@happyvertical/smrt-ingestion 0.55.8 → 0.55.10

package/dist/recipes.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Declared ingestion workflows for applications that provide an authenticated
+ * intake-review host (#3725).
+ *
+ * These recipes describe the user-facing inbox and review work. They do not
+ * expose the ingestion records as generic CRUD models: all reads and writes
+ * continue through the host's scoped service callbacks.
+ */
+import { SmrtRecipe } from '@happyvertical/smrt-core';
+import { IntakeAction, IntakeAnalysis, IntakeEvidence, IntakeItem, IntakeReviewDecision } from './models.js';
+/** Incoming material that needs authenticated human attention. */
+export declare class IngestionInboxRecipe extends SmrtRecipe {
+    static id: string;
+    static help: string;
+    static label: string;
+    static summary: string;
+    static synonyms: string[];
+    static group: {
+        id: string;
+        label: string;
+        summary: string;
+    };
+    static section: {
+        id: string;
+        label: string;
+        icon: string;
+        description: string;
+    };
+    static models: (typeof IntakeItem | typeof IntakeEvidence)[];
+    static runtime: "both";
+    static surfaces: readonly [{
+        readonly kind: "route";
+        readonly path: "/ingestion/inbox";
+        readonly export: "@happyvertical/smrt-ingestion/svelte#IntakeInbox";
+        readonly label: "Ingestion inbox";
+    }];
+    static nav: {
+        label: string;
+        model: typeof IntakeItem;
+        icon: string;
+        description: string;
+        key: string;
+        noun: string;
+    }[];
+}
+/** Revision-bound human review of proposed actions. */
+export declare class IngestionReviewRecipe extends SmrtRecipe {
+    static id: string;
+    static help: string;
+    static label: string;
+    static summary: string;
+    static synonyms: string[];
+    static group: {
+        id: string;
+        label: string;
+        summary: string;
+    };
+    static section: {
+        id: string;
+        label: string;
+        icon: string;
+        description: string;
+    };
+    static models: (typeof IntakeItem | typeof IntakeEvidence | typeof IntakeAnalysis | typeof IntakeAction | typeof IntakeReviewDecision)[];
+    static runtime: "both";
+    static surfaces: readonly [{
+        readonly kind: "route";
+        readonly path: "/ingestion/review";
+        readonly export: "@happyvertical/smrt-ingestion/svelte#IntakeReview";
+        readonly label: "Ingestion review";
+    }];
+    static nav: {
+        label: string;
+        model: typeof IntakeReviewDecision;
+        icon: string;
+        description: string;
+        key: string;
+        noun: string;
+    }[];
+}
+//# sourceMappingURL=recipes.d.ts.map

package/dist/recipes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipes.d.ts","sourceRoot":"","sources":["../src/recipes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,UAAU,EACV,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAErB,kEAAkE;AAClE,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,MAAM,CAAC,EAAE,SAAqB;IAC9B,MAAM,CAAC,IAAI,SAAiC;IAC5C,MAAM,CAAC,KAAK,SAAqB;IACjC,MAAM,CAAC,OAAO,SACmD;IACjE,MAAM,CAAC,QAAQ,WAA0D;IACzE,MAAM,CAAC,KAAK;;;;MAIV;IACF,MAAM,CAAC,OAAO;;;;;MAKZ;IACF,MAAM,CAAC,MAAM,gDAAgC;IAG7C,MAAM,CAAC,OAAO,EAAG,MAAM,CAAU;IACjC,MAAM,CAAC,QAAQ;;;;;OAOJ;IACX,MAAM,CAAC,GAAG;;;;;;;QASR;CACH;AAED,uDAAuD;AACvD,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,MAAM,CAAC,EAAE,SAAsB;IAC/B,MAAM,CAAC,IAAI,SAAkC;IAC7C,MAAM,CAAC,KAAK,SAAsB;IAClC,MAAM,CAAC,OAAO,SAC+D;IAC7E,MAAM,CAAC,QAAQ,WAA0D;IACzE,MAAM,CAAC,KAAK;;;;MAIV;IACF,MAAM,CAAC,OAAO;;;;;MAKZ;IACF,MAAM,CAAC,MAAM,4HAMX;IAGF,MAAM,CAAC,OAAO,EAAG,MAAM,CAAU;IACjC,MAAM,CAAC,QAAQ;;;;;OAOJ;IACX,MAAM,CAAC,GAAG;;;;;;;QASR;CACH"}

package/dist/smrt-knowledge.json

@@ -3,15 +3,15 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-ingestion",
-  "packageVersion": "0.55.8",
+  "packageVersion": "0.55.10",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "c1c496cd1c89cd95614c46e10a7291611ee804745322f42c1daf85089d211a6f",
-    "packageJson": "449a59551333b1e68201ebcb171f1e72bf2930bf6f838aa545c18c9fc7a89895",
+    "manifest": "6550d2dc16e37807c12e70984fdf582ad227bf53f2ac3400d9d7ef94e3b3228a",
+    "packageJson": "be11c4832929ade172a54ad0a3b522a2296083219417d252b05da153222e511a",
     "agents": "dea14442054ec1de798cba9be1fbdd955f44b0e4672639cbf3db8101d290c1fb",
     "moduleDoc:agents/execution.md": "6153206adeea46fee1be57ccc01d171621ffb3dc3a754b3634bfe2ce367e8416",
-    "moduleDoc:README.md": "c95d019573db738fa250b41e9e80527dee376fb9ff17efd6714e4debd4038c68",
+    "moduleDoc:README.md": "810edf32fc35d12a6d1d4d8c506dca2c803f1db4bffd44201cb83993a1f06b25",
     "moduleDoc:EXTRACTION.md": "b735a25a7be75f3a13f3f9e92b0c25834c1394835c16ccd73a076d5720c14243",
     "moduleDoc:PROPOSALS.md": "3accad9430e917e65319b7b7708d5c1df277eea7eaa0490df913cf361e80b7bc",
     "moduleDoc:FEEDBACK.md": "795337ba256b486ecf0e836c4ad090d12f60c8c31dfb7c83155a8689da3d4dc5",
@@ -1604,7 +1604,7 @@
     {
       "path": "README.md",
       "module": "README",
-      "content": "# @happyvertical/smrt-ingestion\n\nDurable receipt, evidence, analysis attempts and action-journal foundations for\n[ADR 0004](../../docs/adr/0004-application-aware-ingestion.md).\n\nThe root, `/models` and `/dto` entry points are browser-safe. Import\n`IngestionService` from `/server` in trusted host code. Generated REST, CLI and\nMCP access to the persistence models is disabled; hosts expose authorized DTO\nmethods through their authenticated application transport.\n\nBefore starting a service, deploy the package manifest through the public s-m-r-t\nmigration APIs or `smrt db:migrate`. `assertReady()` only checks existing tables.\nSQLite and PostgreSQL are supported; other engines fail construction.\n\nA host supplies a database, AssetRuntime, authenticated tenant/actor/confidential\nscope, a live authorization callback, a registered jobs target, and an idempotent\n`purgeDerived` callback for host-owned previews, retrieval indexes and caches.\nThe authorization callback receives the captured ceiling and the current\ntransaction executor; it must intersect current grants with that ceiling. Never\nconstruct the scope, retention policy or budgets from incoming document labels.\n\n`receive` accepts bounded original byte buffers, with stable source part IDs,\nparent relationships and optional upstream identity/version. Source adapters own\nstreaming and upstream snapshot retrieval. Receipt identity is tenant + source +\ndelivery key; changing bytes or authenticated scope conflicts. Content equality\nin a different conversation does not deduplicate an arrival. The returned item\nID and version are safe acknowledgment data, never a storage URL.\n\nStorage intents contain a stable asset ID and a public AssetStore-planned URI\nbefore byte I/O. Preservation verifies existing bytes instead of replacing them.\nA receipt becomes ready only after every part is durable and its dispatch intent\ncommits. A source retries the same receive call after failure or lost\nacknowledgment. Hosts schedule `repairDispatches` after restart and periodically;\nit repairs missing/failed queue submissions through SmrtJobCollection. The host\njob restores the captured scope and calls the analysis lifecycle methods. Run\nTaskRunner with the `ingestion` queue enabled.\n\n`analyze` appends immutable input/configuration revisions. `claimAnalysis` uses\nleases, monotonic fences and attempt budgets; `completeAnalysis` rejects expired\nor superseded workers. Terminal attempt output/provenance is preserved. Queue\nsubmission budgets also stop repeated handler failures in visible\n`needs_attention`. Reprocessing does not mint actions. `createAction`,\n`publishProposal` and `appendPlan` persist explicit intentions and exact attempt\nbindings for the later review/execution layer. They do not approve or apply\nbusiness operations. Decision/execution/feedback models are persistence\nfoundations; policy, handler expansion, review and business apply belong to the\nlater epic children.\n\n`expire` revokes access and pending work before removing bytes and calling\n`purgeDerived`. Interrupted deletion is retried by `repairDeletions` and\n`sweepRetention`. Minimal receipt/action identities remain, including successful\naction result digests; all content-bearing journal payloads are redacted. Private\ncleanup locators remain in deletion tombstones so repeated sweeps can remove a\nlate stale writer's orphan bytes even after the asset owner row is gone. Source\nadapters must enforce their configured delivery-age cutoff; expired replay IDs\nnever become fresh work. Continue running the cleanup sweep for the retained\nstorage namespace. Upstream source mutation/deletion cannot change copied\noriginals; explicit privacy deletion revokes every ingestion-derived payload and\nrequires host cache/index purge.\n\nSee [EXTRACTION.md](EXTRACTION.md) for bounded extraction, lease-bound input\nsnapshots, provider isolation requirements and the extraction corpus.\n\nValidation commands are `pnpm test`, `pnpm test:postgres`, `pnpm test:providers`, `pnpm typecheck` and\n`pnpm build` (including built browser import inspection). The PostgreSQL lane\nrequires the repository's configured database service and never silently skips.\nThe provider lane exercises local SDK adapters and process isolation; it does not\nclaim live remote recognition quality. `pnpm test:components` and `pnpm test:e2e`\ncover the maintained review surface. `pnpm test:evaluation` checks repository\nevaluation tooling contracts; measured held-out quality requires a separately\nfrozen protocol and an approved aggregate provider budget. See the [behavior matrix](../../docs/test-matrix/3670-ingestion-foundation.md).\n\n## Authoritative review and execution\n\nConfigure `IngestionOptions.execution` for policy, immutable previews, authenticated\ndecisions and idempotent domain execution. See [execution integration](agents/execution.md)\nfor the public handler catalog, required host authorization/target locks, deployment\nmigrations and jobs continuation integration. The maintained application reference\nin `reference/handlers.ts` creates draft ContentDocuments and attaches retained\nevidence through public domain APIs; it is not a published runtime adapter.\n\n## Configured source adapters\n\nThe server entry exports `createSourceDeliveryHandler`, `EmailSourceAdapter`,\n`WatchFolderSourceAdapter`, and `createVendorWebhookHandler`. Construct a\n`SourceBinding` from authenticated host configuration: enabled flag, scoped\n`IngestionService`, stable source ID/version, captured authority ceiling,\nretention policy, allowed media types and receipt limits. Re-resolve this binding\nwhen grants/configuration change. Source payloads never supply authority.\n\nThe reference POST handler authenticates before reading bytes and requires\n`Idempotency-Key`. JSON accepts exactly `capturedAt` and one of `text`,\n`structured`, or `reference: { owner: 'asset'|'message', id, version }`.\nThe host's `snapshotReference` must authorize current ownership and return copied\nbytes; an absent snapshot fails rather than acknowledging a mutable locator.\nMultipart accepts one `file` plus `captureId` (equal to the idempotency key),\n`capturedAt`, `captureSource` (`camera`, `native_picker`, `audio`, `document`), and optional\nlowercase SHA-256 `sha256`. This reuses mobile's durable UUID Idempotency-Key,\nMIME-bearing file part and explicit capture metadata convention. Captures retain\noriginal bytes and a parent metadata evidence record. Configure both the wire\nlimit `maxRequestBytes` and receipt `maxBytes`/`maxParts`; include\n`application/json` in the media allowlist for capture/email metadata. Signature\nchecks cover PDF, TIFF, PNG/JPEG/WebP and WAV/Ogg/WebM/MP3/MP4 audio; signature\nacceptance promises preservation, not extraction support or codec validity.\n\nEmail is explicitly opt-in per configured account. `EmailSourceAdapter` takes a\n`readMessage` callback compatible with the messages owner's\n`EmailAccount.readIntakeMessage(providerLookup, maxBytes, imapIdentity?)` snapshot.\nThe provider lookup is Gmail message ID, POP3 UIDL, or IMAP RFC Message-ID; it\nis separate from the delivery dedupe key. IMAP requires `{ folder, uidValidity,\nuid }`: the method selects the mailbox and verifies UIDVALIDITY and returned UID.\nAmbiguous sender IDs resolving to another UID fail explicitly. That method connects,\nfetches the full message including actual attachment bytes, copies the bytes,\nand disconnects. Metadata-only attachments fail explicitly. It never reads an\nattachment path supplied by a provider. A host lists provider deliveries using a\nstable account-specific locator (for IMAP include folder, UIDVALIDITY and UID),\nan explicit revision, and an opaque resumable checkpoint. Same locator/revision\nwith changed bytes conflicts; an explicit new revision creates a new receipt.\nDo not use sender-controlled RFC Message-ID as the sole transport identity.\n`receiveBatch` processes in order and stops at the first failure. The host owns\ndurable checkpoint storage and commits its `acknowledge` callback only after the\nadapter has received accepted/duplicate. If checkpoint persistence fails, retry\nreturns the original receipt. Message/thread/attachment relationships are copied;\ncredentials and arbitrary headers are excluded. The ordinary `syncFrom` metadata\nsync remains separate; `hasAttachments` is never proof of byte preservation.\n\nWatch-folder intake polls only an explicitly configured existing private local\ndirectory. Producers should close their files, preferably publishing with atomic\nrename. Two unchanged size/inode/mtime/ctime observations separated by\n`stabilityMs` are required, and the interval runs again after claim/restart.\nA private `.ingestion-claims/<UUID>/claim.json` intent is synced before atomically\nrenaming the original into that directory. Keep the directory on one filesystem,\nunder the host's ownership; symlink inputs are refused. A file descriptor still\nheld by an uncooperative producer can write after any stability window, so the\nproducer close/publish protocol is required for immutable input. Accepted or\nduplicate receipts move the entire claim to `.ingestion-processed`; do not delete\nclaims to retry. Polling recovers persisted UUIDs after process death, so receipt\nreplay deduplicates ready-without-ack. `failure.json` and poll results expose safe\ncategories while originals remain available. Intent directories without an\noriginal mean death before claim or a competing poll won; the producer original\nhas not been removed. Operators may remove these empty intents after confirming\nno active importer. Keep processed originals according to the host's retention\npolicy. This adapter does not watch arbitrary paths or start background loops.\n\nVendor webhooks use a host `verify(request, originalBytes)` callback after bounded\nraw-body reading. The callback must verify signature, delivery time/replay window\nand account ownership, then return trusted binding and durable delivery identity.\nNo vendor implementation or hardware driver is selected. All adapters invoke\nonly receipt preservation, never domain writes, AI tools or external actions.\n\nSee [PROPOSALS.md](PROPOSALS.md) for bounded application catalog discovery, durable\ninterpretation revisions, optional typed decisions and explicit generated preview.\n\n## Human review\n\nMount the `/svelte` inbox and review components through an authenticated host using\nthe browser-safe `IntakeReviewHost` DTO contract. See [REVIEW.md](REVIEW.md) for\nexact revision-bound callbacks, live evidence access, logical split corrections,\nassignment ownership, and the maintained upload-to-domain-result browser fixture.\n\nOptional explicit feedback and scoped example retrieval are documented in\n[FEEDBACK.md](FEEDBACK.md). Approval and execution outcomes remain separate from\ninterpretation correctness; routing policy adoption is explicit and versioned.\n"
+      "content": "# @happyvertical/smrt-ingestion\n\nDurable receipt, evidence, analysis attempts and action-journal foundations for\n[ADR 0004](../../docs/adr/0004-application-aware-ingestion.md).\n\nThe root, `/models` and `/dto` entry points are browser-safe. Import\n`IngestionService` from `/server` in trusted host code. Generated REST, CLI and\nMCP access to the persistence models is disabled; hosts expose authorized DTO\nmethods through their authenticated application transport.\n\nBefore starting a service, deploy the package manifest through the public s-m-r-t\nmigration APIs or `smrt db:migrate`. `assertReady()` only checks existing tables.\nSQLite and PostgreSQL are supported; other engines fail construction.\n\nA host supplies a database, AssetRuntime, authenticated tenant/actor/confidential\nscope, a live authorization callback, a registered jobs target, and an idempotent\n`purgeDerived` callback for host-owned previews, retrieval indexes and caches.\nThe authorization callback receives the captured ceiling and the current\ntransaction executor; it must intersect current grants with that ceiling. Never\nconstruct the scope, retention policy or budgets from incoming document labels.\n\n`receive` accepts bounded original byte buffers, with stable source part IDs,\nparent relationships and optional upstream identity/version. Source adapters own\nstreaming and upstream snapshot retrieval. Receipt identity is tenant + source +\ndelivery key; changing bytes or authenticated scope conflicts. Content equality\nin a different conversation does not deduplicate an arrival. The returned item\nID and version are safe acknowledgment data, never a storage URL.\n\nStorage intents contain a stable asset ID and a public AssetStore-planned URI\nbefore byte I/O. Preservation verifies existing bytes instead of replacing them.\nA receipt becomes ready only after every part is durable and its dispatch intent\ncommits. A source retries the same receive call after failure or lost\nacknowledgment. Hosts schedule `repairDispatches` after restart and periodically;\nit repairs missing/failed queue submissions through SmrtJobCollection. The host\njob restores the captured scope and calls the analysis lifecycle methods. Run\nTaskRunner with the `ingestion` queue enabled.\n\n`analyze` appends immutable input/configuration revisions. `claimAnalysis` uses\nleases, monotonic fences and attempt budgets; `completeAnalysis` rejects expired\nor superseded workers. Terminal attempt output/provenance is preserved. Queue\nsubmission budgets also stop repeated handler failures in visible\n`needs_attention`. Reprocessing does not mint actions. `createAction`,\n`publishProposal` and `appendPlan` persist explicit intentions and exact attempt\nbindings for the later review/execution layer. They do not approve or apply\nbusiness operations. Decision/execution/feedback models are persistence\nfoundations; policy, handler expansion, review and business apply belong to the\nlater epic children.\n\n`expire` revokes access and pending work before removing bytes and calling\n`purgeDerived`. Interrupted deletion is retried by `repairDeletions` and\n`sweepRetention`. Minimal receipt/action identities remain, including successful\naction result digests; all content-bearing journal payloads are redacted. Private\ncleanup locators remain in deletion tombstones so repeated sweeps can remove a\nlate stale writer's orphan bytes even after the asset owner row is gone. Source\nadapters must enforce their configured delivery-age cutoff; expired replay IDs\nnever become fresh work. Continue running the cleanup sweep for the retained\nstorage namespace. Upstream source mutation/deletion cannot change copied\noriginals; explicit privacy deletion revokes every ingestion-derived payload and\nrequires host cache/index purge.\n\nSee [EXTRACTION.md](EXTRACTION.md) for bounded extraction, lease-bound input\nsnapshots, provider isolation requirements and the extraction corpus.\n\nValidation commands are `pnpm test`, `pnpm test:postgres`, `pnpm test:providers`, `pnpm typecheck` and\n`pnpm build` (including built browser import inspection). The PostgreSQL lane\nrequires the repository's configured database service and never silently skips.\nThe provider lane exercises local SDK adapters and process isolation; it does not\nclaim live remote recognition quality. `pnpm test:components` and `pnpm test:e2e`\ncover the maintained review surface. `pnpm test:evaluation` checks repository\nevaluation tooling contracts; measured held-out quality requires a separately\nfrozen protocol and an approved aggregate provider budget. See the [behavior matrix](../../docs/test-matrix/3670-ingestion-foundation.md).\n\n## Authoritative review and execution\n\nConfigure `IngestionOptions.execution` for policy, immutable previews, authenticated\ndecisions and idempotent domain execution. See [execution integration](agents/execution.md)\nfor the public handler catalog, required host authorization/target locks, deployment\nmigrations and jobs continuation integration. The maintained application reference\nin `reference/handlers.ts` creates draft ContentDocuments and attaches retained\nevidence through public domain APIs; it is not a published runtime adapter.\n\n## Configured source adapters\n\nThe server entry exports `createSourceDeliveryHandler`, `EmailSourceAdapter`,\n`WatchFolderSourceAdapter`, and `createVendorWebhookHandler`. Construct a\n`SourceBinding` from authenticated host configuration: enabled flag, scoped\n`IngestionService`, stable source ID/version, captured authority ceiling,\nretention policy, allowed media types and receipt limits. Re-resolve this binding\nwhen grants/configuration change. Source payloads never supply authority.\n\nThe reference POST handler authenticates before reading bytes and requires\n`Idempotency-Key`. JSON accepts exactly `capturedAt` and one of `text`,\n`structured`, or `reference: { owner: 'asset'|'message', id, version }`.\nThe host's `snapshotReference` must authorize current ownership and return copied\nbytes; an absent snapshot fails rather than acknowledging a mutable locator.\nMultipart accepts one `file` plus `captureId` (equal to the idempotency key),\n`capturedAt`, `captureSource` (`camera`, `native_picker`, `audio`, `document`), and optional\nlowercase SHA-256 `sha256`. This reuses mobile's durable UUID Idempotency-Key,\nMIME-bearing file part and explicit capture metadata convention. Captures retain\noriginal bytes and a parent metadata evidence record. Configure both the wire\nlimit `maxRequestBytes` and receipt `maxBytes`/`maxParts`; include\n`application/json` in the media allowlist for capture/email metadata. Signature\nchecks cover PDF, TIFF, PNG/JPEG/WebP and WAV/Ogg/WebM/MP3/MP4 audio; signature\nacceptance promises preservation, not extraction support or codec validity.\n\nEmail is explicitly opt-in per configured account. `EmailSourceAdapter` takes a\n`readMessage` callback compatible with the messages owner's\n`EmailAccount.readIntakeMessage(providerLookup, maxBytes, imapIdentity?)` snapshot.\nThe provider lookup is Gmail message ID, POP3 UIDL, or IMAP RFC Message-ID; it\nis separate from the delivery dedupe key. IMAP requires `{ folder, uidValidity,\nuid }`: the method selects the mailbox and verifies UIDVALIDITY and returned UID.\nAmbiguous sender IDs resolving to another UID fail explicitly. That method connects,\nfetches the full message including actual attachment bytes, copies the bytes,\nand disconnects. Metadata-only attachments fail explicitly. It never reads an\nattachment path supplied by a provider. A host lists provider deliveries using a\nstable account-specific locator (for IMAP include folder, UIDVALIDITY and UID),\nan explicit revision, and an opaque resumable checkpoint. Same locator/revision\nwith changed bytes conflicts; an explicit new revision creates a new receipt.\nDo not use sender-controlled RFC Message-ID as the sole transport identity.\n`receiveBatch` processes in order and stops at the first failure. The host owns\ndurable checkpoint storage and commits its `acknowledge` callback only after the\nadapter has received accepted/duplicate. If checkpoint persistence fails, retry\nreturns the original receipt. Message/thread/attachment relationships are copied;\ncredentials and arbitrary headers are excluded. The ordinary `syncFrom` metadata\nsync remains separate; `hasAttachments` is never proof of byte preservation.\n\nWatch-folder intake polls only an explicitly configured existing private local\ndirectory. Producers should close their files, preferably publishing with atomic\nrename. Two unchanged size/inode/mtime/ctime observations separated by\n`stabilityMs` are required, and the interval runs again after claim/restart.\nA private `.ingestion-claims/<UUID>/claim.json` intent is synced before atomically\nrenaming the original into that directory. Keep the directory on one filesystem,\nunder the host's ownership; symlink inputs are refused. A file descriptor still\nheld by an uncooperative producer can write after any stability window, so the\nproducer close/publish protocol is required for immutable input. Accepted or\nduplicate receipts move the entire claim to `.ingestion-processed`; do not delete\nclaims to retry. Polling recovers persisted UUIDs after process death, so receipt\nreplay deduplicates ready-without-ack. `failure.json` and poll results expose safe\ncategories while originals remain available. Intent directories without an\noriginal mean death before claim or a competing poll won; the producer original\nhas not been removed. Operators may remove these empty intents after confirming\nno active importer. Keep processed originals according to the host's retention\npolicy. This adapter does not watch arbitrary paths or start background loops.\n\nVendor webhooks use a host `verify(request, originalBytes)` callback after bounded\nraw-body reading. The callback must verify signature, delivery time/replay window\nand account ownership, then return trusted binding and durable delivery identity.\nNo vendor implementation or hardware driver is selected. All adapters invoke\nonly receipt preservation, never domain writes, AI tools or external actions.\n\nSee [PROPOSALS.md](PROPOSALS.md) for bounded application catalog discovery, durable\ninterpretation revisions, optional typed decisions and explicit generated preview.\n\n## Human review\n\nMount the `/svelte` inbox and review components through an authenticated host using\nthe browser-safe `IntakeReviewHost` DTO contract. See [REVIEW.md](REVIEW.md) for\nexact revision-bound callbacks, live evidence access, logical split corrections,\nassignment ownership, and the maintained upload-to-domain-result browser fixture.\n\nOptional explicit feedback and scoped example retrieval are documented in\n[FEEDBACK.md](FEEDBACK.md). Approval and execution outcomes remain separate from\ninterpretation correctness; routing policy adoption is explicit and versioned.\n\n## Recipe preview\n\n`ingestion.inbox` and `ingestion.review` declare the user-facing inbox and\nreview workflows for app discovery. The reference workflow and measured\nevaluation are now published, but the evaluation did not meet supported-reference\nquality gates and did not establish safety. Automation remains disabled. The\nrecipes do not configure a source or provider, expose generic CRUD routes, or\nenable automatic execution. Mount `IntakeInbox` and `IntakeReview` with an\nauthenticated `IntakeReviewHost`; [REVIEW.md](REVIEW.md) remains the source of\ntruth for its scoped callbacks and freshness checks. See the [adoption\nchecklist](../../docs/evaluation/3677-adoption.md) and [measured\nreport](../../docs/evaluation/3677-measured-evaluation.md) for the release\nlimits.\n\nThe recipe manifest registers those existing browser components as\n`/ingestion/inbox` and `/ingestion/review` routes for a host to mount. The route\nmetadata does not supply a host, source, provider, or demo fixture, and it does\nnot change the preview-only status. Both recipes declare `both` runtime: their\ncomponents render in a browser, while the authenticated review host and package\ndependency closure require a server.\n"
     },
     {
       "path": "EXTRACTION.md",
@@ -1681,6 +1681,123 @@
       }
     ]
   },
+  "recipes": [
+    {
+      "id": "ingestion.inbox",
+      "className": "IngestionInboxRecipe",
+      "label": "Ingestion inbox",
+      "summary": "Review incoming material and see which items need attention.",
+      "synonyms": [
+        "intake inbox",
+        "incoming documents",
+        "review queue"
+      ],
+      "models": [
+        "@happyvertical/smrt-ingestion:IntakeItem",
+        "@happyvertical/smrt-ingestion:IntakeEvidence"
+      ],
+      "nav": [
+        {
+          "label": "Ingestion inbox",
+          "model": "@happyvertical/smrt-ingestion:IntakeItem",
+          "icon": "archive",
+          "description": "Incoming material that needs authenticated attention.",
+          "key": "inbox",
+          "noun": "inbox item"
+        }
+      ],
+      "requires": [],
+      "group": {
+        "id": "ingestion",
+        "label": "Ingestion",
+        "summary": "Review incoming material safely before it can change records."
+      },
+      "section": {
+        "id": "ingestion",
+        "label": "Ingestion",
+        "icon": "archive",
+        "description": "Incoming material and its authenticated review workflow."
+      },
+      "help": {
+        "markdown": "## Overview\n\nThe ingestion inbox is where an authenticated reviewer finds incoming material\nthat needs attention. It keeps the original material and its related evidence\ntogether, so a reviewer can understand what arrived before choosing a next\nstep.\n\n## Tasks\n\n### Check items that need attention\n\n1. Open the ingestion inbox in an application that has configured an\n   authenticated review host.\n2. Choose an item to inspect its evidence and current review state.\n3. Open the item in Ingestion review when it has a proposed action.\n\n### Keep uncertain material for review\n\n1. Leave material in the inbox when there is not enough information to decide.\n2. Return after the application has new information or a reviewer can make a\n   decision.\n3. Do not treat an inbox item as permission to change another record.\n\n## Preview status\n\nThis recipe describes a preview workflow. The published evaluation did not meet\nquality gates and did not establish safety, so automation remains disabled. It\ndoes not configure a source, provider, generic record route, or automatic\naction. Applications continue to use the scoped callbacks described in the\ningestion review documentation.\n",
+        "fieldRefs": []
+      },
+      "surfaces": [
+        {
+          "kind": "route",
+          "path": "/ingestion/inbox",
+          "export": "@happyvertical/smrt-ingestion/svelte#IntakeInbox",
+          "label": "Ingestion inbox"
+        }
+      ],
+      "runtime": "both",
+      "demo": {
+        "mode": "server",
+        "reasons": [
+          "Needs a server because its package depends on @happyvertical/smrt-agents, @happyvertical/smrt-jobs, @happyvertical/smrt-profiles, @happyvertical/smrt-reports, @happyvertical/smrt-secrets, @happyvertical/smrt-tenancy, @happyvertical/smrt-users, which do not build for a browser (#3615, #3617, #3624, #3625, #3626, #3627)."
+        ]
+      }
+    },
+    {
+      "id": "ingestion.review",
+      "className": "IngestionReviewRecipe",
+      "label": "Ingestion review",
+      "summary": "Inspect evidence and approve, change, reject, or defer proposed actions.",
+      "synonyms": [
+        "intake review",
+        "proposal review",
+        "human approval"
+      ],
+      "models": [
+        "@happyvertical/smrt-ingestion:IntakeItem",
+        "@happyvertical/smrt-ingestion:IntakeEvidence",
+        "@happyvertical/smrt-ingestion:IntakeAnalysis",
+        "@happyvertical/smrt-ingestion:IntakeAction",
+        "@happyvertical/smrt-ingestion:IntakeReviewDecision"
+      ],
+      "nav": [
+        {
+          "label": "Ingestion review",
+          "model": "@happyvertical/smrt-ingestion:IntakeReviewDecision",
+          "icon": "fileText",
+          "description": "Revision-bound decisions on proposed actions.",
+          "key": "review",
+          "noun": "review decision"
+        }
+      ],
+      "requires": [],
+      "group": {
+        "id": "ingestion",
+        "label": "Ingestion",
+        "summary": "Review incoming material safely before it can change records."
+      },
+      "section": {
+        "id": "ingestion",
+        "label": "Ingestion",
+        "icon": "archive",
+        "description": "Incoming material and its authenticated review workflow."
+      },
+      "help": {
+        "markdown": "## Overview\n\nIngestion review lets an authorized person inspect the evidence behind a\nproposed action before it can affect another record. A decision is tied to the\nspecific material and proposal that the reviewer saw.\n\n## Tasks\n\n### Review a proposed action\n\n1. Open an inbox item that has a proposed action.\n2. Read the evidence and the proposed result in the authenticated review host.\n3. Approve, change, reject, or defer the proposal according to the current\n   application policy.\n\n### Return to an item after it changes\n\n1. Refresh the review when the host indicates that the material or proposal has\n   changed.\n2. Review the current proposal before making a decision.\n3. Leave a proposal deferred when its evidence or destination is still\n   uncertain.\n\n## Preview status\n\nThis recipe describes a preview workflow. The published evaluation did not meet\nquality gates and did not establish safety, so automation remains disabled. It\ndoes not create a generic editing surface or enable automatic execution. A host\nrechecks the reviewer, scope, and current proposal before it accepts a decision.\n",
+        "fieldRefs": []
+      },
+      "surfaces": [
+        {
+          "kind": "route",
+          "path": "/ingestion/review",
+          "export": "@happyvertical/smrt-ingestion/svelte#IntakeReview",
+          "label": "Ingestion review"
+        }
+      ],
+      "runtime": "both",
+      "demo": {
+        "mode": "server",
+        "reasons": [
+          "Needs a server because its package depends on @happyvertical/smrt-agents, @happyvertical/smrt-jobs, @happyvertical/smrt-profiles, @happyvertical/smrt-reports, @happyvertical/smrt-secrets, @happyvertical/smrt-tenancy, @happyvertical/smrt-users, which do not build for a browser (#3615, #3617, #3624, #3625, #3626, #3627)."
+        ]
+      }
+    }
+  ],
   "browser": {
     "status": "server-only",
     "issues": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-ingestion",
-  "version": "0.55.8",
+  "version": "0.55.10",
   "description": "Durable tenant-scoped intake and evidence foundations",
   "type": "module",
   "main": "./dist/index.js",
@@ -50,32 +50,32 @@
     }
   },
   "dependencies": {
-    "@happyvertical/smrt-core": "0.55.8",
-    "@happyvertical/smrt-types": "0.55.8",
-    "@happyvertical/smrt-tenancy": "0.55.8",
-    "@happyvertical/smrt-assets": "0.55.8",
-    "@happyvertical/smrt-jobs": "0.55.8",
+    "@happyvertical/smrt-core": "0.55.10",
+    "@happyvertical/smrt-types": "0.55.10",
+    "@happyvertical/smrt-tenancy": "0.55.10",
+    "@happyvertical/smrt-assets": "0.55.10",
+    "@happyvertical/smrt-jobs": "0.55.10",
     "@happyvertical/sql": "^0.103.1",
     "@happyvertical/pdf": "^0.65.9",
     "@happyvertical/ocr": "^0.61.6",
     "@happyvertical/speech": "^0.103.1",
     "@happyvertical/ai": "^0.103.1",
     "sharp": "^0.35.5",
-    "@happyvertical/smrt-agents": "0.55.8",
-    "@happyvertical/smrt-playbooks": "0.55.8",
+    "@happyvertical/smrt-agents": "0.55.10",
+    "@happyvertical/smrt-playbooks": "0.55.10",
     "ajv": "8.20.0",
-    "@happyvertical/smrt-ui": "0.55.8"
+    "@happyvertical/smrt-ui": "0.55.10"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.55.8",
+    "@happyvertical/smrt-vitest": "0.55.10",
     "@types/node": "24.13.6",
     "typescript": "6.0.3",
     "vite": "8.1.4",
     "vitest": "4.1.10",
-    "@happyvertical/smrt-content": "0.55.8",
-    "@happyvertical/smrt-messages": "0.55.8",
+    "@happyvertical/smrt-content": "0.55.10",
+    "@happyvertical/smrt-messages": "0.55.10",
     "@happyvertical/email": "^0.103.1",
-    "@happyvertical/smrt-users": "0.55.8",
+    "@happyvertical/smrt-users": "0.55.10",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "svelte": "^5.57.1",