@lssm/lib.contracts-spec 17.3.2

package/dist/node/app-config/app-config.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as a,defineQuery as r}from"../operations/index.js";import{OwnersEnum as n,StabilityEnum as i,TagsEnum as s}from"../ownership.js";const u=new t({name:"BrandingAssetInput",fields:{type:{type:e.String_unsecure(),isOptional:!1},url:{type:e.URL(),isOptional:!1},mimeType:{type:e.String_unsecure(),isOptional:!0}}}),d=new t({name:"UpdateTenantBrandingInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},environment:{type:e.String_unsecure(),isOptional:!0},appName:{type:e.JSONObject(),isOptional:!0},assets:{type:u,isOptional:!0,isArray:!0},colors:{type:e.JSONObject(),isOptional:!0},customDomain:{type:e.String_unsecure(),isOptional:!0},subdomain:{type:e.String_unsecure(),isOptional:!0}}}),o=new t({name:"UpdateTenantBrandingOutput",fields:{success:{type:e.Boolean(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),c=new t({name:"VerifyCustomDomainInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},domain:{type:e.String_unsecure(),isOptional:!1}}}),g=new t({name:"VerifyCustomDomainOutput",fields:{status:{type:e.String_unsecure(),isOptional:!1},message:{type:e.String_unsecure(),isOptional:!0}}}),p=new t({name:"TranslationEntryInput",fields:{key:{type:e.String_unsecure(),isOptional:!1},locale:{type:e.String_unsecure(),isOptional:!0},value:{type:e.String_unsecure(),isOptional:!1},context:{type:e.String_unsecure(),isOptional:!0}}}),m=new t({name:"UpdateBlueprintTranslationInput",fields:{blueprintName:{type:e.String_unsecure(),isOptional:!1},blueprintVersion:{type:e.Int_unsecure(),isOptional:!1},catalogName:{type:e.String_unsecure(),isOptional:!1},catalogVersion:{type:e.String_unsecure(),isOptional:!1},defaultLocale:{type:e.String_unsecure(),isOptional:!1},supportedLocales:{type:e.String_unsecure(),isOptional:!1,isArray:!0},entries:{type:p,isOptional:!1,isArray:!0}}}),y=new t({name:"UpdateTenantTranslationInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},entries:{type:p,isOptional:!1,isArray:!0},defaultLocale:{type:e.String_unsecure(),isOptional:!0},enabledLocales:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}}),f=new t({name:"MessageResolutionInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},locale:{type:e.String_unsecure(),isOptional:!0},key:{type:e.String_unsecure(),isOptional:!1}}}),O=new t({name:"MessageResolutionOutput",fields:{value:{type:e.String_unsecure(),isOptional:!0},source:{type:e.String_unsecure(),isOptional:!0}}});export const UpdateTenantBrandingCommand=a({meta:{key:"appConfig.updateTenantBranding",version:"1.0.0",description:"Applies tenant branding overrides (names, assets, domains).",owners:[n.PlatformSigil],tags:["branding"],stability:i.Beta,goal:"Maintain tenant-specific branding assets and domains.",context:"Invoked by the Studio or automation when a tenant updates branding settings."},io:{input:d,output:o},policy:{auth:"admin",policies:[{key:"platform.app-config.manage",version:"1.0.0"}]}}),VerifyCustomDomainCommand=a({meta:{key:"appConfig.verifyCustomDomain",version:"1.0.0",description:"Validates DNS ownership for tenant custom domains.",owners:[n.PlatformSigil],tags:["branding"],stability:i.Experimental,goal:"Confirm tenant-provided domains before activation.",context:"Triggered after the tenant adds DNS records to verify domain ownership."},io:{input:c,output:g},policy:{auth:"admin",policies:[{key:"platform.app-config.manage",version:"1.0.0"}]}}),UpdateBlueprintTranslationCatalogCommand=a({meta:{key:"appConfig.updateBlueprintTranslationCatalog",version:"1.0.0",description:"Registers or updates translation entries for a blueprint.",owners:[n.PlatformSigil],tags:[s.I18n],stability:i.Beta,goal:"Keep blueprint translation catalogs in sync with shipped copy.",context:"Executed by platform automation or CI when committing updated translation catalogs."},io:{input:m,output:o},policy:{auth:"admin",policies:[{key:"platform.app-config.manage",version:"1.0.0"}]}}),UpdateTenantTranslationOverridesCommand=a({meta:{key:"appConfig.updateTenantTranslations",version:"1.0.0",description:"Applies tenant-specific translation entries.",owners:[n.PlatformSigil],tags:[s.I18n],stability:i.Beta,goal:"Allow tenants to override selected message keys.",context:"Called by the Studio when a tenant customizes labels or copy for their locale."},io:{input:y,output:o},policy:{auth:"admin",policies:[{key:"platform.app-config.manage",version:"1.0.0"}]}}),GetResolvedBrandingQuery=r({meta:{key:"appConfig.getResolvedBranding",version:"1.0.0",description:"Returns the resolved branding for a tenant/app/environment.",owners:[n.PlatformSigil],tags:["branding"],stability:i.Beta,goal:"Expose hydrated branding assets for rendering UI/email experiences.",context:"Used by runtime surfaces to fetch brand assets prior to rendering tenant-specific experiences."},io:{input:new t({name:"GetResolvedBrandingInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},environment:{type:e.String_unsecure(),isOptional:!0}}}),output:new t({name:"GetResolvedBrandingOutput",fields:{branding:{type:e.JSONObject(),isOptional:!1}}})},policy:{auth:"admin",policies:[{key:"platform.app-config.read",version:"1.0.0"}]}}),ResolveMessageQuery=r({meta:{key:"appConfig.resolveMessage",version:"1.0.0",description:"Resolves a translation key for a tenant in the requested locale.",owners:[n.PlatformSigil],tags:[s.I18n],stability:i.Experimental,goal:"Expose a server-side API for resolving message keys on demand.",context:"Used by backend services or scripts that need translated copy outside the front-end runtime."},io:{input:f,output:O},policy:{auth:"admin",policies:[{key:"platform.app-config.read",version:"1.0.0"}]}}),appConfigOperations={UpdateTenantBrandingCommand,VerifyCustomDomainCommand,UpdateBlueprintTranslationCatalogCommand,UpdateTenantTranslationOverridesCommand,GetResolvedBrandingQuery,ResolveMessageQuery};export function registerAppConfigOperations(l){return l.register(UpdateTenantBrandingCommand).register(VerifyCustomDomainCommand).register(UpdateBlueprintTranslationCatalogCommand).register(UpdateTenantTranslationOverridesCommand).register(GetResolvedBrandingQuery).register(ResolveMessageQuery)}

package/dist/node/app-config/app-config.feature.js

@@ -0,0 +1 @@
+import{defineFeature as e}from"../features/index.js";export const AppConfigFeature=e({meta:{key:"app-config",version:"1.0.0",title:"App Configuration",description:"Tenant app configuration lifecycle management with draft, preview, and publish stages",domain:"platform",owners:["@platform.sigil"],tags:["app-config","lifecycle","configuration","tenant"],stability:"beta"},operations:[],events:[{key:"app_config.draft_created",version:"1.0.0"},{key:"app_config.promoted_to_preview",version:"1.0.0"},{key:"app_config.published",version:"1.0.0"},{key:"app_config.rolled_back",version:"1.0.0"}],presentations:[],opToPresentation:[],presentationsTargets:[],capabilities:{provides:[{key:"app-config",version:"1.0.0"}],requires:[]}});

package/dist/node/app-config/events.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as n}from"@lssm/lib.schema";import{defineEvent as t}from"../events.js";import{OwnersEnum as a,StabilityEnum as o,TagsEnum as s}from"../ownership.js";const i={title:"Tenant App Config Lifecycle",description:"Events emitted when tenant app configurations move through lifecycle stages.",domain:"app-config.lifecycle",owners:[a.PlatformSigil],tags:[s.Hygiene],stability:o.Beta};export const ConfigDraftCreatedEvent=t({meta:{...i,key:"app_config.draft_created",version:"1.0.0",description:"A new tenant config draft was created."},payload:new n({name:"ConfigDraftCreatedPayload",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},version:{type:e.String_unsecure(),isOptional:!1},blueprintName:{type:e.String_unsecure(),isOptional:!1},blueprintVersion:{type:e.String_unsecure(),isOptional:!1},createdBy:{type:e.String_unsecure(),isOptional:!1},clonedFrom:{type:e.Int_unsecure(),isOptional:!0}}})}),ConfigPromotedToPreviewEvent=t({meta:{...i,key:"app_config.promoted_to_preview",version:"1.0.0",description:"A tenant config draft was promoted to preview."},payload:new n({name:"ConfigPromotedToPreviewPayload",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},version:{type:e.String_unsecure(),isOptional:!1},promotedBy:{type:e.String_unsecure(),isOptional:!1},warnings:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}})}),ConfigPublishedEvent=t({meta:{...i,key:"app_config.published",version:"1.0.0",description:"A tenant config version was published to production."},payload:new n({name:"ConfigPublishedPayload",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},version:{type:e.String_unsecure(),isOptional:!1},previousVersion:{type:e.String_unsecure(),isOptional:!0},publishedBy:{type:e.String_unsecure(),isOptional:!1},changeSummary:{type:e.String_unsecure(),isOptional:!0},changedSections:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}})}),ConfigRolledBackEvent=t({meta:{...i,key:"app_config.rolled_back",version:"1.0.0",description:"A tenant config was rolled back to a previous version."},payload:new n({name:"ConfigRolledBackPayload",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},newVersion:{type:e.String_unsecure(),isOptional:!1},rolledBackFrom:{type:e.String_unsecure(),isOptional:!1},rolledBackTo:{type:e.String_unsecure(),isOptional:!1},rolledBackBy:{type:e.String_unsecure(),isOptional:!1},reason:{type:e.String_unsecure(),isOptional:!1}}})});

package/dist/node/app-config/index.js

@@ -0,0 +1 @@
+export*from"./app-config.capability.js";export*from"./app-config.feature.js";export*from"./branding.js";export*from"./events.js";export*from"./integrations.js";export*from"./lifecycle.js";export*from"./lifecycle-contracts.js";export*from"./runtime.js";export*from"./spec.js";export*from"./validation.js";

package/dist/node/app-config/lifecycle-contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as s,defineQuery as r}from"../operations/index.js";import{OwnersEnum as n,StabilityEnum as i,TagsEnum as o}from"../ownership.js";import{ConfigDraftCreatedEvent as f,ConfigPromotedToPreviewEvent as c,ConfigPublishedEvent as g,ConfigRolledBackEvent as y}from"./events.js";const a={auth:"admin",policies:[{key:"platform.app-config.manage",version:"1.0.0"}]},p={auth:"admin",policies:[{key:"platform.app-config.read",version:"1.0.0"}]},l=new t({name:"ConfigVersionRecord",fields:{meta:{type:e.JSONObject(),isOptional:!1},config:{type:e.JSONObject(),isOptional:!1}}}),m=new t({name:"ConfigTransitionRecord",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},fromStatus:{type:e.String_unsecure(),isOptional:!1},toStatus:{type:e.String_unsecure(),isOptional:!1},version:{type:e.String_unsecure(),isOptional:!1},timestamp:{type:e.DateTime(),isOptional:!1},actor:{type:e.String_unsecure(),isOptional:!1},reason:{type:e.String_unsecure(),isOptional:!0}}}),d=new t({name:"CreateTenantConfigDraftInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},blueprintName:{type:e.String_unsecure(),isOptional:!1},blueprintVersion:{type:e.Int_unsecure(),isOptional:!1},environment:{type:e.String_unsecure(),isOptional:!0},fromVersion:{type:e.String_unsecure(),isOptional:!0},createdBy:{type:e.String_unsecure(),isOptional:!1}}}),O=new t({name:"CreateTenantConfigDraftOutput",fields:{version:{type:e.String_unsecure(),isOptional:!1},status:{type:e.String_unsecure(),isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}});export const CreateTenantConfigDraftCommand=s({meta:{key:"appConfig.lifecycle.createDraft",version:"1.0.0",description:"Creates a new draft tenant config version.",owners:[n.PlatformSigil],tags:[o.Hygiene,"app-config"],stability:i.Experimental,goal:"Allow operators to start editing a new tenant config version.",context:"Invoked by the Studio or automation when starting a new configuration run."},io:{input:d,output:O},policy:a,sideEffects:{emits:[{ref:f.meta,when:"after successful draft creation"}]}});const C=new t({name:"PromoteTenantConfigPreviewInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},version:{type:e.String_unsecure(),isOptional:!1},promotedBy:{type:e.String_unsecure(),isOptional:!1}}}),S=new t({name:"PromoteTenantConfigPreviewOutput",fields:{version:{type:e.String_unsecure(),isOptional:!1},status:{type:e.String_unsecure(),isOptional:!1},warnings:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}});export const PromoteTenantConfigToPreviewCommand=s({meta:{key:"appConfig.lifecycle.promoteToPreview",version:"1.0.0",description:"Promotes a draft tenant config to preview/testing state.",owners:[n.PlatformSigil],tags:[o.Hygiene,"app-config"],stability:i.Experimental,goal:"Enable validation and testing of draft configurations.",context:"Called when a draft passes initial checks and should be exposed to preview environments."},io:{input:C,output:S},policy:a,sideEffects:{emits:[{ref:c.meta,when:"after promotion to preview"}]}});const v=new t({name:"PublishTenantConfigInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},version:{type:e.String_unsecure(),isOptional:!1},environment:{type:e.String_unsecure(),isOptional:!0},publishedBy:{type:e.String_unsecure(),isOptional:!1},changeSummary:{type:e.String_unsecure(),isOptional:!0}}}),w=new t({name:"PublishTenantConfigOutput",fields:{version:{type:e.String_unsecure(),isOptional:!1},status:{type:e.String_unsecure(),isOptional:!1},previousVersion:{type:e.String_unsecure(),isOptional:!0},publishedAt:{type:e.DateTime(),isOptional:!1}}});export const PublishTenantConfigCommand=s({meta:{key:"appConfig.lifecycle.publish",version:"1.0.0",description:"Publishes a preview tenant config to production.",owners:[n.PlatformSigil],tags:[o.Hygiene,"app-config"],stability:i.Experimental,goal:"Promote tested configurations to production safely.",context:"Triggered after validation passes and change management approvals are complete."},io:{input:v,output:w},policy:a,sideEffects:{emits:[{ref:g.meta,when:"after publish succeeds"}]}});const I=new t({name:"RollbackTenantConfigInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},toVersion:{type:e.String_unsecure(),isOptional:!1},environment:{type:e.String_unsecure(),isOptional:!0},rolledBackBy:{type:e.String_unsecure(),isOptional:!1},reason:{type:e.String_unsecure(),isOptional:!1}}}),b=new t({name:"RollbackTenantConfigOutput",fields:{newVersion:{type:e.String_unsecure(),isOptional:!1},status:{type:e.String_unsecure(),isOptional:!1},rolledBackFrom:{type:e.Int_unsecure(),isOptional:!1}}});export const RollbackTenantConfigCommand=s({meta:{key:"appConfig.lifecycle.rollback",version:"1.0.0",description:"Rolls back to a previously published tenant config version.",owners:[n.PlatformSigil],tags:[o.Hygiene,"app-config"],stability:i.Experimental,goal:"Provide rapid recovery when new configs regress production.",context:"Called manually or automatically when monitoring detects regression and a rollback is required."},io:{input:I,output:b},policy:a,sideEffects:{emits:[{ref:y.meta,when:"after rollback completes"}]}});const h=new t({name:"ListTenantConfigVersionsInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1}}}),_=new t({name:"ListTenantConfigVersionsOutput",fields:{versions:{type:l,isOptional:!1,isArray:!0},transitions:{type:m,isOptional:!0,isArray:!0}}});export const ListTenantConfigVersionsQuery=r({meta:{key:"appConfig.lifecycle.listVersions",version:"1.0.0",description:"Lists all versions of a tenant configuration.",owners:[n.PlatformSigil],tags:["app-config",o.Hygiene],stability:i.Experimental,goal:"Support lifecycle views and change audit tooling.",context:"Used by the Studio to render history timelines and by automation for change tracking."},io:{input:h,output:_},policy:p});const P=new t({name:"GetTenantConfigVersionInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},version:{type:e.String_unsecure(),isOptional:!1}}}),T=new t({name:"GetTenantConfigVersionOutput",fields:{version:{type:l,isOptional:!1}}});export const GetTenantConfigVersionQuery=r({meta:{key:"appConfig.lifecycle.getVersion",version:"1.0.0",description:"Fetches a single tenant config version by id.",owners:[n.PlatformSigil],tags:["app-config",o.Hygiene],stability:i.Experimental,goal:"Allow detail drill-down for lifecycle entries.",context:"Used by automation to fetch config payloads for comparison or export."},io:{input:P,output:T},policy:p}),lifecycleContracts={CreateTenantConfigDraftCommand,PromoteTenantConfigToPreviewCommand,PublishTenantConfigCommand,RollbackTenantConfigCommand,ListTenantConfigVersionsQuery,GetTenantConfigVersionQuery};export function registerAppConfigLifecycleContracts(u){return u.register(CreateTenantConfigDraftCommand).register(PromoteTenantConfigToPreviewCommand).register(PublishTenantConfigCommand).register(RollbackTenantConfigCommand).register(ListTenantConfigVersionsQuery).register(GetTenantConfigVersionQuery)}

package/dist/node/app-config/runtime.js

@@ -0,0 +1 @@
+import{createLegacyDesignSelectionPolicy as E,createLegacyThemeDesignPack as V,resolveDesignSelection as O}from"../design-packs/index.js";import{isKnowledgeSourceAvailableForBinding as M}from"../knowledge/source.js";export function resolveAppConfig(e,i,n={}){const t=j(e.capabilities,i.capabilities),o=L(e.features,i.features),s=x(e.dataViews??{},i.dataViewOverrides),r=x(e.workflows??{},i.workflowOverrides),c=x(e.jobs??{},i.jobOverrides),p=N(e.policies??[],i.additionalPolicies??[]),f=W(e.theme,i.themeOverride),g=e.design??e.designPolicy,v=!g&&f,a=g??(v?E(v):void 0),u=i.design??i.designPolicy,y=a?O({policy:a,tenantPolicy:g?u:void 0,userSelection:n.userDesignSelection,available:g?n.availableDesignPacks:void 0,editorialFallback:n.editorialDesignPack}):void 0,S=U(e.telemetry,i.telemetryOverride),d=_(e.experiments,i.experiments),l=z(e.featureFlags??[],i.featureFlags??[]),m=H(e.routes??[],i.routeOverrides??[]),{resolved:R}=F(e.integrationSlots,i.integrations,n.integrationConnections,n.integrationSpecs),A=Y(i.knowledge,n.knowledgeSpaces,n.knowledgeSources,{tenantId:i.meta.tenantId,environment:i.meta.environment}),P=G(e.branding,i),b=X(e.translationCatalog,i.locales,i.translationOverrides);return{appId:e.meta.appId,tenantId:i.meta.tenantId,environment:i.meta.environment,blueprintName:e.meta.key,blueprintVersion:e.meta.version,configVersion:i.meta.version,capabilities:t,features:o,dataViews:s,workflows:r,jobs:c,policies:p,theme:f,design:y,designSelection:y,telemetry:S,experiments:d,featureFlags:l,routes:m,integrations:R,knowledge:A,translation:b,branding:P,aiDiscovery:e.aiDiscovery,notes:i.notes??e.notes}}export function composeAppConfig(e,i,n,t={}){const o=resolveAppConfig(e,i,n),s=[],r=F(e.integrationSlots,i.integrations,n.integrationConnections,n.integrationSpecs);o.integrations=r.resolved;s.push(...r.missing);s.push(...Z(i.knowledge??[],n.knowledgeSpaces,n.knowledgeSources,{tenantId:i.meta.tenantId,environment:i.meta.environment}));const c=ee(o.capabilities.enabled,n.capabilities,s),p=ne(o.features.include,n.features,s),f=D(o.dataViews,n.dataViews,"dataView",s),g=D(o.workflows,n.workflows,"workflow",s),v=D(o.jobs,n.jobs,"job",s),a=ie(o.policies,n.policies,s),{theme:u,fallbacks:y,themeMissing:S}=te(o.theme,n.themes);s.push(...S);const d=!e.design&&!e.designPolicy&&o.theme?V(o.theme.primary):void 0,l=d??(o.designSelection?n.designPacks?.get(o.designSelection.designPack.key,o.designSelection.designPack.version):void 0);if(o.designSelection&&n.designPacks&&!l&&!d)s.push({type:"designPack",identifier:`${o.designSelection.designPack.key}@${o.designSelection.designPack.version}`});const{telemetry:m,telemetryMissing:R}=oe(o.telemetry,n.telemetry);s.push(...R);const A=se(o.experiments,n.experiments,s);if(t.strict&&s.length>0){const P=s.map((b)=>`${b.type}:${b.identifier}`).join(", ");throw Error(`composeAppConfig: missing references -> ${P}`)}return{resolved:o,capabilities:c,features:p,dataViews:f,workflows:g,jobs:v,policies:a,theme:u,themeFallbacks:y,designPack:l,telemetry:m,experiments:A,integrations:o.integrations,knowledge:o.knowledge,missing:s}}function j(e,i){const n=w([...e?.enabled??[],...i?.enable??[]],h),t=w([...e?.disabled??[],...i?.disable??[]],h),o=new Set(t.map(h));return{enabled:n.filter((r)=>!o.has(h(r))),disabled:t}}function L(e,i){const n=w([...e?.include??[],...i?.include??[]],C),t=w([...e?.exclude??[],...i?.exclude??[]],C),o=new Set(t.map(C));return{include:n.filter((r)=>!o.has(C(r))),exclude:t}}function x(e,i){const n={...e};if(!i)return n;for(const t of i){if(!t)continue;if(!t.pointer)delete n[t.slot];else n[t.slot]=t.pointer}return n}function N(e,i){return w([...e,...i],B)}function W(e,i){if(!e&&!i)return;const n=i?.primary??e?.primary;if(!n)return;const t=i?.fallbacks??e?.fallbacks??[];return{primary:n,fallbacks:t}}function U(e,i){if(!e&&!i)return;const n={spec:e?.spec,disabledEvents:e?.disabledEvents?[...e.disabledEvents]:void 0,samplingOverrides:e?.samplingOverrides?{...e.samplingOverrides}:void 0};if(i?.spec!==void 0)n.spec=i.spec??void 0;if(i?.disabledEvents)n.disabledEvents=K([...n.disabledEvents??[],...i.disabledEvents]);if(i?.samplingOverrides)n.samplingOverrides={...n.samplingOverrides??{},...i.samplingOverrides};if(!n.spec&&!n.disabledEvents?.length)return;return n}function _(e,i){const n=e?.active??[],t=e?.paused??[],o=i?.active,s=i?.paused,r=o&&o.length>0?o:n,c=s&&s.length>0?s:t,p=w(r,k);let f=w(c,k);const g=new Set(p.map(k));f=f.filter((a)=>!g.has(k(a)));return{catalog:w([...n,...t,...o??[],...s??[]],k),active:p,paused:f}}function q(e){if(!e)return{};const i={};for(const[n,t]of Object.entries(e))if(t!==void 0)i[n]=t;return i}function I(e,i){if(!e&&!i)return;return{...e??{},...q(i)}}function G(e,i){const{branding:n,meta:t}=i,o="app.localhost",s=n?.customDomain??(n?.subdomain?`${n.subdomain}.${o}`:`${t.tenantId}.${o}`),r=[];if(i.locales?.defaultLocale)r.push(i.locales.defaultLocale);if(n?.appName)r.push("default","en");let c;if(n?.appName){for(const d of r){const l=n.appName[d];if(l){c=l;break}}if(!c){const[,d]=Object.entries(n.appName)[0]??[];if(typeof d==="string")c=d}}if(!c)c=e?.appNameKey??t.appId;const p=new Map,f=(d)=>{if(!d)return;for(const l of d){if(!l?.type)continue;if("url"in l&&l.url)p.set(l.type,l.url)}};f(e?.assets);f(n?.assets);const g={logo:p.get("logo"),logoDark:p.get("logo-dark"),favicon:p.get("favicon"),ogImage:p.get("og-image")},v={primary:n?.colors?.primary??e?.colorTokens?.primary??"#1f2937",secondary:n?.colors?.secondary??e?.colorTokens?.secondary??"#4b5563"},a=I(e?.iconSet,n?.iconSet),u=I(e?.manifest,n?.manifest),y=I(e?.seo?.verification,n?.verification),S=J(e?.seo,g.ogImage,y);return{appName:c,assets:g,colors:v,domain:s,...S?{seo:S}:{},...a?{iconSet:a}:{},...u?{manifest:u}:{},...y?{verification:y}:{}}}function J(e,i,n){if(!e)return;const t=e.ogDefaults?.url??i;let o;if(e.ogDefaults||t){o={...e.ogDefaults??{}};if(t)o.url=t}return{...e,...o?{ogDefaults:o}:{},...n?{verification:n}:{}}}function X(e,i,n){const t=i?.defaultLocale??"en",o=i?.enabledLocales??[],s=K([t,...o]),r=n?.entries??[];return{defaultLocale:t,supportedLocales:s,blueprintCatalog:e,tenantOverrides:r}}function z(e,i){const n=new Map;for(const t of e)n.set(t.key,{...t});for(const t of i)n.set(t.key,{...t});return[...n.values()]}function H(e,i){const n=new Map;for(const t of e)n.set(t.path,{...t});for(const t of i){const o=n.get(t.path)??{path:t.path};if(t.label!==void 0)if(t.label===null)delete o.label;else o.label=t.label;if(t.dataView!==void 0)if(t.dataView===null)delete o.dataView;else o.dataView=t.dataView;if(t.workflow!==void 0)if(t.workflow===null)delete o.workflow;else o.workflow=t.workflow;if(t.guard!==void 0)if(t.guard===null)delete o.guard;else o.guard=t.guard;if(t.featureFlag!==void 0)if(t.featureFlag===null)delete o.featureFlag;else o.featureFlag=t.featureFlag;if(t.experiment!==void 0)if(t.experiment===null)delete o.experiment;else o.experiment=t.experiment;n.set(o.path,o)}return[...n.values()]}function F(e,i,n,t){const o=[],s=[],r=new Set,c=(a)=>{const u=`${a.type}:${a.identifier}`;if(r.has(u))return;r.add(u);s.push(a)},p=e??[],f=new Map;for(const a of p)f.set(a.slotId,a);const g=new Map;for(const a of i??[]){if(!f.get(a.slotId)){c({type:"integrationSlot",identifier:`slot:${a.slotId}`});continue}const y=g.get(a.slotId);if(y)y.push(a);else g.set(a.slotId,[a])}for(const a of p){const u=g.get(a.slotId)??[];if(a.required&&u.length===0)c({type:"integrationSlot",identifier:`slot:${a.slotId}`})}if(!n||!t)return{resolved:o,missing:s};const v=new Map;for(const a of n)v.set(a.meta.id,a);for(const a of p){const u=g.get(a.slotId)??[];if(u.length===0)continue;const y=[...u].sort((d,l)=>{const m=d.priority??Number.MAX_SAFE_INTEGER,R=l.priority??Number.MAX_SAFE_INTEGER;if(m===R)return 0;return m<R?-1:1});let S=!1;for(const d of y){const l=v.get(d.connectionId);if(!l){c({type:"integrationConnection",identifier:`connection:${d.connectionId}`});continue}const m=t.get(l.meta.integrationKey,l.meta.integrationVersion);if(!m){c({type:"integrationSpec",identifier:`spec:${l.meta.integrationKey}.v${l.meta.integrationVersion}`});continue}if(m.meta.category!==a.requiredCategory){c({type:"integrationSpec",identifier:`spec:${m.meta.key}.category`});continue}if(!m.supportedModes.includes(l.ownershipMode)){c({type:"integrationSpec",identifier:`spec:${m.meta.key}.mode:${l.ownershipMode}`});continue}if(a.allowedModes&&a.allowedModes.length>0&&!a.allowedModes.includes(l.ownershipMode)){c({type:"integrationConnection",identifier:`connection:${l.meta.id}:mode`});continue}if(a.requiredCapabilities&&!a.requiredCapabilities.every((R)=>Q(m,R))){c({type:"integrationSpec",identifier:`spec:${m.meta.key}.capabilities`});continue}o.push({slot:a,binding:d,connection:l,spec:m});S=!0;break}if(!S&&a.required)c({type:"integrationSlot",identifier:`slot:${a.slotId}`})}return{resolved:o,missing:s}}function Q(e,i){return e.capabilities.provides.some((n)=>{if(n.key!==i.key)return!1;if(i.version==null)return!0;return n.version===i.version})}function Y(e,i,n,t){if(!e?.length||!i)return[];const o=n??[];return e.map((s)=>{const r=i.get(s.spaceKey,s.spaceVersion);if(!r)return null;const c=o.filter((p)=>{return M(p,s,t)});return{binding:s,space:r,sources:c}}).filter((s)=>s!==null)}function Z(e,i,n,t){if(!e.length||!i)return[];const o=[],s=n??[];for(const r of e){if(!i.get(r.spaceKey,r.spaceVersion)){o.push({type:"knowledgeSpace",identifier:r.spaceVersion?`${r.spaceKey}@${r.spaceVersion}`:r.spaceKey});continue}if(n){if(s.filter((f)=>{return M(f,r,t)}).length===0)o.push({type:"knowledgeSource",identifier:r.spaceVersion?`${r.spaceKey}@${r.spaceVersion}`:r.spaceKey})}}return o}function ee(e,i,n){if(!i){if(e.length>0)for(const o of e)n.push({type:"capability",identifier:h(o)});return[]}const t=[];for(const o of e){const s=i.get(o.key,o.version);if(!s){n.push({type:"capability",identifier:h(o)});continue}t.push(s)}return t}function ne(e,i,n){if(!i){if(e.length>0)for(const o of e)n.push({type:"feature",identifier:o.key});return[]}const t=[];for(const o of e){const s=i.get(o.key);if(!s){n.push({type:"feature",identifier:o.key});continue}t.push(s)}return t}function D(e,i,n,t){if(!i){if(Object.keys(e).length>0)for(const[s,r]of Object.entries(e))t.push({type:n,identifier:`${s} -> ${T(r)}`});return{}}const o={};for(const[s,r]of Object.entries(e)){const c=i.get(r.key,r.version);if(!c){t.push({type:n,identifier:`${s} -> ${T(r)}`});continue}o[s]=c}return o}function ie(e,i,n){if(!i){if(e.length>0)for(const o of e)n.push({type:"policy",identifier:B(o)});return[]}const t=[];for(const o of e){const s=i.get(o.key,o.version);if(!s){n.push({type:"policy",identifier:B(o)});continue}t.push(s)}return t}function te(e,i){const n=[];if(!e)return{theme:void 0,fallbacks:[],themeMissing:n};if(!i){n.push({type:"theme",identifier:`${e.primary.key}.v${e.primary.version}`});for(const s of e.fallbacks??[])n.push({type:"theme",identifier:`${s.key}.v${s.version}`});return{theme:void 0,fallbacks:[],themeMissing:n}}const t=i.get(e.primary.key,e.primary.version);if(!t)n.push({type:"theme",identifier:`${e.primary.key}.v${e.primary.version}`});const o=[];for(const s of e.fallbacks??[]){const r=i.get(s.key,s.version);if(!r){n.push({type:"theme",identifier:`${s.key}.v${s.version}`});continue}o.push(r)}return{theme:t??void 0,fallbacks:o,themeMissing:n}}function oe(e,i){const n=[];if(!e?.spec)return{telemetry:void 0,telemetryMissing:n};if(!i){n.push({type:"telemetry",identifier:T(e.spec)});return{telemetry:void 0,telemetryMissing:n}}const t=i.get(e.spec.key,e.spec.version);if(!t)n.push({type:"telemetry",identifier:T(e.spec)});return{telemetry:t??void 0,telemetryMissing:n}}function se(e,i,n){const t=(o)=>{if(o.length===0)return[];if(!i){for(const r of o)n.push({type:"experiment",identifier:k(r)});return[]}const s=[];for(const r of o){const c=i.get(r.key,r.version);if(!c){n.push({type:"experiment",identifier:k(r)});continue}s.push(c)}return s};return{active:t(e.active),paused:t(e.paused)}}function h(e){return`${e.key}${e.version?`.v${e.version}`:""}`}function C(e){return e.key}function T(e){return`${e.key}${e.version?`.v${e.version}`:""}`}function B(e){return`${e.key}${e.version?`.v${e.version}`:""}`}function k(e){return`${e.key}${e.version?`.v${e.version}`:""}`}function w(e,i){const n=new Map;for(const t of e)n.set(i(t),t);return[...n.values()]}function K(e){return[...new Set(e)]}

package/dist/node/app-config/spec.js

@@ -0,0 +1,162 @@
+import{SpecContractRegistry as t}from"../registry.js";const n=(e)=>`${e.key}.v${e.version}`;export class AppBlueprintRegistry extends t{constructor(e){super("app-config",e)}}export function makeAppBlueprintKey(e){return n(e)}export const defineAppConfig=(e)=>e,tech_contracts_app_config_DocBlocks=[{id:"docs.tech.contracts.app-config",title:"App Configuration Layers",summary:"App orchestration is split into three explicit layers:",kind:"reference",visibility:"public",route:"/docs/tech/contracts/app-config",tags:["tech","contracts","app-config"],body:`## App Configuration Layers
+
+App orchestration is split into three explicit layers:
+
+1. **AppBlueprintSpec**: global, versioned description of what an app can look like. Stored in Git with no tenant or environment data.
+2. **TenantAppConfig**: tenant and environment overrides that Studio or control-plane workflows edit over time.
+3. **ResolvedAppConfig**: the pure merged view consumed by runtime code.
+
+- Types and registry: \`packages/libs/contracts-spec/src/app-config/spec.ts\`
+- Resolution helpers: \`packages/libs/contracts-spec/src/app-config/runtime.ts\`
+- Validation helpers: \`packages/libs/contracts-spec/src/app-config/validation.ts\`
+- CLI wizard: \`contractspec create app-config\`
+
+### 1. AppBlueprintSpec
+
+\`\`\`ts
+export interface AppBlueprintSpec {
+  meta: AppBlueprintMeta;          // { key, version, appId, ownership }
+  capabilities?: { enabled?: CapabilityRef[]; disabled?: CapabilityRef[] };
+  features?: { include?: FeatureRef[]; exclude?: FeatureRef[] };
+  integrationSlots?: AppIntegrationSlot[];
+  branding?: BrandingDefaults;
+  translationCatalog?: { key: string; version: string };
+  dataViews?: Record<string, SpecPointer>;
+  workflows?: Record<string, SpecPointer>;
+  jobs?: Record<string, SpecPointer>;
+  policies?: PolicyRef[];
+  theme?: AppThemeBinding;         // { primary: ThemeRef; fallbacks?: ThemeRef[] }
+  telemetry?: TelemetryBinding;    // { spec?: SpecPointer; disabledEvents?: string[] }
+  experiments?: { active?: ExperimentRef[]; paused?: ExperimentRef[] };
+  featureFlags?: FeatureFlagState[];
+  routes?: AppRouteConfig[];
+  notes?: string;
+}
+\`\`\`
+
+Register blueprints with \`AppBlueprintRegistry\`. Blueprints only capture the default, global experience.
+
+- **Integration slots** declare the categories and capability requirements an app expects. Slots never include secrets.
+- **Branding defaults** provide message-key-based names, placeholder assets, and token references that tenants can override later.
+
+#### Branding meta surfaces (icons, manifest, verification)
+
+\`BrandingDefaults\` also carries the marketing/meta surfaces consumed by the Next SEO lane (\`toNextMetadata\`, \`buildManifest\`). All fields are optional and additive:
+
+- \`iconSet\` (\`BrandingIconSet\`): the full favicon/app-icon set (\`favicon\`, \`icon32\`, \`icon192\`, \`icon512\`, \`appleTouch180\`, \`maskable\`) plus PWA \`themeColor\`/\`backgroundColor\`. The run-once icon-gen CLI emits the referenced assets into the app's \`public/\`; the Next lane declares them via \`metadata.icons\`.
+- \`manifest\` (\`WebManifestDefaults\`): web app manifest fields in camelCase (\`shortName\`, \`startUrl\`, \`themeColor\`, …) including \`categories\`, \`shortcuts\`, and \`screenshots\`. \`buildManifest\` maps these onto the W3C snake_case manifest and derives top-level \`icons[]\` from \`iconSet\`.
+- \`seo.verification\` (\`SiteVerificationTokens\`): site-ownership tokens (\`google\`, \`bing\`, …; open-ended).
+
+\`resolveAppConfig\` merges these defaults with \`TenantBrandingConfig\` overrides (per-field, override-wins) and surfaces them on \`ResolvedBranding\` as \`iconSet\`, \`manifest\`, and \`verification\` (the latter also mirrored onto \`ResolvedBranding.seo.verification\`).
+
+### 2. TenantAppConfig
+
+\`\`\`ts
+export interface TenantAppConfig {
+  meta: TenantAppConfigMeta;  // { id, tenantId, appId, blueprintName, blueprintVersion, version, status }
+  capabilities?: { enable?: CapabilityRef[]; disable?: CapabilityRef[] };
+  features?: { include?: FeatureRef[]; exclude?: FeatureRef[] };
+  dataViewOverrides?: TenantSpecOverride[];
+  workflowOverrides?: TenantSpecOverride[];
+  jobOverrides?: TenantSpecOverride[];
+  additionalPolicies?: PolicyRef[];
+  themeOverride?: { primary?: ThemeRef | null; fallbacks?: ThemeRef[] };
+  telemetryOverride?: { spec?: SpecPointer | null; disabledEvents?: string[] };
+  experiments?: { active?: ExperimentRef[]; paused?: ExperimentRef[] };
+  featureFlags?: FeatureFlagState[];
+  routeOverrides?: TenantRouteOverride[];
+  integrations?: AppIntegrationBinding[];
+  knowledge?: AppKnowledgeBinding[];
+  locales?: { defaultLocale: Locale; enabledLocales: Locale[] };
+  translationOverrides?: { entries?: TranslationEntry[] };
+  branding?: TenantBrandingConfig;
+  notes?: string;
+}
+\`\`\`
+
+- **AppIntegrationBinding** maps \`slotId\` to \`connectionId\` plus optional workflow scopes.
+- **TenantBrandingConfig** allows per-tenant names, assets, and domains while keeping secrets and large files out of blueprints.
+
+### 3. ResolvedAppConfig
+
+Use \`resolveAppConfig(blueprint, tenant)\` to build the merged pointer view. Use \`composeAppConfig(...)\` to hydrate those pointers against registries and collect missing references.
+
+\`\`\`ts
+const blueprint = blueprintRegistry.get('core.app', '1.0.0');
+const tenant = loadTenantConfigFromDB();
+
+const composition = composeAppConfig(blueprint!, tenant, {
+  capabilities,
+  features,
+  dataViews,
+  workflows,
+  jobs,
+  policies,
+  themes,
+  telemetry,
+  experiments,
+});
+
+if (composition.missing.length) {
+  console.warn('Unresolved references', composition.missing);
+}
+\`\`\`
+
+### Static Validation
+
+Use the validation helpers in \`@lssm/lib.contracts-spec/app-config/validation\` before publish or promotion:
+
+\`\`\`ts
+import {
+  assertBlueprintValid,
+  assertResolvedConfigValid,
+  assertTenantConfigValid,
+  validateBlueprint,
+  validateConfig,
+  validateResolvedConfig,
+  validateTenantConfig,
+} from '@lssm/lib.contracts-spec/app-config/validation';
+
+const blueprintReport = validateBlueprint(blueprint, context);
+const tenantReport = validateTenantConfig(blueprint, tenant, context);
+const publishReport = validateConfig(blueprint, tenant, context);
+const resolvedReport = validateResolvedConfig(blueprint, resolved, context);
+
+assertBlueprintValid(blueprint, context);
+assertTenantConfigValid(blueprint, tenant, context);
+assertResolvedConfigValid(blueprint, resolved, context);
+\`\`\`
+
+- \`ValidationResult\` exposes \`valid\`, plus structured \`errors\`, \`warnings\`, and \`info\`.
+- Core rules cover capability references, integration slot bindings, knowledge bindings, branding constraints, and translation coverage.
+- Run \`composeAppConfig(..., { strict: true })\` and the validators in CI to catch drift early.
+
+### CLI
+
+\`\`\`
+contractspec create app-config
+contractspec validate --blueprint packages/examples/integration-stripe/src/blueprint.ts
+\`\`\`
+
+### Lifecycle Types and Events
+
+To model multi-step configuration changes, import the lifecycle helpers from \`@lssm/lib.contracts-spec/app-config\`:
+
+\`\`\`ts
+import type {
+  ConfigStatus,
+  TenantAppConfigVersion,
+  ConfigTransition,
+} from '@lssm/lib.contracts-spec/app-config';
+import {
+  ConfigDraftCreatedEvent,
+  ConfigPromotedToPreviewEvent,
+  ConfigPublishedEvent,
+  ConfigRolledBackEvent,
+} from '@lssm/lib.contracts-spec/app-config';
+\`\`\`
+
+- \`ConfigStatus\` enumerates the canonical states: \`draft\`, \`preview\`, \`published\`, \`archived\`, \`superseded\`.
+- \`TenantAppConfigMeta\` includes lifecycle metadata such as \`createdBy\`, \`publishedBy\`, \`publishedAt\`, and rollback lineage.
+- Lifecycle contract specs under \`appConfig.lifecycle.*\` expose typed commands and queries for create -> preview -> publish -> rollback flows.
+`}];

package/dist/node/app-config/validation.js

@@ -0,0 +1 @@
+import{isKnowledgeSourceAvailableForBinding as N}from"../knowledge/source.js";import{DERIVABLE_STRUCTURED_DATA_KINDS as C,STRUCTURED_DATA_KINDS as w}from"../structured-data/index.js";export class AppConfigValidationError extends Error{result;constructor(e,t){super(e);this.result=t;this.name="AppConfigValidationError"}}class _{blueprintRules=[];tenantRules=[];resolvedRules=[];register(e){if(e.scope==="blueprint")this.blueprintRules.push(e);else if(e.scope==="tenant")this.tenantRules.push(e);else this.resolvedRules.push(e);return this}validateBlueprint(e,t){return E(this.blueprintRules.flatMap((s)=>s.validate(e,t)))}validateTenant(e,t,s){return E(this.tenantRules.flatMap((n)=>n.validate(e,t,s)))}validateResolved(e,t,s){return E(this.resolvedRules.flatMap((n)=>n.validate(e,t,s)))}}const D=/^(?!:\/\/)([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.[A-Za-z]{2,}$/,v=/^https:\/\//i,S={logo:["png","svg","webp"],"logo-dark":["png","svg","webp"],favicon:["ico","png","svg"],"og-image":["png","jpg","jpeg","webp"]},m={};let T;function R(){if(!T)T=O();return T}export function validateConfig(e,t,s=m){const n=R(),i=I(n.validateBlueprint(e,s)),d=I(n.validateTenant(e,t,s));return L(i,d)}export function validateBlueprint(e,t=m){const s=R().validateBlueprint(e,t);return I(s)}export function validateTenantConfig(e,t,s=m){const n=R().validateTenant(e,t,s);return I(n)}export function validateResolvedConfig(e,t,s=m){const n=R().validateResolved(e,t,s);return I(n)}export function assertBlueprintValid(e,t=m){const s=validateBlueprint(e,t);if(!s.valid)throw new AppConfigValidationError(`App blueprint ${e.meta.key}.v${e.meta.version} is invalid`,s)}export function assertTenantConfigValid(e,t,s=m){const n=validateTenantConfig(e,t,s);if(!n.valid)throw new AppConfigValidationError(`Tenant app config ${t.meta.id} for ${e.meta.key}.v${e.meta.version} is invalid`,n)}export function assertResolvedConfigValid(e,t,s=m){const n=validateResolvedConfig(e,t,s);if(!n.valid)throw new AppConfigValidationError(`Resolved app config ${t.appId} for ${e.meta.key}.v${e.meta.version} is invalid`,n)}function I(e){const t=e.filter((i)=>i.severity==="error"),s=e.filter((i)=>i.severity==="warning"),n=e.filter((i)=>i.severity==="info");return{valid:t.length===0,errors:t,warnings:s,info:n}}function L(...e){const t=e.flatMap((i)=>i.errors),s=e.flatMap((i)=>i.warnings),n=e.flatMap((i)=>i.info);return{valid:t.length===0,errors:t,warnings:s,info:n}}function O(){return new _().register(k).register(P).register(U).register(M).register(B).register(V).register(K).register(x).register(G).register(W).register(Y).register(q)}const k={scope:"blueprint",name:"design.policy",category:"design",validate(e,t){const s=e.design??e.designPolicy;if(!s)return[];const n=[],i=[s.default,...s.allowed??[],...s.fallbacks??[]];if(s.fixed)i.push(s.fixed);if(s.allowed&&!h(s.allowed,s.default))n.push(a({code:"DESIGN_DEFAULT_NOT_ALLOWED",severity:"error",path:"design.default",message:"The app design default must be included in its allowed catalog."}));if(s.fixed&&s.allowed&&!h(s.allowed,s.fixed))n.push(a({code:"DESIGN_FIXED_NOT_ALLOWED",severity:"error",path:"design.fixed",message:"The fixed design must be included in the app catalog."}));for(const d of i)if(t.designPacks&&!t.designPacks.get(d.key,d.version))n.push(a({code:"DESIGN_PACK_NOT_REGISTERED",severity:"error",path:"design",message:`Design pack "${d.key}@${d.version}" is not registered.`}));return n}},V={scope:"tenant",name:"design.tenant-narrowing",category:"design",validate(e,t){const s=e.design??e.designPolicy,n=t.design??t.designPolicy;if(!s||!n)return[];const i=[];for(const[d,o]of[["default",n.default],["fixed",n.fixed]]){if(o&&s.allowed&&!h(s.allowed,o))i.push(a({code:"TENANT_DESIGN_POLICY_WIDENS_APP",severity:"error",path:`design.${d}`,message:`Tenant design pack "${o.key}@${o.version}" is outside the app catalog.`}));if(o&&n.allowed&&!h(n.allowed,o))i.push(a({code:"TENANT_DESIGN_DEFAULT_NOT_ALLOWED",severity:"error",path:`design.${d}`,message:`Tenant ${d} design must be included in the narrowed catalog.`}))}for(const[d,o]of[["allowed",n.allowed],["fallbacks",n.fallbacks]])for(const c of o??[])if(s.allowed&&!h(s.allowed,c))i.push(a({code:"TENANT_DESIGN_POLICY_WIDENS_APP",severity:"error",path:`design.${d}`,message:`Tenant design pack "${c.key}@${c.version}" is outside the app catalog.`}));if(n.customDesigns&&A(n.customDesigns)>A(s.customDesigns))i.push(a({code:"TENANT_CUSTOM_DESIGNS_WIDENS_APP",severity:"error",path:"design.customDesigns",message:"Tenant custom-design policy cannot widen the app policy."}));return i}};function h(e,t){return e.some((s)=>s.key===t.key&&s.version===t.version)}function A(e){return e==="disabled"?0:e==="private"?1:2}const P={scope:"blueprint",name:"integration.duplicate-slots",category:"integration",validate(e){const t=[],s=new Set;for(const n of e.integrationSlots??[]){if(s.has(n.slotId))t.push(a({code:"DUPLICATE_SLOT",severity:"error",path:`integrationSlots.${n.slotId}`,message:`Duplicate integration slot id "${n.slotId}".`}));else s.add(n.slotId);if(n.allowedModes&&n.allowedModes.length===0)t.push(a({code:"EMPTY_ALLOWED_MODES",severity:"warning",path:`integrationSlots.${n.slotId}.allowedModes`,message:"allowedModes is empty; the slot will accept any supported mode."}))}if(e.branding&&!e.branding.appNameKey.trim())t.push(a({code:"MISSING_APP_NAME_KEY",severity:"warning",path:"branding.appNameKey",message:"branding.appNameKey should reference a translation catalog key."}));return t}},U={scope:"blueprint",name:"seo.defaults-and-structured-data",category:"seo",validate(e){const t=[],s=e.branding?.seo,n=e.routes??[];if((n.filter((d)=>d.seo).length>0||e.aiDiscovery)&&!s)t.push(a({code:"MISSING_SEO_DEFAULTS",severity:"warning",path:"branding.seo",message:"Routes define SEO (or aiDiscovery is set) but branding.seo defaults are missing.",suggestion:"Add site-wide SEO defaults (titleTemplate, canonicalBase) under branding.seo."}));if(s){if(!s.titleTemplate?.trim())t.push(a({code:"EMPTY_TITLE_TEMPLATE",severity:"error",path:"branding.seo.titleTemplate",message:"branding.seo.titleTemplate must be a non-empty string."}));if(s.canonicalBase&&!v.test(s.canonicalBase))t.push(a({code:"INSECURE_CANONICAL_BASE",severity:"error",path:"branding.seo.canonicalBase",message:"branding.seo.canonicalBase must be an HTTPS URL."}));if(s.ogDefaults?.url&&!v.test(s.ogDefaults.url))t.push(a({code:"INSECURE_OG_IMAGE",severity:"warning",path:"branding.seo.ogDefaults.url",message:"branding.seo.ogDefaults.url should be an HTTPS URL."}))}n.forEach((d,o)=>{const c=d.seo;if(!c)return;const r=`routes[${o}].seo`;if(c.canonical&&!v.test(c.canonical))t.push(a({code:"INSECURE_ROUTE_CANONICAL",severity:"warning",path:`${r}.canonical`,message:"Route canonical URL should be an HTTPS URL."}));if(c.ogImage&&!v.test(c.ogImage))t.push(a({code:"INSECURE_ROUTE_OG_IMAGE",severity:"warning",path:`${r}.ogImage`,message:"Route ogImage should be an HTTPS URL."}));(c.schemaOrg??[]).forEach((u,g)=>{const p=`${r}.schemaOrg[${g}]`,l=u;if(!l||typeof l!=="object"){t.push(a({code:"INVALID_STRUCTURED_DATA_REF",severity:"error",path:p,message:"Structured-data ref must be an object."}));return}if(l.mode==="derive"){if(!C.includes(l.kind??""))t.push(a({code:"NON_DERIVABLE_KIND",severity:"error",path:`${p}.kind`,message:`Kind "${l.kind}" cannot be derived; supply inline data instead.`,suggestion:`Derivable kinds: ${C.join(", ")}.`}))}else if(l.mode==="inline"){if(!w.includes(l.kind??""))t.push(a({code:"UNKNOWN_STRUCTURED_DATA_KIND",severity:"error",path:`${p}.kind`,message:`Unknown structured-data kind "${l.kind}".`}));else if(l.data?.["@type"]!==l.kind)t.push(a({code:"STRUCTURED_DATA_TYPE_MISMATCH",severity:"error",path:`${p}.data`,message:`Inline structured-data @type "${l.data?.["@type"]}" does not match kind "${l.kind}".`}))}else t.push(a({code:"INVALID_STRUCTURED_DATA_MODE",severity:"error",path:`${p}.mode`,message:`Structured-data ref mode must be "inline" or "derive" (got "${l.mode}").`}))})});if(e.aiDiscovery&&(e.aiDiscovery.crawlerPolicy??[]).length===0)t.push(a({code:"EMPTY_CRAWLER_POLICY",severity:"warning",path:"aiDiscovery.crawlerPolicy",message:"aiDiscovery.crawlerPolicy is empty; no AI-crawler allow/deny rules will be emitted."}));return t}},M={scope:"blueprint",name:"capability.registry-check",category:"capability",validate(e,t){const s=[],n=t.capabilities;if(!n)return s;(e.capabilities?.enabled??[]).forEach((d,o)=>{if(!n.get(d.key,d.version))s.push(a({code:"MISSING_CAPABILITY",severity:"error",path:`capabilities.enabled[${o}]`,message:`Capability "${d.key}@${d.version}" is not registered.`}))});return s}},B={scope:"tenant",name:"capability.required-enabled",category:"capability",validate(e,t,s){const n=[],i=s.capabilities,d=new Set((e.capabilities?.enabled??[]).map(b)),o=t.capabilities?.disable??[];o.forEach((c,r)=>{if(d.has(b(c)))n.push(a({code:"DISABLED_REQUIRED_CAPABILITY",severity:"error",path:`capabilities.disable[${r}]`,message:`Capability "${c.key}@${c.version}" is required by the blueprint and cannot be disabled.`}))});if(i){(t.capabilities?.enable??[]).forEach((c,r)=>{if(!i.get(c.key,c.version))n.push(a({code:"UNKNOWN_CAPABILITY_ENABLE",severity:"error",path:`capabilities.enable[${r}]`,message:`Capability "${c.key}@${c.version}" is not registered.`}))});o.forEach((c,r)=>{if(!i.get(c.key,c.version))n.push(a({code:"UNKNOWN_CAPABILITY_DISABLE",severity:"warning",path:`capabilities.disable[${r}]`,message:`Capability "${c.key}@${c.version}" is not registered.`}))})}return n}},K={scope:"tenant",name:"integration.slot-binding",category:"integration",validate(e,t,s){const n=[],i=new Map((e.integrationSlots??[]).map((r)=>[r.slotId,r])),d=t.integrations??[],o=s.tenantConnections?.reduce((r,u)=>r.set(u.meta.id,u),new Map)??new Map,c=new Set;d.forEach((r)=>{const u=`integrations.${r.slotId}`,g=i.get(r.slotId);if(!g){n.push(a({code:"UNKNOWN_SLOT_BINDING",severity:"error",path:u,message:`Integration slot "${r.slotId}" is not defined in the blueprint.`}));return}let p=!0;const l=o.get(r.connectionId);if(!l){n.push(a({code:"MISSING_INTEGRATION_CONNECTION",severity:"error",path:u,message:`Integration connection "${r.connectionId}" was not found for tenant "${t.meta.tenantId}".`}));p=!1;return}if(l.meta.tenantId!==t.meta.tenantId){n.push(a({code:"FOREIGN_CONNECTION",severity:"error",path:u,message:`Connection "${r.connectionId}" belongs to tenant "${l.meta.tenantId}", not "${t.meta.tenantId}".`}));p=!1}if(g.allowedModes&&g.allowedModes.length>0){if(!g.allowedModes.includes(l.ownershipMode)){n.push(a({code:"MODE_MISMATCH",severity:"error",path:u,message:`Slot "${g.slotId}" only allows modes [${g.allowedModes.join(", ")}] but connection is "${l.ownershipMode}".`}));p=!1}}if(l.status==="disconnected"||l.status==="error"){n.push(a({code:"CONNECTION_NOT_READY",severity:"error",path:u,message:`Connection "${l.meta.label}" is in status "${l.status}".`}));p=!1}else if(l.status==="unknown")n.push(a({code:"CONNECTION_STATUS_UNKNOWN",severity:"warning",path:u,message:`Connection "${l.meta.label}" has unknown health status.`}));const f=F(s.integrationSpecs,l);if(!f){n.push(a({code:"INTEGRATION_SPEC_NOT_FOUND",severity:"warning",path:u,message:`Integration spec "${l.meta.integrationKey}@${l.meta.integrationVersion}" is not registered.`}));p=!1;return}if(f.meta.category!==g.requiredCategory){n.push(a({code:"CATEGORY_MISMATCH",severity:"error",path:u,message:`Slot "${g.slotId}" requires category "${g.requiredCategory}" but connection provides "${f.meta.category}".`}));p=!1}if(!f.supportedModes.includes(l.ownershipMode)){n.push(a({code:"UNSUPPORTED_OWNERSHIP_MODE",severity:"error",path:u,message:`Integration spec "${f.meta.key}" does not support ownership mode "${l.ownershipMode}".`}));p=!1}for(const y of g.requiredCapabilities??[])if(!H(f,y)){n.push(a({code:"CAPABILITY_NOT_PROVIDED",severity:"error",path:u,message:`Integration "${f.meta.key}" does not provide required capability "${y.key}@${y.version}".`}));p=!1}if(p)c.add(g.slotId)});for(const r of i.values())if(r.required&&!c.has(r.slotId))n.push(a({code:"MISSING_REQUIRED_SLOT",severity:"error",path:`integrations.${r.slotId}`,message:`Required integration slot "${r.slotId}" is not bound.`}));return n}},x={scope:"tenant",name:"knowledge.bindings",category:"knowledge",validate(e,t,s){const n=[],i=s.knowledgeSpaces;if(!i)return n;const d=s.knowledgeSources??[];(t.knowledge??[]).forEach((o,c)=>{const r=`knowledge[${c}]`,u=i.get(o.spaceKey,o.spaceVersion);if(!u){n.push(a({code:"UNKNOWN_KNOWLEDGE_SPACE",severity:"error",path:`${r}.spaceKey`,message:`Knowledge space "${o.spaceKey}" is not registered.`}));return}if(!d.some((p)=>N(p,o,{tenantId:t.meta.tenantId,environment:t.meta.environment})))n.push(a({code:"MISSING_KNOWLEDGE_SOURCES",severity:"error",path:r,message:`Knowledge space "${o.spaceKey}" has no configured sources for tenant "${t.meta.tenantId}".`}));if(u.meta.category==="external"||u.meta.category==="ephemeral")n.push(a({code:"LOW_TRUST_KNOWLEDGE",severity:"warning",path:r,message:`Knowledge space "${o.spaceKey}" has category "${u.meta.category}". Avoid using it for irreversible or policy decisions.`}))});return n}},G={scope:"tenant",name:"branding.constraints",category:"branding",validate(e,t,s){const n=[],i=t.branding;if(!i)return n;const d=i.customDomain?.trim();if(d){if(!D.test(d))n.push(a({code:"INVALID_DOMAIN",severity:"error",path:"branding.customDomain",message:`Custom domain "${d}" is not a valid hostname.`}));const o=(s.existingConfigs??[]).find((c)=>{if(c.meta.id===t.meta.id)return!1;const r=c.branding?.customDomain?.trim();if(!r)return!1;return r.toLowerCase()===d.toLowerCase()});if(o)n.push(a({code:"DUPLICATE_DOMAIN",severity:"error",path:"branding.customDomain",message:`Custom domain "${d}" is already used by tenant "${o.meta.tenantId}".`}))}(i.assets??[]).forEach((o,c)=>{const r=`branding.assets[${c}]`;if(!v.test(o.url))n.push(a({code:"INSECURE_ASSET_URL",severity:"error",path:`${r}.url`,message:`Branding asset "${o.type}" must use an HTTPS URL.`}));const u=S[o.type]??S.logo,g=j(o.url);if(g&&u&&!u.includes(g))n.push(a({code:"UNEXPECTED_ASSET_TYPE",severity:"warning",path:`${r}.url`,message:`Asset "${o.type}" should use one of: ${(u??[]).join(", ")}. Detected "${g}".`}))});return n}},W={scope:"tenant",name:"translation.consistency",category:"translation",validate(e,t,s){const n=[],i=e.translationCatalog,d=X(s.translationCatalogs),o=i?d.blueprint.find((p)=>p.meta.key===i.key&&p.meta.version===i.version):void 0;if(i&&!o)n.push(a({code:"MISSING_BLUEPRINT_CATALOG",severity:"error",path:"translationCatalog",message:`Blueprint translation catalog "${i.key}@${i.version}" is not loaded in context.`}));const c=new Set;if(e.branding?.appNameKey){c.add(e.branding.appNameKey);if(o&&!z(o.entries,e.branding.appNameKey,o.defaultLocale))n.push(a({code:"MISSING_TRANSLATION_KEY",severity:"error",path:"branding.appNameKey",message:`Translation key "${e.branding.appNameKey}" is missing for locale "${o.defaultLocale}".`}))}const r=t.locales;if(r){const{defaultLocale:p,enabledLocales:l}=r;if(!l.includes(p))n.push(a({code:"LOCALE_NOT_ENABLED",severity:"warning",path:"locales.enabledLocales",message:`enabledLocales does not include defaultLocale "${p}".`}));if(o){const f=new Set(o.supportedLocales);for(const y of[p,...l])if(!f.has(y))n.push(a({code:"UNSUPPORTED_LOCALE",severity:"error",path:"locales.enabledLocales",message:`Locale "${y}" is not supported by blueprint catalog "${o.meta.key}".`}))}}const u=new Set;for(const p of d.blueprint)for(const l of p.entries)u.add(l.key);for(const p of d.platform)for(const l of p.entries)u.add(l.key);(t.translationOverrides?.entries??[]).forEach((p,l)=>{const f=`translationOverrides.entries[${l}]`;if(!u.has(p.key))n.push(a({code:"UNKNOWN_TRANSLATION_KEY",severity:"error",path:f,message:`Override references unknown key "${p.key}".`}));if(o){if(!new Set([...o.supportedLocales,...t.locales?.enabledLocales??[],t.locales?.defaultLocale??o.defaultLocale]).has(p.locale))n.push(a({code:"UNSUPPORTED_LOCALE_OVERRIDE",severity:"error",path:f,message:`Locale "${p.locale}" is not enabled for tenant overrides.`}))}});return n}},Y={scope:"resolved",name:"integration.required-slots",category:"integration",validate(e,t){const s=[],n=(e.integrationSlots??[]).filter((i)=>i.required);for(const i of n)if(!t.integrations.some((o)=>o.slot.slotId===i.slotId))s.push(a({code:"MISSING_REQUIRED_SLOT",severity:"error",path:`integrations.${i.slotId}`,message:`Resolved config is missing integration slot "${i.slotId}".`}));for(const i of t.integrations)if(i.connection.status==="disconnected"||i.connection.status==="error")s.push(a({code:"CONNECTION_NOT_READY",severity:"error",path:`integrations.${i.slot.slotId}`,message:`Resolved integration "${i.slot.slotId}" uses a connection in status "${i.connection.status}".`}));return s}},q={scope:"resolved",name:"translation.default-locale",category:"translation",validate(e,t){const s=[],n=t.translation;if(n&&!n.supportedLocales.includes(n.defaultLocale))s.push(a({code:"DEFAULT_LOCALE_NOT_SUPPORTED",severity:"warning",path:"translation.defaultLocale",message:"supportedLocales should include defaultLocale for consistent fallback behaviour."}));return s}};function a(e){return e}function E(e){const t=new Map;for(const s of e){const n=`${s.code}|${s.path}|${s.severity}`;if(!t.has(n))t.set(n,s)}return[...t.values()]}function b(e){return`${e.key}@${e.version}`}function H(e,t){return e.capabilities.provides.some((s)=>s.key===t.key&&s.version===t.version)}function F(e,t){if(!e)return;return e.get(t.meta.integrationKey,t.meta.integrationVersion)}function j(e){const[t]=e.split("?");if(!t)return;const s=t.lastIndexOf(".");if(s===-1)return;return t.slice(s+1).toLowerCase()}function X(e){if(!e)return{platform:[],blueprint:[]};const t=e.platform?Array.isArray(e.platform)?e.platform:[e.platform]:[],s=e.blueprint?Array.isArray(e.blueprint)?e.blueprint:[e.blueprint]:[];return{platform:t,blueprint:s}}function z(e,t,s){return e.some((n)=>n.key===t&&n.locale===s)}

package/dist/node/app-submission-readiness/admin-rules.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as l,defineQuery as u}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as i,APP_SUBMISSION_READINESS_DOMAIN as a,APP_SUBMISSION_READINESS_OWNERS as r,APP_SUBMISSION_READINESS_STABILITY as s,APP_SUBMISSION_READINESS_TAGS as n}from"./constants.js";const p=new t({name:"ReviewReadyRuleCreateInput",fields:{ruleKey:{type:e.NonEmptyString(),isOptional:!1},title:{type:e.NonEmptyString(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},category:{type:e.String_unsecure(),isOptional:!1},severity:{type:e.String_unsecure(),isOptional:!1},guidance:{type:e.String_unsecure(),isOptional:!1},sourceUrl:{type:e.URL(),isOptional:!1},retrievedAt:{type:e.Date(),isOptional:!1},effectiveDate:{type:e.Date(),isOptional:!1},reviewState:{type:e.String_unsecure(),isOptional:!1},policyOwner:{type:e.String_unsecure(),isOptional:!0}}}),o=new t({name:"ReviewReadyRuleMutationOutput",fields:{ruleId:{type:e.ID(),isOptional:!1},ruleKey:{type:e.NonEmptyString(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},reviewState:{type:e.String_unsecure(),isOptional:!1},version:{type:e.Int_unsecure(),isOptional:!1}}});export const RuleCreateCommand=l({meta:{key:"app-submission.rule.create",title:"Create ReviewReady Rule",version:"1.0.0",description:"Create a ReviewReady readiness rule with mandatory source provenance.",goal:"Let admins encode store readiness guidance traceable to official sources.",context:"sourceUrl, retrievedAt, effectiveDate, and reviewState are required so stale policy is detectable. store differentiates apple-app-store, google-play, or both. Rules are guidance, never legal advice or approval guarantees.",domain:a,owners:[...r],tags:[...n,"admin","rule"],stability:s},capability:{...i},io:{input:p,output:o,errors:{RULE_KEY_EXISTS:{description:"A rule with this key already exists.",http:409,when:"ruleKey is already registered."},SOURCE_METADATA_REQUIRED:{description:"Official source URL, dates, and review state are required.",http:422,when:"sourceUrl, retrievedAt, effectiveDate, or reviewState is missing."}}},policy:{auth:"admin",pii:[]}});const c=new t({name:"ReviewReadyRuleUpdateInput",fields:{ruleId:{type:e.ID(),isOptional:!1},guidance:{type:e.String_unsecure(),isOptional:!0},severity:{type:e.String_unsecure(),isOptional:!0},sourceUrl:{type:e.URL(),isOptional:!0},retrievedAt:{type:e.Date(),isOptional:!0},effectiveDate:{type:e.Date(),isOptional:!0},reviewState:{type:e.String_unsecure(),isOptional:!0}}});export const RuleUpdateCommand=l({meta:{key:"app-submission.rule.update",title:"Update ReviewReady Rule",version:"1.0.0",description:"Update a ReviewReady rule and refresh its official-source provenance.",goal:"Keep rules current with store policy and record review freshness.",context:"Updating guidance should refresh sourceUrl/retrievedAt/reviewState; the runtime flags rules whose review state is stale.",domain:a,owners:[...r],tags:[...n,"admin","rule"],stability:s},capability:{...i},io:{input:c,output:o,errors:{RULE_NOT_FOUND:{description:"No rule matches the supplied id.",http:404,when:"ruleId does not resolve."}}},policy:{auth:"admin",pii:[]}});const d=new t({name:"ReviewReadyRuleListInput",fields:{store:{type:e.String_unsecure(),isOptional:!0},reviewState:{type:e.String_unsecure(),isOptional:!0}}}),y=new t({name:"ReviewReadyRuleListOutput",fields:{rules:{type:e.JSONObject(),isOptional:!1},total:{type:e.Int_unsecure(),isOptional:!1},staleCount:{type:e.Int_unsecure(),isOptional:!1}}});export const RuleListQuery=u({meta:{key:"app-submission.rule.list",title:"List ReviewReady Rules",version:"1.0.0",description:"List ReviewReady rules with source provenance and stale-policy counts.",goal:"Power the admin rule manager and surface stale policy for review.",context:"Read-only; each rule carries sourceUrl, retrievedAt, effectiveDate, and reviewState so admins can detect drift.",domain:a,owners:[...r],tags:[...n,"admin","rule"],stability:s},capability:{...i},io:{input:d,output:y},policy:{auth:"admin",pii:[]}});

package/dist/node/app-submission-readiness/assets.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as r,defineQuery as o}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as s,APP_SUBMISSION_READINESS_DOMAIN as a,APP_SUBMISSION_READINESS_OWNERS as i,APP_SUBMISSION_READINESS_STABILITY as n,APP_SUBMISSION_READINESS_TAGS as p}from"./constants.js";const u=new t({name:"ReviewReadyAssetPackRegisterInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},iconRef:{type:e.String_unsecure(),isOptional:!0},splashRef:{type:e.String_unsecure(),isOptional:!0},adaptiveIconRef:{type:e.String_unsecure(),isOptional:!0},screenshotRefs:{type:e.JSONObject(),isOptional:!0}}}),c=new t({name:"ReviewReadyAssetPackRegisterOutput",fields:{assetPackId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},assetCount:{type:e.Int_unsecure(),isOptional:!1}}});export const AssetPackRegisterCommand=r({meta:{key:"app-submission.assets.register",title:"Register Submission Asset Pack",version:"1.0.0",description:"Register icon, splash, and screenshot asset references for an audited app.",goal:"Capture store asset evidence so the audit can detect missing artwork.",context:"Assets are stored as opaque storage refs (not raw binaries); store differentiates required artwork between apple-app-store and google-play.",domain:a,owners:[...i],tags:[...p,"assets"],stability:n},capability:{...s},io:{input:u,output:c,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});const l=new t({name:"ReviewReadyAssetPackGetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1}}}),d=new t({name:"ReviewReadyAssetPackGetOutput",fields:{assetPackId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},iconRef:{type:e.String_unsecure(),isOptional:!0},splashRef:{type:e.String_unsecure(),isOptional:!0},adaptiveIconRef:{type:e.String_unsecure(),isOptional:!0},screenshotRefs:{type:e.JSONObject(),isOptional:!0}}});export const AssetPackGetQuery=o({meta:{key:"app-submission.assets.get",title:"Get Submission Asset Pack",version:"1.0.0",description:"Read the registered submission asset pack for an audited app.",goal:"Surface known asset evidence for review and remediation.",context:"Read-only; returns asset references only, never raw binaries.",domain:a,owners:[...i],tags:[...p,"assets"],stability:n},capability:{...s},io:{input:l,output:d,errors:{ASSET_PACK_NOT_FOUND:{description:"No asset pack registered for this app.",http:404,when:"appId has no registered asset pack."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/audit.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as i}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as s,APP_SUBMISSION_READINESS_DOMAIN as n,APP_SUBMISSION_READINESS_OWNERS as a,APP_SUBMISSION_READINESS_STABILITY as o,APP_SUBMISSION_READINESS_TAGS as p}from"./constants.js";const r=new t({name:"ReviewReadyAuditRunInput",fields:{tenantId:{type:e.ID(),isOptional:!1},projectId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},ruleSetVersion:{type:e.String_unsecure(),isOptional:!0}}}),u=new t({name:"ReviewReadyAuditRunOutput",fields:{reportId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},decision:{type:e.String_unsecure(),isOptional:!1},score:{type:e.Int_unsecure(),isOptional:!1},findingCount:{type:e.Int_unsecure(),isOptional:!1},checkedAt:{type:e.DateTime(),isOptional:!1}}});export const AuditRunCommand=i({meta:{key:"app-submission.audit.run",title:"Run Readiness Audit",version:"1.0.0",description:"Run a deterministic readiness audit over collected submission inputs.",goal:"Produce an evidence-backed readiness report before store submission.",context:"The audit consumes already-collected inputs (assets, links, disclosures, manifests, SDKs); it does not make network calls. Findings cite evidence and rule sources. store differentiates apple-app-store, google-play, or both.",domain:n,owners:[...a],tags:[...p,"audit"],stability:o},capability:{...s},io:{input:r,output:u,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."},INPUTS_INCOMPLETE:{description:"Required submission inputs are missing for an audit.",http:422,when:"No auditable inputs are registered for the app."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/constants.js

@@ -0,0 +1 @@
+import{StabilityEnum as S}from"../ownership.js";export const APP_SUBMISSION_READINESS_DOMAIN="app-submission-readiness",APP_SUBMISSION_READINESS_OWNERS=["team-reviewready"],APP_SUBMISSION_READINESS_TAGS=["app-submission-readiness","reviewready"],APP_SUBMISSION_READINESS_STABILITY=S.Experimental,APP_SUBMISSION_READINESS_CAPABILITY={key:"app-submission-readiness.core",version:"1.0.0"};

package/dist/node/app-submission-readiness/contracts.js

@@ -0,0 +1 @@
+export*from"./admin-rules.contracts.js";export*from"./assets.contracts.js";export*from"./audit.contracts.js";export*from"./events.js";export*from"./legal-links.contracts.js";export*from"./manifests.contracts.js";export*from"./privacy-disclosures.contracts.js";export*from"./project.contracts.js";export*from"./rejection-response.contracts.js";export*from"./reports.contracts.js";export*from"./reviewer-access.contracts.js";export*from"./sdk-inventory.contracts.js";export*from"./store-integrations.contracts.js";

package/dist/node/app-submission-readiness/events.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineEvent as i}from"../events.js";import{APP_SUBMISSION_READINESS_OWNERS as n,APP_SUBMISSION_READINESS_STABILITY as s,APP_SUBMISSION_READINESS_TAGS as a}from"./constants.js";export const AppSubmissionAuditCompletedEvent=i({meta:{key:"app-submission.audit-completed",title:"Readiness Audit Completed",version:"1.0.0",description:"Emitted when a readiness audit completes and a report is produced.",stability:s,owners:[...n],tags:[...a,"audit"]},pii:[],payload:new t({name:"AppSubmissionAuditCompletedPayload",fields:{tenantId:{type:e.ID(),isOptional:!1},projectId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},reportId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},decision:{type:e.String_unsecure(),isOptional:!1},score:{type:e.Int_unsecure(),isOptional:!1},findingCount:{type:e.Int_unsecure(),isOptional:!1},checkedAt:{type:e.DateTime(),isOptional:!1}}})}),AppSubmissionRuleUpdatedEvent=i({meta:{key:"app-submission.rule-updated",title:"Readiness Rule Updated",version:"1.0.0",description:"Emitted when an admin creates or updates a readiness rule.",stability:s,owners:[...n],tags:[...a,"rule"]},pii:[],payload:new t({name:"AppSubmissionRuleUpdatedPayload",fields:{ruleId:{type:e.ID(),isOptional:!1},ruleKey:{type:e.NonEmptyString(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},reviewState:{type:e.String_unsecure(),isOptional:!1},sourceUrl:{type:e.URL(),isOptional:!1},version:{type:e.Int_unsecure(),isOptional:!1}}})}),AppSubmissionIntegrationConnectedEvent=i({meta:{key:"app-submission.integration-connected",title:"Store Integration Connected",version:"1.0.0",description:"Emitted when an App Store Connect or Google Play integration is connected.",stability:s,owners:[...n],tags:[...a,"integration"]},pii:[],payload:new t({name:"AppSubmissionIntegrationConnectedPayload",fields:{tenantId:{type:e.ID(),isOptional:!1},projectId:{type:e.ID(),isOptional:!1},connectionId:{type:e.ID(),isOptional:!1},provider:{type:e.String_unsecure(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},status:{type:e.String_unsecure(),isOptional:!1},credentialRef:{type:e.String_unsecure(),isOptional:!1}}})}),appSubmissionReadinessEvents=[AppSubmissionAuditCompletedEvent,AppSubmissionRuleUpdatedEvent,AppSubmissionIntegrationConnectedEvent];

package/dist/node/app-submission-readiness/fixtures.js

@@ -0,0 +1 @@
+export const AppSubmissionReadinessBaselineChecklist=[{id:"metadata.description",category:"metadata",title:"Store listing description is final and truthful",status:"pass",severity:"critical",required:!0},{id:"privacy.policy-url",category:"privacy",title:"Privacy policy URL is reachable and matches data disclosures",status:"pass",severity:"critical",required:!0},{id:"privacy.data-safety",category:"privacy",title:"Data safety / nutrition-label declarations match runtime collection",status:"pass",severity:"critical",required:!0},{id:"security.secrets",category:"security",title:"Submission evidence contains no raw secrets or provider tokens",status:"pass",severity:"critical",required:!0},{id:"assets.screenshots",category:"assets",title:"Required screenshots and icons are present for target devices",status:"pass",severity:"warning",required:!0},{id:"legal.third-party-notices",category:"legal",title:"Third-party notices and license acknowledgements are current",status:"pass",severity:"warning",required:!0},{id:"build.production-binary",category:"build",title:"Production binary was built from the submitted release revision",status:"pass",severity:"critical",required:!0},{id:"review.credentials",category:"review",title:"Reviewer account, demo mode, and review notes are non-sensitive",status:"pass",severity:"warning",required:!0}];

package/dist/node/app-submission-readiness/index.js

@@ -0,0 +1 @@
+export*from"./constants.js";export*from"./contracts.js";export*from"./fixtures.js";export*from"./markdown-report.js";export*from"./provider-capabilities.js";export*from"./registry.js";export*from"./runtime.js";export*from"./types.js";

package/dist/node/app-submission-readiness/legal-links.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as o,defineQuery as s}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as i,APP_SUBMISSION_READINESS_DOMAIN as n,APP_SUBMISSION_READINESS_OWNERS as a,APP_SUBMISSION_READINESS_STABILITY as l,APP_SUBMISSION_READINESS_TAGS as p}from"./constants.js";const r=new t({name:"ReviewReadyLegalLinkSetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},privacyPolicyUrl:{type:e.URL(),isOptional:!0},termsUrl:{type:e.URL(),isOptional:!0},supportUrl:{type:e.URL(),isOptional:!0},accountDeletionUrl:{type:e.URL(),isOptional:!0},dataProcessingUrl:{type:e.URL(),isOptional:!0},marketingUrl:{type:e.URL(),isOptional:!0}}}),u=new t({name:"ReviewReadyLegalLinkSetOutput",fields:{inventoryId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},providedCount:{type:e.Int_unsecure(),isOptional:!1}}});export const LegalLinkSetCommand=o({meta:{key:"app-submission.legal-links.set",title:"Set Legal Link Inventory",version:"1.0.0",description:"Set legal, support, and account-deletion links for an audited app.",goal:"Track the public URLs both stores require so missing links surface as findings.",context:"All URLs are public submission metadata; account-deletion and data-processing links matter for both apple-app-store and google-play disclosures.",domain:n,owners:[...a],tags:[...p,"legal"],stability:l},capability:{...i},io:{input:r,output:u,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."},INVALID_URL:{description:"A supplied link is not a valid absolute URL.",http:422,when:"Any provided link fails URL validation."}}},policy:{auth:"user",pii:[]}});const d=new t({name:"ReviewReadyLegalLinkGetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1}}}),y=new t({name:"ReviewReadyLegalLinkGetOutput",fields:{inventoryId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},privacyPolicyUrl:{type:e.URL(),isOptional:!0},termsUrl:{type:e.URL(),isOptional:!0},supportUrl:{type:e.URL(),isOptional:!0},accountDeletionUrl:{type:e.URL(),isOptional:!0},dataProcessingUrl:{type:e.URL(),isOptional:!0},marketingUrl:{type:e.URL(),isOptional:!0}}});export const LegalLinkGetQuery=s({meta:{key:"app-submission.legal-links.get",title:"Get Legal Link Inventory",version:"1.0.0",description:"Read the legal link inventory for an audited app.",goal:"Surface known legal links for review and missing-link findings.",context:"Read-only; returns public URLs only.",domain:n,owners:[...a],tags:[...p,"legal"],stability:l},capability:{...i},io:{input:d,output:y,errors:{INVENTORY_NOT_FOUND:{description:"No legal link inventory registered for this app.",http:404,when:"appId has no legal link inventory."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/manifests.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as t,SchemaModel as e}from"@lssm/lib.schema";import{defineCommand as o,defineQuery as r}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as a,APP_SUBMISSION_READINESS_DOMAIN as s,APP_SUBMISSION_READINESS_OWNERS as i,APP_SUBMISSION_READINESS_STABILITY as n,APP_SUBMISSION_READINESS_TAGS as p}from"./constants.js";const d=new e({name:"ReviewReadyIosManifestSnapshotSetInput",fields:{tenantId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1},privacyManifest:{type:t.JSONObject(),isOptional:!1},infoPlistKeys:{type:t.JSONObject(),isOptional:!0},capturedAt:{type:t.DateTime(),isOptional:!0}}}),l=new e({name:"ReviewReadyIosManifestSnapshotSetOutput",fields:{snapshotId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1},store:{type:t.String_unsecure(),isOptional:!1}}});export const IosManifestSnapshotSetCommand=o({meta:{key:"app-submission.ios-manifest.set",title:"Set iOS Privacy Manifest Snapshot",version:"1.0.0",description:"Store an iOS privacy manifest and Info.plist key snapshot for an audited app.",goal:"Capture iOS technical evidence to cross-check against store privacy answers.",context:"Store is apple-app-store. Source: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files",domain:s,owners:[...i],tags:[...p,"manifest","apple-app-store"],stability:n},capability:{...a},io:{input:d,output:l,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});const S=new e({name:"ReviewReadyAndroidManifestSnapshotSetInput",fields:{tenantId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1},permissions:{type:t.JSONObject(),isOptional:!1},targetSdkVersion:{type:t.Int_unsecure(),isOptional:!0},capturedAt:{type:t.DateTime(),isOptional:!0}}}),c=new e({name:"ReviewReadyAndroidManifestSnapshotSetOutput",fields:{snapshotId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1},store:{type:t.String_unsecure(),isOptional:!1}}});export const AndroidManifestSnapshotSetCommand=o({meta:{key:"app-submission.android-manifest.set",title:"Set Android Manifest Snapshot",version:"1.0.0",description:"Store an Android manifest permissions snapshot for an audited app.",goal:"Capture Android technical evidence to cross-check against Data Safety answers.",context:"Store is google-play; permissions feed the consistency matrix against declared collection.",domain:s,owners:[...i],tags:[...p,"manifest","google-play"],stability:n},capability:{...a},io:{input:S,output:c,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});const f=new e({name:"ReviewReadyManifestSnapshotGetInput",fields:{tenantId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1}}}),u=new e({name:"ReviewReadyManifestSnapshotGetOutput",fields:{appId:{type:t.ID(),isOptional:!1},ios:{type:t.JSONObject(),isOptional:!0},android:{type:t.JSONObject(),isOptional:!0}}});export const ManifestSnapshotGetQuery=r({meta:{key:"app-submission.manifests.get",title:"Get Manifest Snapshots",version:"1.0.0",description:"Read iOS and Android manifest snapshots for an audited app.",goal:"Surface manifest technical evidence for the consistency matrix.",context:"Read-only; combines apple-app-store and google-play snapshots.",domain:s,owners:[...i],tags:[...p,"manifest"],stability:n},capability:{...a},io:{input:f,output:u,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/markdown-report.js

@@ -0,0 +1,3 @@
+export function createAppSubmissionReadinessMarkdownReport(s){const i=[`# App submission readiness: ${s.appName}`,"",`- App ID: ${s.appId}`,`- Store: ${s.store}`,`- Checked at: ${s.checkedAt}`,`- Decision: ${s.decision}`,`- Score: ${s.score}/100`];if(s.releaseVersion)i.push(`- Release version: ${s.releaseVersion}`);i.push("","## Category scores");for(const e of s.categoryScores)i.push(`- ${e.category}: ${e.score}/100 (${e.passed}/${e.total} passed, ${e.blocking} blocking)`);i.push("","## Findings");if(s.findings.length===0)i.push("- None.");else for(const e of s.findings){i.push(`- [${e.severity}] ${e.title}: ${e.message}`);if(e.remediation)i.push(`  - Remediation: ${e.remediation}`);if(e.evidenceRefs.length)i.push(`  - Evidence: ${e.evidenceRefs.join(", ")}`)}return`${i.join(`
+`)}
+`}

package/dist/node/app-submission-readiness/privacy-disclosures.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as n,defineQuery as r}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as a,APP_SUBMISSION_READINESS_DOMAIN as p,APP_SUBMISSION_READINESS_OWNERS as i,APP_SUBMISSION_READINESS_STABILITY as o,APP_SUBMISSION_READINESS_TAGS as s}from"./constants.js";const l=new t({name:"ReviewReadyAppleAppPrivacySetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},dataTypes:{type:e.JSONObject(),isOptional:!1},tracking:{type:e.Boolean(),isOptional:!0},sourceUrl:{type:e.URL(),isOptional:!0}}}),c=new t({name:"ReviewReadyAppleAppPrivacySetOutput",fields:{answerSetId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1}}});export const AppleAppPrivacySetCommand=n({meta:{key:"app-submission.apple-app-privacy.set",title:"Set Apple App Privacy Answers",version:"1.0.0",description:"Set the Apple App Privacy answer set for an audited app.",goal:"Capture Apple privacy nutrition-label answers for consistency checks.",context:"Store is fixed to apple-app-store; dataTypes mirror Apple App Privacy Details categories. Source: https://developer.apple.com/app-store/app-privacy-details/",domain:p,owners:[...i],tags:[...s,"privacy","apple-app-store"],stability:o},capability:{...a},io:{input:l,output:c,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."},DATA_TYPES_REQUIRED:{description:"At least one declared data type is required.",http:422,when:"dataTypes is empty."}}},policy:{auth:"user",pii:[]}});const y=new t({name:"ReviewReadyGooglePlayDataSafetySetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},dataCollected:{type:e.JSONObject(),isOptional:!1},dataShared:{type:e.JSONObject(),isOptional:!0},encryptionInTransit:{type:e.Boolean(),isOptional:!0},sourceUrl:{type:e.URL(),isOptional:!0}}}),d=new t({name:"ReviewReadyGooglePlayDataSafetySetOutput",fields:{answerSetId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1}}});export const GooglePlayDataSafetySetCommand=n({meta:{key:"app-submission.google-data-safety.set",title:"Set Google Play Data Safety Answers",version:"1.0.0",description:"Set the Google Play Data Safety answer set for an audited app.",goal:"Capture Google Data Safety declarations for consistency checks.",context:"Store is fixed to google-play; fields mirror the Data Safety form. Source: https://support.google.com/googleplay/android-developer/answer/10787469",domain:p,owners:[...i],tags:[...s,"privacy","google-play"],stability:o},capability:{...a},io:{input:y,output:d,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."},DATA_COLLECTED_REQUIRED:{description:"A data-collected declaration is required.",http:422,when:"dataCollected is empty."}}},policy:{auth:"user",pii:[]}});const u=new t({name:"ReviewReadyPrivacyDisclosureGetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1}}}),S=new t({name:"ReviewReadyPrivacyDisclosureGetOutput",fields:{appId:{type:e.ID(),isOptional:!1},apple:{type:e.JSONObject(),isOptional:!0},google:{type:e.JSONObject(),isOptional:!0}}});export const PrivacyDisclosureGetQuery=r({meta:{key:"app-submission.privacy-disclosures.get",title:"Get Privacy Disclosure Set",version:"1.0.0",description:"Read Apple and Google privacy disclosures for an audited app.",goal:"Surface store privacy answers for the consistency matrix.",context:"Read-only; combines apple-app-store and google-play answer sets.",domain:p,owners:[...i],tags:[...s,"privacy"],stability:o},capability:{...a},io:{input:u,output:S,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/project.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as p,defineQuery as r}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as i,APP_SUBMISSION_READINESS_DOMAIN as o,APP_SUBMISSION_READINESS_OWNERS as a,APP_SUBMISSION_READINESS_STABILITY as s,APP_SUBMISSION_READINESS_TAGS as n}from"./constants.js";const l=new t({name:"ReviewReadyProjectCreateInput",fields:{tenantId:{type:e.ID(),isOptional:!1},name:{type:e.NonEmptyString(),isOptional:!1},targetStore:{type:e.String_unsecure(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0}}}),u=new t({name:"ReviewReadyProjectCreateOutput",fields:{projectId:{type:e.ID(),isOptional:!1},name:{type:e.NonEmptyString(),isOptional:!1},targetStore:{type:e.String_unsecure(),isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}});export const ProjectCreateCommand=p({meta:{key:"app-submission.project.create",title:"Create ReviewReady Project",version:"1.0.0",description:"Create a ReviewReady audit project for a mobile submission.",goal:"Give teams a scoped workspace to audit one app before store submission.",context:"targetStore differentiates apple-app-store, google-play, or both; no submission materials are required at creation.",domain:o,owners:[...a],tags:[...n,"project"],stability:s},capability:{...i},io:{input:l,output:u,errors:{INVALID_STORE:{description:"targetStore is not a supported submission store.",http:422,when:"targetStore is not apple-app-store, google-play, or both."},NAME_REQUIRED:{description:"A non-empty project name is required.",http:422,when:"name is empty after trimming."}}},policy:{auth:"user",pii:[]}});const c=new t({name:"ReviewReadyProjectGetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},projectId:{type:e.ID(),isOptional:!1}}}),d=new t({name:"ReviewReadyProjectGetOutput",fields:{projectId:{type:e.ID(),isOptional:!1},name:{type:e.NonEmptyString(),isOptional:!1},targetStore:{type:e.String_unsecure(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}});export const ProjectGetQuery=r({meta:{key:"app-submission.project.get",title:"Get ReviewReady Project",version:"1.0.0",description:"Read a ReviewReady audit project by id.",goal:"Let product surfaces hydrate a single audit project.",context:"Read-only; returns no submission materials or secrets.",domain:o,owners:[...a],tags:[...n,"project"],stability:s},capability:{...i},io:{input:c,output:d,errors:{PROJECT_NOT_FOUND:{description:"No project matches the supplied id for this tenant.",http:404,when:"projectId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});const y=new t({name:"ReviewReadyProjectListInput",fields:{tenantId:{type:e.ID(),isOptional:!1},limit:{type:e.Int_unsecure(),isOptional:!0}}}),m=new t({name:"ReviewReadyProjectListOutput",fields:{projects:{type:e.JSONObject(),isOptional:!1},total:{type:e.Int_unsecure(),isOptional:!1}}});export const ProjectListQuery=r({meta:{key:"app-submission.project.list",title:"List ReviewReady Projects",version:"1.0.0",description:"List ReviewReady audit projects for a tenant.",goal:"Power the ReviewReady project picker and dashboards.",context:"Read-only; returns project summaries without submission materials.",domain:o,owners:[...a],tags:[...n,"project"],stability:s},capability:{...i},io:{input:y,output:m},policy:{auth:"user",pii:[]}});const S=new t({name:"ReviewReadyMobileAppSetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},projectId:{type:e.ID(),isOptional:!1},appName:{type:e.NonEmptyString(),isOptional:!1},bundleId:{type:e.String_unsecure(),isOptional:!0},packageName:{type:e.String_unsecure(),isOptional:!0},store:{type:e.String_unsecure(),isOptional:!1},category:{type:e.String_unsecure(),isOptional:!0},releaseVersion:{type:e.String_unsecure(),isOptional:!0}}}),I=new t({name:"ReviewReadyMobileAppSetOutput",fields:{appId:{type:e.ID(),isOptional:!1},projectId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1}}});export const SubmissionAppSetCommand=p({meta:{key:"app-submission.app.set",title:"Set Mobile Submission App Identity",version:"1.0.0",description:"Attach or update the mobile app identity audited in a project.",goal:"Bind store identifiers (bundle id, package name) to the audit scope.",context:"bundleId targets apple-app-store; packageName targets google-play; both can coexist when store is both. Identifiers are internal metadata, not secrets.",domain:o,owners:[...a],tags:[...n,"app-identity"],stability:s},capability:{...i},io:{input:S,output:I,errors:{PROJECT_NOT_FOUND:{description:"No project matches the supplied id for this tenant.",http:404,when:"projectId does not resolve in the tenant scope."},STORE_IDENTIFIER_MISSING:{description:"A store-appropriate identifier is required.",http:422,when:"apple needs bundleId, google-play needs packageName, both needs each."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/provider-capabilities.js

@@ -0,0 +1 @@
+import{PROVIDER_CAPABILITY_SEEDS as a}from"./provider-capabilities.seeds.js";export const PROVIDER_CAPABILITY_STATES=["api-read","api-write","manual-import","manual-required","unsupported"];const t="2026-06-07",o=(r)=>({store:r.store,fieldId:r.fieldId,state:r.state,capabilityState:r.state,officialSourceUrl:r.officialSourceUrl,sourceUrl:r.officialSourceUrl,reviewedAt:t,riskNote:r.riskNote,fallbackBehavior:r.fallbackBehavior,fixtureCoverage:r.fixtureCoverage});export const appSubmissionProviderCapabilities=a.map(o),PROVIDER_PRIVACY_CONSENT_FIELD_IDS=["apple.app-privacy.answers","google.data-safety.answers"],getProviderCapability=(r,i)=>appSubmissionProviderCapabilities.find((e)=>e.store===r&&e.fieldId===i),findProviderCapability=getProviderCapability;

package/dist/node/app-submission-readiness/provider-capabilities.seeds.js

@@ -0,0 +1 @@
+const e="https://developer.apple.com/documentation/appstoreconnectapi/",o="https://developer.apple.com/help/app-store-connect/manage-app-information/manage-app-privacy/",t="https://developer.apple.com/documentation/bundleresources/privacy_manifest_files",a="https://developers.google.com/android-publisher/edits",r="https://support.google.com/googleplay/android-developer/answer/10787469";export const PROVIDER_CAPABILITY_SEEDS=[{store:"apple-app-store",fieldId:"apple.app-metadata",state:"api-read",officialSourceUrl:e,riskNote:"App Store Connect API exposes app records, App Store versions, and localizations for reading.",fallbackBehavior:"Fall back to manual entry if the API token lacks app access.",fixtureCoverage:!0},{store:"apple-app-store",fieldId:"apple.app-name",state:"api-read",officialSourceUrl:e,riskNote:"Localized app name is readable via appStoreVersionLocalizations; differs per storefront.",fallbackBehavior:"Prompt for manual app name confirmation if absent.",fixtureCoverage:!0},{store:"apple-app-store",fieldId:"apple.category",state:"api-read",officialSourceUrl:e,riskNote:"Primary/secondary categories are exposed via app info relationships.",fallbackBehavior:"Prompt for manual category confirmation if absent.",fixtureCoverage:!1},{store:"apple-app-store",fieldId:"apple.screenshots",state:"api-read",officialSourceUrl:e,riskNote:"Screenshot sets are readable per display type; binary content is not audited.",fallbackBehavior:"Report presence/absence only; flag manual visual review.",fixtureCoverage:!1},{store:"apple-app-store",fieldId:"apple.build",state:"api-read",officialSourceUrl:e,riskNote:"Builds and build states are readable via the Builds resource; ReviewReady reads, never mutates.",fallbackBehavior:"Treat build presence as manual-import when no build is returned.",fixtureCoverage:!0},{store:"apple-app-store",fieldId:"apple.app-privacy.answers",state:"manual-required",officialSourceUrl:o,riskNote:"App Privacy data-collection answers are managed in the console and are not safely writable, nor reliably readable, via the public API.",fallbackBehavior:"Prompt the operator to confirm App Privacy answers manually; never auto-write.",fixtureCoverage:!0},{store:"apple-app-store",fieldId:"apple.content-rating",state:"manual-required",officialSourceUrl:o,riskNote:"The age-rating questionnaire is a console questionnaire, not a writable API surface.",fallbackBehavior:"Require manual confirmation of content-rating answers in the console.",fixtureCoverage:!1},{store:"apple-app-store",fieldId:"apple.privacy-manifest",state:"manual-import",officialSourceUrl:t,riskNote:"The iOS privacy manifest (PrivacyInfo.xcprivacy) ships inside the build; it is imported from project files, not the App Store Connect API.",fallbackBehavior:"Import the manifest snapshot from the uploaded project; flag missing.",fixtureCoverage:!0},{store:"google-play",fieldId:"google.listing",state:"api-read",officialSourceUrl:a,riskNote:"Store listing metadata is readable inside an Android Publisher edit; ReviewReady opens read-first edits only.",fallbackBehavior:"Fall back to manual entry when the service account lacks listing access.",fixtureCoverage:!0},{store:"google-play",fieldId:"google.app-name",state:"api-read",officialSourceUrl:a,riskNote:"Listing title is readable per language inside an edit; max length enforced by Play.",fallbackBehavior:"Prompt for manual app name confirmation if absent.",fixtureCoverage:!0},{store:"google-play",fieldId:"google.category",state:"manual-required",officialSourceUrl:r,riskNote:"App category is set in the Play Console listing UI and is not exposed by the edits API.",fallbackBehavior:"Require manual category confirmation in the console.",fixtureCoverage:!1},{store:"google-play",fieldId:"google.screenshots",state:"api-read",officialSourceUrl:a,riskNote:"Listing images are readable per image type via edits.images; visual content needs manual review.",fallbackBehavior:"Report presence/absence only; flag manual visual review.",fixtureCoverage:!1},{store:"google-play",fieldId:"google.release.track",state:"api-read",officialSourceUrl:a,riskNote:"Track and release metadata is readable via edits.tracks; ReviewReady reads track state, it does not promote or roll out.",fallbackBehavior:"Report track state as manual-required if no edit can be opened.",fixtureCoverage:!0},{store:"google-play",fieldId:"google.data-safety.answers",state:"manual-required",officialSourceUrl:r,riskNote:"Data Safety form answers are console-managed and not exposed for safe API read/write; treat as manual confirmation.",fallbackBehavior:"Prompt the operator to confirm Data Safety answers manually; never auto-write.",fixtureCoverage:!0},{store:"google-play",fieldId:"google.content-rating",state:"manual-required",officialSourceUrl:r,riskNote:"IARC content-rating questionnaire is console-driven and legal-consent gated; not safely automated.",fallbackBehavior:"Require manual completion/confirmation of the rating questionnaire.",fixtureCoverage:!1},{store:"google-play",fieldId:"google.android-manifest",state:"manual-import",officialSourceUrl:a,riskNote:"Android manifest permissions live in the build artifact; they are imported from project output, not the listing API.",fallbackBehavior:"Import permissions from the uploaded project/Expo config; flag missing.",fixtureCoverage:!0}];

package/dist/node/app-submission-readiness/registry.js

@@ -0,0 +1 @@
+import{RuleCreateCommand as e,RuleListQuery as i,RuleUpdateCommand as t}from"./admin-rules.contracts.js";import{AssetPackGetQuery as o,AssetPackRegisterCommand as p}from"./assets.contracts.js";import{AuditRunCommand as n}from"./audit.contracts.js";import{appSubmissionReadinessEvents as s}from"./events.js";import{LegalLinkGetQuery as a,LegalLinkSetCommand as r}from"./legal-links.contracts.js";import{AndroidManifestSnapshotSetCommand as m,IosManifestSnapshotSetCommand as u,ManifestSnapshotGetQuery as d}from"./manifests.contracts.js";import{AppleAppPrivacySetCommand as c,GooglePlayDataSafetySetCommand as y,PrivacyDisclosureGetQuery as b}from"./privacy-disclosures.contracts.js";import{ProjectCreateCommand as f,ProjectGetQuery as g,ProjectListQuery as l,SubmissionAppSetCommand as S}from"./project.contracts.js";import{RejectionResponseDraftCommand as R}from"./rejection-response.contracts.js";import{FindingListQuery as v,ReportGetQuery as C}from"./reports.contracts.js";import{ReviewerAccessGetQuery as A,ReviewerAccessSetCommand as k}from"./reviewer-access.contracts.js";import{SdkInventoryGetQuery as Q,SdkInventorySubmitCommand as j}from"./sdk-inventory.contracts.js";import{StoreIntegrationConnectCommand as G,StoreIntegrationHealthQuery as O}from"./store-integrations.contracts.js";export const appSubmissionReadinessOperationRegistry={"app-submission.project.create":f,"app-submission.project.get":g,"app-submission.project.list":l,"app-submission.app.set":S,"app-submission.assets.register":p,"app-submission.assets.get":o,"app-submission.legal-links.set":r,"app-submission.legal-links.get":a,"app-submission.apple-app-privacy.set":c,"app-submission.google-data-safety.set":y,"app-submission.privacy-disclosures.get":b,"app-submission.ios-manifest.set":u,"app-submission.android-manifest.set":m,"app-submission.manifests.get":d,"app-submission.sdk-inventory.submit":j,"app-submission.sdk-inventory.get":Q,"app-submission.reviewer-access.set":k,"app-submission.reviewer-access.get":A,"app-submission.store-integration.connect":G,"app-submission.store-integration.health":O,"app-submission.rule.create":e,"app-submission.rule.update":t,"app-submission.rule.list":i,"app-submission.audit.run":n,"app-submission.findings.list":v,"app-submission.report.get":C,"app-submission.rejection-response.draft":R},appSubmissionReadinessOperations=Object.values(appSubmissionReadinessOperationRegistry),appSubmissionReadinessEventRegistry={"app-submission.audit-completed":s[0],"app-submission.rule-updated":s[1],"app-submission.integration-connected":s[2]};

package/dist/node/app-submission-readiness/rejection-response.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as s}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as i,APP_SUBMISSION_READINESS_DOMAIN as n,APP_SUBMISSION_READINESS_OWNERS as a,APP_SUBMISSION_READINESS_STABILITY as o,APP_SUBMISSION_READINESS_TAGS as p}from"./constants.js";const r=new t({name:"ReviewReadyRejectionResponseDraftInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},rejectionMessage:{type:e.String_unsecure(),isOptional:!1},guidelineRefs:{type:e.JSONObject(),isOptional:!0}}}),l=new t({name:"ReviewReadyRejectionResponseDraftOutput",fields:{draftId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},responseDraft:{type:e.String_unsecure(),isOptional:!1},resubmissionChecklist:{type:e.JSONObject(),isOptional:!1},citedRuleRefs:{type:e.JSONObject(),isOptional:!1}}});export const RejectionResponseDraftCommand=s({meta:{key:"app-submission.rejection-response.draft",title:"Draft Rejection Response",version:"1.0.0",description:"Draft a rejection response and resubmission checklist from rules and templates.",goal:"Help teams respond to store rejections with cited, actionable guidance.",context:"rejectionMessage is internal-by-default text; the draft cites rule refs and avoids legal-advice or guaranteed-approval claims. store differentiates apple-app-store and google-play response norms. Raw secrets must never appear in the message or draft.",domain:n,owners:[...a],tags:[...p,"rejection-response"],stability:o},capability:{...i},io:{input:r,output:l,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."},REJECTION_MESSAGE_REQUIRED:{description:"A non-empty rejection message is required.",http:422,when:"rejectionMessage is empty after trimming."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/reports.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineQuery as i}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as n,APP_SUBMISSION_READINESS_DOMAIN as s,APP_SUBMISSION_READINESS_OWNERS as r,APP_SUBMISSION_READINESS_STABILITY as a,APP_SUBMISSION_READINESS_TAGS as o}from"./constants.js";const p=new t({name:"ReviewReadyFindingListInput",fields:{tenantId:{type:e.ID(),isOptional:!1},reportId:{type:e.ID(),isOptional:!1},severity:{type:e.String_unsecure(),isOptional:!0}}}),d=new t({name:"ReviewReadyFindingListOutput",fields:{reportId:{type:e.ID(),isOptional:!1},findings:{type:e.JSONObject(),isOptional:!1},total:{type:e.Int_unsecure(),isOptional:!1}}});export const FindingListQuery=i({meta:{key:"app-submission.findings.list",title:"List Readiness Findings",version:"1.0.0",description:"List findings for an audit report with evidence and rule refs.",goal:"Let reviewers triage blockers, warnings, and improvements with provenance.",context:"Read-only; every finding includes evidenceRefs and a ruleRef/sourceRef so guidance is traceable. Copy avoids approval guarantees.",domain:s,owners:[...r],tags:[...o,"findings"],stability:a},capability:{...n},io:{input:p,output:d,errors:{REPORT_NOT_FOUND:{description:"No report matches the supplied id for this tenant.",http:404,when:"reportId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});const l=new t({name:"ReviewReadyReportGetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},reportId:{type:e.ID(),isOptional:!1},redact:{type:e.Boolean(),isOptional:!0}}}),u=new t({name:"ReviewReadyReportGetOutput",fields:{reportId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},decision:{type:e.String_unsecure(),isOptional:!1},score:{type:e.Int_unsecure(),isOptional:!1},categoryScores:{type:e.JSONObject(),isOptional:!1},findings:{type:e.JSONObject(),isOptional:!1},provenance:{type:e.JSONObject(),isOptional:!1},ruleSetVersion:{type:e.String_unsecure(),isOptional:!0},checkedAt:{type:e.DateTime(),isOptional:!1}}});export const ReportGetQuery=i({meta:{key:"app-submission.report.get",title:"Get Readiness Report",version:"1.0.0",description:"Read a full readiness report including findings, scores, and provenance.",goal:"Surface the readiness verdict and evidence trail for the audited app.",context:"Read-only; provenance records inputs, rule versions, and snapshots without raw secrets. redact controls whether internal identifiers are masked for share surfaces.",domain:s,owners:[...r],tags:[...o,"report"],stability:a},capability:{...n},io:{input:l,output:u,errors:{REPORT_NOT_FOUND:{description:"No report matches the supplied id for this tenant.",http:404,when:"reportId does not resolve in the tenant scope."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/reviewer-access.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as o,defineQuery as p}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as s,APP_SUBMISSION_READINESS_DOMAIN as r,APP_SUBMISSION_READINESS_OWNERS as i,APP_SUBMISSION_READINESS_STABILITY as n,APP_SUBMISSION_READINESS_TAGS as a}from"./constants.js";const c=new t({name:"ReviewReadyReviewerAccessSetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},demoAccountRequired:{type:e.Boolean(),isOptional:!1},usernameRef:{type:e.String_unsecure(),isOptional:!0},secretRefId:{type:e.String_unsecure(),isOptional:!0},demoInstructions:{type:e.String_unsecure(),isOptional:!0}}}),u=new t({name:"ReviewReadyReviewerAccessSetOutput",fields:{requirementId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},demoAccountRequired:{type:e.Boolean(),isOptional:!1},hasSecretRef:{type:e.Boolean(),isOptional:!1}}});export const ReviewerAccessSetCommand=o({meta:{key:"app-submission.reviewer-access.set",title:"Set Reviewer Access Requirement",version:"1.0.0",description:"Set reviewer/demo account requirements using secret references only.",goal:"Track whether a reviewer demo account is required without storing raw credentials.",context:"usernameRef and secretRefId resolve through the tenant secret store; raw passwords/tokens never enter operation arguments. store differentiates apple-app-store and google-play reviewer expectations.",domain:r,owners:[...i],tags:[...a,"reviewer-access","secret-ref"],stability:n},capability:{...s},io:{input:c,output:u,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."},SECRET_REF_REQUIRED:{description:"A demo account is required but no secret reference was supplied.",http:422,when:"demoAccountRequired is true and secretRefId is missing."},SECRET_REF_INVALID:{description:"The supplied secret reference is missing or unreadable.",http:422,when:"secretRefId does not resolve in the tenant secret store."}}},policy:{auth:"user",pii:[]}});const l=new t({name:"ReviewReadyReviewerAccessGetInput",fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1}}}),d=new t({name:"ReviewReadyReviewerAccessGetOutput",fields:{requirementId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},demoAccountRequired:{type:e.Boolean(),isOptional:!1},usernameRef:{type:e.String_unsecure(),isOptional:!0},hasSecretRef:{type:e.Boolean(),isOptional:!1},demoInstructions:{type:e.String_unsecure(),isOptional:!0}}});export const ReviewerAccessGetQuery=p({meta:{key:"app-submission.reviewer-access.get",title:"Get Reviewer Access Requirement",version:"1.0.0",description:"Read reviewer access requirements without exposing raw credentials.",goal:"Surface reviewer/demo requirements while keeping secrets reference-only.",context:"Read-only; returns presence flags and refs (usernameRef, hasSecretRef) only, never resolved secret values.",domain:r,owners:[...i],tags:[...a,"reviewer-access","secret-ref"],stability:n},capability:{...s},io:{input:l,output:d,errors:{REQUIREMENT_NOT_FOUND:{description:"No reviewer access requirement registered for this app.",http:404,when:"appId has no reviewer access requirement."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/runtime.js

@@ -0,0 +1 @@
+export const APP_SUBMISSION_READINESS_REDACTION_PLACEHOLDER="•••• app-submission evidence redacted ••••";const o=[/\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{12,}\b/i,/\b(?:xox[baprs]-|gh[pousr]_|github_pat_|ya29\.|AIza)[A-Za-z0-9_\-.]{12,}\b/i,/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/_-]{16,}/i,/\b(?:api[_-]?key|secret|token|password|webhook)[A-Za-z0-9_-]*\s*[:=]\s*["']?[^\s"']{12,}/i],a=["metadata","privacy","security","assets","legal","build","review"],r={critical:25,warning:10,info:3};export function auditAppSubmissionReadiness(e,s={}){const i=redactAppSubmissionReadinessAuditInput(e,s),n=collectAppSubmissionReadinessFindings(i.items),t=scoreAppSubmissionReadiness(i.items);return{appId:i.appId,appName:i.appName,store:i.store,checkedAt:i.checkedAt,releaseVersion:i.releaseVersion,decision:l(t,n),score:t,categoryScores:scoreAppSubmissionReadinessByCategory(i.items),findings:n,redactedInput:i}}export function scoreAppSubmissionReadiness(e){const s=e.filter((n)=>n.status!=="not-applicable");if(s.length===0)return 0;const i=s.reduce((n,t)=>n+d(t),0);return b(100-i)}export function scoreAppSubmissionReadinessByCategory(e){return a.map((s)=>{const i=e.filter((n)=>n.category===s&&n.status!=="not-applicable");if(i.length===0)return;return{category:s,score:scoreAppSubmissionReadiness(i),passed:i.filter((n)=>n.status==="pass").length,total:i.length,blocking:i.filter(c).length}}).filter((s)=>Boolean(s))}export function collectAppSubmissionReadinessFindings(e){return e.flatMap((s)=>{if(s.status==="pass"||s.status==="not-applicable")return[];return[{itemId:s.id,category:s.category,severity:s.severity,status:s.status,title:s.title,message:m(s),remediation:s.remediation,evidenceRefs:(s.evidence??[]).map((i)=>i.ref),stores:s.stores}]})}export function redactAppSubmissionReadinessAuditInput(e,s={}){return{...e,items:e.items.map((i)=>({...i,evidence:i.evidence?.map((n)=>redactAppSubmissionEvidence(n,s))}))}}export function redactAppSubmissionEvidence(e,s={}){if(!p(e,s))return e;return{...e,value:s.placeholder??APP_SUBMISSION_READINESS_REDACTION_PLACEHOLDER,redacted:!0}}export function containsAppSubmissionSecretLikeValue(e){return o.some((s)=>s.test(e))}function p(e,s){return Boolean(e.sensitivity&&(s.deniedSensitivity??u()).includes(e.sensitivity))||Boolean(s.deniedEvidenceIds?.includes(e.id))||Boolean((s.redactSecretLikeValues??!0)&&e.value&&containsAppSubmissionSecretLikeValue(e.value))}function u(){return["personal-data","secret"]}function d(e){if(e.status==="pass"||e.status==="not-applicable")return 0;const s=e.required===!1?0.5:1,i={missing:1,risk:0.7};return r[e.severity]*i[e.status]*s}function c(e){return e.required!==!1&&e.status!=="pass"&&e.status!=="not-applicable"&&e.severity==="critical"}function l(e,s){if(s.some((i)=>i.severity==="critical")||e<70)return"blocked";if(s.length>0||e<95)return"review-needed";return"ready"}function m(e){const s=e.status==="missing"?"missing":"at risk";return`${e.category} readiness item is ${s} for submission review.`}function b(e){return Math.max(0,Math.min(100,Math.round(e)))}

package/dist/node/app-submission-readiness/sdk-inventory.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as t,SchemaModel as e}from"@lssm/lib.schema";import{defineCommand as p,defineQuery as r}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as n,APP_SUBMISSION_READINESS_DOMAIN as i,APP_SUBMISSION_READINESS_OWNERS as a,APP_SUBMISSION_READINESS_STABILITY as s,APP_SUBMISSION_READINESS_TAGS as o}from"./constants.js";const d=new e({name:"ReviewReadySdkInventorySubmitInput",fields:{tenantId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1},sdks:{type:t.JSONObject(),isOptional:!1},dataPractices:{type:t.JSONObject(),isOptional:!0},capturedAt:{type:t.DateTime(),isOptional:!0}}}),S=new e({name:"ReviewReadySdkInventorySubmitOutput",fields:{inventoryId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1},sdkCount:{type:t.Int_unsecure(),isOptional:!1}}});export const SdkInventorySubmitCommand=p({meta:{key:"app-submission.sdk-inventory.submit",title:"Submit SDK Inventory",version:"1.0.0",description:"Submit the SDK inventory and declared data practices for an audited app.",goal:"Capture third-party SDK data practices to detect undisclosed collection.",context:"SDK inventory is sensitive technical evidence; entries carry per-SDK data practices that feed both apple-app-store and google-play consistency checks.",domain:i,owners:[...a],tags:[...o,"sdk"],stability:s},capability:{...n},io:{input:d,output:S,errors:{APP_NOT_FOUND:{description:"No audited app matches the supplied id for this tenant.",http:404,when:"appId does not resolve in the tenant scope."},SDKS_REQUIRED:{description:"At least one SDK entry is required.",http:422,when:"sdks is empty."}}},policy:{auth:"user",pii:[]}});const c=new e({name:"ReviewReadySdkInventoryGetInput",fields:{tenantId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1}}}),y=new e({name:"ReviewReadySdkInventoryGetOutput",fields:{inventoryId:{type:t.ID(),isOptional:!1},appId:{type:t.ID(),isOptional:!1},sdks:{type:t.JSONObject(),isOptional:!1},dataPractices:{type:t.JSONObject(),isOptional:!0},capturedAt:{type:t.DateTime(),isOptional:!0}}});export const SdkInventoryGetQuery=r({meta:{key:"app-submission.sdk-inventory.get",title:"Get SDK Inventory",version:"1.0.0",description:"Read the SDK inventory for an audited app.",goal:"Surface SDK technical evidence for review and consistency findings.",context:"Read-only; returns SDK metadata and data practices, no secrets.",domain:i,owners:[...a],tags:[...o,"sdk"],stability:s},capability:{...n},io:{input:c,output:y,errors:{INVENTORY_NOT_FOUND:{description:"No SDK inventory registered for this app.",http:404,when:"appId has no SDK inventory."}}},policy:{auth:"user",pii:[]}});

package/dist/node/app-submission-readiness/store-integrations.contracts.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineCommand as s,defineQuery as p}from"../operations/index.js";import{APP_SUBMISSION_READINESS_CAPABILITY as n,APP_SUBMISSION_READINESS_DOMAIN as o,APP_SUBMISSION_READINESS_OWNERS as i,APP_SUBMISSION_READINESS_STABILITY as r,APP_SUBMISSION_READINESS_TAGS as a}from"./constants.js";const c=new t({name:"ReviewReadyStoreIntegrationConnectInput",fields:{tenantId:{type:e.ID(),isOptional:!1},projectId:{type:e.ID(),isOptional:!1},provider:{type:e.String_unsecure(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},secretRefId:{type:e.String_unsecure(),isOptional:!1},issuerRef:{type:e.String_unsecure(),isOptional:!0}}}),l=new t({name:"ReviewReadyStoreIntegrationConnectOutput",fields:{connectionId:{type:e.ID(),isOptional:!1},provider:{type:e.String_unsecure(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},status:{type:e.String_unsecure(),isOptional:!1},credentialRef:{type:e.String_unsecure(),isOptional:!1}}});export const StoreIntegrationConnectCommand=s({meta:{key:"app-submission.store-integration.connect",title:"Connect Store Integration",version:"1.0.0",description:"Connect an App Store Connect or Google Play integration using a secret reference.",goal:"Enable read-first provider snapshots without storing raw credentials.",context:"provider is app-store-connect or google-play-developer; secretRefId resolves through the tenant secret store. Read-first by default per the live API safety policy. Source: https://developer.apple.com/documentation/appstoreconnectapi/ and https://developers.google.com/android-publisher/edits",domain:o,owners:[...i],tags:[...a,"integration","secret-ref"],stability:r},capability:{...n},io:{input:c,output:l,errors:{PROJECT_NOT_FOUND:{description:"No project matches the supplied id for this tenant.",http:404,when:"projectId does not resolve in the tenant scope."},SECRET_REF_INVALID:{description:"The supplied secret reference is missing or unreadable.",http:422,when:"secretRefId does not resolve in the tenant secret store."},PROVIDER_NOT_SUPPORTED:{description:"Provider is not a supported store integration.",http:422,when:"provider is not app-store-connect or google-play-developer."}}},policy:{auth:"admin",pii:[]}});const d=new t({name:"ReviewReadyStoreIntegrationHealthInput",fields:{tenantId:{type:e.ID(),isOptional:!1},connectionId:{type:e.ID(),isOptional:!1}}}),u=new t({name:"ReviewReadyStoreIntegrationHealthOutput",fields:{connectionId:{type:e.ID(),isOptional:!1},provider:{type:e.String_unsecure(),isOptional:!1},store:{type:e.String_unsecure(),isOptional:!1},status:{type:e.String_unsecure(),isOptional:!1},checkedAt:{type:e.DateTime(),isOptional:!1},capabilities:{type:e.JSONObject(),isOptional:!0}}});export const StoreIntegrationHealthQuery=p({meta:{key:"app-submission.store-integration.health",title:"Check Store Integration Health",version:"1.0.0",description:"Read connection health for a store integration without exposing secrets.",goal:"Confirm a provider connection can read metadata before audits run.",context:"Read-only; returns status and capability states (api-read/manual-required/unsupported) only, never credential material.",domain:o,owners:[...i],tags:[...a,"integration","secret-ref"],stability:r},capability:{...n},io:{input:d,output:u,errors:{CONNECTION_NOT_FOUND:{description:"No connection matches the supplied id for this tenant.",http:404,when:"connectionId does not resolve in the tenant scope."}}},policy:{auth:"admin",pii:[]}});

package/dist/node/capabilities/agent-workflow.js

@@ -0,0 +1 @@
+import{StabilityEnum as e}from"../ownership.js";const a=["team-platform-agents-workflow"],t=["agent-workflow-pillar"];export const agentFleetReadCapability={meta:{key:"agent.fleet.read",version:"1.0.0",kind:"data",title:"Agent Fleet (Read)",description:"Read-only access to the agent fleet — list, get, runs, tools.",domain:"agent",owners:[...a],tags:[...t,"agent","read"],stability:e.Experimental},provides:[{surface:"operation",key:"agent.list",version:"1.0.0"},{surface:"operation",key:"agent.get",version:"1.0.0"}]},agentFleetManageCapability={meta:{key:"agent.fleet.manage",version:"1.0.0",kind:"data",title:"Agent Fleet (Manage)",description:"Author + edit agent metadata, tool bindings, autonomy, risk tier (non-deploy lifecycle).",domain:"agent",owners:[...a],tags:[...t,"agent","manage"],stability:e.Experimental},provides:[{surface:"operation",key:"agent.create",version:"1.0.0"},{surface:"operation",key:"agent.update",version:"1.0.0"},{surface:"operation",key:"agent.clone",version:"1.0.0"},{surface:"operation",key:"agent.pause",version:"1.0.0"},{surface:"operation",key:"agent.assign-tool",version:"1.0.0"},{surface:"operation",key:"agent.set-autonomy",version:"1.0.0"},{surface:"operation",key:"agent.set-risk-tier",version:"1.0.0"}]},agentFleetDeployCapability={meta:{key:"agent.fleet.deploy",version:"1.0.0",kind:"data",title:"Agent Fleet (Deploy)",description:"Start / stop / archive agents + lower risk tier + attach elevated-risk tools (deploy-tier lifecycle).",domain:"agent",owners:[...a],tags:[...t,"agent","deploy"],stability:e.Experimental},provides:[{surface:"operation",key:"agent.start",version:"1.0.0"},{surface:"operation",key:"agent.stop",version:"1.0.0"},{surface:"operation",key:"agent.archive",version:"1.0.0"}]},workflowReadCapability={meta:{key:"workflow.read",version:"1.0.0",kind:"data",title:"Workflow (Read)",description:"Read-only access to workflow definitions, runs, steps.",domain:"workflow",owners:[...a],tags:[...t,"workflow","read"],stability:e.Experimental},provides:[{surface:"operation",key:"workflow.list",version:"1.0.0"},{surface:"operation",key:"workflow.get",version:"1.0.0"},{surface:"operation",key:"workflow.runner.health",version:"1.0.0"}]},workflowAuthorCapability={meta:{key:"workflow.author",version:"1.0.0",kind:"data",title:"Workflow (Author)",description:"Author + update + activate + deactivate workflow templates.",domain:"workflow",owners:[...a],tags:[...t,"workflow","author"],stability:e.Experimental},provides:[{surface:"operation",key:"workflow.create",version:"1.0.0"},{surface:"operation",key:"workflow.update",version:"1.0.0"},{surface:"operation",key:"workflow.activate",version:"1.0.0"},{surface:"operation",key:"workflow.deactivate",version:"1.0.0"}]},workflowDispatchCapability={meta:{key:"workflow.dispatch",version:"1.0.0",kind:"data",title:"Workflow (Dispatch)",description:"Dispatch + pause + resume + retry runs + advance / skip steps.",domain:"workflow",owners:[...a],tags:[...t,"workflow","dispatch"],stability:e.Experimental},provides:[{surface:"operation",key:"workflow.run.dispatch",version:"1.0.0"},{surface:"operation",key:"workflow.run.pause",version:"1.0.0"},{surface:"operation",key:"workflow.run.resume",version:"1.0.0"},{surface:"operation",key:"workflow.run.retry",version:"1.0.0"},{surface:"operation",key:"workflow.step.advance",version:"1.0.0"},{surface:"operation",key:"workflow.step.skip",version:"1.0.0"}]},workflowCancelCapability={meta:{key:"workflow.cancel",version:"1.0.0",kind:"data",title:"Workflow (Cancel)",description:"Cancel in-flight runs (destructive — ceremony required).",domain:"workflow",owners:[...a],tags:[...t,"workflow","cancel","destructive"],stability:e.Experimental},provides:[{surface:"operation",key:"workflow.run.cancel",version:"1.0.0"}]},reviewReadCapability={meta:{key:"review.read",version:"1.0.0",kind:"data",title:"Review Queue (Read)",description:"Read-only access to the review queue + decisions + evidence.",domain:"review",owners:[...a],tags:[...t,"review","read"],stability:e.Experimental},provides:[{surface:"operation",key:"review.list",version:"1.0.0"},{surface:"operation",key:"review.get",version:"1.0.0"}]},reviewActCapability={meta:{key:"review.act",version:"1.0.0",kind:"data",title:"Review Queue (Act)",description:"Approve / reject / request-changes / comment / assign on review items.",domain:"review",owners:[...a],tags:[...t,"review","act"],stability:e.Experimental},provides:[{surface:"operation",key:"review.approve",version:"1.0.0"},{surface:"operation",key:"review.reject",version:"1.0.0"},{surface:"operation",key:"review.request-changes",version:"1.0.0"},{surface:"operation",key:"review.comment",version:"1.0.0"},{surface:"operation",key:"review.assign",version:"1.0.0"}]},reviewEscalateCapability={meta:{key:"review.escalate",version:"1.0.0",kind:"data",title:"Review Queue (Escalate)",description:"Escalate review items to a higher tier — emits audit + governance notification.",domain:"review",owners:[...a],tags:[...t,"review","escalate"],stability:e.Experimental},provides:[{surface:"operation",key:"review.escalate",version:"1.0.0"}]},governanceReadCapability={meta:{key:"governance.read",version:"1.0.0",kind:"data",title:"Governance (Read)",description:"Read-only access to policies, constraints, simulations.",domain:"governance",owners:[...a],tags:[...t,"governance","read"],stability:e.Experimental},provides:[{surface:"operation",key:"governance.policy.list",version:"1.0.0"},{surface:"operation",key:"governance.policy.get",version:"1.0.0"}]},governanceWriteCapability={meta:{key:"governance.write",version:"1.0.0",kind:"data",title:"Governance (Write)",description:"Mutate policies + constraints + apply transitions (governance.policy.update + constraint.add/remove). Internal notification dispatch is `policy.auth: internal` and not surfaced here.",domain:"governance",owners:[...a],tags:[...t,"governance","write"],stability:e.Experimental},provides:[{surface:"operation",key:"governance.policy.update",version:"1.0.0"},{surface:"operation",key:"governance.constraint.add",version:"1.0.0"},{surface:"operation",key:"governance.constraint.remove",version:"1.0.0"}]},governanceSimulateCapability={meta:{key:"governance.simulate",version:"1.0.0",kind:"data",title:"Governance (Simulate)",description:"Dry-run policy changes to surface affected agents + workflows + reviews before apply. Auditor-reachable per DOMAIN_NOTES §4.",domain:"governance",owners:[...a],tags:[...t,"governance","simulate"],stability:e.Experimental},provides:[{surface:"operation",key:"governance.policy.simulate",version:"1.0.0"}]},auditReadCapability={meta:{key:"audit.read",version:"1.0.0",kind:"data",title:"Audit (Read)",description:"Read the append-only audit trail — primary auditor surface.",domain:"audit",owners:[...a],tags:[...t,"audit","read"],stability:e.Experimental},provides:[{surface:"operation",key:"audit.event.list",version:"1.0.0"},{surface:"operation",key:"audit.event.get",version:"1.0.0"}]},auditExportCapability={meta:{key:"audit.export",version:"1.0.0",kind:"data",title:"Audit (Export)",description:"Materialise signed audit export bundles + attach evidence to existing records.",domain:"audit",owners:[...a],tags:[...t,"audit","export"],stability:e.Experimental},provides:[{surface:"operation",key:"audit.event.export",version:"1.0.0"},{surface:"operation",key:"audit.evidence.attach",version:"1.0.0"}]},fleetMetricsReadCapability={meta:{key:"fleet.metrics.read",version:"1.0.0",kind:"data",title:"Fleet Metrics (Read)",description:"Aggregating read across agent + workflow + review for the operator cockpit. Covers fleet.* rollups and the health probes composed by fleet.health.snapshot.",domain:"fleet",owners:[...a],tags:[...t,"fleet","aggregation","read"],stability:e.Experimental},provides:[{surface:"operation",key:"fleet.metrics.summary",version:"1.0.0"},{surface:"operation",key:"fleet.health.snapshot",version:"1.0.0"},{surface:"operation",key:"fleet.roi.snapshot",version:"1.0.0"},{surface:"operation",key:"agent.fleet.health",version:"1.0.0"},{surface:"operation",key:"review.queue.health",version:"1.0.0"},{surface:"operation",key:"governance.policy.health",version:"1.0.0"},{surface:"operation",key:"audit.pipeline.health",version:"1.0.0"}]},coachSuggestCapability={meta:{key:"coach.suggest",version:"1.0.0",kind:"data",title:"Coach Suggestions",description:"Receive AI-driven suggestions across agent / workflow / review / governance surfaces. Read-modifying (telemetry side-effect feeds adaptive-recipes).",domain:"coach",owners:[...a],tags:[...t,"coach","intelligence","suggest"],stability:e.Experimental},provides:[{surface:"operation",key:"agent.coach.suggest-tool",version:"1.0.0"},{surface:"operation",key:"workflow.coach.suggest-step",version:"1.0.0"},{surface:"operation",key:"review.coach.summarize",version:"1.0.0"},{surface:"operation",key:"governance.coach.suggest-constraint",version:"1.0.0"}]},AGENT_WORKFLOW_CAPABILITIES=[agentFleetReadCapability,agentFleetManageCapability,agentFleetDeployCapability,workflowReadCapability,workflowAuthorCapability,workflowDispatchCapability,workflowCancelCapability,reviewReadCapability,reviewActCapability,reviewEscalateCapability,governanceReadCapability,governanceWriteCapability,governanceSimulateCapability,auditReadCapability,auditExportCapability,fleetMetricsReadCapability,coachSuggestCapability];export function registerAgentWorkflowCapabilities(o){let i=o;for(const r of AGENT_WORKFLOW_CAPABILITIES)i=i.register(r);return i}