations.push(op.meta.key);
-      }
-    }
-  }
-  if (deps.events) {
-    for (const event of deps.events.list()) {
-      if (!event.capability) {
-        result.events.push(event.meta.key);
-      }
-    }
-  }
-  if (deps.presentations) {
-    for (const pres of deps.presentations.list()) {
-      if (!pres.capability) {
-        result.presentations.push(pres.meta.key);
-      }
-    }
-  }
-  return result;
-}
-
-// src/capabilities/context.ts
-class CapabilityMissingError extends Error {
-  capabilityKey;
-  requiredVersion;
-  constructor(capabilityKey2, requiredVersion) {
-    const versionSuffix = requiredVersion ? `.v${requiredVersion}` : "";
-    super(`Missing required capability: ${capabilityKey2}${versionSuffix}`);
-    this.name = "CapabilityMissingError";
-    this.capabilityKey = capabilityKey2;
-    this.requiredVersion = requiredVersion;
-  }
-}
-
-class CapabilityContextImpl {
-  capabilities;
-  capabilityVersions;
-  constructor(enabledCapabilities) {
-    const capSet = new Set;
-    const versionMap = new Map;
-    for (const cap of enabledCapabilities) {
-      capSet.add(cap.key);
-      versionMap.set(cap.key, cap.version);
-    }
-    this.capabilities = capSet;
-    this.capabilityVersions = versionMap;
-  }
-  hasCapability(key, version) {
-    if (!this.capabilities.has(key))
-      return false;
-    if (version != null) {
-      const enabledVersion = this.capabilityVersions.get(key);
-      return enabledVersion === version;
-    }
-    return true;
-  }
-  requireCapability(key, version) {
-    if (!this.hasCapability(key, version)) {
-      throw new CapabilityMissingError(key, version);
-    }
-  }
-  hasAllCapabilities(keys) {
-    return keys.every((k) => this.capabilities.has(k));
-  }
-  hasAnyCapability(keys) {
-    return keys.some((k) => this.capabilities.has(k));
-  }
-  getMatchingCapabilities(pattern) {
-    if (!pattern.includes("*")) {
-      return this.capabilities.has(pattern) ? [pattern] : [];
-    }
-    const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    const regex = new RegExp(`^${regexPattern}$`);
-    return [...this.capabilities].filter((key) => regex.test(key));
-  }
-}
-function createCapabilityContext(enabledCapabilities) {
-  return new CapabilityContextImpl(enabledCapabilities);
-}
-function createEmptyCapabilityContext() {
-  return new CapabilityContextImpl([]);
-}
-function createBypassCapabilityContext(allCapabilities) {
-  return new CapabilityContextImpl(allCapabilities);
-}
-
-// src/capabilities/guards.ts
-function checkCapabilityForOperation(ctx, operation) {
-  if (!operation.capability) {
-    return { allowed: true };
-  }
-  const { key, version } = operation.capability;
-  if (ctx.hasCapability(key, version)) {
-    return { allowed: true };
-  }
-  return {
-    allowed: false,
-    missingCapability: { key, version },
-    reason: `Operation "${operation.meta.key}" requires capability "${key}.v${version}"`
-  };
-}
-function assertCapabilityForOperation(ctx, operation) {
-  const result = checkCapabilityForOperation(ctx, operation);
-  if (!result.allowed && result.missingCapability) {
-    throw new CapabilityMissingError(result.missingCapability.key, result.missingCapability.version);
-  }
-}
-function checkCapabilityForEvent(ctx, event) {
-  if (!event.capability) {
-    return { allowed: true };
-  }
-  const { key, version } = event.capability;
-  if (ctx.hasCapability(key, version)) {
-    return { allowed: true };
-  }
-  return {
-    allowed: false,
-    missingCapability: { key, version },
-    reason: `Event "${event.meta.key}" requires capability "${key}.v${version}"`
-  };
-}
-function assertCapabilityForEvent(ctx, event) {
-  const result = checkCapabilityForEvent(ctx, event);
-  if (!result.allowed && result.missingCapability) {
-    throw new CapabilityMissingError(result.missingCapability.key, result.missingCapability.version);
-  }
-}
-function checkCapabilityForPresentation(ctx, presentation) {
-  if (!presentation.capability) {
-    return { allowed: true };
-  }
-  const { key, version } = presentation.capability;
-  if (ctx.hasCapability(key, version)) {
-    return { allowed: true };
-  }
-  return {
-    allowed: false,
-    missingCapability: { key, version },
-    reason: `Presentation "${presentation.meta.key}" requires capability "${key}.v${version}"`
-  };
-}
-function assertCapabilityForPresentation(ctx, presentation) {
-  const result = checkCapabilityForPresentation(ctx, presentation);
-  if (!result.allowed && result.missingCapability) {
-    throw new CapabilityMissingError(result.missingCapability.key, result.missingCapability.version);
-  }
-}
-function filterOperationsByCapability(ctx, operations) {
-  return operations.filter((op) => checkCapabilityForOperation(ctx, op).allowed);
-}
-function filterEventsByCapability(ctx, events) {
-  return events.filter((ev) => checkCapabilityForEvent(ctx, ev).allowed);
-}
-function filterPresentationsByCapability(ctx, presentations) {
-  return presentations.filter((pres) => checkCapabilityForPresentation(ctx, pres).allowed);
-}
-
-// src/ownership.ts
-var StabilityEnum = {
-  Idea: "idea",
-  InCreation: "in_creation",
-  Experimental: "experimental",
-  Beta: "beta",
-  Stable: "stable",
-  Deprecated: "deprecated"
-};
-var OwnersEnum = {
-  PlatformCore: "platform.core",
-  PlatformSigil: "platform.sigil",
-  PlatformMarketplace: "platform.marketplace",
-  PlatformMessaging: "platform.messaging",
-  PlatformContent: "platform.content",
-  PlatformFeatureFlags: "platform.featureflags",
-  PlatformFinance: "platform.finance"
-};
-var Owners = OwnersEnum;
-var TagsEnum = {
-  Spots: "spots",
-  Collectivity: "collectivity",
-  Marketplace: "marketplace",
-  Sellers: "sellers",
-  Auth: "auth",
-  Login: "login",
-  Signup: "signup",
-  Guide: "guide",
-  Docs: "docs",
-  I18n: "i18n",
-  Incident: "incident",
-  Automation: "automation",
-  Hygiene: "hygiene"
-};
-var Tags = TagsEnum;
-
-// src/capabilities/openbanking.ts
-var OWNERS = ["platform.finance"];
-var TAGS = ["open-banking", "finance"];
-var openBankingAccountsReadCapability = {
-  meta: {
-    key: "openbanking.accounts.read",
-    version: "1.0.0",
-    kind: "integration",
-    title: "Open Banking Accounts (Read)",
-    description: "Provides read-only access to linked bank accounts, including account summaries and metadata.",
-    domain: "finance",
-    owners: [...OWNERS],
-    tags: [...TAGS],
-    stability: StabilityEnum.Experimental
-  },
-  provides: [
-    {
-      surface: "operation",
-      key: "openbanking.accounts.list",
-      version: "1.0.0",
-      description: "List bank accounts linked to a Powens open banking connection."
-    },
-    {
-      surface: "operation",
-      key: "openbanking.accounts.get",
-      version: "1.0.0",
-      description: "Retrieve the canonical bank account record for a specific account."
-    },
-    {
-      surface: "operation",
-      key: "openbanking.accounts.sync",
-      version: "1.0.0",
-      description: "Trigger a refresh of bank account metadata from the open banking provider."
-    }
-  ]
-};
-var openBankingTransactionsReadCapability = {
-  meta: {
-    key: "openbanking.transactions.read",
-    version: "1.0.0",
-    kind: "integration",
-    title: "Open Banking Transactions (Read)",
-    description: "Enables retrieval of transaction history for linked bank accounts via open banking providers.",
-    domain: "finance",
-    owners: [...OWNERS],
-    tags: [...TAGS, "transactions"],
-    stability: StabilityEnum.Experimental
-  },
-  provides: [
-    {
-      surface: "operation",
-      key: "openbanking.transactions.list",
-      version: "1.0.0",
-      description: "List transactions for a given bank account with optional date filtering."
-    },
-    {
-      surface: "operation",
-      key: "openbanking.transactions.sync",
-      version: "1.0.0",
-      description: "Synchronise transactions from the open banking provider into the canonical ledger."
-    }
-  ]
-};
-var openBankingBalancesReadCapability = {
-  meta: {
-    key: "openbanking.balances.read",
-    version: "1.0.0",
-    kind: "integration",
-    title: "Open Banking Balances (Read)",
-    description: "Allows querying of current and available balances for linked bank accounts via open banking providers.",
-    domain: "finance",
-    owners: [...OWNERS],
-    tags: [...TAGS, "balances"],
-    stability: StabilityEnum.Experimental
-  },
-  provides: [
-    {
-      surface: "operation",
-      key: "openbanking.balances.get",
-      version: "1.0.0",
-      description: "Retrieve the latest known balances for a specified bank account."
-    },
-    {
-      surface: "operation",
-      key: "openbanking.balances.refresh",
-      version: "1.0.0",
-      description: "Force a balance refresh from the open banking provider."
-    }
-  ]
-};
-function registerOpenBankingCapabilities(registry) {
-  return registry.register(openBankingAccountsReadCapability).register(openBankingTransactionsReadCapability).register(openBankingBalancesReadCapability);
-}
-
-// src/capabilities/meeting-recorder.ts
-var OWNERS2 = ["platform.integrations"];
-var TAGS2 = ["meeting-recorder", "transcripts", "integrations"];
-var meetingRecorderMeetingsReadCapability = {
-  meta: {
-    key: "meeting-recorder.meetings.read",
-    version: "1.0.0",
-    kind: "integration",
-    title: "Meeting Recorder Meetings (Read)",
-    description: "Provides read-only access to recorded meetings and their metadata.",
-    domain: "integrations",
-    owners: [...OWNERS2],
-    tags: [...TAGS2, "meetings"],
-    stability: StabilityEnum.Experimental
-  },
-  provides: [
-    {
-      surface: "operation",
-      key: "meeting-recorder.meetings.list",
-      version: "1.0.0",
-      description: "List meetings available from the recorder provider."
-    },
-    {
-      surface: "operation",
-      key: "meeting-recorder.meetings.get",
-      version: "1.0.0",
-      description: "Fetch detailed metadata for a specific meeting."
-    }
-  ]
-};
-var meetingRecorderTranscriptsReadCapability = {
-  meta: {
-    key: "meeting-recorder.transcripts.read",
-    version: "1.0.0",
-    kind: "integration",
-    title: "Meeting Recorder Transcripts (Read)",
-    description: "Enables retrieval of transcripts for recorded meetings from external providers.",
-    domain: "integrations",
-    owners: [...OWNERS2],
-    tags: [...TAGS2, "transcripts"],
-    stability: StabilityEnum.Experimental
-  },
-  provides: [
-    {
-      surface: "operation",
-      key: "meeting-recorder.transcripts.get",
-      version: "1.0.0",
-      description: "Fetch the transcript for a specific meeting recording."
-    },
-    {
-      surface: "operation",
-      key: "meeting-recorder.transcripts.sync",
-      version: "1.0.0",
-      description: "Trigger a transcript sync from the recorder provider."
-    }
-  ]
-};
-var meetingRecorderWebhooksCapability = {
-  meta: {
-    key: "meeting-recorder.webhooks",
-    version: "1.0.0",
-    kind: "integration",
-    title: "Meeting Recorder Webhooks",
-    description: "Allows processing of webhook events for meeting transcript readiness.",
-    domain: "integrations",
-    owners: [...OWNERS2],
-    tags: [...TAGS2, "webhooks"],
-    stability: StabilityEnum.Experimental
-  },
-  provides: [
-    {
-      surface: "operation",
-      key: "meeting-recorder.webhooks.ingest",
-      version: "1.0.0",
-      description: "Ingest and verify meeting recorder webhook payloads."
-    }
-  ]
-};
-function registerMeetingRecorderCapabilities(registry) {
-  return registry.register(meetingRecorderMeetingsReadCapability).register(meetingRecorderTranscriptsReadCapability).register(meetingRecorderWebhooksCapability);
-}
-// src/app-config/app-config.capability.ts
-var AppConfigCapability = defineCapability({
-  meta: {
-    key: "app-config",
-    version: "1.0.0",
-    title: "App Configuration Capability",
-    description: "Provides tenant app configuration lifecycle management.",
-    domain: "platform",
-    owners: [OwnersEnum.PlatformSigil],
-    tags: [TagsEnum.Hygiene],
-    kind: "api",
-    stability: StabilityEnum.Stable
-  },
-  provides: [],
-  requires: []
-});
-
-// src/operations/operation.ts
-var isEmitDeclRef = (e) => ("ref" in e);
-var defineCommand = (spec) => ({
-  ...spec,
-  meta: { ...spec.meta, kind: "command" },
-  policy: {
-    ...spec.policy,
-    idempotent: spec.policy?.["policy"]?.idempotent ?? false
-  }
-});
-var defineQuery = (spec) => ({
-  ...spec,
-  meta: { ...spec.meta, kind: "query" },
-  policy: { ...spec.policy, idempotent: true }
-});
-
-// src/registry.ts
-init_registry_utils();
-import { compareVersions as compareVersions2 } from "compare-versions";
-var keyOfSpecContract = (spec) => `${spec.meta.key}.v${spec.meta.version}`;
-
-class SpecContractRegistry {
-  contractType;
-  items = new Map;
-  constructor(contractType, items) {
-    this.contractType = contractType;
-    if (items) {
-      items.forEach((p) => this.register(p));
-    }
-  }
-  register(p) {
-    const key = keyOfSpecContract(p);
-    if (this.items.has(key))
-      throw new Error(`Duplicate contract \`${this.contractType}\` ${key}`);
-    this.items.set(key, p);
-    return this;
-  }
-  count() {
-    return this.items.size;
-  }
-  list() {
-    return [...this.items.values()];
-  }
-  get(key, version) {
-    if (version != null)
-      return this.items.get(`${key}.v${version}`);
-    let candidate;
-    for (const [k, p] of this.items.entries()) {
-      if (!k.startsWith(`${key}.v`))
-        continue;
-      if (!candidate || compareVersions2(p.meta.version, candidate.meta.version) > 0) {
-        candidate = p;
-      }
-    }
-    return candidate;
-  }
-  has(key, version) {
-    return !!this.get(key, version);
-  }
-  filter(criteria) {
-    return filterBy(this.list(), criteria);
-  }
-  listByTag(tag) {
-    return this.list().filter((p) => p.meta.tags?.includes(tag));
-  }
-  listByOwner(owner) {
-    return this.list().filter((p) => p.meta.owners?.includes(owner));
-  }
-  groupBy(keyFn) {
-    return groupBy(this.list(), keyFn);
-  }
-  getUniqueTags() {
-    return getUniqueTags(this.list());
-  }
-}
-
-// src/events.ts
-function defineEvent(e) {
-  return e;
-}
-var eventKey = (key, version) => `${key}.v${version}`;
-
-class EventRegistry extends SpecContractRegistry {
-  constructor(items) {
-    super("event", items);
-  }
-}
-
-// src/operations/registry.ts
-function opKey(key, version) {
-  return `${key}.v${version}`;
-}
-
-class OperationSpecRegistry extends SpecContractRegistry {
-  handlers = new Map;
-  constructor(items) {
-    super("operation", items);
-  }
-  bind(spec, handler) {
-    const key = opKey(spec.meta.key, spec.meta.version);
-    if (!this.items.has(key))
-      throw new Error(`Cannot bind; spec not found: ${key}`);
-    if (this.handlers.has(key))
-      throw new Error(`Handler already bound for ${key}`);
-    this.handlers.set(key, handler);
-    return this;
-  }
-  getHandler(key, version) {
-    const spec = this.get(key, version);
-    if (!spec)
-      return;
-    return this.handlers.get(opKey(spec.meta.key, spec.meta.version));
-  }
-  listBound() {
-    const out = [];
-    for (const [k, spec] of this.items.entries()) {
-      const h = this.handlers.get(k);
-      if (h)
-        out.push({ spec, handler: h });
-    }
-    return out;
-  }
-  async execute(key, version, rawInput, ctx) {
-    const baseSpec = this.get(key, version);
-    if (!baseSpec)
-      throw new Error(`Spec not found for ${key}${version ? `.v${version}` : ""}`);
-    const spec = await ctx.specVariantResolver?.resolve({
-      name: baseSpec.meta.key,
-      version: baseSpec.meta.version,
-      kind: baseSpec.meta.kind
-    }, ctx) ?? baseSpec;
-    let handlerKey = opKey(spec.meta.key, spec.meta.version);
-    let handler = this.handlers.get(handlerKey);
-    if (!handler) {
-      const fallbackKey = opKey(baseSpec.meta.key, baseSpec.meta.version);
-      handler = this.handlers.get(fallbackKey);
-      handlerKey = fallbackKey;
-    }
-    if (!handler)
-      throw new Error(`No handler bound for ${handlerKey}`);
-    const parsedInput = spec.io.input?.getZod().parse(rawInput);
-    if (ctx.decide) {
-      const [service, command] = spec.meta.key.split(".");
-      if (!service || !command)
-        throw new Error(`Invalid spec name: ${spec.meta.key}`);
-      const decision = await ctx.decide({
-        service,
-        command,
-        version: spec.meta.version,
-        actor: ctx.actor ?? "anonymous",
-        channel: ctx.channel,
-        roles: ctx.roles,
-        organizationId: ctx.organizationId,
-        userId: ctx.userId,
-        flags: []
-      });
-      if (decision.effect === "deny") {
-        throw new Error(`PolicyDenied: ${spec.meta.key}.v${spec.meta.version}`);
-      }
-      if (decision.rateLimit && ctx.rateLimit) {
-        const key2 = decision.rateLimit.key ?? "default";
-        const rpm = decision.rateLimit.rpm ?? 60;
-        await ctx.rateLimit(key2, 1, rpm);
-      }
-    }
-    const allowedEvents = new Map;
-    if (spec.sideEffects?.emits) {
-      for (const e of spec.sideEffects.emits) {
-        if (isEmitDeclRef(e)) {
-          const eventSpec = ctx.eventSpecResolver?.get(e.ref.key, e.ref.version);
-          if (eventSpec) {
-            allowedEvents.set(`${e.ref.key}.v${e.ref.version}`, eventSpec.payload);
-          }
-        } else {
-          allowedEvents.set(`${e.key}.v${e.version}`, e.payload);
-        }
-      }
-    }
-    const emitGuard = async (eventName, eventVersion, payload) => {
-      const key2 = eventKey(eventName, eventVersion);
-      const schema = allowedEvents.get(key2);
-      if (!schema)
-        throw new Error(`UndeclaredEvent: ${key2} not allowed by ${opKey(spec.meta.key, spec.meta.version)}`);
-      const parsed = schema.getZod().parse(payload);
-      await ctx.eventPublisher?.({
-        key: eventName,
-        version: eventVersion,
-        payload: parsed,
-        traceId: ctx.traceId
-      });
-    };
-    if (ctx.appConfig) {
-      if (!ctx.branding) {
-        ctx.branding = ctx.appConfig.branding;
-      }
-      if (!ctx.translation) {
-        ctx.translation = { config: ctx.appConfig.translation };
-      } else if (!ctx.translation.config) {
-        ctx.translation = {
-          ...ctx.translation,
-          config: ctx.appConfig.translation
-        };
-      }
-    }
-    const telemetryContext = ctx.telemetry;
-    const trackTelemetry = async (trigger, details) => {
-      if (!telemetryContext || !trigger?.event)
-        return;
-      try {
-        const props = trigger.properties?.(details) ?? {};
-        await telemetryContext.track(trigger.event.key, trigger.event.version ?? "1.0.0", props, {
-          tenantId: ctx.organizationId ?? undefined,
-          organizationId: ctx.organizationId,
-          userId: ctx.userId,
-          actor: ctx.actor,
-          channel: ctx.channel,
-          metadata: ctx.traceId ? { traceId: ctx.traceId } : undefined
-        });
-      } catch (_error) {}
-    };
-    let result;
-    try {
-      result = await handler(parsedInput, {
-        ...ctx,
-        __emitGuard__: emitGuard
-      });
-    } catch (error) {
-      if (spec.telemetry?.failure) {
-        await trackTelemetry(spec.telemetry.failure, {
-          input: parsedInput ?? rawInput,
-          error
-        });
-      }
-      throw error;
-    }
-    if (spec.telemetry?.success) {
-      await trackTelemetry(spec.telemetry.success, {
-        input: parsedInput ?? rawInput,
-        output: result
-      });
-    }
-    const outputModel = spec.io.output;
-    if (outputModel?.getZod) {
-      const parsedOutput = outputModel.getZod().parse(result);
-      return parsedOutput;
-    }
-    return result;
-  }
-}
-
-// src/operations/report/getContractVerificationStatus.ts
-import {
-  ScalarTypeEnum,
-  SchemaModel,
-  ZodSchemaType
-} from "@contractspec/lib.schema";
-import * as z from "zod";
-var REPORT_DOMAIN = "report";
-var REPORT_OWNERS = ["platform.core"];
-var REPORT_TAGS = ["report", "drift", "verification"];
-var REPORT_STABILITY = StabilityEnum.Experimental;
-var ContractVerificationStatusModel = new SchemaModel({
-  name: "ContractVerificationStatus",
-  fields: {
-    name: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },
-    lastVerifiedSha: {
-      type: ScalarTypeEnum.String_unsecure(),
-      isOptional: true
-    },
-    lastVerifiedDate: {
-      type: ScalarTypeEnum.String_unsecure(),
-      isOptional: true
-    },
-    surfaces: {
-      type: ScalarTypeEnum.String_unsecure(),
-      isOptional: false,
-      isArray: true
-    },
-    driftMismatches: {
-      type: ScalarTypeEnum.Int_unsecure(),
-      isOptional: false
-    }
-  }
-});
-var GetContractVerificationStatusInput = new SchemaModel({
-  name: "GetContractVerificationStatusInput",
-  fields: {
-    projectPath: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },
-    baseline: { type: ScalarTypeEnum.String_unsecure(), isOptional: true }
-  }
-});
-var GetContractVerificationStatusOutput = new ZodSchemaType(z.object({
-  contracts: z.object({
-    name: z.string(),
-    lastVerifiedSha: z.string().optional(),
-    lastVerifiedDate: z.string().optional(),
-    surfaces: z.string().array(),
-    driftMismatches: z.int()
-  }).array()
-}), {
-  name: "GetContractVerificationStatusOutput"
-});
-var GetContractVerificationStatusQuery = defineQuery({
-  meta: {
-    key: "report.getContractVerificationStatus",
-    title: "Get Contract Verification Status",
-    version: "1.0.0",
-    description: "Retrieves per-contract verification status for the impact report.",
-    goal: "Enable stakeholders to see contract health at a glance.",
-    context: "Part of the impact report domain. Reads from drift check outputs and verified.json to provide a consolidated view of each contract's drift debt and surface coverage.",
-    domain: REPORT_DOMAIN,
-    owners: REPORT_OWNERS,
-    tags: REPORT_TAGS,
-    stability: REPORT_STABILITY
-  },
-  io: {
-    input: GetContractVerificationStatusInput,
-    output: GetContractVerificationStatusOutput,
-    errors: {
-      PROJECT_NOT_FOUND: {
-        description: "Project path does not exist.",
-        http: 404,
-        when: "The provided projectPath does not resolve to a valid directory."
-      }
-    }
-  },
-  policy: {
-    auth: "anonymous",
-    pii: []
-  }
-});
-
-// src/install.ts
-function makeEmit(_spec, ctx) {
-  return {
-    ref: async (ev, payload) => {
-      await ctx.__emitGuard__?.(ev.meta.key, ev.meta.version, payload);
-    },
-    key: async (key, version, payload) => {
-      await ctx.__emitGuard__?.(key, version, payload);
-    },
-    object: async (evt) => {
-      await ctx.__emitGuard__?.(evt.key, evt.version, evt.payload);
-    }
-  };
-}
-function installOp(reg, spec, handler) {
-  return reg.register(spec).bind(spec, handler);
-}
-function op(spec, handler) {
-  return {
-    spec,
-    handler,
-    install: (reg) => installOp(reg, spec, handler)
-  };
-}
-
-// src/data-views/spec.ts
-function defineDataView(spec) {
-  return spec;
-}
-
-// src/data-views/report/contractVerificationTable.ts
-var ContractVerificationTableDataView = defineDataView({
-  meta: {
-    key: "report.contractVerificationTable",
-    title: "Contract Verification Table",
-    version: "1.0.0",
-    description: "Table view of per-contract verification status for the impact report.",
-    domain: "report",
-    owners: ["platform.core"],
-    tags: ["report", "data-view", "verification"],
-    stability: StabilityEnum.Experimental,
-    entity: "contract-verification"
-  },
-  source: {
-    primary: {
-      key: GetContractVerificationStatusQuery.meta.key,
-      version: GetContractVerificationStatusQuery.meta.version
-    }
-  },
-  view: {
-    kind: "table",
-    fields: [
-      {
-        key: "name",
-        label: "Contract / Endpoint / Event",
-        dataPath: "name"
-      },
-      {
-        key: "timeSinceVerified",
-        label: "Time since verified",
-        dataPath: "lastVerifiedDate"
-      },
-      {
-        key: "driftMismatches",
-        label: "Drift debt",
-        dataPath: "driftMismatches",
-        format: "number",
-        sortable: true
-      },
-      {
-        key: "surfaces",
-        label: "Surfaces covered",
-        dataPath: "surfaces",
-        format: "badge"
-      },
-      {
-        key: "lastVerifiedSha",
-        label: "Last verified commit",
-        dataPath: "lastVerifiedSha",
-        width: "sm"
-      }
-    ],
-    primaryField: "name",
-    secondaryFields: ["driftMismatches", "timeSinceVerified"],
-    columns: [
-      { field: "name", width: "lg" },
-      { field: "lastVerifiedSha", width: "sm" },
-      { field: "timeSinceVerified", width: "sm" },
-      { field: "surfaces", width: "md" },
-      { field: "driftMismatches", width: "xs", align: "right" }
-    ]
-  },
-  policy: {
-    flags: [],
-    pii: []
-  }
-});
-
-// src/operations/report/index.ts
-var getContractVerificationStatusHandler = async (input, _ctx) => {
-  try {
-    const cmdProcess = Bun.spawn(["contractspec", "impl", "status", "--format", "json", "--all"], {
-      cwd: input.projectPath
-    });
-    const cmdStdout = await cmdProcess.stdout;
-    const output = await Bun.readableStreamToText(cmdStdout);
-    if (!output) {
-      return { contracts: [] };
-    }
-    const cliOutput = JSON.parse(output);
-    const contracts = [];
-    for (const spec of cliOutput.results || []) {
-      const contract = {
-        name: spec.specKey,
-        lastVerifiedSha: spec.specHash,
-        lastVerifiedDate: spec.specHash ? new Date().toISOString() : undefined,
-        surfaces: spec.implementations.filter((impl) => impl.exists).map((impl) => impl.type),
-        driftMismatches: spec.implementations.filter((impl) => !impl.exists).length
-      };
-      contracts.push(contract);
-    }
-    return { contracts };
-  } catch (error) {
-    console.error("Failed to get contract verification status:", error);
-    return { contracts: [] };
-  }
-};
-function registerReportContracts(registry) {
-  installOp(registry, GetContractVerificationStatusQuery, getContractVerificationStatusHandler);
-  return registry;
-}
-// src/app-config/spec.ts
-var blueprintKey = (meta) => `${meta.key}.v${meta.version}`;
-
-class AppBlueprintRegistry extends SpecContractRegistry {
-  constructor(items) {
-    super("app-config", items);
-  }
-}
-function makeAppBlueprintKey(meta) {
-  return blueprintKey(meta);
-}
-var defineAppConfig = (spec) => spec;
-
-// src/app-config/app-config.feature.ts
-var AppConfigFeature = defineAppConfig({
-  meta: {
-    key: "app-config",
-    version: "1.0.0",
-    title: "App Configuration",
-    description: "Tenant app configuration lifecycle management with draft, preview, and publish stages",
-    domain: "platform",
-    owners: ["@platform.sigil"],
-    tags: ["app-config", "lifecycle", "configuration", "tenant"],
-    stability: "beta"
-  },
-  operations: [],
-  events: [
-    { key: "app_config.draft_created", version: "1.0.0" },
-    { key: "app_config.promoted_to_preview", version: "1.0.0" },
-    { key: "app_config.published", version: "1.0.0" },
-    { key: "app_config.rolled_back", version: "1.0.0" }
-  ],
-  presentations: [],
-  opToPresentation: [],
-  presentationsTargets: [],
-  capabilities: {
-    provides: [{ key: "app-config", version: "1.0.0" }],
-    requires: []
-  }
-});
-// src/app-config/events.ts
-import { SchemaModel as SchemaModel2, ScalarTypeEnum as ScalarTypeEnum2 } from "@contractspec/lib.schema";
-var lifecycleOwnership = {
-  title: "Tenant App Config Lifecycle",
-  description: "Events emitted when tenant app configurations move through lifecycle stages.",
-  domain: "app-config.lifecycle",
-  owners: [OwnersEnum.PlatformSigil],
-  tags: [TagsEnum.Hygiene],
-  stability: StabilityEnum.Beta
-};
-var ConfigDraftCreatedEvent = defineEvent({
-  meta: {
-    ...lifecycleOwnership,
-    key: "app_config.draft_created",
-    version: "1.0.0",
-    description: "A new tenant config draft was created."
-  },
-  payload: new SchemaModel2({
-    name: "ConfigDraftCreatedPayload",
-    fields: {
-      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      version: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
-      blueprintName: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: false
-      },
-      blueprintVersion: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: false
-      },
-      createdBy: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
-      clonedFrom: { type: ScalarTypeEnum2.Int_unsecure(), isOptional: true }
-    }
-  })
-});
-var ConfigPromotedToPreviewEvent = defineEvent({
-  meta: {
-    ...lifecycleOwnership,
-    key: "app_config.promoted_to_preview",
-    version: "1.0.0",
-    description: "A tenant config draft was promoted to preview."
-  },
-  payload: new SchemaModel2({
-    name: "ConfigPromotedToPreviewPayload",
-    fields: {
-      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      version: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
-      promotedBy: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
-      warnings: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: true,
-        isArray: true
-      }
-    }
-  })
-});
-var ConfigPublishedEvent = defineEvent({
-  meta: {
-    ...lifecycleOwnership,
-    key: "app_config.published",
-    version: "1.0.0",
-    description: "A tenant config version was published to production."
-  },
-  payload: new SchemaModel2({
-    name: "ConfigPublishedPayload",
-    fields: {
-      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      version: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
-      previousVersion: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: true
-      },
-      publishedBy: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: false
-      },
-      changeSummary: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: true
-      },
-      changedSections: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: true,
-        isArray: true
-      }
-    }
-  })
-});
-var ConfigRolledBackEvent = defineEvent({
-  meta: {
-    ...lifecycleOwnership,
-    key: "app_config.rolled_back",
-    version: "1.0.0",
-    description: "A tenant config was rolled back to a previous version."
-  },
-  payload: new SchemaModel2({
-    name: "ConfigRolledBackPayload",
-    fields: {
-      tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      appId: { type: ScalarTypeEnum2.ID(), isOptional: false },
-      newVersion: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false },
-      rolledBackFrom: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: false
-      },
-      rolledBackTo: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: false
-      },
-      rolledBackBy: {
-        type: ScalarTypeEnum2.String_unsecure(),
-        isOptional: false
-      },
-      reason: { type: ScalarTypeEnum2.String_unsecure(), isOptional: false }
-    }
-  })
-});
-
-// src/app-config/runtime.ts
-function resolveAppConfig(blueprint, tenant, deps = {}) {
-  const capabilities2 = mergeCapabilities(blueprint.capabilities, tenant.capabilities);
-  const features = mergeFeatures(blueprint.features, tenant.features);
-  const dataViews = mergeMappings(blueprint.dataViews ?? {}, tenant.dataViewOverrides);
-  const workflows = mergeMappings(blueprint.workflows ?? {}, tenant.workflowOverrides);
-  const policies = mergePolicies(blueprint.policies ?? [], tenant.additionalPolicies ?? []);
-  const theme = mergeTheme(blueprint.theme, tenant.themeOverride);
-  const telemetry = mergeTelemetry(blueprint.telemetry, tenant.telemetryOverride);
-  const experiments = mergeExperiments(blueprint.experiments, tenant.experiments);
-  const featureFlags = mergeFeatureFlags(blueprint.featureFlags ?? [], tenant.featureFlags ?? []);
-  const routes = mergeRoutes(blueprint.routes ?? [], tenant.routeOverrides ?? []);
-  const { resolved: integrations } = evaluateIntegrationSlots(blueprint.integrationSlots, tenant.integrations, deps.integrationConnections, deps.integrationSpecs);
-  const knowledge = resolveKnowledgeBindings(tenant.knowledge, deps.knowledgeSpaces, deps.knowledgeSources);
-  const branding = resolveBranding(blueprint.branding, tenant);
-  const translation = resolveTranslation(blueprint.translationCatalog, tenant.locales, tenant.translationOverrides);
-  return {
-    appId: blueprint.meta.appId,
-    tenantId: tenant.meta.tenantId,
-    environment: tenant.meta.environment,
-    blueprintName: blueprint.meta.key,
-    blueprintVersion: blueprint.meta.version,
-    configVersion: tenant.meta.version,
-    capabilities: capabilities2,
-    features,
-    dataViews,
-    workflows,
-    policies,
-    theme,
-    telemetry,
-    experiments,
-    featureFlags,
-    routes,
-    integrations,
-    knowledge,
-    translation,
-    branding,
-    notes: tenant.notes ?? blueprint.notes
-  };
-}
-function composeAppConfig(blueprint, tenant, deps, options = {}) {
-  const resolved = resolveAppConfig(blueprint, tenant, deps);
-  const missing = [];
-  const integrationEvaluation = evaluateIntegrationSlots(blueprint.integrationSlots, tenant.integrations, deps.integrationConnections, deps.integrationSpecs);
-  resolved.integrations = integrationEvaluation.resolved;
-  missing.push(...integrationEvaluation.missing);
-  missing.push(...collectMissingKnowledge(tenant.knowledge ?? [], deps.knowledgeSpaces, deps.knowledgeSources));
-  const capabilities2 = resolveCapabilityRefs(resolved.capabilities.enabled, deps.capabilities, missing);
-  const features = resolveFeatureRefs(resolved.features.include, deps.features, missing);
-  const dataViews = resolvePointerRecord(resolved.dataViews, deps.dataViews, "dataView", missing);
-  const workflows = resolvePointerRecord(resolved.workflows, deps.workflows, "workflow", missing);
-  const policies = resolvePolicies(resolved.policies, deps.policies, missing);
-  const { theme, fallbacks, themeMissing } = resolveThemeBinding(resolved.theme, deps.themes);
-  missing.push(...themeMissing);
-  const { telemetry, telemetryMissing } = resolveTelemetryBinding(resolved.telemetry, deps.telemetry);
-  missing.push(...telemetryMissing);
-  const experiments = resolveExperimentsSpecs(resolved.experiments, deps.experiments, missing);
-  if (options.strict && missing.length > 0) {
-    const reasons = missing.map((item) => `${item.type}:${item.identifier}`).join(", ");
-    throw new Error(`composeAppConfig: missing references -> ${reasons}`);
-  }
-  return {
-    resolved,
-    capabilities: capabilities2,
-    features,
-    dataViews,
-    workflows,
-    policies,
-    theme,
-    themeFallbacks: fallbacks,
-    telemetry,
-    experiments,
-    integrations: resolved.integrations,
-    knowledge: resolved.knowledge,
-    missing
-  };
-}
-function mergeCapabilities(blueprint, tenant) {
-  const enabled = dedupeRefs([...blueprint?.enabled ?? [], ...tenant?.enable ?? []], capabilityKey2);
-  const disabled = dedupeRefs([...blueprint?.disabled ?? [], ...tenant?.disable ?? []], capabilityKey2);
-  const disabledKeys = new Set(disabled.map(capabilityKey2));
-  const filteredEnabled = enabled.filter((ref) => !disabledKeys.has(capabilityKey2(ref)));
-  return { enabled: filteredEnabled, disabled };
-}
-function mergeFeatures(blueprint, tenant) {
-  const include = dedupeRefs([...blueprint?.include ?? [], ...tenant?.include ?? []], featureKey);
-  const exclude = dedupeRefs([...blueprint?.exclude ?? [], ...tenant?.exclude ?? []], featureKey);
-  const excludeSet = new Set(exclude.map(featureKey));
-  const filteredInclude = include.filter((ref) => !excludeSet.has(featureKey(ref)));
-  return { include: filteredInclude, exclude };
-}
-function mergeMappings(blueprint, overrides) {
-  const merged = { ...blueprint };
-  if (!overrides)
-    return merged;
-  for (const override of overrides) {
-    if (!override)
-      continue;
-    if (!override.pointer) {
-      delete merged[override.slot];
-    } else {
-      merged[override.slot] = override.pointer;
-    }
-  }
-  return merged;
-}
-function mergePolicies(blueprint, additional) {
-  return dedupeRefs([...blueprint, ...additional], policyKey);
-}
-function mergeTheme(blueprint, override) {
-  if (!blueprint && !override)
-    return;
-  const primary = override?.primary ?? blueprint?.primary;
-  if (!primary)
-    return;
-  const fallbacks = override?.fallbacks ?? blueprint?.fallbacks ?? [];
-  return { primary, fallbacks };
-}
-function mergeTelemetry(blueprint, override) {
-  if (!blueprint && !override)
-    return;
-  const binding = {
-    spec: blueprint?.spec,
-    disabledEvents: blueprint?.disabledEvents ? [...blueprint.disabledEvents] : undefined,
-    samplingOverrides: blueprint?.samplingOverrides ? { ...blueprint.samplingOverrides } : undefined
-  };
-  if (override?.spec !== undefined) {
-    binding.spec = override.spec ?? undefined;
-  }
-  if (override?.disabledEvents) {
-    binding.disabledEvents = dedupeStrings([
-      ...binding.disabledEvents ?? [],
-      ...override.disabledEvents
-    ]);
-  }
-  if (override?.samplingOverrides) {
-    binding.samplingOverrides = {
-      ...binding.samplingOverrides ?? {},
-      ...override.samplingOverrides
-    };
-  }
-  if (!binding.spec && !binding.disabledEvents?.length) {
-    return;
-  }
-  return binding;
-}
-function mergeExperiments(blueprint, tenant) {
-  const defaultActive = blueprint?.active ?? [];
-  const defaultPaused = blueprint?.paused ?? [];
-  const tenantActive = tenant?.active;
-  const tenantPaused = tenant?.paused;
-  const activeSource = tenantActive && tenantActive.length > 0 ? tenantActive : defaultActive;
-  const pausedSource = tenantPaused && tenantPaused.length > 0 ? tenantPaused : defaultPaused;
-  const active = dedupeRefs(activeSource, experimentKey);
-  let paused = dedupeRefs(pausedSource, experimentKey);
-  const activeKeys = new Set(active.map(experimentKey));
-  paused = paused.filter((ref) => !activeKeys.has(experimentKey(ref)));
-  const catalog = dedupeRefs([
-    ...defaultActive,
-    ...defaultPaused,
-    ...tenantActive ?? [],
-    ...tenantPaused ?? []
-  ], experimentKey);
-  return { catalog, active, paused };
-}
-function resolveBranding(defaults, tenant) {
-  const override = tenant.branding;
-  const tenantMeta = tenant.meta;
-  const baseDomain = "app.localhost";
-  const domain = override?.customDomain ?? (override?.subdomain ? `${override.subdomain}.${baseDomain}` : `${tenantMeta.tenantId}.${baseDomain}`);
-  const localePreferenceOrder = [];
-  if (tenant.locales?.defaultLocale) {
-    localePreferenceOrder.push(tenant.locales.defaultLocale);
-  }
-  if (override?.appName) {
-    localePreferenceOrder.push("default", "en");
-  }
-  let appName;
-  if (override?.appName) {
-    for (const key of localePreferenceOrder) {
-      const candidate = override.appName[key];
-      if (candidate) {
-        appName = candidate;
-        break;
-      }
-    }
-    if (!appName) {
-      const [, firstValue] = Object.entries(override.appName)[0] ?? [];
-      if (typeof firstValue === "string") {
-        appName = firstValue;
-      }
-    }
-  }
-  if (!appName) {
-    appName = defaults?.appNameKey ?? tenantMeta.appId;
-  }
-  const assetEntries = new Map;
-  const applyAssets = (assets2) => {
-    if (!assets2)
-      return;
-    for (const asset of assets2) {
-      if (!asset?.type)
-        continue;
-      if ("url" in asset && asset.url) {
-        assetEntries.set(asset.type, asset.url);
-      }
-    }
-  };
-  applyAssets(defaults?.assets);
-  applyAssets(override?.assets);
-  const assets = {
-    logo: assetEntries.get("logo"),
-    logoDark: assetEntries.get("logo-dark"),
-    favicon: assetEntries.get("favicon"),
-    ogImage: assetEntries.get("og-image")
-  };
-  const colors = {
-    primary: override?.colors?.primary ?? defaults?.colorTokens?.primary ?? "#1f2937",
-    secondary: override?.colors?.secondary ?? defaults?.colorTokens?.secondary ?? "#4b5563"
-  };
-  return {
-    appName,
-    assets,
-    colors,
-    domain
-  };
-}
-function resolveTranslation(catalogPointer, locales, overrides) {
-  const defaultLocale = locales?.defaultLocale ?? "en";
-  const enabled = locales?.enabledLocales ?? [];
-  const supportedLocales = dedupeStrings([defaultLocale, ...enabled]);
-  const entries = overrides?.entries ?? [];
-  return {
-    defaultLocale,
-    supportedLocales,
-    blueprintCatalog: catalogPointer,
-    tenantOverrides: entries
-  };
-}
-function mergeFeatureFlags(blueprint, overrides) {
-  const merged = new Map;
-  for (const flag of blueprint) {
-    merged.set(flag.key, { ...flag });
-  }
-  for (const override of overrides) {
-    merged.set(override.key, { ...override });
-  }
-  return [...merged.values()];
-}
-function mergeRoutes(blueprint, overrides) {
-  const routes = new Map;
-  for (const route of blueprint) {
-    routes.set(route.path, { ...route });
-  }
-  for (const override of overrides) {
-    const existing = routes.get(override.path) ?? { path: override.path };
-    if (override.label !== undefined) {
-      if (override.label === null)
-        delete existing.label;
-      else
-        existing.label = override.label;
-    }
-    if (override.dataView !== undefined) {
-      if (override.dataView === null)
-        delete existing.dataView;
-      else
-        existing.dataView = override.dataView;
-    }
-    if (override.workflow !== undefined) {
-      if (override.workflow === null)
-        delete existing.workflow;
-      else
-        existing.workflow = override.workflow;
-    }
-    if (override.guard !== undefined) {
-      if (override.guard === null)
-        delete existing.guard;
-      else
-        existing.guard = override.guard;
-    }
-    if (override.featureFlag !== undefined) {
-      if (override.featureFlag === null)
-        delete existing.featureFlag;
-      else
-        existing.featureFlag = override.featureFlag;
-    }
-    if (override.experiment !== undefined) {
-      if (override.experiment === null)
-        delete existing.experiment;
-      else
-        existing.experiment = override.experiment;
-    }
-    routes.set(existing.path, existing);
-  }
-  return [...routes.values()];
-}
-function evaluateIntegrationSlots(slots, bindings, connections, specs) {
-  const resolved = [];
-  const missing = [];
-  const missingKeys = new Set;
-  const recordMissing = (entry) => {
-    const key = `${entry.type}:${entry.identifier}`;
-    if (missingKeys.has(key))
-      return;
-    missingKeys.add(key);
-    missing.push(entry);
-  };
-  const slotList = slots ?? [];
-  const slotById = new Map;
-  for (const slot of slotList) {
-    slotById.set(slot.slotId, slot);
-  }
-  const bindingsBySlot = new Map;
-  for (const binding of bindings ?? []) {
-    const slot = slotById.get(binding.slotId);
-    if (!slot) {
-      recordMissing({
-        type: "integrationSlot",
-        identifier: `slot:${binding.slotId}`
-      });
-      continue;
-    }
-    const entries = bindingsBySlot.get(binding.slotId);
-    if (entries)
-      entries.push(binding);
-    else
-      bindingsBySlot.set(binding.slotId, [binding]);
-  }
-  for (const slot of slotList) {
-    const slotBindings = bindingsBySlot.get(slot.slotId) ?? [];
-    if (slot.required && slotBindings.length === 0) {
-      recordMissing({
-        type: "integrationSlot",
-        identifier: `slot:${slot.slotId}`
-      });
-    }
-  }
-  if (!connections || !specs) {
-    return { resolved, missing };
-  }
-  const connectionById = new Map;
-  for (const connection of connections) {
-    connectionById.set(connection.meta.id, connection);
-  }
-  for (const slot of slotList) {
-    const slotBindings = bindingsBySlot.get(slot.slotId) ?? [];
-    if (slotBindings.length === 0)
-      continue;
-    const orderedBindings = [...slotBindings].sort((a, b) => {
-      const aPriority = a.priority ?? Number.MAX_SAFE_INTEGER;
-      const bPriority = b.priority ?? Number.MAX_SAFE_INTEGER;
-      if (aPriority === bPriority)
-        return 0;
-      return aPriority < bPriority ? -1 : 1;
-    });
-    let slotResolved = false;
-    for (const binding of orderedBindings) {
-      const connection = connectionById.get(binding.connectionId);
-      if (!connection) {
-        recordMissing({
-          type: "integrationConnection",
-          identifier: `connection:${binding.connectionId}`
-        });
-        continue;
-      }
-      const spec = specs.get(connection.meta.integrationKey, connection.meta.integrationVersion);
-      if (!spec) {
-        recordMissing({
-          type: "integrationSpec",
-          identifier: `spec:${connection.meta.integrationKey}.v${connection.meta.integrationVersion}`
-        });
-        continue;
-      }
-      if (spec.meta.category !== slot.requiredCategory) {
-        recordMissing({
-          type: "integrationSpec",
-          identifier: `spec:${spec.meta.key}.category`
-        });
-        continue;
-      }
-      if (!spec.supportedModes.includes(connection.ownershipMode)) {
-        recordMissing({
-          type: "integrationSpec",
-          identifier: `spec:${spec.meta.key}.mode:${connection.ownershipMode}`
-        });
-        continue;
-      }
-      if (slot.allowedModes && slot.allowedModes.length > 0 && !slot.allowedModes.includes(connection.ownershipMode)) {
-        recordMissing({
-          type: "integrationConnection",
-          identifier: `connection:${connection.meta.id}:mode`
-        });
-        continue;
-      }
-      if (slot.requiredCapabilities && !slot.requiredCapabilities.every((requirement) => integrationProvidesCapability(spec, requirement))) {
-        recordMissing({
-          type: "integrationSpec",
-          identifier: `spec:${spec.meta.key}.capabilities`
-        });
-        continue;
-      }
-      resolved.push({
-        slot,
-        binding,
-        connection,
-        spec
-      });
-      slotResolved = true;
-      break;
-    }
-    if (!slotResolved && slot.required) {
-      recordMissing({
-        type: "integrationSlot",
-        identifier: `slot:${slot.slotId}`
-      });
-    }
-  }
-  return { resolved, missing };
-}
-function integrationProvidesCapability(spec, required) {
-  return spec.capabilities.provides.some((capability) => {
-    if (capability.key !== required.key)
-      return false;
-    if (required.version == null)
-      return true;
-    return capability.version === required.version;
-  });
-}
-function resolveKnowledgeBindings(bindings, spaces, sources) {
-  if (!bindings?.length || !spaces)
-    return [];
-  const sourceList = sources ?? [];
-  return bindings.map((binding) => {
-    const space = spaces.get(binding.spaceKey, binding.spaceVersion);
-    if (!space)
-      return null;
-    const relevantSources = sourceList.filter((source) => {
-      if (source.meta.spaceKey !== binding.spaceKey)
-        return false;
-      if (binding.spaceVersion != null) {
-        return source.meta.spaceVersion === binding.spaceVersion;
-      }
-      return true;
-    });
-    return {
-      binding,
-      space,
-      sources: relevantSources
-    };
-  }).filter((entry) => entry !== null);
-}
-function collectMissingKnowledge(bindings, spaces, sources) {
-  if (!bindings.length || !spaces)
-    return [];
-  const missing = [];
-  const sourceList = sources ?? [];
-  for (const binding of bindings) {
-    const space = spaces.get(binding.spaceKey, binding.spaceVersion);
-    if (!space) {
-      missing.push({
-        type: "knowledgeSpace",
-        identifier: binding.spaceVersion ? `${binding.spaceKey}@${binding.spaceVersion}` : binding.spaceKey
-      });
-      continue;
-    }
-    if (sources) {
-      const relevantSources = sourceList.filter((source) => {
-        if (source.meta.spaceKey !== binding.spaceKey)
-          return false;
-        if (binding.spaceVersion != null) {
-          return source.meta.spaceVersion === binding.spaceVersion;
-        }
-        return true;
-      });
-      if (relevantSources.length === 0) {
-        missing.push({
-          type: "knowledgeSource",
-          identifier: binding.spaceVersion ? `${binding.spaceKey}@${binding.spaceVersion}` : binding.spaceKey
-        });
-      }
-    }
-  }
-  return missing;
-}
-function resolveCapabilityRefs(refs, registry2, missing) {
-  if (!registry2) {
-    if (refs.length > 0) {
-      for (const ref of refs) {
-        missing.push({
-          type: "capability",
-          identifier: capabilityKey2(ref)
-        });
-      }
-    }
-    return [];
-  }
-  const resolved = [];
-  for (const ref of refs) {
-    const spec = registry2.get(ref.key, ref.version);
-    if (!spec) {
-      missing.push({
-        type: "capability",
-        identifier: capabilityKey2(ref)
-      });
-      continue;
-    }
-    resolved.push(spec);
-  }
-  return resolved;
-}
-function resolveFeatureRefs(refs, registry2, missing) {
-  if (!registry2) {
-    if (refs.length > 0) {
-      for (const ref of refs) {
-        missing.push({ type: "feature", identifier: ref.key });
-      }
-    }
-    return [];
-  }
-  const resolved = [];
-  for (const ref of refs) {
-    const spec = registry2.get(ref.key);
-    if (!spec) {
-      missing.push({ type: "feature", identifier: ref.key });
-      continue;
-    }
-    resolved.push(spec);
-  }
-  return resolved;
-}
-function resolvePointerRecord(record, registry2, type, missing) {
-  if (!registry2) {
-    if (Object.keys(record).length > 0) {
-      for (const [slot, pointer] of Object.entries(record)) {
-        missing.push({
-          type,
-          identifier: `${slot} -> ${specPointerKey(pointer)}`
-        });
-      }
-    }
-    return {};
-  }
-  const resolved = {};
-  for (const [slot, pointer] of Object.entries(record)) {
-    const spec = registry2.get(pointer.key, pointer.version);
-    if (!spec) {
-      missing.push({
-        type,
-        identifier: `${slot} -> ${specPointerKey(pointer)}`
-      });
-      continue;
-    }
-    resolved[slot] = spec;
-  }
-  return resolved;
-}
-function resolvePolicies(policies, registry2, missing) {
-  if (!registry2) {
-    if (policies.length > 0) {
-      for (const policy of policies) {
-        missing.push({
-          type: "policy",
-          identifier: policyKey(policy)
-        });
-      }
-    }
-    return [];
-  }
-  const resolved = [];
-  for (const policy of policies) {
-    const spec = registry2.get(policy.key, policy.version);
-    if (!spec) {
-      missing.push({
-        type: "policy",
-        identifier: policyKey(policy)
-      });
-      continue;
-    }
-    resolved.push(spec);
-  }
-  return resolved;
-}
-function resolveThemeBinding(binding, registry2) {
-  const themeMissing = [];
-  if (!binding) {
-    return { theme: undefined, fallbacks: [], themeMissing };
-  }
-  if (!registry2) {
-    themeMissing.push({
-      type: "theme",
-      identifier: `${binding.primary.key}.v${binding.primary.version}`
-    });
-    for (const fallback of binding.fallbacks ?? []) {
-      themeMissing.push({
-        type: "theme",
-        identifier: `${fallback.key}.v${fallback.version}`
-      });
-    }
-    return { theme: undefined, fallbacks: [], themeMissing };
-  }
-  const theme = registry2.get(binding.primary.key, binding.primary.version);
-  if (!theme) {
-    themeMissing.push({
-      type: "theme",
-      identifier: `${binding.primary.key}.v${binding.primary.version}`
-    });
-  }
-  const fallbacks = [];
-  for (const fallback of binding.fallbacks ?? []) {
-    const spec = registry2.get(fallback.key, fallback.version);
-    if (!spec) {
-      themeMissing.push({
-        type: "theme",
-        identifier: `${fallback.key}.v${fallback.version}`
-      });
-      continue;
-    }
-    fallbacks.push(spec);
-  }
-  return { theme: theme ?? undefined, fallbacks, themeMissing };
-}
-function resolveTelemetryBinding(binding, registry2) {
-  const telemetryMissing = [];
-  if (!binding?.spec) {
-    return { telemetry: undefined, telemetryMissing };
-  }
-  if (!registry2) {
-    telemetryMissing.push({
-      type: "telemetry",
-      identifier: specPointerKey(binding.spec)
-    });
-    return { telemetry: undefined, telemetryMissing };
-  }
-  const telemetry = registry2.get(binding.spec.key, binding.spec.version);
-  if (!telemetry) {
-    telemetryMissing.push({
-      type: "telemetry",
-      identifier: specPointerKey(binding.spec)
-    });
-  }
-  return { telemetry: telemetry ?? undefined, telemetryMissing };
-}
-function resolveExperimentsSpecs(experiments, registry2, missing) {
-  const resolveList = (refs) => {
-    if (refs.length === 0)
-      return [];
-    if (!registry2) {
-      for (const ref of refs) {
-        missing.push({
-          type: "experiment",
-          identifier: experimentKey(ref)
-        });
-      }
-      return [];
-    }
-    const resolved = [];
-    for (const ref of refs) {
-      const spec = registry2.get(ref.key, ref.version);
-      if (!spec) {
-        missing.push({
-          type: "experiment",
-          identifier: experimentKey(ref)
-        });
-        continue;
-      }
-      resolved.push(spec);
-    }
-    return resolved;
-  };
-  return {
-    active: resolveList(experiments.active),
-    paused: resolveList(experiments.paused)
-  };
-}
-function capabilityKey2(ref) {
-  return `${ref.key}${ref.version ? `.v${ref.version}` : ""}`;
-}
-function featureKey(ref) {
-  return ref.key;
-}
-function specPointerKey(pointer) {
-  return `${pointer.key}${pointer.version ? `.v${pointer.version}` : ""}`;
-}
-function policyKey(ref) {
-  return `${ref.key}${ref.version ? `.v${ref.version}` : ""}`;
-}
-function experimentKey(ref) {
-  return `${ref.key}${ref.version ? `.v${ref.version}` : ""}`;
-}
-function dedupeRefs(refs, keyFn) {
-  const map = new Map;
-  for (const ref of refs) {
-    map.set(keyFn(ref), ref);
-  }
-  return [...map.values()];
-}
-function dedupeStrings(values) {
-  return [...new Set(values)];
-}
-
-// src/app-config/validation.ts
-class ValidationRuleRegistry {
-  blueprintRules = [];
-  tenantRules = [];
-  resolvedRules = [];
-  register(rule) {
-    if (rule.scope === "blueprint") {
-      this.blueprintRules.push(rule);
-    } else if (rule.scope === "tenant") {
-      this.tenantRules.push(rule);
-    } else {
-      this.resolvedRules.push(rule);
-    }
-    return this;
-  }
-  validateBlueprint(blueprint, context2) {
-    return dedupeIssues(this.blueprintRules.flatMap((rule) => rule.validate(blueprint, context2)));
-  }
-  validateTenant(blueprint, tenant, context2) {
-    return dedupeIssues(this.tenantRules.flatMap((rule) => rule.validate(blueprint, tenant, context2)));
-  }
-  validateResolved(blueprint, resolved, context2) {
-    return dedupeIssues(this.resolvedRules.flatMap((rule) => rule.validate(blueprint, resolved, context2)));
-  }
-}
-var DOMAIN_REGEX = /^(?!:\/\/)([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.[A-Za-z]{2,}$/;
-var HTTPS_URL_REGEX = /^https:\/\//i;
-var ALLOWED_ASSET_EXTENSIONS = {
-  logo: ["png", "svg", "webp"],
-  "logo-dark": ["png", "svg", "webp"],
-  favicon: ["ico", "png", "svg"],
-  "og-image": ["png", "jpg", "jpeg", "webp"]
-};
-var EMPTY_CONTEXT = {};
-var registryInstance;
-function getRegistry() {
-  if (!registryInstance) {
-    registryInstance = createDefaultRegistry();
-  }
-  return registryInstance;
-}
-function validateConfig(blueprint, tenant, context2 = EMPTY_CONTEXT) {
-  const registry2 = getRegistry();
-  const blueprintResult = buildResult(registry2.validateBlueprint(blueprint, context2));
-  const tenantResult = buildResult(registry2.validateTenant(blueprint, tenant, context2));
-  return mergeResults(blueprintResult, tenantResult);
-}
-function validateBlueprint(blueprint, context2 = EMPTY_CONTEXT) {
-  const issues = getRegistry().validateBlueprint(blueprint, context2);
-  return buildResult(issues);
-}
-function validateTenantConfig(blueprint, tenant, context2 = EMPTY_CONTEXT) {
-  const issues = getRegistry().validateTenant(blueprint, tenant, context2);
-  return buildResult(issues);
-}
-function validateResolvedConfig(blueprint, resolved, context2 = EMPTY_CONTEXT) {
-  const issues = getRegistry().validateResolved(blueprint, resolved, context2);
-  return buildResult(issues);
-}
-function buildResult(issues) {
-  const errors = issues.filter((issue) => issue.severity === "error");
-  const warnings = issues.filter((issue) => issue.severity === "warning");
-  const info = issues.filter((issue) => issue.severity === "info");
-  return {
-    valid: errors.length === 0,
-    errors,
-    warnings,
-    info
-  };
-}
-function mergeResults(...results) {
-  const errors = results.flatMap((result) => result.errors);
-  const warnings = results.flatMap((result) => result.warnings);
-  const info = results.flatMap((result) => result.info);
-  return {
-    valid: errors.length === 0,
-    errors,
-    warnings,
-    info
-  };
-}
-function createDefaultRegistry() {
-  return new ValidationRuleRegistry().register(blueprintIntegrationSlotRule).register(blueprintCapabilityRegistryRule).register(tenantCapabilityRule).register(tenantIntegrationBindingRule).register(tenantKnowledgeRule).register(tenantBrandingRule).register(tenantTranslationRule).register(resolvedIntegrationRule).register(resolvedTranslationRule);
-}
-var blueprintIntegrationSlotRule = {
-  scope: "blueprint",
-  name: "integration.duplicate-slots",
-  category: "integration",
-  validate(blueprint) {
-    const issues = [];
-    const seen = new Set;
-    for (const slot of blueprint.integrationSlots ?? []) {
-      if (seen.has(slot.slotId)) {
-        issues.push(issue({
-          code: "DUPLICATE_SLOT",
-          severity: "error",
-          path: `integrationSlots.${slot.slotId}`,
-          message: `Duplicate integration slot id "${slot.slotId}".`
-        }));
-      } else {
-        seen.add(slot.slotId);
-      }
-      if (slot.allowedModes && slot.allowedModes.length === 0) {
-        issues.push(issue({
-          code: "EMPTY_ALLOWED_MODES",
-          severity: "warning",
-          path: `integrationSlots.${slot.slotId}.allowedModes`,
-          message: "allowedModes is empty; the slot will accept any supported mode."
-        }));
-      }
-    }
-    if (blueprint.branding && !blueprint.branding.appNameKey.trim()) {
-      issues.push(issue({
-        code: "MISSING_APP_NAME_KEY",
-        severity: "warning",
-        path: "branding.appNameKey",
-        message: "branding.appNameKey should reference a translation catalog key."
-      }));
-    }
-    return issues;
-  }
-};
-var blueprintCapabilityRegistryRule = {
-  scope: "blueprint",
-  name: "capability.registry-check",
-  category: "capability",
-  validate(blueprint, context2) {
-    const issues = [];
-    const registry2 = context2.capabilities;
-    if (!registry2)
-      return issues;
-    const required = blueprint.capabilities?.enabled ?? [];
-    required.forEach((ref, index) => {
-      if (!registry2.get(ref.key, ref.version)) {
-        issues.push(issue({
-          code: "MISSING_CAPABILITY",
-          severity: "error",
-          path: `capabilities.enabled[${index}]`,
-          message: `Capability "${ref.key}@${ref.version}" is not registered.`
-        }));
-      }
-    });
-    return issues;
-  }
-};
-var tenantCapabilityRule = {
-  scope: "tenant",
-  name: "capability.required-enabled",
-  category: "capability",
-  validate(blueprint, tenant, context2) {
-    const issues = [];
-    const registry2 = context2.capabilities;
-    const requiredKeys = new Set((blueprint.capabilities?.enabled ?? []).map(capabilityRefKey));
-    const disabled = tenant.capabilities?.disable ?? [];
-    disabled.forEach((ref, index) => {
-      if (requiredKeys.has(capabilityRefKey(ref))) {
-        issues.push(issue({
-          code: "DISABLED_REQUIRED_CAPABILITY",
-          severity: "error",
-          path: `capabilities.disable[${index}]`,
-          message: `Capability "${ref.key}@${ref.version}" is required by the blueprint and cannot be disabled.`
-        }));
-      }
-    });
-    if (registry2) {
-      (tenant.capabilities?.enable ?? []).forEach((ref, index) => {
-        if (!registry2.get(ref.key, ref.version)) {
-          issues.push(issue({
-            code: "UNKNOWN_CAPABILITY_ENABLE",
-            severity: "error",
-            path: `capabilities.enable[${index}]`,
-            message: `Capability "${ref.key}@${ref.version}" is not registered.`
-          }));
-        }
-      });
-      disabled.forEach((ref, index) => {
-        if (!registry2.get(ref.key, ref.version)) {
-          issues.push(issue({
-            code: "UNKNOWN_CAPABILITY_DISABLE",
-            severity: "warning",
-            path: `capabilities.disable[${index}]`,
-            message: `Capability "${ref.key}@${ref.version}" is not registered.`
-          }));
-        }
-      });
-    }
-    return issues;
-  }
-};
-var tenantIntegrationBindingRule = {
-  scope: "tenant",
-  name: "integration.slot-binding",
-  category: "integration",
-  validate(blueprint, tenant, context2) {
-    const issues = [];
-    const slots = new Map((blueprint.integrationSlots ?? []).map((slot) => [slot.slotId, slot]));
-    const bindings = tenant.integrations ?? [];
-    const connections = context2.tenantConnections?.reduce((map, connection) => map.set(connection.meta.id, connection), new Map) ?? new Map;
-    const satisfiedSlots = new Set;
-    bindings.forEach((binding) => {
-      const path = `integrations.${binding.slotId}`;
-      const slot = slots.get(binding.slotId);
-      if (!slot) {
-        issues.push(issue({
-          code: "UNKNOWN_SLOT_BINDING",
-          severity: "error",
-          path,
-          message: `Integration slot "${binding.slotId}" is not defined in the blueprint.`
-        }));
-        return;
-      }
-      let slotValid = true;
-      const connection = connections.get(binding.connectionId);
-      if (!connection) {
-        issues.push(issue({
-          code: "MISSING_INTEGRATION_CONNECTION",
-          severity: "error",
-          path,
-          message: `Integration connection "${binding.connectionId}" was not found for tenant "${tenant.meta.tenantId}".`
-        }));
-        slotValid = false;
-        return;
-      }
-      if (connection.meta.tenantId !== tenant.meta.tenantId) {
-        issues.push(issue({
-          code: "FOREIGN_CONNECTION",
-          severity: "error",
-          path,
-          message: `Connection "${binding.connectionId}" belongs to tenant "${connection.meta.tenantId}", not "${tenant.meta.tenantId}".`
-        }));
-        slotValid = false;
-      }
-      if (slot.allowedModes && slot.allowedModes.length > 0) {
-        if (!slot.allowedModes.includes(connection.ownershipMode)) {
-          issues.push(issue({
-            code: "MODE_MISMATCH",
-            severity: "error",
-            path,
-            message: `Slot "${slot.slotId}" only allows modes [${slot.allowedModes.join(", ")}] but connection is "${connection.ownershipMode}".`
-          }));
-          slotValid = false;
-        }
-      }
-      if (connection.status === "disconnected" || connection.status === "error") {
-        issues.push(issue({
-          code: "CONNECTION_NOT_READY",
-          severity: "error",
-          path,
-          message: `Connection "${connection.meta.label}" is in status "${connection.status}".`
-        }));
-        slotValid = false;
-      } else if (connection.status === "unknown") {
-        issues.push(issue({
-          code: "CONNECTION_STATUS_UNKNOWN",
-          severity: "warning",
-          path,
-          message: `Connection "${connection.meta.label}" has unknown health status.`
-        }));
-      }
-      const spec = lookupIntegrationSpec(context2.integrationSpecs, connection);
-      if (!spec) {
-        issues.push(issue({
-          code: "INTEGRATION_SPEC_NOT_FOUND",
-          severity: "warning",
-          path,
-          message: `Integration spec "${connection.meta.integrationKey}@${connection.meta.integrationVersion}" is not registered.`
-        }));
-        slotValid = false;
-        return;
-      }
-      if (spec.meta.category !== slot.requiredCategory) {
-        issues.push(issue({
-          code: "CATEGORY_MISMATCH",
-          severity: "error",
-          path,
-          message: `Slot "${slot.slotId}" requires category "${slot.requiredCategory}" but connection provides "${spec.meta.category}".`
-        }));
-        slotValid = false;
-      }
-      if (!spec.supportedModes.includes(connection.ownershipMode)) {
-        issues.push(issue({
-          code: "UNSUPPORTED_OWNERSHIP_MODE",
-          severity: "error",
-          path,
-          message: `Integration spec "${spec.meta.key}" does not support ownership mode "${connection.ownershipMode}".`
-        }));
-        slotValid = false;
-      }
-      for (const required of slot.requiredCapabilities ?? []) {
-        if (!integrationProvidesCapability2(spec, required)) {
-          issues.push(issue({
-            code: "CAPABILITY_NOT_PROVIDED",
-            severity: "error",
-            path,
-            message: `Integration "${spec.meta.key}" does not provide required capability "${required.key}@${required.version}".`
-          }));
-          slotValid = false;
-        }
-      }
-      if (slotValid) {
-        satisfiedSlots.add(slot.slotId);
-      }
-    });
-    for (const slot of slots.values()) {
-      if (slot.required && !satisfiedSlots.has(slot.slotId)) {
-        issues.push(issue({
-          code: "MISSING_REQUIRED_SLOT",
-          severity: "error",
-          path: `integrations.${slot.slotId}`,
-          message: `Required integration slot "${slot.slotId}" is not bound.`
-        }));
-      }
-    }
-    return issues;
-  }
-};
-var tenantKnowledgeRule = {
-  scope: "tenant",
-  name: "knowledge.bindings",
-  category: "knowledge",
-  validate(_blueprint, tenant, context2) {
-    const issues = [];
-    const registry2 = context2.knowledgeSpaces;
-    if (!registry2)
-      return issues;
-    const sources = context2.knowledgeSources ?? [];
-    (tenant.knowledge ?? []).forEach((binding, index) => {
-      const path = `knowledge[${index}]`;
-      const space = registry2.get(binding.spaceKey, binding.spaceVersion);
-      if (!space) {
-        issues.push(issue({
-          code: "UNKNOWN_KNOWLEDGE_SPACE",
-          severity: "error",
-          path: `${path}.spaceKey`,
-          message: `Knowledge space "${binding.spaceKey}" is not registered.`
-        }));
-        return;
-      }
-      const hasSources = sources.some((source) => {
-        if (source.meta.spaceKey !== binding.spaceKey)
-          return false;
-        if (binding.spaceVersion != null) {
-          return source.meta.spaceVersion === binding.spaceVersion;
-        }
-        return true;
-      });
-      if (!hasSources) {
-        issues.push(issue({
-          code: "MISSING_KNOWLEDGE_SOURCES",
-          severity: "error",
-          path,
-          message: `Knowledge space "${binding.spaceKey}" has no configured sources for tenant "${tenant.meta.tenantId}".`
-        }));
-      }
-      if (space.meta.category === "external" || space.meta.category === "ephemeral") {
-        issues.push(issue({
-          code: "LOW_TRUST_KNOWLEDGE",
-          severity: "warning",
-          path,
-          message: `Knowledge space "${binding.spaceKey}" has category "${space.meta.category}". Avoid using it for irreversible or policy decisions.`
-        }));
-      }
-    });
-    return issues;
-  }
-};
-var tenantBrandingRule = {
-  scope: "tenant",
-  name: "branding.constraints",
-  category: "branding",
-  validate(_blueprint, tenant, context2) {
-    const issues = [];
-    const branding = tenant.branding;
-    if (!branding)
-      return issues;
-    const domain = branding.customDomain?.trim();
-    if (domain) {
-      if (!DOMAIN_REGEX.test(domain)) {
-        issues.push(issue({
-          code: "INVALID_DOMAIN",
-          severity: "error",
-          path: "branding.customDomain",
-          message: `Custom domain "${domain}" is not a valid hostname.`
-        }));
-      }
-      const conflict = (context2.existingConfigs ?? []).find((config) => {
-        if (config.meta.id === tenant.meta.id)
-          return false;
-        const otherDomain = config.branding?.customDomain?.trim();
-        if (!otherDomain)
-          return false;
-        return otherDomain.toLowerCase() === domain.toLowerCase();
-      });
-      if (conflict) {
-        issues.push(issue({
-          code: "DUPLICATE_DOMAIN",
-          severity: "error",
-          path: "branding.customDomain",
-          message: `Custom domain "${domain}" is already used by tenant "${conflict.meta.tenantId}".`
-        }));
-      }
-    }
-    (branding.assets ?? []).forEach((asset, index) => {
-      const assetPath = `branding.assets[${index}]`;
-      if (!HTTPS_URL_REGEX.test(asset.url)) {
-        issues.push(issue({
-          code: "INSECURE_ASSET_URL",
-          severity: "error",
-          path: `${assetPath}.url`,
-          message: `Branding asset "${asset.type}" must use an HTTPS URL.`
-        }));
-      }
-      const allowed = ALLOWED_ASSET_EXTENSIONS[asset.type] ?? ALLOWED_ASSET_EXTENSIONS.logo;
-      const extension = extractExtension(asset.url);
-      if (extension && allowed && !allowed.includes(extension)) {
-        issues.push(issue({
-          code: "UNEXPECTED_ASSET_TYPE",
-          severity: "warning",
-          path: `${assetPath}.url`,
-          message: `Asset "${asset.type}" should use one of: ${(allowed ?? []).join(", ")}. Detected "${extension}".`
-        }));
-      }
-    });
-    return issues;
-  }
-};
-var tenantTranslationRule = {
-  scope: "tenant",
-  name: "translation.consistency",
-  category: "translation",
-  validate(blueprint, tenant, context2) {
-    const issues = [];
-    const pointer = blueprint.translationCatalog;
-    const catalogs = normalizeCatalogs(context2.translationCatalogs);
-    const blueprintCatalog = pointer ? catalogs.blueprint.find((catalog) => catalog.meta.key === pointer.key && catalog.meta.version === pointer.version) : undefined;
-    if (pointer && !blueprintCatalog) {
-      issues.push(issue({
-        code: "MISSING_BLUEPRINT_CATALOG",
-        severity: "error",
-        path: "translationCatalog",
-        message: `Blueprint translation catalog "${pointer.key}@${pointer.version}" is not loaded in context.`
-      }));
-    }
-    const requiredKeys = new Set;
-    if (blueprint.branding?.appNameKey) {
-      requiredKeys.add(blueprint.branding.appNameKey);
-      if (blueprintCatalog && !hasTranslationEntry(blueprintCatalog.entries, blueprint.branding.appNameKey, blueprintCatalog.defaultLocale)) {
-        issues.push(issue({
-          code: "MISSING_TRANSLATION_KEY",
-          severity: "error",
-          path: "branding.appNameKey",
-          message: `Translation key "${blueprint.branding.appNameKey}" is missing for locale "${blueprintCatalog.defaultLocale}".`
-        }));
-      }
-    }
-    const tenantLocales = tenant.locales;
-    if (tenantLocales) {
-      const { defaultLocale, enabledLocales } = tenantLocales;
-      if (!enabledLocales.includes(defaultLocale)) {
-        issues.push(issue({
-          code: "LOCALE_NOT_ENABLED",
-          severity: "warning",
-          path: "locales.enabledLocales",
-          message: `enabledLocales does not include defaultLocale "${defaultLocale}".`
-        }));
-      }
-      if (blueprintCatalog) {
-        const supported = new Set(blueprintCatalog.supportedLocales);
-        for (const locale of [defaultLocale, ...enabledLocales]) {
-          if (!supported.has(locale)) {
-            issues.push(issue({
-              code: "UNSUPPORTED_LOCALE",
-              severity: "error",
-              path: "locales.enabledLocales",
-              message: `Locale "${locale}" is not supported by blueprint catalog "${blueprintCatalog.meta.key}".`
-            }));
-          }
-        }
-      }
-    }
-    const allowedKeys = new Set;
-    for (const catalog of catalogs.blueprint) {
-      for (const entry of catalog.entries) {
-        allowedKeys.add(entry.key);
-      }
-    }
-    for (const catalog of catalogs.platform) {
-      for (const entry of catalog.entries) {
-        allowedKeys.add(entry.key);
-      }
-    }
-    const overrides = tenant.translationOverrides?.entries ?? [];
-    overrides.forEach((entry, index) => {
-      const path = `translationOverrides.entries[${index}]`;
-      if (!allowedKeys.has(entry.key)) {
-        issues.push(issue({
-          code: "UNKNOWN_TRANSLATION_KEY",
-          severity: "error",
-          path,
-          message: `Override references unknown key "${entry.key}".`
-        }));
-      }
-      if (blueprintCatalog) {
-        const supportedLocales = new Set([
-          ...blueprintCatalog.supportedLocales,
-          ...tenant.locales?.enabledLocales ?? [],
-          tenant.locales?.defaultLocale ?? blueprintCatalog.defaultLocale
-        ]);
-        if (!supportedLocales.has(entry.locale)) {
-          issues.push(issue({
-            code: "UNSUPPORTED_LOCALE_OVERRIDE",
-            severity: "error",
-            path,
-            message: `Locale "${entry.locale}" is not enabled for tenant overrides.`
-          }));
-        }
-      }
-    });
-    return issues;
-  }
-};
-var resolvedIntegrationRule = {
-  scope: "resolved",
-  name: "integration.required-slots",
-  category: "integration",
-  validate(blueprint, resolved) {
-    const issues = [];
-    const requiredSlots = (blueprint.integrationSlots ?? []).filter((slot) => slot.required);
-    for (const slot of requiredSlots) {
-      const satisfied = resolved.integrations.some((integration) => integration.slot.slotId === slot.slotId);
-      if (!satisfied) {
-        issues.push(issue({
-          code: "MISSING_REQUIRED_SLOT",
-          severity: "error",
-          path: `integrations.${slot.slotId}`,
-          message: `Resolved config is missing integration slot "${slot.slotId}".`
-        }));
-      }
-    }
-    for (const integration of resolved.integrations) {
-      if (integration.connection.status === "disconnected" || integration.connection.status === "error") {
-        issues.push(issue({
-          code: "CONNECTION_NOT_READY",
-          severity: "error",
-          path: `integrations.${integration.slot.slotId}`,
-          message: `Resolved integration "${integration.slot.slotId}" uses a connection in status "${integration.connection.status}".`
-        }));
-      }
-    }
-    return issues;
-  }
-};
-var resolvedTranslationRule = {
-  scope: "resolved",
-  name: "translation.default-locale",
-  category: "translation",
-  validate(_blueprint, resolved) {
-    const issues = [];
-    const translation = resolved.translation;
-    if (translation && !translation.supportedLocales.includes(translation.defaultLocale)) {
-      issues.push(issue({
-        code: "DEFAULT_LOCALE_NOT_SUPPORTED",
-        severity: "warning",
-        path: "translation.defaultLocale",
-        message: "supportedLocales should include defaultLocale for consistent fallback behaviour."
-      }));
-    }
-    return issues;
-  }
-};
-function issue(input) {
-  return input;
-}
-function dedupeIssues(issues) {
-  const map = new Map;
-  for (const current of issues) {
-    const key = `${current.code}|${current.path}|${current.severity}`;
-    if (!map.has(key)) {
-      map.set(key, current);
-    }
-  }
-  return [...map.values()];
-}
-function capabilityRefKey(ref) {
-  return `${ref.key}@${ref.version}`;
-}
-function integrationProvidesCapability2(spec, required) {
-  return spec.capabilities.provides.some((provided) => provided.key === required.key && provided.version === required.version);
-}
-function lookupIntegrationSpec(registry2, connection) {
-  if (!registry2)
-    return;
-  return registry2.get(connection.meta.integrationKey, connection.meta.integrationVersion);
-}
-function extractExtension(url) {
-  const [raw] = url.split("?");
-  if (!raw)
-    return;
-  const lastDot = raw.lastIndexOf(".");
-  if (lastDot === -1)
-    return;
-  return raw.slice(lastDot + 1).toLowerCase();
-}
-function normalizeCatalogs(catalogs) {
-  if (!catalogs)
-    return { platform: [], blueprint: [] };
-  const platform = catalogs.platform ? Array.isArray(catalogs.platform) ? catalogs.platform : [catalogs.platform] : [];
-  const blueprint = catalogs.blueprint ? Array.isArray(catalogs.blueprint) ? catalogs.blueprint : [catalogs.blueprint] : [];
-  return { platform, blueprint };
-}
-function hasTranslationEntry(entries, key, locale) {
-  return entries.some((entry) => entry.key === key && entry.locale === locale);
-}
-// src/app-config/lifecycle-contracts.ts
-import { ScalarTypeEnum as ScalarTypeEnum3, SchemaModel as SchemaModel3 } from "@contractspec/lib.schema";
-var LifecyclePolicy = {
-  auth: "admin",
-  policies: [{ key: "platform.app-config.manage", version: "1.0.0" }]
-};
-var LifecycleReadPolicy = {
-  auth: "admin",
-  policies: [{ key: "platform.app-config.read", version: "1.0.0" }]
-};
-var ConfigVersionRecord = new SchemaModel3({
-  name: "ConfigVersionRecord",
-  fields: {
-    meta: { type: ScalarTypeEnum3.JSONObject(), isOptional: false },
-    config: { type: ScalarTypeEnum3.JSONObject(), isOptional: false }
-  }
-});
-var ConfigTransitionRecord = new SchemaModel3({
-  name: "ConfigTransitionRecord",
-  fields: {
-    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    fromStatus: {
-      type: ScalarTypeEnum3.String_unsecure(),
-      isOptional: false
-    },
-    toStatus: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    timestamp: { type: ScalarTypeEnum3.DateTime(), isOptional: false },
-    actor: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    reason: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true }
-  }
-});
-var CreateDraftInput = new SchemaModel3({
-  name: "CreateTenantConfigDraftInput",
-  fields: {
-    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    blueprintName: {
-      type: ScalarTypeEnum3.String_unsecure(),
-      isOptional: false
-    },
-    blueprintVersion: {
-      type: ScalarTypeEnum3.Int_unsecure(),
-      isOptional: false
-    },
-    environment: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
-    fromVersion: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
-    createdBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
-  }
-});
-var CreateDraftOutput = new SchemaModel3({
-  name: "CreateTenantConfigDraftOutput",
-  fields: {
-    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    createdAt: { type: ScalarTypeEnum3.DateTime(), isOptional: false }
-  }
-});
-var CreateTenantConfigDraftCommand = defineCommand({
-  meta: {
-    key: "appConfig.lifecycle.createDraft",
-    version: "1.0.0",
-    description: "Creates a new draft tenant config version.",
-    owners: [OwnersEnum.PlatformSigil],
-    tags: [TagsEnum.Hygiene, "app-config"],
-    stability: StabilityEnum.Experimental,
-    goal: "Allow operators to start editing a new tenant config version.",
-    context: "Invoked by the Studio or automation when starting a new configuration run."
-  },
-  io: {
-    input: CreateDraftInput,
-    output: CreateDraftOutput
-  },
-  policy: LifecyclePolicy,
-  sideEffects: {
-    emits: [
-      {
-        ref: ConfigDraftCreatedEvent.meta,
-        when: "after successful draft creation"
-      }
-    ]
-  }
-});
-var PromotePreviewInput = new SchemaModel3({
-  name: "PromoteTenantConfigPreviewInput",
-  fields: {
-    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    promotedBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
-  }
-});
-var PromotePreviewOutput = new SchemaModel3({
-  name: "PromoteTenantConfigPreviewOutput",
-  fields: {
-    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    warnings: {
-      type: ScalarTypeEnum3.String_unsecure(),
-      isOptional: true,
-      isArray: true
-    }
-  }
-});
-var PromoteTenantConfigToPreviewCommand = defineCommand({
-  meta: {
-    key: "appConfig.lifecycle.promoteToPreview",
-    version: "1.0.0",
-    description: "Promotes a draft tenant config to preview/testing state.",
-    owners: [OwnersEnum.PlatformSigil],
-    tags: [TagsEnum.Hygiene, "app-config"],
-    stability: StabilityEnum.Experimental,
-    goal: "Enable validation and testing of draft configurations.",
-    context: "Called when a draft passes initial checks and should be exposed to preview environments."
-  },
-  io: {
-    input: PromotePreviewInput,
-    output: PromotePreviewOutput
-  },
-  policy: LifecyclePolicy,
-  sideEffects: {
-    emits: [
-      {
-        ref: ConfigPromotedToPreviewEvent.meta,
-        when: "after promotion to preview"
-      }
-    ]
-  }
-});
-var PublishConfigInput = new SchemaModel3({
-  name: "PublishTenantConfigInput",
-  fields: {
-    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    environment: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
-    publishedBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    changeSummary: {
-      type: ScalarTypeEnum3.String_unsecure(),
-      isOptional: true
-    }
-  }
-});
-var PublishConfigOutput = new SchemaModel3({
-  name: "PublishTenantConfigOutput",
-  fields: {
-    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    previousVersion: {
-      type: ScalarTypeEnum3.String_unsecure(),
-      isOptional: true
-    },
-    publishedAt: { type: ScalarTypeEnum3.DateTime(), isOptional: false }
-  }
-});
-var PublishTenantConfigCommand = defineCommand({
-  meta: {
-    key: "appConfig.lifecycle.publish",
-    version: "1.0.0",
-    description: "Publishes a preview tenant config to production.",
-    owners: [OwnersEnum.PlatformSigil],
-    tags: [TagsEnum.Hygiene, "app-config"],
-    stability: StabilityEnum.Experimental,
-    goal: "Promote tested configurations to production safely.",
-    context: "Triggered after validation passes and change management approvals are complete."
-  },
-  io: {
-    input: PublishConfigInput,
-    output: PublishConfigOutput
-  },
-  policy: LifecyclePolicy,
-  sideEffects: {
-    emits: [
-      {
-        ref: ConfigPublishedEvent.meta,
-        when: "after publish succeeds"
-      }
-    ]
-  }
-});
-var RollbackConfigInput = new SchemaModel3({
-  name: "RollbackTenantConfigInput",
-  fields: {
-    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    toVersion: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    environment: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
-    rolledBackBy: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    reason: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
-  }
-});
-var RollbackConfigOutput = new SchemaModel3({
-  name: "RollbackTenantConfigOutput",
-  fields: {
-    newVersion: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    status: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false },
-    rolledBackFrom: { type: ScalarTypeEnum3.Int_unsecure(), isOptional: false }
-  }
-});
-var RollbackTenantConfigCommand = defineCommand({
-  meta: {
-    key: "appConfig.lifecycle.rollback",
-    version: "1.0.0",
-    description: "Rolls back to a previously published tenant config version.",
-    owners: [OwnersEnum.PlatformSigil],
-    tags: [TagsEnum.Hygiene, "app-config"],
-    stability: StabilityEnum.Experimental,
-    goal: "Provide rapid recovery when new configs regress production.",
-    context: "Called manually or automatically when monitoring detects regression and a rollback is required."
-  },
-  io: {
-    input: RollbackConfigInput,
-    output: RollbackConfigOutput
-  },
-  policy: LifecyclePolicy,
-  sideEffects: {
-    emits: [
-      {
-        ref: ConfigRolledBackEvent.meta,
-        when: "after rollback completes"
-      }
-    ]
-  }
-});
-var ListVersionsInput = new SchemaModel3({
-  name: "ListTenantConfigVersionsInput",
-  fields: {
-    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    appId: { type: ScalarTypeEnum3.ID(), isOptional: false }
-  }
-});
-var ListVersionsOutput = new SchemaModel3({
-  name: "ListTenantConfigVersionsOutput",
-  fields: {
-    versions: { type: ConfigVersionRecord, isOptional: false, isArray: true },
-    transitions: {
-      type: ConfigTransitionRecord,
-      isOptional: true,
-      isArray: true
-    }
-  }
-});
-var ListTenantConfigVersionsQuery = defineQuery({
-  meta: {
-    key: "appConfig.lifecycle.listVersions",
-    version: "1.0.0",
-    description: "Lists all versions of a tenant configuration.",
-    owners: [OwnersEnum.PlatformSigil],
-    tags: ["app-config", TagsEnum.Hygiene],
-    stability: StabilityEnum.Experimental,
-    goal: "Support lifecycle views and change audit tooling.",
-    context: "Used by the Studio to render history timelines and by automation for change tracking."
-  },
-  io: {
-    input: ListVersionsInput,
-    output: ListVersionsOutput
-  },
-  policy: LifecycleReadPolicy
-});
-var GetVersionInput = new SchemaModel3({
-  name: "GetTenantConfigVersionInput",
-  fields: {
-    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    appId: { type: ScalarTypeEnum3.ID(), isOptional: false },
-    version: { type: ScalarTypeEnum3.String_unsecure(), isOptional: false }
-  }
-});
-var GetVersionOutput = new SchemaModel3({
-  name: "GetTenantConfigVersionOutput",
-  fields: {
-    version: { type: ConfigVersionRecord, isOptional: false }
-  }
-});
-var GetTenantConfigVersionQuery = defineQuery({
-  meta: {
-    key: "appConfig.lifecycle.getVersion",
-    version: "1.0.0",
-    description: "Fetches a single tenant config version by id.",
-    owners: [OwnersEnum.PlatformSigil],
-    tags: ["app-config", TagsEnum.Hygiene],
-    stability: StabilityEnum.Experimental,
-    goal: "Allow detail drill-down for lifecycle entries.",
-    context: "Used by automation to fetch config payloads for comparison or export."
-  },
-  io: {
-    input: GetVersionInput,
-    output: GetVersionOutput
-  },
-  policy: LifecycleReadPolicy
-});
-var lifecycleContracts = {
-  CreateTenantConfigDraftCommand,
-  PromoteTenantConfigToPreviewCommand,
-  PublishTenantConfigCommand,
-  RollbackTenantConfigCommand,
-  ListTenantConfigVersionsQuery,
-  GetTenantConfigVersionQuery
-};
-function registerAppConfigLifecycleContracts(registry2) {
-  return registry2.register(CreateTenantConfigDraftCommand).register(PromoteTenantConfigToPreviewCommand).register(PublishTenantConfigCommand).register(RollbackTenantConfigCommand).register(ListTenantConfigVersionsQuery).register(GetTenantConfigVersionQuery);
-}
-export {
-  validateTenantConfig,
-  validateResolvedConfig,
-  validateConfig,
-  validateBlueprint,
-  resolveAppConfig,
-  registerAppConfigLifecycleContracts,
-  makeAppBlueprintKey,
-  lifecycleContracts,
-  defineAppConfig,
-  composeAppConfig,
-  RollbackTenantConfigCommand,
-  PublishTenantConfigCommand,
-  PromoteTenantConfigToPreviewCommand,
-  ListTenantConfigVersionsQuery,
-  GetTenantConfigVersionQuery,
-  CreateTenantConfigDraftCommand,
-  ConfigRolledBackEvent,
-  ConfigPublishedEvent,
-  ConfigPromotedToPreviewEvent,
-  ConfigDraftCreatedEvent,
-  AppConfigFeature,
-  AppConfigCapability,
-  AppBlueprintRegistry
-};