@lssm/lib.contracts-runtime-core 3.0.1

package/dist/native/index.js

@@ -0,0 +1,1879 @@
+// src/approval.ts
+import { OPERATION_EXECUTION_EFFECTS } from "@lssm/lib.contracts-spec/operations";
+function createMemoryApprovalNonceStore(now = () => new Date) {
+  const consumed = new Map;
+  return {
+    async consume(nonce, expiresAt) {
+      const currentTime = now().getTime();
+      for (const [key, expiry] of consumed) {
+        if (expiry <= currentTime)
+          consumed.delete(key);
+      }
+      if (consumed.has(nonce))
+        return false;
+      consumed.set(nonce, Date.parse(expiresAt));
+      return true;
+    }
+  };
+}
+function createOperationApprovalPort(options = {}) {
+  const now = options.now ?? (() => new Date);
+  const nonceStore = options.nonceStore ?? createMemoryApprovalNonceStore(now);
+  return {
+    async authorize(request) {
+      const denial = await validateApprovalRequest(request, now(), options.verifyEvidence);
+      if (denial)
+        return denial;
+      if (!await nonceStore.consume(request.receipt.nonce, request.receipt.expiresAt)) {
+        return { effect: "deny", reason: "replayed_receipt" };
+      }
+      return {
+        effect: "allow",
+        receiptId: request.receipt.id,
+        nonce: request.receipt.nonce
+      };
+    }
+  };
+}
+async function operationApprovalInputDigest(input) {
+  const bytes = new TextEncoder().encode(canonicalJson(input));
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+async function validateApprovalRequest(request, now, verifyEvidence) {
+  const { receipt } = request;
+  const issuedAt = Date.parse(receipt.issuedAt);
+  const expiresAt = Date.parse(receipt.expiresAt);
+  if (!receipt.id || !receipt.nonce || !receipt.issuer || !receipt.evidenceRef || !hasSubjectScope(receipt.subject) || receipt.effects.some((effect) => !OPERATION_EXECUTION_EFFECTS.includes(effect)) || !Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt) {
+    return deny("malformed_receipt");
+  }
+  if (expiresAt <= now.getTime())
+    return deny("expired_receipt");
+  if (issuedAt > now.getTime())
+    return deny("not_yet_valid");
+  if (!matchesSubject(receipt.subject, request.subject, ["actor", "userId"])) {
+    return deny("wrong_subject");
+  }
+  if (!matchesSubject(receipt.subject, request.subject, [
+    "tenantId",
+    "workspaceId",
+    "organizationId"
+  ])) {
+    return deny("wrong_tenant");
+  }
+  if (receipt.operation.key !== request.operation.key || receipt.operation.version !== request.operation.version) {
+    return deny("wrong_operation");
+  }
+  if (receipt.inputDigest !== await operationApprovalInputDigest(request.input)) {
+    return deny("wrong_input");
+  }
+  const approvedEffects = new Set(receipt.effects);
+  if (request.requiredEffects.some((effect) => !approvedEffects.has(effect))) {
+    return deny("insufficient_effects");
+  }
+  if (!coversCost(receipt, request)) {
+    return deny("insufficient_cost_ceiling");
+  }
+  if (verifyEvidence && !await verifyEvidence(receipt)) {
+    return deny("invalid_evidence");
+  }
+  return;
+}
+function matchesSubject(receipt, expected, keys) {
+  return keys.every((key) => {
+    const expectedValue = expected[key];
+    return expectedValue == null || receipt[key] === expectedValue;
+  });
+}
+function coversCost(receipt, request) {
+  if (!request.requestedCost)
+    return true;
+  if (!Number.isFinite(request.requestedCost.amount) || request.requestedCost.amount < 0) {
+    return false;
+  }
+  const ceiling = receipt.costCeiling;
+  if (!ceiling || !Number.isFinite(ceiling.amount) || ceiling.amount < 0) {
+    return false;
+  }
+  return ceiling.amount >= request.requestedCost.amount && (!request.requestedCost.currency || ceiling.currency === request.requestedCost.currency) && (!request.requestedCost.unit || ceiling.unit === request.requestedCost.unit);
+}
+function hasSubjectScope(subject) {
+  return Object.values(subject).some((value) => typeof value === "string" && value.length > 0);
+}
+function deny(reason) {
+  return { effect: "deny", reason };
+}
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new TypeError("Approval input is not JSON.");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
+  }
+  if (value instanceof Date)
+    return JSON.stringify(value.toISOString());
+  if (typeof value === "object") {
+    const entries = Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right));
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+  }
+  throw new TypeError("Approval input is not JSON.");
+}
+// src/contracts-runtime-core.feature.ts
+import { defineFeature } from "@lssm/lib.contracts-spec/features";
+var ContractsRuntimeCoreFeature = defineFeature({
+  meta: {
+    key: "libs.contracts-runtime-core",
+    version: "1.0.0",
+    title: "Contracts Runtime Core",
+    description: "Framework-neutral in-house query/cache/offline engine and Transport port for ContractSpec data fetching.",
+    domain: "contracts-runtime-core",
+    owners: ["@contractspec-core"],
+    tags: ["package", "libs", "contracts-runtime-core"],
+    stability: "experimental"
+  }
+});
+// src/engine/backoff.ts
+var DEFAULT_BASE_MS = 200;
+var DEFAULT_FACTOR = 2;
+var DEFAULT_MAX_MS = 30000;
+function backoffDelayMs(attempt, options = {}) {
+  const base = options.baseMs ?? DEFAULT_BASE_MS;
+  const factor = options.factor ?? DEFAULT_FACTOR;
+  const max = options.maxMs ?? DEFAULT_MAX_MS;
+  const jitter = options.jitter ?? Math.random;
+  const exponent = Math.max(0, attempt - 1);
+  const raw = Math.min(max, base * factor ** exponent);
+  return Math.round(raw * (0.5 + jitter() * 0.5));
+}
+// src/engine/cache-store.ts
+import { invalidationTagMatches } from "@lssm/lib.contracts-spec/query/invalidation";
+var CACHE_PREFIX = "cache:";
+function createCacheStore(storage) {
+  const tagIndex = new Map;
+  const storageKey = (key) => `${CACHE_PREFIX}${key}`;
+  return {
+    read: (key) => storage.get(storageKey(key)),
+    write: async (entry) => {
+      tagIndex.set(entry.key, entry.tags);
+      await storage.set(storageKey(entry.key), entry);
+    },
+    remove: async (key) => {
+      tagIndex.delete(key);
+      await storage.remove(storageKey(key));
+    },
+    entries: async () => {
+      const keys = await storage.keys(CACHE_PREFIX);
+      const all = [];
+      for (const key of keys) {
+        const entry = await storage.get(key);
+        if (entry !== undefined)
+          all.push(entry);
+      }
+      return all;
+    },
+    invalidate: async (tags, now) => {
+      const affected = [];
+      for (const [cacheKey, entryTags] of tagIndex.entries()) {
+        const matched = entryTags.some((subject) => tags.some((pattern) => invalidationTagMatches(subject, pattern)));
+        if (!matched)
+          continue;
+        const stored = await storage.get(storageKey(cacheKey));
+        if (stored === undefined)
+          continue;
+        await storage.set(storageKey(cacheKey), {
+          ...stored,
+          status: "stale",
+          staleAt: now
+        });
+        affected.push(cacheKey);
+      }
+      return affected;
+    }
+  };
+}
+// src/engine/conflict-registry.ts
+function fieldMerge(ctx) {
+  const server = ctx.serverData;
+  const local = ctx.localData;
+  const fields = ctx.mergeFields ?? [];
+  if (typeof server !== "object" || server === null || typeof local !== "object" || local === null) {
+    return { outcome: "surface" };
+  }
+  const merged = {
+    ...server
+  };
+  const localRecord = local;
+  for (const field of fields) {
+    if (field in localRecord)
+      merged[field] = localRecord[field];
+  }
+  return { outcome: "merged", data: merged };
+}
+function createConflictResolverRegistry() {
+  const resolvers = new Map;
+  return {
+    register(key, resolver) {
+      resolvers.set(key, resolver);
+    },
+    has(key) {
+      return resolvers.has(key);
+    },
+    async resolve(ctx) {
+      switch (ctx.strategy) {
+        case "server-wins":
+          return { outcome: "use-server", data: ctx.serverData };
+        case "client-wins":
+          return { outcome: "use-client", data: ctx.localData };
+        case "field-merge":
+          return fieldMerge(ctx);
+        case "surface":
+          return { outcome: "surface" };
+        default: {
+          const key = ctx.policy.resolver;
+          const resolver = key === undefined ? undefined : resolvers.get(key);
+          if (resolver === undefined)
+            return { outcome: "surface" };
+          return resolver(ctx);
+        }
+      }
+    }
+  };
+}
+// src/engine/conflict-resolution.ts
+import { defaultConflictPolicy } from "@lssm/lib.contracts-spec/query/conflict-policy";
+async function restoreSnapshots(snapshots, cache) {
+  for (const snapshot of snapshots) {
+    if (snapshot.previous === undefined)
+      await cache.remove(snapshot.key);
+    else
+      await cache.write(snapshot.previous);
+  }
+}
+async function resolveQueuedConflict(entry, problem, deps) {
+  const policy = entry.conflictPolicy ?? defaultConflictPolicy();
+  const primaryKey = entry.rollback[0]?.key;
+  const localEntry = primaryKey === undefined ? undefined : await deps.cache.read(primaryKey);
+  const serverData = problem.metadata?.serverData;
+  const resolution = await deps.resolvers.resolve({
+    strategy: policy.strategy,
+    policy,
+    localData: localEntry?.data,
+    serverData,
+    localVersion: entry.versionToken,
+    serverVersion: problem.versionToken,
+    mergeFields: policy.mergeFields
+  });
+  deps.events.emit({
+    type: "mutation-conflict",
+    id: entry.id,
+    strategy: policy.strategy,
+    outcome: resolution.outcome
+  });
+  switch (resolution.outcome) {
+    case "use-server": {
+      await restoreSnapshots(entry.rollback, deps.cache);
+      await deps.cache.invalidate(entry.tags, deps.now());
+      for (const snapshot of entry.rollback) {
+        await deps.queryEngine?.refresh(snapshot.key);
+      }
+      return "resolved";
+    }
+    case "use-client":
+      await deps.queue.update({
+        ...entry,
+        versionToken: problem.versionToken,
+        status: "pending"
+      });
+      return "re-enqueued";
+    case "merged": {
+      if (primaryKey !== undefined && localEntry !== undefined) {
+        await deps.cache.write({
+          ...localEntry,
+          data: resolution.data,
+          versionToken: problem.versionToken,
+          status: "warm",
+          storedAt: deps.now()
+        });
+        await deps.queryEngine?.refresh(primaryKey);
+      }
+      await deps.queue.update({
+        ...entry,
+        versionToken: problem.versionToken,
+        status: "pending"
+      });
+      return "re-enqueued";
+    }
+    default: {
+      if (primaryKey !== undefined) {
+        await deps.queryEngine?.emitConflict(primaryKey, {
+          versionToken: problem.versionToken,
+          serverData,
+          clientData: localEntry?.data,
+          strategy: policy.strategy
+        });
+      }
+      return "resolved";
+    }
+  }
+}
+// src/local-offline.ts
+var MODES = new Set([
+  "online-only",
+  "memory-cache",
+  "offline-capable"
+]);
+var MODE_ALIASES = {
+  "online-only": "online-only",
+  online: "online-only",
+  disabled: "online-only",
+  false: "online-only",
+  off: "online-only",
+  "memory-cache": "memory-cache",
+  memory: "memory-cache",
+  cache: "memory-cache",
+  "offline-capable": "offline-capable",
+  offline: "offline-capable",
+  enabled: "offline-capable",
+  true: "offline-capable",
+  on: "offline-capable"
+};
+function isLocalOfflineMode(value) {
+  return typeof value === "string" && MODES.has(value);
+}
+function resolveLocalOfflinePolicy(options = {}) {
+  const fallback = options.defaultMode === undefined ? {
+    mode: "online-only",
+    source: "default",
+    reason: "No local/offline policy input was supplied."
+  } : normalizePolicy(options.defaultMode, "explicit") ?? {
+    mode: "online-only",
+    source: "explicit"
+  };
+  const env = normalizePolicy(readEnvValue(options.env), "env", {
+    allowUnknown: true
+  });
+  const flag = normalizePolicy(options.flag, "feature-flag");
+  return flag ?? env ?? fallback;
+}
+function readEnvValue(input) {
+  if (typeof input !== "object" || input === null)
+    return input;
+  if ("CONTRACTSPEC_LOCAL_OFFLINE" in input) {
+    return input.CONTRACTSPEC_LOCAL_OFFLINE;
+  }
+  if ("mode" in input)
+    return input;
+  return;
+}
+function normalizePolicy(input, source, options = {}) {
+  if (input === undefined || input === null || input === "")
+    return;
+  if (typeof input === "boolean") {
+    return { mode: input ? "offline-capable" : "online-only", source };
+  }
+  if (typeof input === "string") {
+    const mode = MODE_ALIASES[input.trim().toLowerCase()];
+    if (mode !== undefined)
+      return { mode, source };
+    if (options.allowUnknown)
+      return;
+  }
+  if (typeof input === "object" && input !== null && "mode" in input) {
+    const policy = input;
+    const mode = typeof policy.mode === "string" ? MODE_ALIASES[policy.mode.trim().toLowerCase()] : undefined;
+    if (mode !== undefined) {
+      return {
+        mode,
+        source,
+        ...typeof policy.reason === "string" ? { reason: policy.reason } : {}
+      };
+    }
+    if (options.allowUnknown)
+      return;
+  }
+  throw new Error(`Unsupported localOffline policy value: ${String(input)}`);
+}
+
+// src/reachability.ts
+function isNetworkAllowed(signal) {
+  return signal !== "offline";
+}
+function createStaticReachabilitySource(signal = "online") {
+  const snapshot = { signal, since: Date.now() };
+  return {
+    getSnapshot: () => snapshot,
+    subscribe: () => () => {}
+  };
+}
+var reachabilityPortDoc = {
+  id: "docs.contracts-runtime-core.reachability",
+  title: "Reachability input port (tri-state)",
+  summary: "Engine-owned reachability input port; integrations feed it, the engine never imports them.",
+  kind: "reference",
+  visibility: "internal",
+  route: "/docs/contracts-runtime-core/reachability",
+  domain: "contracts-runtime-core",
+  owners: ["@contractspec-core"],
+  tags: ["contracts-runtime-core", "reachability", "offline", "port"],
+  body: "Tri-state OnlineSignal ('online' | 'restricted' | 'offline'). 'online' allows normal fetch + queue drain. 'restricted' is online-degraded: the engine fetches and drains the queue as if online but may mark results stale-eligible; it never suspends network nor activates the offline queue. Only 'offline' suspends outbound network and activates the durable offline mutation queue. The engine reads reachability solely through ReachabilitySource and MUST NOT import integrations/* — concrete sources (runtime-local networkReachability) are wired via an integration→port adapter (plan §2.3/§4.2, Architect finding 1). isNetworkAllowed mirrors runtime-local's outboundNetworkAllowed = reachability !== 'offline'. createStaticReachabilitySource('online') is the B1a default and online test fixture."
+};
+
+// src/storage/memory.ts
+function createMemoryStorage() {
+  const store = new Map;
+  return {
+    get: async (key) => {
+      const value = store.get(key);
+      return value === undefined ? undefined : structuredClone(value);
+    },
+    set: async (key, value) => {
+      store.set(key, structuredClone(value));
+    },
+    remove: async (key) => {
+      store.delete(key);
+    },
+    keys: async (prefix) => {
+      const all = [...store.keys()];
+      return prefix === undefined ? all : all.filter((key) => key.startsWith(prefix));
+    },
+    clear: async () => {
+      store.clear();
+    }
+  };
+}
+
+// src/engine/events.ts
+function createEngineEvents() {
+  const listeners = new Set;
+  return {
+    emit(event) {
+      for (const listener of listeners)
+        listener(event);
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    }
+  };
+}
+
+// src/engine/maintenance.ts
+function createMaintenance(deps) {
+  return {
+    async collectGarbage() {
+      const ts = deps.now();
+      let evicted = 0;
+      for (const entry of await deps.cache.entries()) {
+        if (entry.expiresAt !== undefined && ts >= entry.expiresAt) {
+          await deps.cache.remove(entry.key);
+          evicted += 1;
+        }
+      }
+      deps.events.emit({ type: "gc-collected", evicted });
+      return evicted;
+    },
+    async revalidateStale() {
+      const revalidate = deps.revalidate;
+      if (revalidate === undefined)
+        return 0;
+      const ts = deps.now();
+      let count = 0;
+      for (const entry of await deps.cache.entries()) {
+        const stale = entry.staleAt !== undefined && ts >= entry.staleAt;
+        if (!stale || entry.envelope === undefined)
+          continue;
+        await revalidate(entry.envelope);
+        deps.events.emit({ type: "revalidated", key: entry.key });
+        count += 1;
+      }
+      return count;
+    }
+  };
+}
+
+// src/engine/mutation-engine.ts
+import {
+  mergeSafeEconomicEvidenceRefIds,
+  parseSafeEconomicEvidenceRefId
+} from "@lssm/lib.contracts-spec/operations";
+import { defaultConflictPolicy as defaultConflictPolicy2 } from "@lssm/lib.contracts-spec/query/conflict-policy";
+var DEFAULT_MAX_ATTEMPTS = 5;
+function mergeEconomicEvidenceRefs(...groups) {
+  return mergeSafeEconomicEvidenceRefIds(...groups);
+}
+function toRuntimeEconomicEvidenceRef(ref) {
+  const safeRef = parseSafeEconomicEvidenceRefId(ref);
+  if (!safeRef) {
+    throw new Error("EconomicEvidenceInvalidRef: unsafe or invalid economic evidence ref");
+  }
+  return safeRef;
+}
+function createMutationEngine(options) {
+  const { transport, cache, queue, reachability, resolvers, events } = options;
+  const now = options.now ?? (() => Date.now());
+  const maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  const deps = {
+    cache,
+    queue,
+    resolvers,
+    events,
+    now,
+    queryEngine: options.queryEngine
+  };
+  let paused = false;
+  let seq = 0;
+  let draining = null;
+  const outcomes = new Map;
+  const toEnvelope = (entry, economicEvidenceRefs = entry.economicEvidenceRefs) => ({
+    operation: entry.operation,
+    input: entry.input,
+    tags: entry.tags,
+    economicEvidenceRefs
+  });
+  async function applyOptimistic(writes) {
+    const snapshots = [];
+    for (const write of writes) {
+      const previous = await cache.read(write.key);
+      snapshots.push({ key: write.key, previous });
+      await cache.write({
+        key: write.key,
+        data: write.data,
+        versionToken: write.versionToken ?? previous?.versionToken,
+        status: "warm",
+        tags: previous?.tags ?? [],
+        storedAt: now(),
+        staleAt: previous?.staleAt,
+        expiresAt: previous?.expiresAt
+      });
+      await options.queryEngine?.refresh(write.key);
+    }
+    return snapshots;
+  }
+  async function commitSuccess(entry, result) {
+    for (const snapshot of entry.rollback) {
+      const current = await cache.read(snapshot.key);
+      if (current !== undefined) {
+        await cache.write({
+          ...current,
+          versionToken: result.versionToken ?? current.versionToken,
+          status: "stale",
+          staleAt: now()
+        });
+      }
+      await options.queryEngine?.refresh(snapshot.key);
+    }
+    await cache.invalidate(entry.tags, now());
+  }
+  async function replayEntry(entry) {
+    let safeEntryEconomicEvidenceRefs;
+    try {
+      safeEntryEconomicEvidenceRefs = mergeEconomicEvidenceRefs(entry.economicEvidenceRefs);
+    } catch {
+      await restoreSnapshots(entry.rollback, cache);
+      for (const snapshot of entry.rollback) {
+        await options.queryEngine?.refresh(snapshot.key);
+      }
+      await queue.remove(entry.id);
+      events.emit({
+        type: "mutation-failed",
+        id: entry.id,
+        code: "ECONOMIC_EVIDENCE_INVALID_REF"
+      });
+      outcomes.set(entry.id, {
+        id: entry.id,
+        status: "failed",
+        problem: {
+          type: "about:blank",
+          title: "Economic evidence ref rejected",
+          status: 422,
+          code: "ECONOMIC_EVIDENCE_INVALID_REF",
+          category: "validation",
+          severity: "error",
+          retryable: false
+        }
+      });
+      return true;
+    }
+    const attempts = entry.attempts + 1;
+    await queue.update({ ...entry, status: "in-flight", attempts });
+    const result = await transport.execute(toEnvelope(entry, safeEntryEconomicEvidenceRefs), options.contextProvider?.());
+    if (result.ok) {
+      const economicEvidenceRefs = mergeEconomicEvidenceRefs(safeEntryEconomicEvidenceRefs, result.data.economicEvidenceRefs);
+      await commitSuccess(entry, result.data);
+      await queue.remove(entry.id);
+      events.emit({
+        type: "mutation-replayed",
+        id: entry.id,
+        queueDepth: await queue.depth()
+      });
+      if (economicEvidenceRefs.length > 0) {
+        events.emit({
+          type: "economic-evidence-attached",
+          operationKey: entry.operation.key,
+          evidenceRefs: economicEvidenceRefs.map(toRuntimeEconomicEvidenceRef)
+        });
+      }
+      outcomes.set(entry.id, {
+        id: entry.id,
+        status: "done",
+        data: result.data.data,
+        economicEvidenceRefs
+      });
+      return true;
+    }
+    const { problem } = result;
+    if (problem.category === "auth") {
+      paused = true;
+      await queue.update({ ...entry, status: "paused-auth", attempts });
+      events.emit({ type: "auth-expired", id: entry.id });
+      outcomes.set(entry.id, { id: entry.id, status: "paused-auth", problem });
+      if (options.refreshAuth !== undefined && await options.refreshAuth()) {
+        paused = false;
+        await queue.update({ ...entry, status: "pending", attempts });
+        return true;
+      }
+      return false;
+    }
+    if (problem.category === "conflict") {
+      const disposition = await resolveQueuedConflict(entry, problem, deps);
+      if (disposition === "resolved") {
+        await queue.remove(entry.id);
+        outcomes.set(entry.id, { id: entry.id, status: "done", problem });
+      }
+      return true;
+    }
+    if (problem.retryable && attempts < maxAttempts) {
+      const delayMs = backoffDelayMs(attempts, options.backoff);
+      await queue.update({ ...entry, status: "failed", attempts });
+      events.emit({
+        type: "mutation-retry",
+        id: entry.id,
+        attempt: attempts,
+        delayMs
+      });
+      outcomes.set(entry.id, { id: entry.id, status: "failed", problem });
+      options.schedule?.(() => {
+        drain();
+      }, delayMs);
+      return true;
+    }
+    await restoreSnapshots(entry.rollback, cache);
+    for (const snapshot of entry.rollback) {
+      await options.queryEngine?.refresh(snapshot.key);
+    }
+    await queue.remove(entry.id);
+    events.emit({ type: "mutation-failed", id: entry.id, code: result.code });
+    outcomes.set(entry.id, { id: entry.id, status: "failed", problem });
+    return true;
+  }
+  async function runDrain() {
+    if (paused)
+      return;
+    if (!isNetworkAllowed(reachability.getSnapshot().signal))
+      return;
+    for (const entry of await queue.list()) {
+      if (entry.status === "paused-auth")
+        continue;
+      if (!await replayEntry(entry))
+        return;
+    }
+    events.emit({ type: "queue-drained", remaining: await queue.depth() });
+  }
+  function drain() {
+    if (draining !== null)
+      return draining;
+    draining = runDrain().finally(() => {
+      draining = null;
+    });
+    return draining;
+  }
+  async function mutate(request, mutateOptions = {}) {
+    mergeEconomicEvidenceRefs(request.economicEvidenceRefs);
+    const enqueuedAt = now();
+    seq += 1;
+    const id = `${enqueuedAt}-${seq}`;
+    const rollback = mutateOptions.optimistic ? await applyOptimistic(mutateOptions.optimistic) : [];
+    await queue.enqueue({
+      ...request,
+      conflictPolicy: request.conflictPolicy ?? defaultConflictPolicy2(),
+      id,
+      enqueuedAt,
+      attempts: 0,
+      status: "pending",
+      rollback
+    });
+    events.emit({
+      type: "mutation-enqueued",
+      id,
+      queueDepth: await queue.depth()
+    });
+    if (!paused && isNetworkAllowed(reachability.getSnapshot().signal)) {
+      await drain();
+    }
+    return outcomes.get(id) ?? {
+      id,
+      status: "pending"
+    };
+  }
+  async function resume() {
+    paused = false;
+    for (const entry of await queue.list()) {
+      if (entry.status === "paused-auth") {
+        await queue.update({ ...entry, status: "pending" });
+      }
+    }
+    await drain();
+  }
+  const unsubscribe = reachability.subscribe((snapshot) => {
+    if (!paused && isNetworkAllowed(snapshot.signal))
+      drain();
+  });
+  return { mutate, drain, resume, dispose: unsubscribe };
+}
+
+// src/engine/mutation-queue.ts
+var QUEUE_PREFIX = "queue:";
+function createMutationQueue(storage) {
+  const storageKey = (id) => `${QUEUE_PREFIX}${id}`;
+  async function readAll() {
+    const keys = await storage.keys(QUEUE_PREFIX);
+    const entries = [];
+    for (const key of keys) {
+      const entry = await storage.get(key);
+      if (entry !== undefined)
+        entries.push(entry);
+    }
+    entries.sort((a, b) => a.enqueuedAt === b.enqueuedAt ? a.id.localeCompare(b.id) : a.enqueuedAt - b.enqueuedAt);
+    return entries;
+  }
+  return {
+    enqueue: (entry) => storage.set(storageKey(entry.id), entry),
+    update: (entry) => storage.set(storageKey(entry.id), entry),
+    remove: (id) => storage.remove(storageKey(id)),
+    list: () => readAll(),
+    depth: async () => (await storage.keys(QUEUE_PREFIX)).length
+  };
+}
+
+// src/engine/online-only-data-engine.ts
+import { createQueryKey } from "@lssm/lib.contracts-spec/query/key";
+
+// src/engine/state.ts
+function computeIsStale(entry, now) {
+  if (entry?.staleAt === undefined)
+    return false;
+  return now >= entry.staleAt;
+}
+function idleState() {
+  return {
+    status: "idle",
+    fetchStatus: "idle",
+    cacheStatus: "empty",
+    isStale: false,
+    isOffline: false
+  };
+}
+function loadingState(entry, now) {
+  if (entry === undefined) {
+    return {
+      status: "loading",
+      fetchStatus: "fetching",
+      cacheStatus: "empty",
+      isStale: false,
+      isOffline: false
+    };
+  }
+  const isStale = computeIsStale(entry, now);
+  return {
+    status: "success",
+    fetchStatus: "fetching",
+    data: entry.data,
+    cacheStatus: isStale ? "stale" : entry.status,
+    isStale,
+    isOffline: false,
+    versionToken: entry.versionToken,
+    dataUpdatedAt: entry.storedAt,
+    ...entry.pageInfo === undefined ? {} : { pageInfo: entry.pageInfo }
+  };
+}
+function successState(entry, now) {
+  const isStale = computeIsStale(entry, now);
+  return {
+    status: "success",
+    fetchStatus: "idle",
+    data: entry.data,
+    cacheStatus: isStale ? "stale" : entry.status,
+    isStale,
+    isOffline: false,
+    versionToken: entry.versionToken,
+    dataUpdatedAt: entry.storedAt,
+    ...entry.pageInfo === undefined ? {} : { pageInfo: entry.pageInfo }
+  };
+}
+function errorState(problem, entry, now) {
+  return {
+    status: "error",
+    fetchStatus: "idle",
+    data: entry?.data,
+    error: problem,
+    cacheStatus: entry === undefined ? "empty" : entry.status,
+    isStale: computeIsStale(entry, now),
+    isOffline: false,
+    versionToken: entry?.versionToken,
+    dataUpdatedAt: entry?.storedAt,
+    errorUpdatedAt: now
+  };
+}
+function authExpiredState(problem, entry, now) {
+  return {
+    status: "auth-expired",
+    fetchStatus: "idle",
+    data: entry?.data,
+    error: problem,
+    cacheStatus: entry === undefined ? "empty" : entry.status,
+    isStale: computeIsStale(entry, now),
+    isOffline: false,
+    versionToken: entry?.versionToken,
+    dataUpdatedAt: entry?.storedAt,
+    errorUpdatedAt: now
+  };
+}
+function conflictState(entry, conflict, now) {
+  return {
+    status: entry === undefined ? "idle" : "success",
+    fetchStatus: "idle",
+    data: entry?.data,
+    cacheStatus: "conflict",
+    isStale: computeIsStale(entry, now),
+    isOffline: false,
+    conflict,
+    versionToken: conflict.versionToken ?? entry?.versionToken,
+    dataUpdatedAt: entry?.storedAt
+  };
+}
+function offlineState(entry, now) {
+  return {
+    status: entry === undefined ? "idle" : "success",
+    fetchStatus: "idle",
+    data: entry?.data,
+    cacheStatus: "offline",
+    isStale: computeIsStale(entry, now),
+    isOffline: true,
+    versionToken: entry?.versionToken,
+    dataUpdatedAt: entry?.storedAt,
+    ...entry?.pageInfo === undefined ? {} : { pageInfo: entry.pageInfo }
+  };
+}
+
+// src/engine/online-only-data-engine.ts
+function createOnlineOnlyDataEngine(options, resolvedPolicy) {
+  const { transport } = options;
+  const advanced = options.advanced ?? {};
+  const now = advanced.now ?? (() => Date.now());
+  const reachability = advanced.reachability ?? createStaticReachabilitySource("online");
+  const events = advanced.events ?? createEngineEvents();
+  const resolvers = advanced.resolvers ?? createConflictResolverRegistry();
+  const localOffline = resolvedPolicy ?? resolveLocalOfflinePolicy({
+    defaultMode: options.localOffline,
+    env: options.env,
+    flag: options.flag
+  });
+  const states = new Map;
+  const listeners = new Map;
+  let seq = 0;
+  function emit(key, state) {
+    states.set(key, state);
+    for (const listener of listeners.get(key) ?? [])
+      listener(state);
+  }
+  const queryEngine = {
+    async query(envelope, ctx) {
+      const key = createQueryKey(envelope);
+      const signal = reachability.getSnapshot().signal;
+      if (!isNetworkAllowed(signal)) {
+        const state = offlineState(undefined, now());
+        emit(key, state);
+        return state;
+      }
+      emit(key, loadingState(undefined, now()));
+      const startedAt = now();
+      const result = await transport.execute(envelope, ctx);
+      const settledAt = now();
+      if (!result.ok) {
+        events.emit({
+          type: "fetch-error",
+          key,
+          code: result.code,
+          latencyMs: settledAt - startedAt
+        });
+        const state = result.problem.category === "auth" ? authExpiredState(result.problem, undefined, settledAt) : errorState(result.problem, undefined, settledAt);
+        emit(key, state);
+        return state;
+      }
+      events.emit({
+        type: "fetch-success",
+        key,
+        latencyMs: settledAt - startedAt
+      });
+      const entry = {
+        key,
+        data: result.data.data,
+        versionToken: result.data.versionToken ?? result.versionToken,
+        status: signal === "restricted" ? "warm" : "fresh",
+        tags: [],
+        storedAt: settledAt,
+        ...result.data.pageInfo === undefined ? {} : { pageInfo: result.data.pageInfo }
+      };
+      const state = successState(entry, settledAt);
+      emit(key, state);
+      return state;
+    },
+    getState(envelope) {
+      return states.get(createQueryKey(envelope)) ?? idleState();
+    },
+    subscribe(envelope, listener) {
+      const key = createQueryKey(envelope);
+      let set = listeners.get(key);
+      if (set === undefined) {
+        set = new Set;
+        listeners.set(key, set);
+      }
+      set.add(listener);
+      return () => set?.delete(listener);
+    },
+    async invalidateTags() {
+      return [];
+    },
+    async refresh(key) {
+      const state = states.get(key) ?? idleState();
+      emit(key, state);
+      return state;
+    },
+    async emitConflict(key, conflict) {
+      const state = conflictState(undefined, conflict, now());
+      emit(key, state);
+      return state;
+    }
+  };
+  const mutationEngine = {
+    async mutate(request, mutateOptions = {}) {
+      seq += 1;
+      const id = `${now()}-${seq}`;
+      if (!isNetworkAllowed(reachability.getSnapshot().signal)) {
+        return {
+          id,
+          status: "disabled-offline",
+          problem: offlineQueueDisabledProblem()
+        };
+      }
+      const result = await transport.execute({
+        operation: request.operation,
+        input: request.input,
+        tags: request.tags
+      }, mutateOptions.ctx ?? advanced.contextProvider?.());
+      if (result.ok)
+        return { id, status: "done", data: result.data.data };
+      if (result.problem.category === "auth") {
+        return { id, status: "paused-auth", problem: result.problem };
+      }
+      return { id, status: "failed", problem: result.problem };
+    },
+    async drain() {},
+    async resume() {},
+    dispose() {}
+  };
+  return {
+    ...queryEngine,
+    ...mutationEngine,
+    maintenance: {
+      collectGarbage: async () => 0,
+      revalidateStale: async () => 0
+    },
+    events,
+    resolvers,
+    localOffline
+  };
+}
+function offlineQueueDisabledProblem() {
+  return {
+    type: "about:blank",
+    title: "Offline mutation queue disabled",
+    status: 409,
+    code: "OFFLINE_QUEUE_DISABLED",
+    category: "conflict",
+    severity: "warning",
+    retryable: false,
+    detail: "localOffline=online-only does not cache local data or queue offline mutations."
+  };
+}
+
+// src/engine/query-engine.ts
+import { createQueryKey as createQueryKey2 } from "@lssm/lib.contracts-spec/query/key";
+
+// src/engine/dedup.ts
+function createInflightRegistry() {
+  const inflight = new Map;
+  return {
+    run(key, factory) {
+      const existing = inflight.get(key);
+      if (existing !== undefined)
+        return existing;
+      const promise = factory().finally(() => {
+        inflight.delete(key);
+      });
+      inflight.set(key, promise);
+      return promise;
+    },
+    size() {
+      return inflight.size;
+    }
+  };
+}
+
+// src/engine/query-engine.ts
+var DEFAULT_STALE_TIME_MS = 0;
+function createQueryEngine(options) {
+  const { transport } = options;
+  const storage = options.storage ?? createMemoryStorage();
+  const reachability = options.reachability ?? createStaticReachabilitySource("online");
+  const now = options.now ?? (() => Date.now());
+  const defaultStaleTimeMs = options.defaultStaleTimeMs ?? DEFAULT_STALE_TIME_MS;
+  const cache = options.cacheStore ?? createCacheStore(storage);
+  const events = options.events ?? createEngineEvents();
+  const inflight = createInflightRegistry();
+  const states = new Map;
+  const listeners = new Map;
+  function emit(key, state) {
+    states.set(key, state);
+    const set = listeners.get(key);
+    if (set === undefined)
+      return;
+    for (const listener of set)
+      listener(state);
+  }
+  async function query(envelope, ctx) {
+    const key = createQueryKey2(envelope);
+    const signal = reachability.getSnapshot().signal;
+    const entry = await cache.read(key);
+    if (!isNetworkAllowed(signal)) {
+      const state = offlineState(entry, now());
+      emit(key, state);
+      return state;
+    }
+    if (entry !== undefined && !computeIsStale(entry, now())) {
+      events.emit({ type: "cache-hit", key });
+      const state = successState(entry, now());
+      emit(key, state);
+      return state;
+    }
+    events.emit({ type: "cache-miss", key });
+    emit(key, loadingState(entry, now()));
+    const startedAt = now();
+    const result = await inflight.run(key, () => transport.execute(envelope, ctx));
+    const settledAt = now();
+    if (!result.ok) {
+      events.emit({
+        type: "fetch-error",
+        key,
+        code: result.code,
+        latencyMs: settledAt - startedAt
+      });
+      const state = result.problem.category === "auth" ? authExpiredState(result.problem, entry, settledAt) : errorState(result.problem, entry, settledAt);
+      emit(key, state);
+      return state;
+    }
+    events.emit({
+      type: "fetch-success",
+      key,
+      latencyMs: settledAt - startedAt
+    });
+    const staleTimeMs = envelope.cache?.staleTimeMs ?? defaultStaleTimeMs;
+    const cacheTimeMs = envelope.cache?.cacheTimeMs;
+    const written = {
+      key,
+      data: result.data.data,
+      versionToken: result.data.versionToken ?? result.versionToken,
+      status: signal === "restricted" ? "warm" : "fresh",
+      tags: envelope.tags ?? [],
+      storedAt: settledAt,
+      staleAt: settledAt + staleTimeMs,
+      envelope,
+      ...cacheTimeMs === undefined ? {} : { expiresAt: settledAt + cacheTimeMs },
+      ...result.data.pageInfo === undefined ? {} : { pageInfo: result.data.pageInfo }
+    };
+    await cache.write(written);
+    const state = successState(written, settledAt);
+    emit(key, state);
+    return state;
+  }
+  async function refresh(key) {
+    const entry = await cache.read(key);
+    const state = entry === undefined ? idleState() : successState(entry, now());
+    emit(key, state);
+    return state;
+  }
+  async function emitConflict(key, conflict) {
+    const entry = await cache.read(key);
+    const state = conflictState(entry, conflict, now());
+    emit(key, state);
+    return state;
+  }
+  function getState(envelope) {
+    const existing = states.get(createQueryKey2(envelope));
+    return existing ?? idleState();
+  }
+  function subscribe(envelope, listener) {
+    const key = createQueryKey2(envelope);
+    let set = listeners.get(key);
+    if (set === undefined) {
+      set = new Set;
+      listeners.set(key, set);
+    }
+    set.add(listener);
+    return () => {
+      listeners.get(key)?.delete(listener);
+    };
+  }
+  async function invalidateTags(tags) {
+    const affected = await cache.invalidate(tags, now());
+    for (const key of affected) {
+      const entry = await cache.read(key);
+      if (entry !== undefined)
+        emit(key, successState(entry, now()));
+    }
+    return affected;
+  }
+  return { query, getState, subscribe, invalidateTags, refresh, emitConflict };
+}
+
+// src/engine/data-engine.ts
+function createDataEngine(options) {
+  assertNoLegacyLowLevelOptions(options);
+  const advanced = options.advanced ?? {};
+  const policy = resolveLocalOfflinePolicy({
+    defaultMode: options.localOffline,
+    env: options.env,
+    flag: options.flag
+  });
+  assertModeCompatibleWithAdvanced(policy.mode, advanced);
+  if (policy.mode === "online-only")
+    return createOnlineOnlyDataEngine(options, policy);
+  const now = advanced.now ?? (() => Date.now());
+  const storage = advanced.storage ?? createMemoryStorage();
+  const events = advanced.events ?? createEngineEvents();
+  const cacheStore = advanced.cacheStore ?? createCacheStore(storage);
+  const reachability = advanced.reachability ?? createStaticReachabilitySource("online");
+  const resolvers = advanced.resolvers ?? createConflictResolverRegistry();
+  const queue = createMutationQueue(storage);
+  const queryEngine = createQueryEngine({
+    ...advanced,
+    transport: options.transport,
+    now,
+    storage,
+    events,
+    cacheStore,
+    reachability
+  });
+  const mutationEngine = createMutationEngine({
+    transport: options.transport,
+    cache: cacheStore,
+    queue,
+    reachability,
+    resolvers,
+    events,
+    now,
+    maxAttempts: advanced.maxAttempts,
+    queryEngine,
+    contextProvider: advanced.contextProvider,
+    refreshAuth: advanced.refreshAuth,
+    schedule: advanced.schedule,
+    backoff: advanced.backoff
+  });
+  const maintenance = createMaintenance({
+    cache: cacheStore,
+    events,
+    now,
+    revalidate: (envelope) => queryEngine.query(envelope)
+  });
+  return {
+    ...queryEngine,
+    ...mutationEngine,
+    maintenance,
+    events,
+    resolvers,
+    localOffline: policy
+  };
+}
+function assertModeCompatibleWithAdvanced(mode, advanced) {
+  if (mode === "offline-capable") {
+    if (advanced.storage === undefined) {
+      throw new Error("localOffline=offline-capable requires advanced.storage; pass a durable StoragePort or explicit platform storage adapter.");
+    }
+    return;
+  }
+  if (advanced.storage !== undefined) {
+    throw new Error(`localOffline=${mode} rejects advanced.storage; this mode must not use durable local persistence.`);
+  }
+  if (advanced.cacheStore !== undefined) {
+    throw new Error(`localOffline=${mode} rejects advanced.cacheStore; this mode owns cache semantics.`);
+  }
+}
+function assertNoLegacyLowLevelOptions(options) {
+  const legacy = options;
+  if (legacy.storage !== undefined) {
+    throw new Error("Use advanced.storage instead of top-level storage.");
+  }
+  if (legacy.cacheStore !== undefined) {
+    throw new Error("Use advanced.cacheStore instead of top-level cacheStore.");
+  }
+}
+// src/engine/data-engine-host.ts
+function readHostEnv() {
+  const proc = globalThis.process;
+  return proc?.env;
+}
+function createDataEngineFromEnv(options) {
+  return createDataEngine({
+    ...options,
+    env: options.env ?? readHostEnv()
+  });
+}
+// src/engine/no-cache-store.ts
+function createNoCacheStore() {
+  return {
+    read: async (_key) => {
+      return;
+    },
+    write: async () => {},
+    remove: async () => {},
+    entries: async () => [],
+    invalidate: async (_tags, _now) => []
+  };
+}
+// src/engine/online-only-mutation-engine.ts
+function offlineDisabledProblem() {
+  return {
+    type: "https://contractspec.io/problems/offline-queue-disabled",
+    title: "Offline mutation queue disabled",
+    status: 503,
+    code: "OFFLINE_QUEUE_DISABLED",
+    category: "policy",
+    severity: "warning",
+    retryable: true,
+    detail: "localOffline is online-only; offline mutations are not queued or replayed."
+  };
+}
+var toEnvelope = (request) => ({
+  operation: request.operation,
+  input: request.input,
+  tags: request.tags
+});
+function createOnlineOnlyMutationEngine(options) {
+  const now = options.now ?? (() => Date.now());
+  let seq = 0;
+  async function mutate(request, mutateOptions = {}) {
+    seq += 1;
+    const id = `${now()}-${seq}`;
+    if (!isNetworkAllowed(options.reachability.getSnapshot().signal)) {
+      return {
+        id,
+        status: "disabled-offline",
+        problem: offlineDisabledProblem()
+      };
+    }
+    const result = await options.transport.execute(toEnvelope(request), mutateOptions.ctx);
+    if (result.ok)
+      return { id, status: "done", data: result.data.data };
+    return { id, status: "failed", problem: result.problem };
+  }
+  return {
+    mutate,
+    drain: async () => {},
+    resume: async () => {},
+    dispose: () => {}
+  };
+}
+// src/forms-platform-types.ts
+class FormsPlatformError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "FormsPlatformError";
+  }
+}
+
+// src/forms-platform-utils.ts
+import {
+  compileFormDocument,
+  validateFormDocument
+} from "@lssm/lib.contracts-spec/forms";
+function requireFormDefinition(definition, scope) {
+  const matches = definition?.owner.product === scope.product && definition.owner.tenantRef === scope.tenantRef && definition.owner.workspaceRef === scope.workspaceRef && definition.owner.ownerRef === scope.ownerRef;
+  if (!definition || !matches) {
+    throw new FormsPlatformError("FORM_NOT_FOUND", "Form definition was not found in the caller scope");
+  }
+  return definition;
+}
+function validateRuntimeFormDocument(document) {
+  const issues = validateFormDocument(document);
+  if (issues.length) {
+    throw new FormsPlatformError("INVALID_FORM_DOCUMENT", issues.map((issue) => issue.message).join("; "));
+  }
+  compileFormDocument(document);
+}
+function formAssuranceMeetsRequirement(assurance, requirement) {
+  if (requirement === "none")
+    return true;
+  if (requirement === "either")
+    return assurance !== "anonymous";
+  if (requirement === "both")
+    return assurance === "both";
+  return assurance === requirement || assurance === "both";
+}
+function resolveFormResponseStatus(document, assurance) {
+  if (formAssuranceMeetsRequirement(assurance, document.verification.requirement)) {
+    return "completed";
+  }
+  return document.verification.unverifiedDisposition === "pending-hidden" ? "pending-verification" : "completed-unverified";
+}
+function resolveFormLocale(document, candidates) {
+  const supported = new Set(document.content.enabledLocales.map((locale) => locale.toLowerCase()));
+  for (const candidate of candidates) {
+    if (!candidate)
+      continue;
+    const normalized = candidate.trim().toLowerCase();
+    const exact = document.content.enabledLocales.find((locale) => locale.toLowerCase() === normalized);
+    if (supported.has(normalized) && exact)
+      return exact;
+    const language = normalized.split("-")[0];
+    const match = document.content.enabledLocales.find((locale) => locale.toLowerCase().split("-")[0] === language);
+    if (match)
+      return match;
+  }
+  return document.content.defaultLocale;
+}
+
+// src/forms-platform-management.ts
+function createFormsManagementService(dependencies) {
+  const emit = async (key, payload) => dependencies.emit?.(key, payload);
+  return {
+    async create(scope, document) {
+      validateRuntimeFormDocument(document);
+      const now = dependencies.now();
+      const definition = {
+        id: dependencies.id("definition"),
+        owner: scope,
+        status: "draft",
+        draft: document,
+        draftVersion: 1,
+        createdAt: now,
+        updatedAt: now
+      };
+      await dependencies.store.insertDefinition(definition);
+      await emit("forms.definition.created", {
+        definitionId: definition.id,
+        occurredAt: now
+      });
+      return definition;
+    },
+    async saveDraft(scope, definitionId, expectedVersion, document) {
+      validateRuntimeFormDocument(document);
+      const current = requireFormDefinition(await dependencies.store.getDefinition(scope, definitionId), scope);
+      if (current.status === "archived") {
+        throw new FormsPlatformError("FORM_ARCHIVED", "Archived forms cannot be edited");
+      }
+      const next = {
+        ...current,
+        draft: document,
+        draftVersion: expectedVersion + 1,
+        updatedAt: dependencies.now()
+      };
+      if (!await dependencies.store.updateDefinition(next, expectedVersion)) {
+        throw new FormsPlatformError("DRAFT_CONFLICT", "The form draft changed; reload before saving");
+      }
+      await emit("forms.draft.saved", {
+        definitionId,
+        occurredAt: next.updatedAt
+      });
+      return next;
+    },
+    async publish(scope, definitionId, expectedVersion) {
+      return dependencies.store.transaction(async (store) => {
+        const current = requireFormDefinition(await store.getDefinition(scope, definitionId), scope);
+        if (current.draftVersion !== expectedVersion) {
+          throw new FormsPlatformError("DRAFT_CONFLICT", "The form draft changed before publish");
+        }
+        validateRuntimeFormDocument(current.draft);
+        const previous = current.publishedRevisionId ? await store.getRevision(current.publishedRevisionId) : undefined;
+        const publishedAt = dependencies.now();
+        const revision = {
+          id: dependencies.id("revision"),
+          definitionId,
+          revision: (previous?.revision ?? 0) + 1,
+          document: structuredClone(current.draft),
+          digest: await dependencies.digest(JSON.stringify(current.draft)),
+          publishedAt
+        };
+        const definition = {
+          ...current,
+          status: "published",
+          publishedRevisionId: revision.id,
+          publicToken: current.publicToken ?? dependencies.publicToken(),
+          updatedAt: publishedAt
+        };
+        await store.insertRevision(revision);
+        if (!await store.updateDefinition(definition, expectedVersion)) {
+          throw new FormsPlatformError("DRAFT_CONFLICT", "The form changed during publish");
+        }
+        await emit("forms.definition.published", {
+          definitionId,
+          revisionId: revision.id,
+          occurredAt: publishedAt
+        });
+        return { definition, revision };
+      });
+    },
+    async close(scope, definitionId) {
+      const current = requireFormDefinition(await dependencies.store.getDefinition(scope, definitionId), scope);
+      if (current.status !== "published") {
+        throw new FormsPlatformError("FORM_NOT_PUBLISHED", "Only a published form can be closed");
+      }
+      const next = {
+        ...current,
+        status: "closed",
+        updatedAt: dependencies.now()
+      };
+      await dependencies.store.updateDefinition(next);
+      await emit("forms.definition.closed", {
+        definitionId,
+        occurredAt: next.updatedAt
+      });
+      return next;
+    },
+    async archive(scope, definitionId) {
+      const current = requireFormDefinition(await dependencies.store.getDefinition(scope, definitionId), scope);
+      if (current.status === "archived")
+        return current;
+      const next = {
+        ...current,
+        status: "archived",
+        updatedAt: dependencies.now()
+      };
+      await dependencies.store.updateDefinition(next);
+      await emit("forms.definition.archived", {
+        definitionId,
+        occurredAt: next.updatedAt
+      });
+      return next;
+    }
+  };
+}
+
+// src/forms-platform-submission.ts
+import {
+  buildZodWithRelations,
+  compileFormDocument as compileFormDocument2,
+  FORM_AI_FULL_DATA_CONSENT_NOTICE_VERSION
+} from "@lssm/lib.contracts-spec/forms";
+function validateCanonicalFormAnswers(document, answers) {
+  const questionsById = new Map(document.questions.map((question) => [question.id, question]));
+  const portableFieldNames = new Set(Object.keys(document.formSpec?.modelFields ?? {}));
+  const unknownIds = Object.keys(answers).filter((id) => !questionsById.has(id) && !portableFieldNames.has(id));
+  if (unknownIds.length) {
+    throw new FormsPlatformError("INVALID_RESPONSE", `Unknown question IDs: ${unknownIds.join(", ")}`);
+  }
+  for (const question of document.questions) {
+    if (!["single-choice", "multi-select", "dropdown"].includes(question.kind))
+      continue;
+    const value = answers[question.id];
+    if (value == null)
+      continue;
+    const allowed = new Set(question.options?.map((option) => option.value));
+    const valid = question.kind === "multi-select" ? Array.isArray(value) && value.every((item) => typeof item === "string" && allowed.has(item)) : typeof value === "string" && allowed.has(value);
+    if (!valid)
+      throw new FormsPlatformError("INVALID_RESPONSE", `Answer for ${question.id} is not a declared option`);
+  }
+  const runtimeAnswers = Object.fromEntries(Object.entries(answers).map(([id, value]) => [
+    questionsById.get(id)?.name ?? id,
+    value
+  ]));
+  const result = buildZodWithRelations(compileFormDocument2(document)).safeParse(runtimeAnswers);
+  if (!result.success) {
+    throw new FormsPlatformError("INVALID_RESPONSE", `Response does not match the published form: ${String(result.error)}`);
+  }
+}
+function publicDocument(document) {
+  const {
+    kind,
+    version,
+    id,
+    titleKey,
+    descriptionKey,
+    content,
+    questions,
+    pages,
+    verification,
+    formSpec,
+    ai,
+    beforeDestination,
+    afterDestination
+  } = document;
+  return structuredClone({
+    kind,
+    version,
+    id,
+    titleKey,
+    descriptionKey,
+    content,
+    questions,
+    pages,
+    verification,
+    formSpec,
+    ai: {
+      mode: ai.mode,
+      dataMode: ai.dataMode,
+      ...ai.dataMode === "full-with-consent" ? {
+        consentNoticeVersion: FORM_AI_FULL_DATA_CONSENT_NOTICE_VERSION
+      } : {}
+    },
+    beforeDestination,
+    afterDestination
+  });
+}
+async function resolveAssurance(dependencies, evidenceRef, definitionId, publicToken) {
+  if (!evidenceRef)
+    return "anonymous";
+  if (!dependencies.resolveAssurance) {
+    throw new FormsPlatformError("VERIFICATION_UNAVAILABLE", "Verification evidence cannot be resolved");
+  }
+  return dependencies.resolveAssurance(evidenceRef, definitionId, publicToken);
+}
+function createFormsSubmissionService(dependencies) {
+  return {
+    async getPublic(publicToken, localeCandidates) {
+      const definition = await dependencies.store.getDefinitionByPublicToken(publicToken);
+      if (!definition || definition.status !== "published" || !definition.publishedRevisionId) {
+        throw new FormsPlatformError("FORM_NOT_FOUND", "Published form was not found");
+      }
+      const revision = await dependencies.store.getRevision(definition.publishedRevisionId, { publicToken });
+      if (!revision) {
+        throw new FormsPlatformError("REVISION_NOT_FOUND", "Published form revision was not found");
+      }
+      return {
+        definitionId: definition.id,
+        revisionId: revision.id,
+        revision: revision.revision,
+        document: publicDocument(revision.document),
+        locale: resolveFormLocale(revision.document, localeCandidates)
+      };
+    },
+    async submit(input) {
+      const definition = await dependencies.store.getDefinitionByPublicToken(input.publicToken);
+      if (!definition || definition.status !== "published") {
+        throw new FormsPlatformError("FORM_NOT_FOUND", "Form is not accepting responses");
+      }
+      const revision = await dependencies.store.getRevision(input.revisionId, {
+        publicToken: input.publicToken
+      });
+      if (!revision || revision.definitionId !== definition.id) {
+        throw new FormsPlatformError("REVISION_MISMATCH", "Response revision does not match the public session");
+      }
+      validateCanonicalFormAnswers(revision.document, input.answers);
+      const assurance = await resolveAssurance(dependencies, input.verificationEvidenceRef, definition.id, input.publicToken);
+      if (revision.document.verification.timing === "before" && !formAssuranceMeetsRequirement(assurance, revision.document.verification.requirement)) {
+        throw new FormsPlatformError("VERIFICATION_REQUIRED", "Verification is required before submission");
+      }
+      const now = dependencies.now();
+      const response = {
+        id: dependencies.id("response"),
+        definitionId: definition.id,
+        revisionId: revision.id,
+        locale: resolveFormLocale(revision.document, [input.locale]),
+        status: resolveFormResponseStatus(revision.document, assurance),
+        authorAssurance: assurance,
+        answers: structuredClone(input.answers),
+        createdAt: now,
+        updatedAt: now,
+        submittedAt: now
+      };
+      const stored = await dependencies.store.insertResponseIdempotently(response, input.publicToken, input.idempotencyKey);
+      if (!stored.inserted)
+        return stored.response;
+      await dependencies.emit?.("forms.response.submitted", {
+        definitionId: response.definitionId,
+        revisionId: response.revisionId,
+        responseId: response.id,
+        occurredAt: now
+      });
+      return stored.response;
+    }
+  };
+}
+
+// src/forms-platform-csv-columns.ts
+import { flattenPortableFormFields } from "@lssm/lib.contracts-spec/forms";
+function formCsvColumns(document) {
+  const questionNames = new Set(document.questions.map(({ name }) => name));
+  const questions = document.questions.map(questionColumn);
+  const portableSensitive = new Set(document.formSpec?.policy?.pii ?? []);
+  const allFields = flattenPortableFormFields(document.formSpec?.fields ?? []);
+  const portable = Object.entries(document.formSpec?.modelFields ?? {}).flatMap(([name, modelField]) => {
+    if (questionNames.has(name))
+      return [];
+    const field = allFields.find((candidate) => candidate.name === name);
+    return [
+      {
+        id: name,
+        labelKey: field?.labelI18n ?? name,
+        sensitive: portableSensitive.has(name) || [...portableSensitive].some((path) => path.startsWith(`${name}.`)) || field?.kind === "email" || field?.kind === "phone" || modelField.type === "email" || modelField.type === "phone"
+      }
+    ];
+  });
+  return [...questions, ...portable];
+}
+function questionColumn(question) {
+  return {
+    id: question.id,
+    labelKey: question.labelKey,
+    sensitive: question.sensitive === true || question.kind === "email" || question.kind === "phone"
+  };
+}
+
+// src/forms-platform-csv.ts
+var RESPONSE_EXTENSIONS_COLUMN = "response_extensions:AI follow-ups";
+function csvCell(value) {
+  const raw = Array.isArray(value) ? value.every((item) => typeof item !== "object") ? value.join(";") : JSON.stringify(value) : value == null ? "" : typeof value === "object" ? JSON.stringify(value) : String(value);
+  const protectedValue = /^[\s]*[=+\-@]/.test(raw) ? `'${raw}` : raw;
+  return `"${protectedValue.replaceAll('"', '""')}"`;
+}
+function csvRow(values) {
+  return `${values.map(csvCell).join(",")}\r
+`;
+}
+function responseRow(revision, response, options) {
+  if (response.revisionId !== revision.id) {
+    throw new Error("CSV responses must belong to the exported revision");
+  }
+  const columns = formCsvColumns(revision.document);
+  const baseIds = new Set(columns.map(({ id }) => id));
+  const extensions = Object.fromEntries(Object.entries(response.answers).filter(([id]) => !baseIds.has(id)));
+  return [
+    response.id,
+    response.status,
+    response.locale,
+    response.submittedAt ?? "",
+    ...columns.map((column) => {
+      const mayIncludeSensitive = options.includeSensitive && options.sensitiveGrant?.authorized;
+      if (!mayIncludeSensitive && column.sensitive) {
+        return "[REDACTED]";
+      }
+      return response.answers[column.id];
+    }),
+    options.includeSensitive && options.sensitiveGrant?.authorized ? extensions : "[REDACTED]"
+  ];
+}
+function csvHeaders(revision, locale) {
+  const resolved = resolveFormLocale(revision.document, [locale]);
+  const catalog = revision.document.content.catalogs[resolved] ?? {};
+  return [
+    "response_id",
+    "status",
+    "locale",
+    "submitted_at",
+    ...formCsvColumns(revision.document).map((column) => `${column.id}:${catalog[column.labelKey] ?? column.labelKey}`),
+    RESPONSE_EXTENSIONS_COLUMN
+  ];
+}
+function serializeFormResponsesCsv(revision, responses, options = {}) {
+  return `\uFEFF${csvRow(csvHeaders(revision, options.locale))}${responses.map((response) => csvRow(responseRow(revision, response, options))).join("")}`;
+}
+async function* streamFormResponsesCsv(revision, responses, options = {}) {
+  yield `\uFEFF${csvRow(csvHeaders(revision, options.locale))}`;
+  for await (const response of responses) {
+    yield csvRow(responseRow(revision, response, options));
+  }
+}
+// src/forms-platform-navigation.ts
+import {
+  evalPredicate
+} from "@lssm/lib.contracts-spec/forms";
+function resolveNextFormPage(document, currentPageId, answers) {
+  const currentIndex = document.pages.findIndex((page) => page.id === currentPageId);
+  if (currentIndex < 0) {
+    throw new FormsPlatformError("PAGE_NOT_FOUND", "Current form page does not exist");
+  }
+  const rule = document.pages[currentIndex]?.nextPageRules?.find((candidate) => evalPredicate(answers, candidate.when));
+  return rule?.nextPageId ?? document.pages[currentIndex]?.defaultNextPageId ?? document.pages[currentIndex + 1]?.id;
+}
+
+// src/forms-platform.ts
+function createFormsPlatformService(dependencies) {
+  return {
+    ...createFormsManagementService(dependencies),
+    ...createFormsSubmissionService(dependencies)
+  };
+}
+// src/redaction.ts
+var SECRET_KEY_PATTERN = /(?:token|secret|password|passwd|authorization|api[_-]?key|credential|cookie|session)/i;
+var REDACTED = "[REDACTED]";
+function redactSecrets(value) {
+  if (Array.isArray(value))
+    return value.map(redactSecrets);
+  if (value === null || typeof value !== "object")
+    return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    out[key] = SECRET_KEY_PATTERN.test(key) ? REDACTED : redactSecrets(child);
+  }
+  return out;
+}
+var identityEncryption = {
+  encrypt: (value) => value,
+  decrypt: (value) => value
+};
+function hashKey(key) {
+  let hash = 2166136261;
+  for (let index = 0;index < key.length; index += 1) {
+    hash ^= key.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+var redactionDoc = {
+  id: "docs.contracts-runtime-core.redaction",
+  title: "Persisted-state redaction + encryption-at-rest seam",
+  summary: "Secret redaction for durable state plus an encryption-at-rest seam and a PII-safe key hash for logs.",
+  kind: "reference",
+  visibility: "internal",
+  route: "/docs/contracts-runtime-core/redaction",
+  domain: "contracts-runtime-core",
+  owners: ["@contractspec-core"],
+  tags: ["contracts-runtime-core", "security", "redaction", "encryption"],
+  body: "redactSecrets recursively strips secret-ish keys (token/secret/password/authorization/api-key/credential/cookie/session) so durable cache+queue state never persists secrets (AC12). EncryptionSeam is the encryption-at-rest seam — default identityEncryption (no-op); sensitive entities plug a real cipher transparently to the storage core. hashKey (FNV-1a) lets observability correlate on a stable key id without logging the raw query key (which embeds input/PII)."
+};
+// src/storage/keyed-store.ts
+function createKeyedStorage(driver, options = {}) {
+  const encryption = options.encryption ?? identityEncryption;
+  const redact = options.redact;
+  const prefix = options.namespace ?? "";
+  const toDriverKey = (key) => `${prefix}${key}`;
+  const fromDriverKey = (key) => prefix !== "" && key.startsWith(prefix) ? key.slice(prefix.length) : key;
+  return {
+    async get(key) {
+      const raw = await driver.getItem(toDriverKey(key));
+      if (raw === null)
+        return;
+      const json = await encryption.decrypt(raw);
+      return JSON.parse(json);
+    },
+    async set(key, value) {
+      const json = JSON.stringify(redact === undefined ? value : redact(value));
+      await driver.setItem(toDriverKey(key), await encryption.encrypt(json));
+    },
+    async remove(key) {
+      await driver.removeItem(toDriverKey(key));
+    },
+    async keys(filter) {
+      const raw = await driver.keys();
+      const scoped = prefix === "" ? raw : raw.filter((key) => key.startsWith(prefix)).map(fromDriverKey);
+      return filter === undefined ? scoped : scoped.filter((key) => key.startsWith(filter));
+    },
+    async clear() {
+      await driver.clear();
+    }
+  };
+}
+// src/storage/port.ts
+var storagePortDoc = {
+  id: "docs.contracts-runtime-core.storage-port",
+  title: "Durable storage port (I/O-free contract)",
+  summary: "Value-agnostic durable key/value port; platform impls own serialization, redaction, and encryption-at-rest.",
+  kind: "reference",
+  visibility: "internal",
+  route: "/docs/contracts-runtime-core/storage-port",
+  domain: "contracts-runtime-core",
+  owners: ["@contractspec-core"],
+  tags: ["contracts-runtime-core", "storage", "persistence", "port"],
+  body: "Durable key/value StoragePort: get/set/remove/keys/clear. Intentionally value-agnostic — the engine layers CacheEntry and MutationQueueEntry shapes on top and namespaces by key prefix. keys(prefix?) supports GC and offline-queue scans. Implementations persist JSON-serializable values and own serialization, per-contract secret redaction, and the encryption-at-rest seam (AC12). B1a ships an in-memory default (createMemoryStorage); IndexedDB (web) and SQLite/AsyncStorage (native) platform variants land in B1b/#7 behind this same contract."
+};
+// src/transport.ts
+var transportPortDoc = {
+  id: "docs.contracts-runtime-core.transport",
+  title: "Transport port + absorbed data-transmission concept map",
+  summary: "One Transport port carries the canonical protocol; each former data-transmission concept has an explicit home.",
+  kind: "reference",
+  visibility: "internal",
+  route: "/docs/contracts-runtime-core/transport",
+  domain: "contracts-runtime-core",
+  owners: ["@contractspec-core"],
+  tags: ["contracts-runtime-core", "transport", "data-transmission", "port"],
+  body: [
+    "The single Transport port: execute(envelope, ctx) → Promise<ContractResult<QueryResultEnvelope>>, plus an optional subscribe(tags, handler) realtime seam. REST/MCP/WebSocket/in-memory are interchangeable adapters behind it.",
+    "",
+    "Absorbed data-transmission concept map (each former concept has exactly one explicit home — no parallel transport types):",
+    "- idempotency → ContractResult success field (ContractResultIdempotency{key,replayed?,firstSeenAt?} on ContractSuccess.idempotency). NOT a transport argument.",
+    "- subscriptions → Transport.subscribe(tags, handler) seam (no spec type, by design); the version token doubles as the realtime invalidation token. Full delivery is a follow-on; the realtime worker migrates onto this seam in Phase 7.",
+    "- invalidation → the InvalidationTag{entity,id?} vocabulary (contracts-spec/query/invalidation) shared by optimistic updates, offline-queue replay, and realtime broadcast; mutations declare the tags they invalidate.",
+    "- consistency levels → the typed QueryEnvelope.consistency request field and ContractSuccess.consistency applied field (QueryConsistency = eventual | read-your-writes | strong, default read-your-writes). Typed, never prose. Subsumes the former DataFetchConsistency incl. read-your-writes.",
+    "",
+    "TransportContext.principal is opaque and carried end-to-end unchanged (AC14, no-strip); policy.auth enforcement stays in authos/identity-rbac."
+  ].join(`
+`)
+};
+export {
+  ContractsRuntimeCoreFeature,
+  FormsPlatformError,
+  authExpiredState,
+  backoffDelayMs,
+  computeIsStale,
+  conflictState,
+  createCacheStore,
+  createConflictResolverRegistry,
+  createDataEngine,
+  createDataEngineFromEnv,
+  createEngineEvents,
+  createFormsPlatformService,
+  createInflightRegistry,
+  createKeyedStorage,
+  createMaintenance,
+  createMemoryApprovalNonceStore,
+  createMemoryStorage,
+  createMutationEngine,
+  createMutationQueue,
+  createNoCacheStore,
+  createOnlineOnlyMutationEngine,
+  createOperationApprovalPort,
+  createQueryEngine,
+  createStaticReachabilitySource,
+  errorState,
+  hashKey,
+  identityEncryption,
+  idleState,
+  isLocalOfflineMode,
+  isNetworkAllowed,
+  loadingState,
+  offlineState,
+  operationApprovalInputDigest,
+  reachabilityPortDoc,
+  readHostEnv,
+  redactSecrets,
+  redactionDoc,
+  resolveFormLocale,
+  resolveLocalOfflinePolicy,
+  resolveNextFormPage,
+  resolveQueuedConflict,
+  restoreSnapshots,
+  serializeFormResponsesCsv,
+  storagePortDoc,
+  streamFormResponsesCsv,
+  successState,
+  transportPortDoc
+};