@lssm/lib.contracts-spec 17.3.2

package/dist/node/osint/job-sources.js

@@ -0,0 +1,18 @@
+export const JOB_SOURCE_LIVE_QUALIFICATION_RECEIPT_FINGERPRINT_V1="contract:osint.job-source.live-qualification-receipt@1.0.0",JobSourceLiveQualificationDocBlock={id:"docs.tech.osint.job-source-live-qualification",title:"Job source live qualification receipts",summary:"Exact-release, scope-, installation-, policy-, request-, response-, and evidence-bound live qualification without promoting fixtures.",kind:"reference",visibility:"public",route:"/docs/tech/osint/job-source-live-qualification",tags:["osint","jobs","qualification","evidence"],relatedSpecs:["osint.source.qualify.governed","osint.source.revalidate.governed"],body:`# Job source live qualification receipts
+
+Live qualification is separate from deterministic fixtures. A passed receipt
+binds the exact release SHA, complete OSINT scope, source capability,
+installation and policy authorization fingerprints, request and response
+digests, immutable evidence, and observation window. Account- or
+permission-gated support remains blocked until an authorized live receipt is
+present. Unsupported capabilities cannot be promoted by a receipt.
+`},JobSourceAcquisitionRoutingDocBlock={id:"docs.tech.osint.job-source-acquisition-routing",title:"Direct-first job source acquisition routing",summary:"Exact-plan direct acquisition with qualified, policy-bound provider escalation and append-only attempt evidence.",kind:"reference",visibility:"public",route:"/docs/tech/osint/job-source-acquisition-routing",tags:["osint","jobs","acquisition","routing","evidence"],relatedSpecs:["osint.source.sync","osint.source.revalidate.governed"],body:`# Direct-first job source acquisition routing
+
+Every acquisition plan starts with credential-free direct fetch. A later route
+may execute only when it has an opaque qualified connection reference and the
+preceding failure is explicitly classified as safe to escalate. Authentication,
+policy, source-restriction, rate-limit, cancellation, and ambiguous failures do
+not rotate providers. Every attempt binds the immutable plan, request digest,
+route, timestamps, evidence, and selected result for exact replay.
+The complete execution receipt is persisted with the immutable source snapshot.
+`},JOB_SOURCE_KEYS_V1=["la-bonne-alternance","iscod","cmonalternance-na","ashby","flatchr","greenhouse","icims","jobaffinity","lever","recruitee","smartrecruiters","taleez","teamtailor","werecruit","workable","workday","indeed-fr"],JOB_SOURCE_CAPABILITIES_V1=["discovery","listing","detail","incremental_ingestion","revalidation","closure","application_discovery"],JOB_SOURCE_CONNECTOR_OPERATION_KEYS_V1={discover:"osint.source.discover",qualify:"osint.source.qualify.governed",ingest:"osint.source.sync",checkpoint:"osint.source.health",revalidate:"osint.source.revalidate.governed",quarantine:"osint.source.quarantine",retire:"osint.source.retire",replay:"osint.replay.get",deadLetterReplay:"osint.dead_letter.replay",listingRevalidate:"osint.job.listing.revalidate",listingClosureReconcile:"osint.job.listing.closure.reconcile"};

package/dist/node/osint/lifecycle-contracts.js

@@ -0,0 +1,8 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{docId as i}from"../docs/registry.js";import{defineCommand as n}from"../operations/index.js";import{OSINT_CAPABILITY as o,OSINT_DOMAIN as s,OSINT_OWNERS as a,OSINT_STABILITY as c,OSINT_TAGS as p}from"./constants.js";export const OsintSourceLifecycleDocBlock={id:"docs.tech.osint.source-lifecycle",title:"Governed OSINT Source Lifecycle",summary:"Contract-first authority, replay, lease, and evidence bindings for source qualification, activation, and revalidation.",kind:"reference",visibility:"public",route:"/docs/tech/osint/source-lifecycle",tags:["osint","source-lifecycle","governance","replay"],relatedSpecs:["osint.source.qualify.governed","osint.source.activate","osint.source.revalidate.governed","osint.source.quarantine","osint.source.retire"],body:`# Governed OSINT Source Lifecycle
+
+Lifecycle mutations bind the authenticated actor, scoped overlay authority,
+policy decision, contract fingerprint, canonical request digest, revision,
+evidence, and bounded claim before any evaluator or persistence effect.
+The original generic qualify and revalidate V1 contracts remain available only
+as compatibility surfaces; durable workers use the governed operation keys.
+`},OsintLifecycleScopeContractV0=new t({name:"OsintLifecycleScopeV0",fields:{ecosystemId:{type:e.ID(),isOptional:!1},tenantId:{type:e.ID(),isOptional:!1},datasetId:{type:e.ID(),isOptional:!1},deploymentId:{type:e.ID(),isOptional:!1},jurisdiction:{type:e.NonEmptyString(),isOptional:!1},purpose:{type:e.NonEmptyString(),isOptional:!1}}}),OsintLifecycleRequestContextContractV0=new t({name:"OsintLifecycleRequestContextV0",fields:{requestId:{type:e.ID(),isOptional:!1},actorId:{type:e.ID(),isOptional:!1},scope:{type:OsintLifecycleScopeContractV0,isOptional:!1},grants:{type:e.NonEmptyString(),isOptional:!1,isArray:!0},purpose:{type:e.NonEmptyString(),isOptional:!1}}}),OsintSourceLifecycleMutationInputContractV0=new t({name:"OsintSourceLifecycleMutationInputV0",fields:{context:{type:OsintLifecycleRequestContextContractV0,isOptional:!1},sourceId:{type:e.ID(),isOptional:!1},expectedRevision:{type:e.Int_unsecure(),isOptional:!1},idempotencyKey:{type:e.NonEmptyString(),isOptional:!1},receiptId:{type:e.ID(),isOptional:!1},policyDecisionRef:{type:e.NonEmptyString(),isOptional:!1},contractFingerprint:{type:e.NonEmptyString(),isOptional:!1},evidenceRefs:{type:e.NonEmptyString(),isOptional:!1,isArray:!0},reason:{type:e.NonEmptyString(),isOptional:!1}}}),OsintSourceLifecycleReceiptContractV0=new t({name:"OsintSourceLifecycleReceiptV0",fields:{id:{type:e.ID(),isOptional:!1},scope:{type:OsintLifecycleScopeContractV0,isOptional:!1},sourceId:{type:e.ID(),isOptional:!1},operation:{type:e.NonEmptyString(),isOptional:!1},idempotencyKey:{type:e.NonEmptyString(),isOptional:!1},from:{type:e.NonEmptyString(),isOptional:!1},to:{type:e.NonEmptyString(),isOptional:!1},expectedRevision:{type:e.Int_unsecure(),isOptional:!1},resultingRevision:{type:e.Int_unsecure(),isOptional:!1},actorRef:{type:e.ID(),isOptional:!1},reason:{type:e.NonEmptyString(),isOptional:!1},evidenceRefs:{type:e.NonEmptyString(),isOptional:!1,isArray:!0},policyDecisionRef:{type:e.NonEmptyString(),isOptional:!1},requestDigest:{type:e.NonEmptyString(),isOptional:!1},contractFingerprint:{type:e.NonEmptyString(),isOptional:!1},claimIdempotencyKey:{type:e.NonEmptyString(),isOptional:!1},claimOwnerRef:{type:e.ID(),isOptional:!1},claimAttempt:{type:e.Int_unsecure(),isOptional:!1},resultingSource:{type:e.JSONObject(),isOptional:!1},occurredAt:{type:e.DateTime(),isOptional:!1}}}),OsintSourceLifecyclePolicyDecisionContractV0=new t({name:"OsintSourceLifecyclePolicyDecisionV0",fields:{allowed:{type:e.Boolean(),isOptional:!1},decisionRef:{type:e.NonEmptyString(),isOptional:!1},operation:{type:e.NonEmptyString(),isOptional:!1},actorId:{type:e.ID(),isOptional:!1},scope:{type:OsintLifecycleScopeContractV0,isOptional:!1},sourceId:{type:e.ID(),isOptional:!1},expectedRevision:{type:e.Int_unsecure(),isOptional:!1},idempotencyKey:{type:e.NonEmptyString(),isOptional:!1},contractFingerprint:{type:e.NonEmptyString(),isOptional:!1},requestDigest:{type:e.NonEmptyString(),isOptional:!1},policyFingerprint:{type:e.NonEmptyString(),isOptional:!1},decidedAt:{type:e.DateTime(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!1}}}),OsintSourceActivateCommand=n({meta:{key:"osint.source.activate",title:"Activate qualified OSINT source",version:"1.0.0",description:"Activate an exactly qualified source through revision, policy, evidence, and idempotency gates.",goal:"Promote only an authorized and independently qualified source.",context:"Activation is fail-closed and binds actor, scope, policy, contract, evidence, and source revision.",domain:s,owners:[...a],tags:[...p,"source-lifecycle"],stability:c,docId:[i(OsintSourceLifecycleDocBlock.id)]},capability:{...o},io:{input:OsintSourceLifecycleMutationInputContractV0,output:OsintSourceLifecycleReceiptContractV0,errors:{SCOPE_DENIED:{description:"The authenticated actor lacks overlay_write authority.",http:403,when:"Actor, scope, purpose, or grant binding does not match."},POLICY_DENIED:{description:"The exact policy decision does not authorize activation.",http:403,when:"The policy decision is absent, expired, denied, or mismatched."},REVISION_CONFLICT:{description:"The source revision is stale.",http:409,when:"Expected revision differs from canonical source revision."},CLAIM_BUSY:{description:"Another fenced worker owns the live activation claim.",http:409,when:"The exact lifecycle claim has not expired or completed."},CLAIM_LOST:{description:"The worker no longer owns the canonical mutation fence.",http:409,when:"The lease expired, was reclaimed, or the claim attempt changed."},IDEMPOTENCY_COLLISION:{description:"The idempotency key is bound to another request digest.",http:409,when:"A replay changes immutable request intent."}}},policy:{auth:"user",pii:[]}});

package/dist/node/osint/lifecycle-worker-contracts.js

@@ -0,0 +1 @@
+import{docId as c}from"../docs/registry.js";import{defineCommand as n}from"../operations/index.js";import{OSINT_CAPABILITY as a,OSINT_DOMAIN as s,OSINT_OWNERS as l,OSINT_STABILITY as d,OSINT_TAGS as u}from"./constants.js";import{OsintSourceLifecycleDocBlock as p,OsintSourceLifecycleMutationInputContractV0 as h,OsintSourceLifecycleReceiptContractV0 as m}from"./lifecycle-contracts.js";const f={SCOPE_DENIED:{description:"The authenticated actor lacks overlay_write authority.",http:403,when:"Actor, scope, purpose, or grant binding does not match."},POLICY_DENIED:{description:"The exact policy decision does not authorize the operation.",http:403,when:"The policy decision is absent, expired, denied, or mismatched."},REVISION_CONFLICT:{description:"The source revision is stale.",http:409,when:"Expected revision differs from canonical source revision."},CLAIM_BUSY:{description:"Another fenced evaluator owns the live claim.",http:409,when:"The exact lifecycle claim has not expired or completed."},CLAIM_LOST:{description:"The evaluator no longer owns the canonical mutation fence.",http:409,when:"The lease expired, was reclaimed, or the claim attempt changed."},IDEMPOTENCY_COLLISION:{description:"The idempotency key is bound to another request digest.",http:409,when:"A replay changes immutable request intent."}};function e(t,o,i,r){return n({meta:{key:t,title:o,version:"1.0.0",description:i,goal:r,context:"Execution is fail-closed and binds actor, scope, policy, contract, revision, claim attempt, evidence, and replay digest.",domain:s,owners:[...l],tags:[...u,"source-lifecycle"],stability:d,docId:[c(p.id)]},capability:{...a},io:{input:h,output:m,errors:f},policy:{auth:"user",pii:[]}})}export const OsintSourceQualifyGovernedCommand=e("osint.source.qualify.governed","Qualify OSINT source","Evaluate legal, robots, terms, capability, rate, schema, and coverage policy through an exact fenced lifecycle request.","Persist an independently authorized qualification result exactly once."),OsintSourceRevalidateGovernedCommand=e("osint.source.revalidate.governed","Revalidate OSINT source","Recheck an active or degraded source for policy, capability, freshness, and structural drift through a recoverable fenced lifecycle request.","Revalidate a source exactly once while allowing crash-safe lease takeover.");

package/dist/node/osint/operational-contracts.js

@@ -0,0 +1,10 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{osintOperationalMutationFenceFields as n,osintOperationalReceiptFenceFields as o,osintOperationalScopeFields as i}from"./operational-schema-fields.js";export const OSINT_OPERATIONAL_CONTRACT_FINGERPRINTS_V1={deadLetterReplay:"contract:osint.dead_letter.replay@1.0.0",webhookDeliveryReplay:"contract:osint.webhook.delivery.replay@1.0.0",jobListingRevalidate:"contract:osint.job.listing.revalidate@1.0.0",jobListingClosureReconcile:"contract:osint.job.listing.closure.reconcile@1.0.0"},OsintOperationalRecoveryDocBlock={id:"docs.tech.osint.operational-recovery",title:"Governed OSINT Operational Recovery",summary:"Revision-, attempt-, authority-, evidence-, and fingerprint-bound recovery for dead letters, webhook deliveries, and job listing reconciliation.",kind:"reference",visibility:"public",route:"/docs/tech/osint/operational-recovery",tags:["osint","dead-letter","webhook","jobs","replay"],relatedSpecs:["osint.dead_letter.list","osint.dead_letter.replay","osint.webhook.delivery.status","osint.webhook.delivery.replay","osint.job.listing.revalidate","osint.job.listing.closure.reconcile"],body:`# Governed OSINT Operational Recovery
+
+Operator recovery is fail-closed. Mutations bind the complete deployment scope,
+an idempotency key, the exact canonical revision and delivery or work attempt,
+authority and policy fingerprints, the public contract fingerprint, and
+authorized evidence. A stale replay or reconciliation request cannot silently
+repeat an effect. Job closure additionally requires explicit closure evidence,
+or repeated successful scans plus a direct detail recheck; a failed crawl is
+never closure evidence.
+`},OsintDeadLetterListInputContractV1=new t({name:"OsintDeadLetterListInputV1",fields:{...i,jobFamily:{type:e.String_unsecure(),isOptional:!0},sourceId:{type:e.ID(),isOptional:!0},cursor:{type:e.String_unsecure(),isOptional:!0},limit:{type:e.Int_unsecure(),isOptional:!0}}}),OsintDeadLetterStatusContractV1=new t({name:"OsintDeadLetterStatusV1",fields:{...i,deadLetterId:{type:e.ID(),isOptional:!1},workItemId:{type:e.ID(),isOptional:!1},runId:{type:e.ID(),isOptional:!1},jobFamily:{type:e.NonEmptyString(),isOptional:!1},state:{type:e.NonEmptyString(),isOptional:!1},attempt:{type:e.Int_unsecure(),isOptional:!1},revision:{type:e.Int_unsecure(),isOptional:!1},failureCode:{type:e.NonEmptyString(),isOptional:!1},evidenceRefs:{type:e.NonEmptyString(),isOptional:!1,isArray:!0},failedAt:{type:e.DateTime(),isOptional:!1}}}),OsintDeadLetterListOutputContractV1=new t({name:"OsintDeadLetterListOutputV1",fields:{items:{type:OsintDeadLetterStatusContractV1,isOptional:!1,isArray:!0},nextCursor:{type:e.String_unsecure(),isOptional:!0},snapshotAt:{type:e.DateTime(),isOptional:!1}}}),OsintDeadLetterReplayInputContractV1=new t({name:"OsintDeadLetterReplayInputV1",fields:{...i,deadLetterId:{type:e.ID(),isOptional:!1},...n}}),OsintDeadLetterReplayReceiptContractV1=new t({name:"OsintDeadLetterReplayReceiptV1",fields:{deadLetterId:{type:e.ID(),isOptional:!1},workItemId:{type:e.ID(),isOptional:!1},...o}}),OsintWebhookDeliveryStatusInputContractV1=new t({name:"OsintWebhookDeliveryStatusInputV1",fields:{...i,subscriptionId:{type:e.ID(),isOptional:!1},deliveryId:{type:e.ID(),isOptional:!1}}}),OsintWebhookDeliveryStatusContractV1=new t({name:"OsintWebhookDeliveryStatusV1",fields:{...i,deliveryId:{type:e.ID(),isOptional:!1},subscriptionId:{type:e.ID(),isOptional:!1},eventId:{type:e.ID(),isOptional:!1},state:{type:e.NonEmptyString(),isOptional:!1},attempt:{type:e.Int_unsecure(),isOptional:!1},revision:{type:e.Int_unsecure(),isOptional:!1},lastStatusCode:{type:e.Int_unsecure(),isOptional:!0},requestDigest:{type:e.NonEmptyString(),isOptional:!1},contractFingerprint:{type:e.NonEmptyString(),isOptional:!1},evidenceRefs:{type:e.NonEmptyString(),isOptional:!1,isArray:!0},nextAttemptAt:{type:e.DateTime(),isOptional:!0},updatedAt:{type:e.DateTime(),isOptional:!1}}}),OsintWebhookDeliveryReplayInputContractV1=new t({name:"OsintWebhookDeliveryReplayInputV1",fields:{...i,subscriptionId:{type:e.ID(),isOptional:!1},deliveryId:{type:e.ID(),isOptional:!1},...n}}),OsintWebhookDeliveryReplayReceiptContractV1=new t({name:"OsintWebhookDeliveryReplayReceiptV1",fields:{deliveryId:{type:e.ID(),isOptional:!1},subscriptionId:{type:e.ID(),isOptional:!1},eventId:{type:e.ID(),isOptional:!1},...o}});

package/dist/node/osint/operational-operations.js

@@ -0,0 +1 @@
+import{docId as p}from"../docs/registry.js";import{defineCommand as o,defineQuery as n}from"../operations/index.js";import{OSINT_CAPABILITY as t,OSINT_DOMAIN as l,OSINT_OWNERS as d,OSINT_STABILITY as u,OSINT_TAGS as y}from"./constants.js";import{OsintJobListingClosureReconciliationInputContractV1 as h,OsintJobListingReconciliationReceiptContractV1 as r,OsintJobListingRevalidationInputContractV1 as m}from"./job-reconciliation-contracts.js";import{OsintDeadLetterListInputContractV1 as O,OsintDeadLetterListOutputContractV1 as b,OsintDeadLetterReplayInputContractV1 as I,OsintDeadLetterReplayReceiptContractV1 as v,OsintOperationalRecoveryDocBlock as T,OsintWebhookDeliveryReplayInputContractV1 as C,OsintWebhookDeliveryReplayReceiptContractV1 as R,OsintWebhookDeliveryStatusContractV1 as g,OsintWebhookDeliveryStatusInputContractV1 as L}from"./operational-contracts.js";const e={SCOPE_DENIED:{description:"The authenticated actor lacks authority for the exact scope.",http:403,when:"Actor, grant, deployment, jurisdiction, or purpose does not match."},AUTHORITY_STALE:{description:"The bound authorization is absent, expired, or mismatched.",http:403,when:"Authority or policy fingerprints differ from the active decision."},REVISION_CONFLICT:{description:"The expected canonical revision is stale.",http:409,when:"The target changed after the operator captured its status."},ATTEMPT_CONFLICT:{description:"The expected work or delivery attempt is stale.",http:409,when:"Another worker or operator already advanced the attempt fence."},IDEMPOTENCY_COLLISION:{description:"The idempotency key is bound to another request digest.",http:409,when:"A replay changes immutable request intent."}},i=(s,c,a)=>({key:s,title:c,version:"1.0.0",description:a,goal:a,context:"Operational requests are scoped and fail closed on stale revision, attempt, authority, policy, contract, or evidence bindings.",domain:l,owners:[...d],tags:[...y,"operational-recovery"],stability:u,docId:[p(T.id)]});export const OsintDeadLetterListQuery=n({meta:i("osint.dead_letter.list","List OSINT dead letters","List authorized dead-lettered work with its immutable attempt fence."),capability:{...t},io:{input:O,output:b,errors:e},policy:{auth:"user",pii:[]}}),OsintDeadLetterReplayCommand=o({meta:i("osint.dead_letter.replay","Replay OSINT dead letter","Replay one dead letter only at its exact canonical revision and attempt."),capability:{...t},io:{input:I,output:v,errors:e},policy:{auth:"user",pii:[]}}),OsintWebhookDeliveryStatusQuery=n({meta:i("osint.webhook.delivery.status","Get OSINT webhook delivery status","Read durable webhook delivery state, revision, and attempt."),capability:{...t},io:{input:L,output:g,errors:e},policy:{auth:"user",pii:[]}}),OsintWebhookDeliveryReplayCommand=o({meta:i("osint.webhook.delivery.replay","Replay OSINT webhook delivery","Replay one durable webhook delivery at its exact revision and attempt."),capability:{...t},io:{input:C,output:R,errors:e},policy:{auth:"user",pii:[]}}),OsintJobListingRevalidateCommand=o({meta:i("osint.job.listing.revalidate","Revalidate OSINT job listing","Reconcile an evidence-backed listing observation without implicitly closing it."),capability:{...t},io:{input:m,output:r,errors:e},policy:{auth:"user",pii:[]}}),OsintJobListingClosureReconcileCommand=o({meta:i("osint.job.listing.closure.reconcile","Reconcile OSINT job closure","Close or retain a listing from explicit evidence or successful scans plus a detail recheck."),capability:{...t},io:{input:h,output:r,errors:e},policy:{auth:"user",pii:[]}}),osintOperationalOperations=[OsintDeadLetterListQuery,OsintDeadLetterReplayCommand,OsintWebhookDeliveryStatusQuery,OsintWebhookDeliveryReplayCommand,OsintJobListingRevalidateCommand,OsintJobListingClosureReconcileCommand];

package/dist/node/osint/operational-schema-fields.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as t}from"@lssm/lib.schema";export const osintOperationalScopeFields={ecosystemId:{type:t.ID(),isOptional:!1},tenantId:{type:t.ID(),isOptional:!1},datasetId:{type:t.ID(),isOptional:!1},deploymentId:{type:t.ID(),isOptional:!1},jurisdiction:{type:t.NonEmptyString(),isOptional:!1},purpose:{type:t.NonEmptyString(),isOptional:!1}},osintOperationalMutationFenceFields={idempotencyKey:{type:t.NonEmptyString(),isOptional:!1},expectedRevision:{type:t.Int_unsecure(),isOptional:!1},expectedAttempt:{type:t.Int_unsecure(),isOptional:!1},authorityReceiptRef:{type:t.NonEmptyString(),isOptional:!1},authorityFingerprint:{type:t.NonEmptyString(),isOptional:!1},policyFingerprint:{type:t.NonEmptyString(),isOptional:!1},contractFingerprint:{type:t.NonEmptyString(),isOptional:!1},evidenceRefs:{type:t.NonEmptyString(),isOptional:!1,isArray:!0},reason:{type:t.NonEmptyString(),isOptional:!1}},osintOperationalReceiptFenceFields={...osintOperationalScopeFields,receiptId:{type:t.ID(),isOptional:!1},state:{type:t.NonEmptyString(),isOptional:!1},expectedRevision:{type:t.Int_unsecure(),isOptional:!1},resultingRevision:{type:t.Int_unsecure(),isOptional:!1},expectedAttempt:{type:t.Int_unsecure(),isOptional:!1},resultingAttempt:{type:t.Int_unsecure(),isOptional:!1},authorityReceiptRef:{type:t.NonEmptyString(),isOptional:!1},authorityFingerprint:{type:t.NonEmptyString(),isOptional:!1},policyFingerprint:{type:t.NonEmptyString(),isOptional:!1},contractFingerprint:{type:t.NonEmptyString(),isOptional:!1},requestDigest:{type:t.NonEmptyString(),isOptional:!1},evidenceRefs:{type:t.NonEmptyString(),isOptional:!1,isArray:!0},replayCursor:{type:t.String_unsecure(),isOptional:!0},occurredAt:{type:t.DateTime(),isOptional:!1}};

package/dist/node/osint/operations-continuation.js

@@ -0,0 +1 @@
+import{OsintSourceActivateCommand as n}from"./lifecycle-contracts.js";import{OsintSourceQualifyGovernedCommand as i,OsintSourceRevalidateGovernedCommand as o}from"./lifecycle-worker-contracts.js";import{osintCommand as t,osintQuery as e}from"./operations.js";import{OsintRightsCompleteCommand as r,OsintRightsDecideCommand as s,OsintRightsGetQuery as a,OsintRightsListQuery as m,OsintRightsSubmitCommand as c,OsintRightsVerifyCommand as d}from"./rights-operations.js";import{OsintSourceQuarantineCommand as u,OsintSourceRetireCommand as O}from"./source-state-operations.js";export{OsintSourceQuarantineCommand,OsintSourceRetireCommand}from"./source-state-operations.js";export const OsintSourceRegisterCommand=t("osint.source.register","Register OSINT source","Register a known source manifest without rerunning discovery."),OsintEntityHistoryQuery=e("osint.entity.history","Get OSINT entity history","Read ordered bitemporal assertions and tombstones for one entity."),OsintEntityDiffQuery=e("osint.entity.diff","Diff OSINT entity","Compare two authorized entity editions with field evidence references."),OsintResearchStatusQuery=e("osint.research.status","Get OSINT research status","Read progress, costs, evidence candidates, and terminal state for bounded research."),OsintResearchCancelCommand=t("osint.research.cancel","Cancel OSINT research","Request cancellation of a bounded research run without deleting its evidence."),osintContinuationOperations=[n,i,o,u,O,OsintSourceRegisterCommand,OsintEntityHistoryQuery,OsintEntityDiffQuery,OsintResearchStatusQuery,OsintResearchCancelCommand,c,a,m,d,s,r];

package/dist/node/osint/operations.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as r}from"@lssm/lib.schema";import{defineCommand as d,defineQuery as l}from"../operations/index.js";import{OSINT_CAPABILITY as a,OSINT_DOMAIN as y,OSINT_OWNERS as m,OSINT_STABILITY as O,OSINT_TAGS as S}from"./constants.js";const c=new r({name:"OsintScopedInputV0",fields:{ecosystemId:{type:e.ID(),isOptional:!1},tenantId:{type:e.ID(),isOptional:!1},datasetId:{type:e.ID(),isOptional:!1},deploymentId:{type:e.ID(),isOptional:!1},jurisdiction:{type:e.String_unsecure(),isOptional:!1},purpose:{type:e.NonEmptyString(),isOptional:!1},idempotencyKey:{type:e.String_unsecure(),isOptional:!0},payload:{type:e.JSONObject(),isOptional:!0}}}),g=new r({name:"OsintMutationOutputV0",fields:{receiptId:{type:e.ID(),isOptional:!1},state:{type:e.String_unsecure(),isOptional:!1},resourceId:{type:e.ID(),isOptional:!0},replayCursor:{type:e.String_unsecure(),isOptional:!0}}}),I=new r({name:"OsintQueryOutputV0",fields:{items:{type:e.JSONObject(),isOptional:!1},nextCursor:{type:e.String_unsecure(),isOptional:!0},snapshotAt:{type:e.DateTime(),isOptional:!1}}}),p=(i,n,o)=>({key:i,title:n,version:"1.0.0",description:o,goal:o,context:"Requests are tenant, dataset, deployment, jurisdiction, and purpose scoped; policy is fail-closed.",domain:y,owners:[...m],tags:[...S],stability:O}),u={SCOPE_DENIED:{description:"The actor lacks a required grant for the requested scope.",http:403,when:"Any tenant, deployment, purpose, or field grant check fails."},POLICY_PENDING:{description:"The jurisdiction or intended use has no approved policy.",http:409,when:"The jurisdiction policy is pending or collection purpose is absent."}};export const osintCommand=(i,n,o)=>d({meta:p(i,n,o),capability:{...a},io:{input:c,output:g,errors:u},policy:{auth:"user",pii:[]}}),osintQuery=(i,n,o)=>l({meta:p(i,n,o),capability:{...a},io:{input:c,output:I,errors:u},policy:{auth:"user",pii:[]}});const t=osintCommand,s=osintQuery;export const OsintDatasetCreateCommand=t("osint.dataset.create","Create OSINT dataset","Create an isolated base, overlay, or federated dataset."),OsintDatasetListQuery=s("osint.dataset.list","List OSINT datasets","List datasets visible through the caller's grants."),OsintProgramUpsertCommand=t("osint.program.upsert","Upsert OSINT program","Create or update a staged collection program and its bounded budget."),OsintProgramRunCommand=t("osint.program.run","Run OSINT program","Queue selected lifecycle stages with a deterministic idempotency key."),OsintGrantSetCommand=t("osint.grant.set","Set OSINT grant","Set scoped base, overlay, restricted-field, export, or admin authority."),OsintSourceDiscoverCommand=t("osint.source.discover","Discover OSINT sources","Discover stable or dynamic sources without ingesting their entity contents."),OsintSourceQualifyCommand=t("osint.source.qualify","Qualify OSINT source","Evaluate legal, robots, terms, capability, rate, schema, and coverage policy."),OsintSourceSyncCommand=t("osint.source.sync","Ingest OSINT source","Ingest qualified source snapshots through resumable cursor and lease controls."),OsintSourceRevalidateCommand=t("osint.source.revalidate","Revalidate OSINT source","Recheck an active or degraded source for policy, capability, and structural drift."),OsintSourceHealthQuery=s("osint.source.health","Get OSINT source health","Read freshness, drift, failures, checkpoints, and next eligible stage."),OsintEntityListQuery=s("osint.entity.list","List OSINT entities","List evidence-backed entities of any supported kind."),OsintEntityGetQuery=s("osint.entity.get","Get OSINT entity","Read one entity with temporal assertions and evidence locators."),OsintCompanyListQuery=s("osint.company.list","List OSINT companies","List company projections without losing underlying assertion evidence."),OsintJobListQuery=s("osint.job.list","List OSINT jobs","List job projections including internship and apprenticeship classifications."),OsintPeopleListQuery=s("osint.people.list","List OSINT people","List policy-filtered public person projections; restricted fields require a grant."),OsintResearchRunCommand=t("osint.research.run","Run bounded OSINT research","Run a budgeted research agent and persist claims only with source evidence."),OsintEvidenceGetQuery=s("osint.evidence.get","Get OSINT evidence","Resolve an evidence locator to its immutable source snapshot metadata."),OsintGraphQuery=s("osint.graph.query","Query OSINT graph","Traverse evidence-backed company, job, person, and source relations."),OsintExportCreateCommand=t("osint.export.create","Create OSINT export","Create a policy-filtered JSON, CSV, or Parquet export with an audit receipt."),OsintCorrectionSubmitCommand=t("osint.correction.submit","Submit OSINT correction","Submit a correction, objection, erasure, or source restriction request."),OsintCurationApplyCommand=t("osint.curation.apply","Apply OSINT curation","Apply an approved correction or identity decision through the base curation service."),OsintReviewListQuery=s("osint.review.list","List OSINT reviews","List conflicts, identity decisions, corrections, and policy reviews requiring action."),OsintSubscriptionCreateCommand=t("osint.subscription.create","Create OSINT subscription","Create a webhook, SSE, or WebSocket subscription using secret references only."),OsintReplayQuery=s("osint.replay.get","Replay OSINT events","Replay ordered outbox events after an authorized cursor."),osintOperations=[OsintDatasetCreateCommand,OsintDatasetListQuery,OsintProgramUpsertCommand,OsintProgramRunCommand,OsintGrantSetCommand,OsintSourceDiscoverCommand,OsintSourceQualifyCommand,OsintSourceSyncCommand,OsintSourceRevalidateCommand,OsintSourceHealthQuery,OsintEntityListQuery,OsintEntityGetQuery,OsintCompanyListQuery,OsintJobListQuery,OsintPeopleListQuery,OsintResearchRunCommand,OsintEvidenceGetQuery,OsintGraphQuery,OsintExportCreateCommand,OsintCorrectionSubmitCommand,OsintCurationApplyCommand,OsintReviewListQuery,OsintSubscriptionCreateCommand,OsintReplayQuery];

package/dist/node/osint/registry.js

@@ -0,0 +1 @@
+import{osintEvents as n}from"./events.js";import{osintOperationalOperations as o}from"./operational-operations.js";import{osintOperations as r}from"./operations.js";import{osintContinuationOperations as i}from"./operations-continuation.js";export const allOsintOperations=[...r,...i,...o],osintOperationRegistry=Object.fromEntries(allOsintOperations.map((t)=>[t.meta.key,t])),osintEventRegistry=Object.fromEntries(n.map((t)=>[t.meta.key,t]));export function assertUniqueOsintContractKeys(){const t=[...allOsintOperations.map((e)=>e.meta.key),...n.map((e)=>e.meta.key)];if(new Set(t).size!==t.length)throw Error("OSINT_CONTRACT_KEY_COLLISION")}

package/dist/node/osint/rights-contracts.js

@@ -0,0 +1,8 @@
+import{ScalarTypeEnum as t,SchemaModel as e}from"@lssm/lib.schema";export const OsintRightsLifecycleDocBlock={id:"docs.tech.osint.rights-lifecycle",title:"Governed OSINT Subject Rights",summary:"Effect-free admission and evidence-, revision-, policy-, deletion-, and replay-bound subject-rights processing.",kind:"reference",visibility:"public",route:"/docs/tech/osint/rights-lifecycle",tags:["osint","privacy","rights","deletion","governance"],relatedSpecs:["osint.rights.submit","osint.rights.get","osint.rights.list","osint.rights.verify","osint.rights.decide","osint.rights.complete"],body:`# Governed OSINT Subject Rights
+
+Submission records a received request and has no suppression or deletion
+effect. Verification and decision are separate revision-fenced operations.
+Only an approved deletion-class decision may create monotonic suppression and
+explicit derived-destination work. Every transition binds evidence, actor,
+policy decision, operation request digest, contract fingerprint, and replay.
+`};const s={ecosystemId:{type:t.ID(),isOptional:!1},tenantId:{type:t.ID(),isOptional:!1},datasetId:{type:t.ID(),isOptional:!1},deploymentId:{type:t.ID(),isOptional:!1},jurisdiction:{type:t.NonEmptyString(),isOptional:!1},purpose:{type:t.NonEmptyString(),isOptional:!1}},n={expectedRevision:{type:t.Int_unsecure(),isOptional:!1},evidenceRefs:{type:t.NonEmptyString(),isOptional:!1,isArray:!0},reason:{type:t.NonEmptyString(),isOptional:!1}};export const OsintRightsSubmitPayloadContractV0=new e({name:"OsintRightsSubmitPayloadV0",fields:{id:{type:t.ID(),isOptional:!1},subjectFingerprint:{type:t.NonEmptyString(),isOptional:!1},kind:{type:t.NonEmptyString(),isOptional:!1},requestedAt:{type:t.DateTime(),isOptional:!1},dueAt:{type:t.DateTime(),isOptional:!1},expectedRevision:{type:t.Int_unsecure(),isOptional:!1},evidenceRefs:{type:t.NonEmptyString(),isOptional:!0,isArray:!0}}}),OsintRightsVerifyPayloadContractV0=new e({name:"OsintRightsVerifyPayloadV0",fields:n}),OsintRightsDecisionPayloadContractV0=new e({name:"OsintRightsDecisionPayloadV0",fields:{...n,decision:{type:t.NonEmptyString(),isOptional:!1},targetRefs:{type:t.JSONObject(),isOptional:!0}}}),OsintRightsMutationOutputContractV0=new e({name:"OsintRightsMutationOutputV0",fields:{receiptId:{type:t.ID(),isOptional:!1},state:{type:t.NonEmptyString(),isOptional:!1},resourceId:{type:t.ID(),isOptional:!1},replayCursor:{type:t.String_unsecure(),isOptional:!0}}}),OsintRightsQueryInputContractV0=new e({name:"OsintRightsQueryInputV0",fields:{...s,state:{type:t.String_unsecure(),isOptional:!0},cursor:{type:t.String_unsecure(),isOptional:!0},limit:{type:t.Int_unsecure(),isOptional:!0}}}),OsintRightsQueryOutputContractV0=new e({name:"OsintRightsQueryOutputV0",fields:{items:{type:t.JSONObject(),isOptional:!1},nextCursor:{type:t.String_unsecure(),isOptional:!0},snapshotAt:{type:t.DateTime(),isOptional:!1}}});function i(o,a){return new e({name:o,fields:{...s,idempotencyKey:{type:t.NonEmptyString(),isOptional:!1},payload:{type:a,isOptional:!1}}})}export const OsintRightsSubmitInputContractV0=i("OsintRightsSubmitInputV0",OsintRightsSubmitPayloadContractV0),OsintRightsVerifyInputContractV0=i("OsintRightsVerifyInputV0",OsintRightsVerifyPayloadContractV0),OsintRightsDecisionInputContractV0=i("OsintRightsDecisionInputV0",OsintRightsDecisionPayloadContractV0);

package/dist/node/osint/rights-operations.js

@@ -0,0 +1 @@
+import{docId as p}from"../docs/registry.js";import{defineCommand as d,defineQuery as g}from"../operations/index.js";import{OSINT_CAPABILITY as n,OSINT_DOMAIN as u,OSINT_OWNERS as m,OSINT_STABILITY as l,OSINT_TAGS as O}from"./constants.js";import{OsintRightsDecisionInputContractV0 as y,OsintRightsLifecycleDocBlock as f,OsintRightsMutationOutputContractV0 as I,OsintRightsQueryInputContractV0 as S,OsintRightsQueryOutputContractV0 as C,OsintRightsSubmitInputContractV0 as T,OsintRightsVerifyInputContractV0 as r}from"./rights-contracts.js";const o={SCOPE_DENIED:{description:"The actor lacks the required scoped rights grant.",http:403,when:"Actor, scope, purpose, or grant binding does not match."},REVISION_CONFLICT:{description:"The request revision is stale.",http:409,when:"Expected revision differs from the canonical rights request."},EVIDENCE_REQUIRED:{description:"The transition lacks independently authorized evidence.",http:422,when:"Verification, decision, or completion evidence is absent."},IDEMPOTENCY_COLLISION:{description:"The idempotency key is bound to another request digest.",http:409,when:"An exact replay changes immutable request intent."}},c=(e,i,t)=>({key:e,title:i,version:"1.0.0",description:t,goal:t,context:"Rights processing is fail-closed and binds scope, revision, evidence, policy, idempotency, and replay.",domain:u,owners:[...m],tags:[...O,"rights"],stability:l,docId:[p(f.id)]});function s(e,i,t,h){return d({meta:c(e,i,t),capability:{...n},io:{input:h,output:I,errors:o},policy:{auth:"user",pii:[]}})}function a(e,i,t){return g({meta:c(e,i,t),capability:{...n},io:{input:S,output:C,errors:o},policy:{auth:"user",pii:[]}})}export const OsintRightsSubmitCommand=s("osint.rights.submit","Submit OSINT rights request","Admit a rights request without applying effects before verification.",T),OsintRightsGetQuery=a("osint.rights.get","Get OSINT rights request","Read one governed request with transitions and deletion progress."),OsintRightsListQuery=a("osint.rights.list","List OSINT rights requests","List governed rights requests visible through scoped curator grants."),OsintRightsVerifyCommand=s("osint.rights.verify","Verify OSINT rights request","Verify subject authority without applying suppression or deletion.",r),OsintRightsDecideCommand=s("osint.rights.decide","Decide OSINT rights request","Approve or deny and atomically create required governed effects.",y),OsintRightsCompleteCommand=s("osint.rights.complete","Complete OSINT rights request","Complete non-deletion rights work after exact effect evidence.",r);

package/dist/node/osint/source-state-operations.js

@@ -0,0 +1 @@
+import{docId as r}from"../docs/registry.js";import{defineCommand as c}from"../operations/index.js";import{OSINT_CAPABILITY as s,OSINT_DOMAIN as a,OSINT_OWNERS as d,OSINT_STABILITY as l,OSINT_TAGS as u}from"./constants.js";import{OsintSourceLifecycleDocBlock as p,OsintSourceLifecycleMutationInputContractV0 as h,OsintSourceLifecycleReceiptContractV0 as m}from"./lifecycle-contracts.js";const f={SCOPE_DENIED:{description:"The authenticated actor lacks overlay_write authority.",http:403,when:"Actor, scope, purpose, or grant binding does not match."},POLICY_DENIED:{description:"The exact policy decision does not authorize this transition.",http:403,when:"The policy decision is absent, expired, denied, or mismatched."},REVISION_CONFLICT:{description:"The source revision is stale.",http:409,when:"Expected revision differs from canonical source revision."},CLAIM_BUSY:{description:"Another fenced worker owns the live lifecycle claim.",http:409,when:"The exact lifecycle claim has not expired or completed."},CLAIM_LOST:{description:"The worker no longer owns the canonical mutation fence.",http:409,when:"The lease expired, was reclaimed, or the claim attempt changed."},IDEMPOTENCY_COLLISION:{description:"The idempotency key is bound to another request digest.",http:409,when:"A replay changes immutable request intent."}};function e(i,t,o,n){return c({meta:{key:i,title:t,version:"1.0.0",description:o,goal:n,context:"The transition is fail-closed and binds actor, scope, policy, contract, evidence, source revision, and a fenced lifecycle claim.",domain:a,owners:[...d],tags:[...u,"source-lifecycle"],stability:l,docId:[r(p.id)]},capability:{...s},io:{input:h,output:m,errors:f},policy:{auth:"user",pii:[]}})}export const OsintSourceQuarantineCommand=e("osint.source.quarantine","Quarantine OSINT source","Prevent canonical promotion for an unsafe, drifting, or unverifiable source.","Fail closed while preserving source and evidence history for review."),OsintSourceRetireCommand=e("osint.source.retire","Retire OSINT source","Retire an obsolete source while preserving append-only history.","Tombstone current projections without deleting immutable source evidence.");

package/dist/node/osint/transport.js

@@ -0,0 +1 @@
+export const OSINT_SOURCE_LIFECYCLE_CONTRACT_FINGERPRINTS_V0={qualify:"contract:osint.source.qualify.governed@1.0.0",activate:"contract:osint.source.activate@1.0.0",revalidate:"contract:osint.source.revalidate.governed@1.0.0"};const n=["rest","sdk","mcp","cli"],o=["rest","sdk","mcp","cli"],e=(s,t,r,i)=>({operationKey:s,method:t,path:r,transports:t==="GET"?n:o,requiredGrants:i});export const osintTransportBindingsV0=[e("osint.dataset.create","POST","/datasets",["admin"]),e("osint.dataset.list","GET","/datasets",["base_read"]),e("osint.program.upsert","POST","/programs",["overlay_write"]),e("osint.program.run","POST","/programs/:programId/runs",["overlay_write"]),e("osint.grant.set","POST","/grants",["admin"]),e("osint.source.register","POST","/sources",["overlay_write"]),e("osint.source.discover","POST","/sources/discover",["overlay_write"]),e("osint.source.qualify","POST","/sources/:sourceId/qualify",["overlay_write"]),e("osint.source.qualify.governed","POST","/sources/:sourceId/lifecycle/qualify",["overlay_write"]),e("osint.source.activate","POST","/sources/:sourceId/activate",["overlay_write"]),e("osint.source.sync","POST","/sources/:sourceId/sync",["overlay_write"]),e("osint.source.revalidate","POST","/sources/:sourceId/revalidate",["overlay_write"]),e("osint.source.revalidate.governed","POST","/sources/:sourceId/lifecycle/revalidate",["overlay_write"]),e("osint.source.quarantine","POST","/sources/:sourceId/lifecycle/quarantine",["overlay_write"]),e("osint.source.retire","POST","/sources/:sourceId/lifecycle/retire",["overlay_write"]),e("osint.source.health","GET","/sources/:sourceId/health",["base_read"]),e("osint.entity.list","GET","/entities",["base_read"]),e("osint.entity.get","GET","/entities/:entityId",["base_read"]),e("osint.entity.history","GET","/entities/:entityId/history",["base_read"]),e("osint.entity.diff","GET","/entities/:entityId/diff",["base_read"]),e("osint.company.list","GET","/companies",["base_read"]),e("osint.job.list","GET","/jobs",["base_read"]),e("osint.people.list","GET","/people",["base_read"]),e("osint.research.run","POST","/research",["overlay_write"]),e("osint.research.status","GET","/research/:researchId",["base_read"]),e("osint.research.cancel","POST","/research/:researchId/cancel",["overlay_write"]),e("osint.evidence.get","GET","/evidence/:evidenceId",["base_read"]),e("osint.graph.query","GET","/graph",["base_read"]),e("osint.export.create","POST","/exports",["export"]),e("osint.correction.submit","POST","/corrections",["base_propose"]),e("osint.rights.submit","POST","/rights",["base_propose"]),e("osint.rights.get","GET","/rights/:requestId",["base_curate"]),e("osint.rights.list","GET","/rights",["base_curate"]),e("osint.rights.verify","POST","/rights/:requestId/verify",["base_curate"]),e("osint.rights.decide","POST","/rights/:requestId/decision",["base_curate"]),e("osint.rights.complete","POST","/rights/:requestId/complete",["base_curate"]),e("osint.curation.apply","POST","/curation/:proposalId/apply",["base_curate"]),e("osint.review.list","GET","/reviews",["base_curate"]),e("osint.subscription.create","POST","/subscriptions",["overlay_write"]),e("osint.replay.get","GET","/events",["base_read"]),e("osint.dead_letter.list","GET","/operations/dead-letters",["base_curate"]),e("osint.dead_letter.replay","POST","/operations/dead-letters/:deadLetterId/replay",["base_curate"]),e("osint.webhook.delivery.status","GET","/subscriptions/:subscriptionId/deliveries/:deliveryId",["base_read"]),e("osint.webhook.delivery.replay","POST","/subscriptions/:subscriptionId/deliveries/:deliveryId/replay",["overlay_write"]),e("osint.job.listing.revalidate","POST","/job-sources/:installationId/listings/:externalListingId/revalidate",["overlay_write"]),e("osint.job.listing.closure.reconcile","POST","/job-sources/:installationId/listings/:externalListingId/closure/reconcile",["overlay_write"])];

package/dist/node/outcome-claims/factory.js

@@ -0,0 +1 @@
+import{claimCorrectionSchema as a,claimEvidenceSchema as n,outcomeClaimSchema as o}from"./validation.js";function c(e){return e.issues.map((i)=>({path:i.path.map((r)=>typeof r==="symbol"?r.toString():r),message:i.message}))}export function defineOutcomeClaim(e){return o.parse(e)}export function validateOutcomeClaim(e){const i=o.safeParse(e);if(i.success)return{valid:!0,claim:i.data,issues:[]};return{valid:!1,issues:c(i.error)}}export function defineClaimEvidence(e){return n.parse(e)}export function defineClaimCorrection(e){return a.parse(e)}export function hasEvidenceBackedClaim(e){return e.evidenceRefs.length>0}export function recordOutcomeClaimCorrection(e,i,r={}){const t=defineClaimCorrection(i);if(t.targetClaimId!==e.id)throw Error(`Claim correction target ${t.targetClaimId} does not match claim ${e.id}`);return defineOutcomeClaim({...e,review:{...e.review,state:r.supersededByClaimId?"superseded":"corrected",correctionRef:t.id,reviewer:t.reviewer,reviewedAt:t.correctedAt,supersededByClaimId:r.supersededByClaimId},corrections:[...e.corrections,t]})}

package/dist/node/outcome-claims/index.js

@@ -0,0 +1 @@
+export*from"./factory.js";export*from"./types.js";export*from"./validation.js";

package/dist/node/outcome-claims/validation.js

@@ -0,0 +1 @@
+import{z as e}from"zod";export const claimPortableRefKindSchema=e.enum(["agent-step","actor","artifact","claim","document","event","manual-actor","prompt","run","session","skill","span","subject","tool-call","tool-result","trace","workflow","other"]),claimPortableRefSchema=e.object({kind:claimPortableRefKindSchema,id:e.string().min(1),uri:e.string().min(1).optional(),label:e.string().min(1).optional(),version:e.string().min(1).optional(),metadata:e.record(e.string(),e.unknown()).optional()}),claimEvidenceKindSchema=e.enum(["artifact","document","human-attestation","metric","policy-decision","receipt","telemetry","tool-result","trace","transcript","other"]),claimEvidenceSchema=e.object({id:e.string().min(1),kind:claimEvidenceKindSchema,ref:e.string().min(1),uri:e.string().min(1).optional(),digest:e.string().min(1).optional(),excerpt:e.string().min(1).optional(),observedAt:e.string().min(1).optional(),collectedBy:claimPortableRefSchema.optional(),redaction:e.object({status:e.enum(["none","redacted","withheld"]),reason:e.string().min(1).optional()}).optional(),metadata:e.record(e.string(),e.unknown()).optional()}),claimProvenanceSchema=e.object({producer:claimPortableRefSchema,producedAt:e.string().min(1),method:e.string().min(1).optional(),traceRefs:e.array(claimPortableRefSchema).optional()}),claimReviewStateSchema=e.enum(["unreviewed","needs-review","approved","rejected","corrected","superseded"]),claimReviewSchema=e.object({state:claimReviewStateSchema,reviewer:claimPortableRefSchema.optional(),reviewedAt:e.string().min(1).optional(),notes:e.string().min(1).optional(),approvalRef:e.string().min(1).optional(),correctionRef:e.string().min(1).optional(),supersededByClaimId:e.string().min(1).optional()}),claimCorrectionPatchOperationSchema=e.object({op:e.enum(["add","replace","remove"]),path:e.string().min(1),value:e.unknown().optional()}),claimCorrectionSchema=e.object({id:e.string().min(1),targetClaimId:e.string().min(1),correctedFields:e.array(claimCorrectionPatchOperationSchema).min(1),reason:e.string().min(1),reviewer:claimPortableRefSchema,evidenceRefs:e.array(claimEvidenceSchema).min(1),correctedAt:e.string().min(1),supersedesClaimId:e.string().min(1).optional(),supersededByClaimId:e.string().min(1).optional()}),outcomeClaimSchema=e.object({id:e.string().min(1),claimType:e.string().min(1),subjectRefs:e.array(claimPortableRefSchema).min(1),sourceRefs:e.array(claimPortableRefSchema).min(1),evidenceRefs:e.array(claimEvidenceSchema).min(1),confidence:e.number().min(0).max(1),reason:e.string().min(1),provenance:claimProvenanceSchema,review:claimReviewSchema,corrections:e.array(claimCorrectionSchema).default([]),attributionRefs:e.array(claimPortableRefSchema).optional(),metadata:e.record(e.string(),e.unknown()).optional()});

package/dist/node/ownership.js

@@ -0,0 +1 @@
+export const StabilityEnum={Idea:"idea",InCreation:"in_creation",Experimental:"experimental",Beta:"beta",Stable:"stable",Deprecated:"deprecated"},OwnersEnum={PlatformCore:"platform.core",PlatformSigil:"platform.sigil",PlatformMarketplace:"platform.marketplace",PlatformMessaging:"platform.messaging",PlatformContent:"platform.content",PlatformFeatureFlags:"platform.featureflags",PlatformFinance:"platform.finance"},Owners=OwnersEnum,TagsEnum={Spots:"spots",Collectivity:"collectivity",Marketplace:"marketplace",Sellers:"sellers",Auth:"auth",Login:"login",Signup:"signup",Guide:"guide",Docs:"docs",I18n:"i18n",Incident:"incident",Automation:"automation",Hygiene:"hygiene"},Tags=TagsEnum;

package/dist/node/policy/context.js

@@ -0,0 +1 @@
+export class PolicyViolationError extends Error{violationType;details;constructor(e,t){const i=l(e,t);super(i);this.name="PolicyViolationError";this.violationType=e;this.details=t}}function l(e,t){const i=t.operation?`Policy violation for "${t.operation}": `:"Policy violation: ";switch(e){case"missing_role":return`${i}Missing required role "${t.requiredRole}"`;case"missing_permission":return`${i}Missing required permission "${t.requiredPermission}"`;case"missing_attribute":return`${i}Missing or invalid attribute "${t.requiredAttribute?.key}"`;case"rate_limit_exceeded":return`${i}Rate limit exceeded for key "${t.rateLimitKey}"`;case"consent_required":return`${i}Consent required: ${t.consentIds?.join(", ")}`;case"access_denied":return`${i}${t.reason??"Access denied"}`}}class s{user;roles;permissions;rateLimitStates=new Map;rateLimitConfigs;auditHandler;constructor(e,t={}){this.user=e;this.roles=new Set(e.roles);this.permissions=new Set(e.permissions);this.rateLimitConfigs=t.rateLimits??{};this.auditHandler=t.auditHandler}hasRole(e){return this.roles.has(e)}hasAnyRole(e){return e.some((t)=>this.roles.has(t))}hasAllRoles(e){return e.every((t)=>this.roles.has(t))}requireRole(e){if(!this.hasRole(e))throw new PolicyViolationError("missing_role",{requiredRole:e})}hasPermission(e){return this.permissions.has(e)}hasAnyPermission(e){return e.some((t)=>this.permissions.has(t))}hasAllPermissions(e){return e.every((t)=>this.permissions.has(t))}requirePermission(e){if(!this.hasPermission(e))throw new PolicyViolationError("missing_permission",{requiredPermission:e})}getAttribute(e){return this.user.attributes[e]}checkAttribute(e,t){return this.user.attributes[e]===t}checkAttributeOneOf(e,t){return t.includes(this.user.attributes[e])}checkRateLimit(e){const t=this.rateLimitConfigs[e];if(!t)return{allowed:!0,remaining:1/0};const i=Date.now(),r=this.rateLimitStates.get(e);if(!r||i-r.windowStart>=t.windowMs)return{allowed:!0,remaining:t.limit};const n=Math.max(0,t.limit-r.count);if(n<=0){const o=new Date(r.windowStart+t.windowMs),a=r.windowStart+t.windowMs-i;return{allowed:!1,remaining:0,resetAt:o,retryAfterMs:a}}return{allowed:!0,remaining:n}}consumeRateLimit(e,t=1){const i=this.rateLimitConfigs[e];if(!i)return{allowed:!0,remaining:1/0};const r=Date.now();let n=this.rateLimitStates.get(e);if(!n||r-n.windowStart>=i.windowMs)n={key:e,count:0,windowStart:r,windowMs:i.windowMs,limit:i.limit};if(n.count+t>i.limit){const o=new Date(n.windowStart+i.windowMs),a=n.windowStart+i.windowMs-r;this.rateLimitStates.set(e,n);return{allowed:!1,remaining:Math.max(0,i.limit-n.count),resetAt:o,retryAfterMs:a}}n.count+=t;this.rateLimitStates.set(e,n);return{allowed:!0,remaining:Math.max(0,i.limit-n.count)}}auditAccess(e,t,i){if(!this.auditHandler)return;const r={timestamp:new Date,operation:e,result:t,reason:i,userId:this.user.id,tenantId:this.user.tenantId,attributes:this.user.attributes};Promise.resolve(this.auditHandler(r)).catch(()=>{})}}export function createPolicyContext(e,t){return new s(e,t)}export function createAnonymousPolicyContext(e){return new s({id:"anonymous",roles:[],permissions:[],attributes:{}},e)}export function createBypassPolicyContext(e,t,i){return new s({id:"system",roles:e,permissions:t,attributes:{bypass:!0}},i)}

package/dist/node/policy/engine.js

@@ -0,0 +1 @@
+export class PolicyEngine{registry;constructor(n){this.registry=n}decide(n){const t=this.resolvePolicies(n.policies);let i,e,o;for(const u of t){const r=this.matchRuleSet(u,n);if(!r)continue;if(r.rule.effect==="deny")return{effect:"deny",reason:r.rule.reason??u.meta.key,requiredConsents:r.missingConsents.length?r.missingConsents:void 0,evaluatedBy:"engine"};if(r.rule.effect==="allow"){if(r.missingConsents.length)return{effect:"deny",reason:"consent_required",requiredConsents:r.missingConsents,evaluatedBy:"engine"};if(!i)i=r.rule.reason??u.meta.key;if(!e&&r.rateLimit)e=r.rateLimit;if(!o&&r.rule.escalate)o=r.rule.escalate}}const s=this.evaluateFields(t,n),c=t.find((u)=>u.pii)?.pii;return{effect:i?"allow":"deny",reason:i,rateLimit:e,escalate:typeof o>"u"?void 0:o,fieldDecisions:s.length?s:void 0,pii:c,evaluatedBy:"engine"}}resolvePolicies(n){const t=[];for(const i of n){const e=this.registry.get(i.key,i.version);if(!e)throw Error(`PolicyEngine: policy not found ${i.key}.v${i.version}`);t.push(e)}return t}matchRuleSet(n,t){let i;for(const e of n.rules){if(!e.actions.includes(t.action))continue;if(!l(e,t.subject))continue;if(!f(e,t.resource))continue;if(!p(e,t))continue;if(!b(e.relationships,t))continue;if(!a(e,t))continue;const o=m(e,n,t),s=h(e,n,t),c={rule:e,missingConsents:o,rateLimit:s};if(e.effect==="deny")return c;if(e.effect==="allow"&&!i)i=c}return i}evaluateFields(n,t){const i=new Map;for(const e of n){if(!e.fieldPolicies)continue;for(const o of e.fieldPolicies){if(!o.actions.includes(g(t.action)))continue;if(!l(o,t.subject))continue;if(!f(o,t.resource))continue;if(!a(o,t))continue;const s=i.get(o.field);if(o.effect==="deny")i.set(o.field,{field:o.field,effect:"deny",reason:o.reason??e.meta.key});else if(!s)i.set(o.field,{field:o.field,effect:"allow",reason:o.reason??e.meta.key})}}return[...i.values()]}}function g(n){if(n.startsWith("write"))return"write";return"read"}function l(n,t){const i=n.subject;if(!i)return!0;if(i.roles?.length){const e=t.roles??[];if(!i.roles.some((s)=>e.includes(s)))return!1}if(i.attributes){const e=t.attributes??{};if(!d(i.attributes,e))return!1}return!0}function f(n,t){const i=n.resource;if(!i)return!0;if(i.type&&i.type!==t.type)return!1;if(i.fields?.length){const e=t.fields??[];if(!i.fields.some((o)=>e.includes(o)))return!1}if(i.attributes){const e=t.attributes??{};if(!d(i.attributes,e))return!1}return!0}function p(n,t){if(!n.flags?.length)return!0;const i=new Set;if(t.flags)for(const o of t.flags)i.add(o);const e=t.subject.attributes?.featureFlags;if(Array.isArray(e))for(const o of e)i.add(o);return n.flags.every((o)=>i.has(o))}function b(n,t){if(!n||n.length===0)return!0;const i=t.subject.relationships??[],e=j(t.resource),o=t.resource.type;return n.every((s)=>i.some((c)=>{if(c.relation!==s.relation)return!1;if(!(!s.objectType||c.objectType===s.objectType||s.objectType===o))return!1;if(!s.objectId)return!0;if(s.objectId==="$resource"){if(e)return c.object===e;return c.object===o||c.objectType===o}return c.object===s.objectId}))}function a(n,t){if(!n.conditions||n.conditions.length===0)return!0;return n.conditions.every((i)=>C(i.expression,t))}function d(n,t){for(const[i,e]of Object.entries(n)){const o=t[i];if(e.exists&&typeof o>"u")return!1;if(typeof e.equals<"u"){if(o!==e.equals)return!1}if(e.oneOf&&!e.oneOf.includes(o))return!1}return!0}function m(n,t,i){if(!n.requiresConsent?.length)return[];const e=new Set(i.consents??[]),o=n.requiresConsent.filter((s)=>!e.has(s));if(o.length===0)return[];return R(t,o)}function R(n,t){const i=n.consents??[];return t.map((e)=>{return i.find((s)=>s.id===e)??{id:e,scope:"unspecified",purpose:"unspecified",description:`Consent "${e}" required by ${n.meta.key}`,required:!0}})}function h(n,t,i){if(!n.rateLimit)return;const e=typeof n.rateLimit==="string"?(t.rateLimits??[]).find((o)=>o.id===n.rateLimit):n.rateLimit;if(!e)throw Error(`PolicyEngine: rate limit "${String(n.rateLimit)}" not declared in ${t.meta.key}`);return{rpm:e.rpm,key:e.key??i.resource.type,windowSeconds:e.windowSeconds,burst:e.burst}}function C(n,t){const i=n.trim();if(!i)return!0;const e={subject:t.subject,resource:t.resource,context:t.context??{}};try{const s=Function("subject","resource","context",`return (${P(i)});`)(e.subject,e.resource,e.context);return Boolean(s)}catch(o){return!1}}function P(n){return n.replace(/&&/g,"&&").replace(/\|\|/g,"||")}function j(n){if(n.id)return n.id;const t=n.attributes?.id;if(typeof t==="string")return t;if(typeof t==="number")return String(t);return}

package/dist/node/policy/guards.js

@@ -0,0 +1 @@
+import{PolicyViolationError as a}from"./context.js";const f=["anonymous","user","admin","internal"];function m(s){return f.indexOf(s)}function u(s,n){if(n==="anonymous")return!0;if(n==="user")return s.user.id!=="anonymous";if(n==="admin")return s.hasRole("admin");if(n==="internal")return s.hasRole("internal")||s.hasPermission("internal:invoke");return!1}export function checkPolicyForOperation(s,n,e=[]){const{policy:i}=n,o=`${n.meta.key}.v${n.meta.version}`,t={};if(!u(s,i.auth))return{allowed:!1,reason:`Operation "${o}" requires "${i.auth}" auth level`,missing:{roles:i.auth==="admin"?["admin"]:void 0}};if(i.flags?.length){const r=new Set(e),l=i.flags.filter((c)=>!r.has(c));if(l.length>0){t.flags=l;return{allowed:!1,reason:`Operation "${o}" requires feature flags: ${l.join(", ")}`,missing:t}}}return{allowed:!0}}export function assertPolicyForOperation(s,n,e=[]){const i=checkPolicyForOperation(s,n,e);if(!i.allowed){const t=`${n.meta.key}.v${n.meta.version}`;s.auditAccess(t,"denied",i.reason);throw new a("access_denied",{operation:t,reason:i.reason})}const o=`${n.meta.key}.v${n.meta.version}`;s.auditAccess(o,"allowed")}export function filterOperationsByPolicy(s,n,e=[]){return n.filter((i)=>checkPolicyForOperation(s,i,e).allowed)}export function checkRole(s,n,e){if(s.hasRole(n))return{allowed:!0};return{allowed:!1,reason:e?`Operation "${e}" requires role "${n}"`:`Missing required role "${n}"`,missing:{roles:[n]}}}export function assertRole(s,n,e){if(!checkRole(s,n,e).allowed)throw new a("missing_role",{operation:e,requiredRole:n})}export function checkAnyRole(s,n,e){if(s.hasAnyRole(n))return{allowed:!0};return{allowed:!1,reason:e?`Operation "${e}" requires one of roles: ${n.join(", ")}`:`Missing required role (need one of: ${n.join(", ")})`,missing:{roles:n}}}export function checkPermission(s,n,e){if(s.hasPermission(n))return{allowed:!0};return{allowed:!1,reason:e?`Operation "${e}" requires permission "${n}"`:`Missing required permission "${n}"`,missing:{permissions:[n]}}}export function assertPermission(s,n,e){if(!checkPermission(s,n,e).allowed)throw new a("missing_permission",{operation:e,requiredPermission:n})}export function checkAllPermissions(s,n,e){const i=n.filter((o)=>!s.hasPermission(o));if(i.length===0)return{allowed:!0};return{allowed:!1,reason:e?`Operation "${e}" requires permissions: ${i.join(", ")}`:`Missing required permissions: ${i.join(", ")}`,missing:{permissions:i}}}export function checkCombinedPolicy(s,n,e=[],i){const o={},t=[];if(n.roles?.length){const r=n.roles.filter((l)=>!s.hasRole(l));if(r.length>0){o.roles=r;t.push(`Missing roles: ${r.join(", ")}`)}}if(n.anyRole?.length){if(!s.hasAnyRole(n.anyRole)){o.roles=[...o.roles??[],...n.anyRole];t.push(`Need one of roles: ${n.anyRole.join(", ")}`)}}if(n.permissions?.length){const r=n.permissions.filter((l)=>!s.hasPermission(l));if(r.length>0){o.permissions=r;t.push(`Missing permissions: ${r.join(", ")}`)}}if(n.anyPermission?.length){if(!s.hasAnyPermission(n.anyPermission)){o.permissions=[...o.permissions??[],...n.anyPermission];t.push(`Need one of permissions: ${n.anyPermission.join(", ")}`)}}if(n.flags?.length){const r=new Set(e),l=n.flags.filter((c)=>!r.has(c));if(l.length>0){o.flags=l;t.push(`Missing feature flags: ${l.join(", ")}`)}}if(t.length>0)return{allowed:!1,reason:(i?`Operation "${i}": `:"")+t.join("; "),missing:o};return{allowed:!0}}export function assertCombinedPolicy(s,n,e=[],i){const o=checkCombinedPolicy(s,n,e,i);if(!o.allowed)throw new a("access_denied",{operation:i,reason:o.reason})}

package/dist/node/policy/index.js

@@ -0,0 +1 @@
+export*from"./context.js";export*from"./engine.js";export*from"./guards.js";export*from"./opa-adapter.js";export*from"./registry.js";export*from"./requirements.js";export*from"./spec.js";export*from"./validation.js";export const definePolicy=(o)=>o;

package/dist/node/policy/opa-adapter.js

@@ -0,0 +1 @@
+export class OPAPolicyAdapter{client;options;constructor(i,n){this.client=i;this.options=n}async evaluate(i,n,e){const t=buildOPAInput(i,n,e),o=await this.client.evaluate(this.options.decisionPath,t),r=this.options.mapResult?this.options.mapResult(o):o;if(!r)return{...e,evaluatedBy:e.evaluatedBy??"engine"};const s=r,l=a(n,e.requiredConsents??[],s.requiredConsents??[]);return{...e,effect:s.effect??e.effect,reason:s.reason??e.reason,fieldDecisions:s.fieldDecisions??e.fieldDecisions,requiredConsents:l.length?l:void 0,evaluatedBy:"opa"}}}export function buildOPAInput(i,n,e){return{context:i,decision:e,policies:n.map((t)=>({meta:t.meta,rules:t.rules,fieldPolicies:t.fieldPolicies,pii:t.pii,relationships:t.relationships,consents:t.consents,rateLimits:t.rateLimits}))}}function a(i,n,e){if(e.length===0)return n;const t=new Set(n.map((r)=>r.id)),o=[...n];for(const r of e){if(t.has(r))continue;const s=u(i,r);if(s){o.push(s);t.add(s.id)}}return o}function u(i,n){for(const e of i){const t=e.consents?.find((o)=>o.id===n);if(t)return t}return{id:n,scope:"unspecified",purpose:"unspecified",description:`Consent "${n}" returned by OPA`,required:!0}}

package/dist/node/policy/registry.js

@@ -0,0 +1 @@
+import{SpecContractRegistry as o}from"../registry.js";export class PolicyRegistry extends o{constructor(c){super("policy",c)}}

package/dist/node/policy/requirements.js

@@ -0,0 +1 @@
+const y=["roles","anyRole","permissions","anyPermission","flags","policies"];export function normalizePolicyRequirement(i){if(!i)return;return{...i}}export function validatePolicyRequirement(i,r={}){const e=[];if(!i)return{valid:!0,issues:e};for(const s of y){const o=i[s];if(Array.isArray(o)&&o.length===0)e.push({level:"error",message:`${s} must be omitted instead of provided as an empty array`,path:s})}t(i.roles,"roles",e);t(i.anyRole,"anyRole",e);t(i.permissions,"permissions",e);t(i.anyPermission,"anyPermission",e);t(i.flags,"flags",e);a(i.policies,"policies",r.registry,e);if(i.auth==="anonymous"&&Boolean(i.roles?.length||i.anyRole?.length||i.permissions?.length||i.anyPermission?.length||i.policies?.length))e.push({level:"warning",message:"anonymous auth combined with roles, permissions, or policies may be ambiguous",path:"auth"});i.fieldPolicies?.forEach((s,o)=>{const n=`fieldPolicies[${o}]`;if(!s.field?.trim())e.push({level:"error",message:"Field policy must specify a field",path:`${n}.field`});if(!s.actions?.length)e.push({level:"error",message:"Field policy must specify at least one action",path:`${n}.actions`});s.actions?.forEach((l,c)=>{if(l!=="read"&&l!=="write")e.push({level:"error",message:`Invalid field policy action: ${String(l)}`,path:`${n}.actions[${c}]`})});t(s.roles,`${n}.roles`,e);t(s.anyRole,`${n}.anyRole`,e);t(s.permissions,`${n}.permissions`,e);t(s.anyPermission,`${n}.anyPermission`,e);t(s.flags,`${n}.flags`,e);a(s.policy?[s.policy]:void 0,`${n}.policy`,r.registry,e)});return{valid:!e.some((s)=>s.level==="error"),issues:e}}function t(i,r,e){if(!i?.length)return;const s=new Set;for(const o of i){if(s.has(o)){e.push({level:"error",message:`Duplicate ${r} value: ${o}`,path:r});continue}s.add(o)}}function a(i,r,e,s){if(!i?.length||!e)return;i.forEach((o,n)=>{if(!e.get(o.key,o.version))s.push({level:"error",message:`Policy reference not found: ${o.key}.v${o.version}`,path:`${r}[${n}]`})})}

package/dist/node/policy/spec.js

@@ -0,0 +1,150 @@
+export const tech_contracts_policy_DocBlocks=[{id:"docs.tech.contracts.policy",title:"PolicySpec & PolicyEngine",summary:"`PolicySpec` gives a declarative, typed home for access-control logic covering:",kind:"reference",visibility:"public",route:"/docs/tech/contracts/policy",tags:["tech","contracts","policy"],body:`# PolicySpec & PolicyEngine
+
+## Purpose
+
+\`PolicySpec\` gives a declarative, typed home for access-control logic covering:
+- **Who** can perform an action (ABAC/ReBAC style rules)
+- **What** they can access (resources + optional field-level overrides)
+- **When** special conditions apply (contextual expressions)
+- **How** PII should be handled (consent/retention hints)
+
+\`PolicyEngine\` evaluates one or more policies and returns an \`allow\`/\`deny\` decision, field-level outcomes, and PII metadata suitable for downstream enforcement (\`OperationSpecRegistry\` → \`ctx.decide\`).
+
+## Location
+
+- Types & registry: \`packages/libs/contracts/src/policy/spec.ts\`
+- Runtime evaluation: \`packages/libs/contracts/src/policy/engine.ts\`
+- Tests: \`packages/.../policy/engine.test.ts\`
+
+## \`PolicySpec\`
+
+\`\`\`ts
+export interface PolicySpec {
+  meta: PolicyMeta;          // ownership metadata + { name, version, scope? }
+  rules: PolicyRule[];       // allow/deny rules for actions
+  fieldPolicies?: FieldPolicyRule[];
+  pii?: { fields: string[]; consentRequired?: boolean; retentionDays?: number };
+  relationships?: RelationshipDefinition[];
+  consents?: ConsentDefinition[];
+  rateLimits?: RateLimitDefinition[];
+  opa?: { package: string; decision?: string };
+}
+\`\`\`
+
+- \`PolicyRule\`
+  - \`effect\`: \`'allow' | 'deny'\`
+  - \`actions\`: e.g., \`['read', 'write', 'delete']\` (string namespace is flexible)
+  - \`subject\`: \`{ roles?: string[]; attributes?: { attr: matcher } }\`
+  - \`resource\`: \`{ type: string; fields?: string[]; attributes?: {...} }\`
+  - \`relationships\`: \`{ relation, objectId?, objectType? }[]\` → ReBAC checks (use \`objectId: '$resource'\` to target the current resource)
+  - \`requiresConsent\`: \`['consent_id']\` → references spec-level consent definitions
+  - \`flags\`: feature flags that must be enabled (\`DecisionContext.flags\`)
+  - \`rateLimit\`: string reference to \`rateLimits\` entry or inline object \`{ rpm, key?, windowSeconds?, burst? }\`
+  - \`escalate\`: \`'human_review' | null\` to indicate manual approval
+  - \`conditions\`: optional expression snippets evaluated against \`{ subject, resource, context }\`
+- \`FieldPolicyRule\`
+  - \`field\`: dot-path string (e.g., \`contact.email\`)
+  - \`actions\`: subset of \`['read', 'write']\`
+  - Same \`subject\` / \`resource\` / \`conditions\` shape
+  - Useful for redacting specific fields, even when the global action is allowed
+- \`RelationshipDefinition\`
+  - Canonical tuples for relationship graph (\`subjectType\`, \`relation\`, \`objectType\`, \`transitive?\`)
+- \`ConsentDefinition\`
+  - \`{ id, scope, purpose, lawfulBasis?, expiresInDays?, required? }\`
+- \`RateLimitDefinition\`
+  - \`{ id, rpm, key?, windowSeconds?, burst? }\`
+- \`PolicyRef\`
+  - \`{ name: string; version: string }\` → attach to contract specs / workflows
+
+## Registry
+
+\`\`\`ts
+const registry = new PolicyRegistry();
+registry.register(CorePolicySpec);
+const spec = registry.get('core.default', 1);
+\`\`\`
+
+Guarantees uniqueness per \`(name, version)\` and exposes helpers to resolve highest versions.
+
+## Engine
+
+\`\`\`ts
+const engine = new PolicyEngine(policyRegistry);
+
+const decision = engine.decide({
+  action: 'read',
+  subject: { roles: ['admin'] },
+  resource: { type: 'resident', fields: ['contact.email'] },
+  policies: [{ name: 'core.default', version: '1.0.0' }],
+});
+/*
+{
+  effect: 'allow',
+  reason: 'core.default',
+  fieldDecisions: [{ field: 'contact.email', effect: 'allow' }],
+  pii: { fields: ['contact.email'], consentRequired: true }
+}
+*/
+\`\`\`
+
+- First matching **deny** wins; otherwise the first **allow** is returned.
+- Field policies are aggregated across referenced policies:
+  - Later denies override earlier allows for a given field.
+  - Returned as \`fieldDecisions\` to simplify downstream masking.
+- PII metadata is surfaced when defined to help adapt logging/telemetry.
+
+### Expression Support
+
+Conditions accept small JS snippets (e.g., \`subject.attributes.orgId === context.orgId\`). The engine runs them in a constrained scope (\`subject\`, \`resource\`, \`context\`) without access to global state.
+
+### ReBAC & Relationships
+
+- Provide relationship tuples via \`PolicySpec.relationships\` for documentation/validation.
+- Reference them inside rules with \`relationships: [{ relation: 'manager_of', objectType: 'resident', objectId: '$resource' }]\`.
+- The execution context must populate \`subject.relationships\` (\`[{ relation, object, objectType }]\`) for the engine to evaluate ReBAC guards.
+
+### Consent & Rate Limits
+
+- Declare reusable consent definitions under \`consents\`. Rules list the IDs they require; if a user session lacks the consent (\`DecisionContext.consents\`), the engine returns \`effect: 'deny'\` with \`reason: 'consent_required'\` and enumerates missing consents.
+- Attach rate limits either inline or via \`rateLimits\` references. When a rule matches, the engine surfaces \`{ rpm, key, windowSeconds?, burst? }\` so callers can feed it to shared limiters.
+
+### OPA Adapter
+
+- \`OPAPolicyAdapter\` bridges engine decisions to Open Policy Agent (OPA). It forwards the evaluation context + policies to OPA and merges any override result (\`effect\`, \`reason\`, \`fieldDecisions\`, \`requiredConsents\`).
+- Use when migrating to OPA policies or running defense-in-depth: call \`engine.decide()\`, then pass the preliminary decision to \`adapter.evaluate(...)\`. The adapter marks merged decisions with \`evaluatedBy: 'opa'\`.
+- OPA inputs include meta, rules, relationships, rate limits, and consent catalogs to simplify policy authoring on the OPA side.
+
+## Contract Integration
+
+\`ContractSpec.policy\` now supports:
+
+\`\`\`ts
+policy: {
+  auth: 'anonymous' | 'user' | 'admin';
+  ...
+  policies?: PolicyRef[];                // policies evaluated before execution
+  fieldPolicies?: {                      // field hints (read/write) per policy
+    field: string;
+    actions: ('read' | 'write')[];
+    policy?: PolicyRef;
+  }[];
+}
+\`\`\`
+
+Adapters can resolve refs through a shared \`PolicyEngine\` and populate \`ctx.decide\` so \`OperationSpecRegistry.execute\` benefits from centralized enforcement.
+
+## Authoring Guidelines
+
+1. Prefer **allow-by-default** policies but explicitly deny sensitive flows (defense-in-depth).
+2. Keep rule scopes narrow (per feature/operation) and compose multiple \`PolicyRef\`s when necessary.
+3. Store PII field lists here to avoid duplication across logs/telemetry.
+4. Use explicit rule reasons for auditability and better developer feedback.
+5. Treat versioning seriously; bump \`meta.version\` whenever behavior changes.
+
+## Future Enhancements
+
+- Richer expression language (composable predicates, time-based conditions).
+- Multi-tenant relationship graph services (store/resolve relationships at scale).
+- Tooling that auto-generates docs/tests for policies referenced in specs.
+
+`}];

package/dist/node/policy/validation.js

@@ -0,0 +1 @@
+export function validatePolicySpec(t){const i=[];p(t,i);f(t,i);d(t,i);y(t,i);h(t,i);u(t,i);c(t,i);return{valid:i.filter((s)=>s.level==="error").length===0,issues:i}}function c(t,i){if(!t.databaseSources?.length)return;const s=new Set;t.databaseSources.forEach((e,a)=>{const o=`databaseSources[${a}]`;if(!e.sourceKey?.trim())i.push({level:"error",message:"Database policy source must have a sourceKey",path:`${o}.sourceKey`});else if(s.has(e.sourceKey))i.push({level:"error",message:`Duplicate database policy source: ${e.sourceKey}`,path:`${o}.sourceKey`});else s.add(e.sourceKey);if(!e.resource?.table?.trim())i.push({level:"error",message:"Database policy source must reference a table",path:`${o}.resource.table`});if(!Object.keys(e.fieldMapping??{}).length)i.push({level:"error",message:"Database policy source must map fields",path:`${o}.fieldMapping`})});t.rules.forEach((e,a)=>{if(e.databaseSource&&!s.has(e.databaseSource))i.push({level:"error",message:`Database source "${e.databaseSource}" referenced but not defined`,path:`rules[${a}].databaseSource`})});t.fieldPolicies?.forEach((e,a)=>{const o=e.databaseEvidence?.sourceKey;if(o&&!s.has(o))i.push({level:"error",message:`Database source "${o}" referenced but not defined`,path:`fieldPolicies[${a}].databaseEvidence.sourceKey`})})}function p(t,i){const{meta:s}=t;if(!s.key?.trim())i.push({level:"error",message:"Policy must have a non-empty key",path:"meta.key"});if(!s.version?.trim())i.push({level:"error",message:"Policy must have a non-empty version",path:"meta.version"});if(!s.owners?.length)i.push({level:"warning",message:"Policy should specify owners",path:"meta.owners"})}function f(t,i){if(!t.rules?.length){i.push({level:"warning",message:"Policy has no rules defined",path:"rules"});return}const s=new Set;t.rules.forEach((e,a)=>{const o=`rules[${a}]`;if(!e.actions?.length)i.push({level:"error",message:"Rule must specify at least one action",path:`${o}.actions`});if(!["allow","deny"].includes(e.effect))i.push({level:"error",message:`Invalid rule effect: ${e.effect}`,path:`${o}.effect`});if(typeof e.rateLimit==="string"){s.add(e.rateLimit);if(!t.rateLimits?.some((n)=>n.id===e.rateLimit))i.push({level:"error",message:`Rate limit "${e.rateLimit}" referenced but not defined`,path:`${o}.rateLimit`})}if(e.requiresConsent?.length){for(const n of e.requiresConsent)if(!t.consents?.some((r)=>r.id===n))i.push({level:"error",message:`Consent "${n}" referenced but not defined`,path:`${o}.requiresConsent`})}l(e.conditions,`${o}.conditions`,i)});if(t.rateLimits?.length){for(const e of t.rateLimits)if(!s.has(e.id)){if(!t.rules.some((o)=>typeof o.rateLimit==="object"&&o.rateLimit.id===e.id))i.push({level:"info",message:`Rate limit "${e.id}" is defined but not referenced`,path:"rateLimits"})}}}function d(t,i){if(!t.fieldPolicies?.length)return;const s=new Map;t.fieldPolicies.forEach((e,a)=>{const o=`fieldPolicies[${a}]`;if(!e.field?.trim())i.push({level:"error",message:"Field policy must specify a field",path:`${o}.field`});if(!e.actions?.length)i.push({level:"error",message:"Field policy must specify at least one action",path:`${o}.actions`});for(const r of e.actions)if(!["read","write"].includes(r))i.push({level:"error",message:`Invalid field action: ${r}`,path:`${o}.actions`});const n=s.get(e.field)??[];n.push(e);s.set(e.field,n);l(e.conditions,`${o}.conditions`,i)});for(const[e,a]of s.entries())if(a.length>1){if(a.some((n)=>n.effect==="allow")&&a.some((n)=>n.effect==="deny"))i.push({level:"warning",message:`Field "${e}" has potentially conflicting allow/deny policies`,path:"fieldPolicies",context:{field:e,ruleCount:a.length}})}}function y(t,i){if(!t.rateLimits?.length)return;const s=new Set;t.rateLimits.forEach((e,a)=>{const o=`rateLimits[${a}]`;if(!e.id?.trim())i.push({level:"error",message:"Rate limit must have an id",path:`${o}.id`});else if(s.has(e.id))i.push({level:"error",message:`Duplicate rate limit id: ${e.id}`,path:`${o}.id`});else s.add(e.id);if(typeof e.rpm!=="number"||e.rpm<=0)i.push({level:"error",message:"Rate limit rpm must be a positive number",path:`${o}.rpm`});if(e.windowSeconds!==void 0&&e.windowSeconds<=0)i.push({level:"error",message:"Rate limit windowSeconds must be positive if specified",path:`${o}.windowSeconds`});if(e.burst!==void 0&&e.burst<0)i.push({level:"error",message:"Rate limit burst must be non-negative if specified",path:`${o}.burst`})})}function h(t,i){if(!t.consents?.length)return;const s=new Set;t.consents.forEach((e,a)=>{const o=`consents[${a}]`;if(!e.id?.trim())i.push({level:"error",message:"Consent must have an id",path:`${o}.id`});else if(s.has(e.id))i.push({level:"error",message:`Duplicate consent id: ${e.id}`,path:`${o}.id`});else s.add(e.id);if(!e.scope?.trim())i.push({level:"error",message:"Consent must specify a scope",path:`${o}.scope`});if(!e.purpose?.trim())i.push({level:"error",message:"Consent must specify a purpose",path:`${o}.purpose`});if(e.expiresInDays!==void 0&&e.expiresInDays<=0)i.push({level:"error",message:"Consent expiresInDays must be positive if specified",path:`${o}.expiresInDays`})})}function u(t,i){if(!t.relationships?.length)return;const s=new Set;t.relationships.forEach((e,a)=>{const o=`relationships[${a}]`,n=`${e.subjectType}:${e.relation}:${e.objectType}`;if(!e.subjectType?.trim())i.push({level:"error",message:"Relationship must specify subjectType",path:`${o}.subjectType`});if(!e.relation?.trim())i.push({level:"error",message:"Relationship must specify relation",path:`${o}.relation`});if(!e.objectType?.trim())i.push({level:"error",message:"Relationship must specify objectType",path:`${o}.objectType`});if(s.has(n))i.push({level:"warning",message:`Duplicate relationship definition: ${n}`,path:o});else s.add(n)})}function l(t,i,s){if(!t?.length)return;t.forEach((e,a)=>{if(!e.expression?.trim())s.push({level:"error",message:"Condition must have a non-empty expression",path:`${i}[${a}].expression`})})}export function validatePolicyConsistency(t){const i=[];for(const s of t.policies.list()){const e=validatePolicySpec(s);i.push(...e.issues.map((a)=>({...a,path:`${s.meta.key}.v${s.meta.version}${a.path?`.${a.path}`:""}`})))}if(t.operations)for(const s of t.operations.list()){const e=s.policy.policies??[];for(const o of e)if(!t.policies.get(o.key,o.version))i.push({level:"error",message:`Operation "${s.meta.key}.v${s.meta.version}" references unknown policy "${o.key}.v${o.version}"`,path:`operations.${s.meta.key}.policy.policies`});const a=s.policy.fieldPolicies??[];for(const o of a)if(o.policy){if(!t.policies.get(o.policy.key,o.policy.version))i.push({level:"error",message:`Operation "${s.meta.key}.v${s.meta.version}" references unknown field policy "${o.policy.key}.v${o.policy.version}"`,path:`operations.${s.meta.key}.policy.fieldPolicies`})}}return{valid:i.filter((s)=>s.level==="error").length===0,issues:i}}export class PolicyValidationError extends Error{issues;constructor(t,i){super(t);this.issues=i;this.name="PolicyValidationError"}}export function assertPolicySpecValid(t){const i=validatePolicySpec(t);if(!i.valid)throw new PolicyValidationError(`Policy ${t.meta.key}.v${t.meta.version} is invalid`,i.issues)}export function assertPolicyConsistency(t){const i=validatePolicyConsistency(t);if(!i.valid)throw new PolicyValidationError("Policy consistency check failed",i.issues)}

package/dist/node/presentations/index.d.js

@@ -0,0 +1 @@
+export*from"./presentations.js";export*from"./registry.js";

package/dist/node/presentations/index.js

@@ -0,0 +1 @@
+export*from"./presentations.js";export*from"./registry.js";

package/dist/node/presentations/presentations.js

@@ -0,0 +1,83 @@
+export const definePresentation=(e)=>{return e},tech_contracts_presentations_conventions_DocBlocks=[{id:"docs.tech.contracts.presentations-conventions",title:"Presentations Conventions (A11y & i18n)",summary:"- Always provide `meta.description` (≥ 3 chars) — used by a11y/docs/agents.",kind:"reference",visibility:"public",route:"/docs/tech/contracts/presentations-conventions",tags:["tech","contracts","presentations-conventions"],body:`## Presentations Conventions (A11y & i18n)
+
+- Always provide \`meta.description\` (≥ 3 chars) — used by a11y/docs/agents.
+- Prefer source = BlockNote for rich guides; use component key for interactive flows.
+- i18n strings belong in host apps; descriptors carry keys/defaults only.
+- Target selection: include only what you intend to support to avoid drift.
+- PII: declare JSON-like paths under \`policy.pii\`; engine redacts in outputs.
+`}],techContractsDocs=[{id:"docs.tech.contracts.presentations",title:"Presentations — Unified Descriptor & Transform Engine",summary:"How PresentationSpec and TransformEngine keep docs/renderers consistent.",visibility:"public",route:"/docs/tech/contracts/presentations",kind:"reference",tags:["presentations","docs","mcp"],body:`## Presentations V2 — Unified Descriptor & Transform Engine
+
+### Purpose
+
+Unify presentations into one descriptor (\`PresentationSpec\`) that declares a single source (React component key or BlockNote doc) and a list of output targets (react, markdown, application/json, application/xml). A pluggable \`TransformEngine\` renders any target and applies PII redaction.
+
+### Types
+
+\`\`\`ts
+type PresentationTarget =
+  | 'react'
+  | 'markdown'
+  | 'application/json'
+  | 'application/xml';
+
+type PresentationSource =
+  | {
+      type: 'component';
+      framework: 'react';
+      componentKey: string;
+      props?: AnySchemaModel;
+    }
+  | { type: 'blocknotejs'; docJson: unknown; blockConfig?: unknown };
+
+interface PresentationSpec {
+  meta: PresentationMeta; // includes partial OwnerShipMeta + description
+  policy?: SurfacePolicyRequirement;
+  source: PresentationSource;
+  targets: PresentationTarget[];
+}
+
+// Shared ownership schema (source of truth in @lssm/lib.contracts-spec/src/ownership.ts)
+interface OwnerShipMeta {
+  title: string;
+  description: string;
+  domain: string;
+  owners: Owner[];
+  tags: Tag[];
+  stability: Stability;
+}
+
+type Stability = 'experimental' | 'beta' | 'stable' | 'deprecated';
+type Owner = string; // curated list available in code (e.g., '@sigil-team', 'team-strit')
+type Tag = string; // curated list available in code (e.g., 'auth', 'spots')
+
+// For presentations, meta is a Partial<OwnerShipMeta> plus description, name, version
+interface PresentationMeta extends Partial<OwnerShipMeta> {
+  name: string;
+  version: string;
+  description?: string;
+}
+\`\`\`
+
+### Engine
+
+Use \`createDefaultTransformEngine()\` from \`@lssm/lib.presentation-runtime-core/transform-engine\` and register custom renderers as needed. React hosts add \`registerDefaultReactRenderer()\` from \`@lssm/lib.contracts-runtime-client-react/transform-engine\`. The core engine supports markdown/json/xml; the React renderer returns a serializable descriptor the host app renders via a \`componentMap\` or a BlockNote renderer. The canonical source type string is \`blocknotejs\` (not \`blocknote\`).
+
+PII paths (JSON-like) are redacted from rendered outputs.
+
+### MCP Integration
+
+\`createMcpServer\` accepts \`presentationsV2\`. Each descriptor is exposed under \`presentation://<name>/v<version>\` and negotiated variants (\`.md/.json/.xml\`) are rendered by the engine.
+
+### Migration
+
+- V1 \`PresentationSpec\` remains supported; a back-compat helper converts V1 → V2 when convenient.
+- Prefer V2 for new work.
+
+### Examples (Sigil)
+
+- \`sigil.auth.webauth_tabs_v2\`: component source (\`componentKey: 'sigil.webauth.tabs'\`), targets \`react/json/xml\`.
+- \`sigil.signup.guide_v2\`: BlockNote doc source, targets \`react/markdown/json/xml\`.
+
+### React Rendering
+
+Host apps use a \`componentMap\` (e.g., \`'sigil.webauth.tabs' → WebAuthTabs\`) and a BlockNote renderer to turn the React render descriptor into elements.`}];

package/dist/node/presentations/registry.js

@@ -0,0 +1 @@
+import{SpecContractRegistry as t}from"../registry.js";export class PresentationRegistry extends t{constructor(e){super("presentation",e)}}

package/dist/node/product-intent/contract-patch-intent.js

@@ -0,0 +1 @@
+import{ZodSchemaType as t}from"@lssm/lib.schema";import*as e from"zod";const n=e.enum(["add_field","remove_field","rename_field","add_event","update_event","add_operation","update_operation","update_form","update_policy","add_enum_value","remove_enum_value","other"]),a=e.object({type:n,target:e.string().min(1),detail:e.string().min(1)});export const PatchChangeModel=new t(a,{name:"PatchChange"});const c=e.object({featureKey:e.string().min(1),changes:e.array(a),acceptanceCriteria:e.array(e.string().min(1))});export const ContractPatchIntentModel=new t(c,{name:"ContractPatchIntent"});

package/dist/node/product-intent/contract-spec-patch.js

@@ -0,0 +1 @@
+import{ZodSchemaType as e}from"@lssm/lib.schema";import*as t from"zod";const a=t.object({path:t.string().min(1),value:t.unknown()});export const ContractPatchAddModel=new e(a,{name:"ContractPatchAdd"});const c=t.object({path:t.string().min(1),value:t.unknown()});export const ContractPatchUpdateModel=new e(c,{name:"ContractPatchUpdate"});const o=t.object({path:t.string().min(1)});export const ContractPatchRemoveModel=new e(o,{name:"ContractPatchRemove"});const n=t.object({adds:t.array(a).optional(),updates:t.array(c).optional(),removes:t.array(o).optional()});export const ContractSpecOverlayModel=new e(n,{name:"ContractSpecOverlay"});const r=t.object({overlay:n});export const ContractSpecPatchModel=new e(r,{name:"ContractSpecPatch"});

package/dist/node/product-intent/evidence.js

@@ -0,0 +1 @@
+import{ZodSchemaType as n}from"@lssm/lib.schema";import*as e from"zod";const o=e.object({chunkId:e.string().min(1),text:e.string().min(1),meta:e.record(e.string(),e.unknown()).optional()});export const EvidenceChunkModel=new n(o,{name:"EvidenceChunk"});

package/dist/node/product-intent/findings.js

@@ -0,0 +1 @@
+import{ZodSchemaType as i}from"@lssm/lib.schema";import*as n from"zod";import{CitationModel as t}from"./insights.js";const e=n.object({findingId:n.string().min(1),summary:n.string().min(1),tags:n.array(n.string().min(1)).optional(),citations:n.array(t.getZod()).min(1)});export const EvidenceFindingModel=new i(e,{name:"EvidenceFinding"});const o=n.object({findings:n.array(e)});export const EvidenceFindingExtractionModel=new i(o,{name:"EvidenceFindingExtraction"});

package/dist/node/product-intent/impact-report.js

@@ -0,0 +1 @@
+import{ZodSchemaType as a}from"@lssm/lib.schema";import*as r from"zod";const t=r.object({api:r.array(r.string().min(1)).optional(),db:r.array(r.string().min(1)).optional(),ui:r.array(r.string().min(1)).optional(),workflows:r.array(r.string().min(1)).optional(),policy:r.array(r.string().min(1)).optional(),docs:r.array(r.string().min(1)).optional(),tests:r.array(r.string().min(1)).optional()});export const ImpactSurfacesModel=new a(t,{name:"ImpactSurfaces"});const o=r.object({reportId:r.string().min(1),patchId:r.string().min(1),summary:r.string().min(1),breaks:r.array(r.string().min(1)).optional(),mustChange:r.array(r.string().min(1)).optional(),risky:r.array(r.string().min(1)).optional(),surfaces:t});export const ImpactReportModel=new a(o,{name:"ImpactReport"});

package/dist/node/product-intent/index.js

@@ -0,0 +1 @@
+export*from"./findings.js";export*from"./problems.js";export*from"./registry.js";export*from"./runtime.js";export*from"./spec.js";export*from"./tickets.js";export*from"./types.js";

package/dist/node/product-intent/insights.js

@@ -0,0 +1 @@
+import{ZodSchemaType as n}from"@lssm/lib.schema";import*as t from"zod";const i=t.object({chunkId:t.string().min(1),quote:t.string().min(1)});export const CitationModel=new n(i,{name:"Citation"});const o=t.object({insightId:t.string().min(1),claim:t.string().min(1),tags:t.array(t.string().min(1)).optional(),segment:t.string().min(1).optional(),confidence:t.number().min(0).max(1).optional(),citations:t.array(i)});export const InsightModel=new n(o,{name:"Insight"});const e=t.object({insights:t.array(o)});export const InsightExtractionModel=new n(e,{name:"InsightExtraction"});

package/dist/node/product-intent/opportunity-brief.js

@@ -0,0 +1 @@
+import{ZodSchemaType as e}from"@lssm/lib.schema";import*as t from"zod";import{CitationModel as i}from"./insights.js";const c=t.enum(["up","down"]),r=t.enum(["low","medium","high"]),o=t.object({text:t.string().min(1),citations:t.array(i.getZod())});export const CitedTextBlockModel=new e(o,{name:"CitedTextBlock"});const n=t.object({text:t.string().min(1),citations:t.array(i.getZod()).optional()});export const RiskModel=new e(n,{name:"Risk"});const p=t.object({metric:t.string().min(1),direction:c,magnitudeHint:t.string().min(1).optional(),timeframeHint:t.string().min(1).optional()});export const ExpectedImpactModel=new e(p,{name:"ExpectedImpact"});const m=t.object({opportunityId:t.string().min(1),title:t.string().min(1),problem:o,who:o,proposedChange:o,expectedImpact:p,confidence:r,risks:t.array(n).optional()});export const OpportunityBriefModel=new e(m,{name:"OpportunityBrief"});

package/dist/node/product-intent/problems.js

@@ -0,0 +1 @@
+import{ZodSchemaType as t}from"@lssm/lib.schema";import*as e from"zod";const r=e.enum(["low","medium","high"]),o=e.object({problemId:e.string().min(1),statement:e.string().min(1),evidenceIds:e.array(e.string().min(1)).min(1),tags:e.array(e.string().min(1)).optional(),severity:r.optional()});export const ProblemStatementModel=new t(o,{name:"ProblemStatement"});const m=e.object({problems:e.array(o)});export const ProblemGroupingModel=new t(m,{name:"ProblemGrouping"});

package/dist/node/product-intent/registry.js

@@ -0,0 +1 @@
+import{keyOfSpecContract as n,SpecContractRegistry as s}from"../registry.js";export class ProductIntentRegistry extends s{constructor(t){super("product-intent",t)}set(t){const e=n(t);this.items.set(e,t);return this}getById(t){return this.list().find((e)=>e.id===t)}delete(t){const e=this.list().find((i)=>i.id===t);if(!e)return!1;const r=n(e);return this.items.delete(r)}deleteByKey(t,e){return this.items.delete(`${t}.v${e}`)}clear(){this.items.clear()}}

package/dist/node/product-intent/runtime.js

@@ -0,0 +1 @@
+import{ProductIntentRegistry as u}from"./registry.js";export class ProductIntentRuntime{registry;opts;constructor(e,n){this.opts=e;this.registry=n??new u}registerIntent(e){this.registry.register(e)}async runDiscovery(e){const{id:n,meta:o,question:s,context:t}=e,d=e.maxEvidenceChunks??this.opts.maxEvidenceChunks??20,i={id:n,meta:o,question:s,runtimeContext:t},P=await this.opts.fetchEvidence({query:s,maxChunks:d,context:t}),c=await this.extractInsights(s,P,t);i.insights=c;if(this.opts.onInsightsGenerated)await this.opts.onInsightsGenerated(c,t);const a=await this.synthesiseBrief(s,c,t);i.brief=a;if(this.opts.onBriefSynthesised)await this.opts.onBriefSynthesised(a,t);const r=await this.generatePatchIntent(a,t);i.patchIntent=r;if(this.opts.onPatchIntentGenerated)await this.opts.onPatchIntentGenerated(r,t);const p=await this.generatePatch(r,t);i.patch=p;if(this.opts.onPatchGenerated)await this.opts.onPatchGenerated(p,t);const h=await this.generateImpactReport(r,p,t);i.impact=h;if(this.opts.onImpactGenerated)await this.opts.onImpactGenerated(h,t);const m=await this.generateTasks(a,r,h,t);i.tasks=m;if(this.opts.onTasksGenerated)await this.opts.onTasksGenerated(m,t);this.registry.set(i);return i}async extractInsights(e,n,o){throw Error("extractInsights() not implemented. Provide an implementation in a subclass.")}async synthesiseBrief(e,n,o){throw Error("synthesiseBrief() not implemented. Provide an implementation in a subclass.")}async generatePatchIntent(e,n){throw Error("generatePatchIntent() not implemented. Provide an implementation in a subclass.")}async generatePatch(e,n){throw Error("generatePatch() not implemented. Provide an implementation in a subclass.")}async generateImpactReport(e,n,o){throw Error("generateImpactReport() not implemented. Provide an implementation in a subclass.")}async generateTasks(e,n,o,s){throw Error("generateTasks() not implemented. Provide an implementation in a subclass.")}}