@lssm/lib.contracts-spec 17.3.2

package/dist/workspace-config/environment-validation-alias.d.ts

@@ -0,0 +1,3 @@
+import type * as z from 'zod';
+import type { EnvironmentConfig } from './environment.js';
+export declare function validateAliasCollisions(config: EnvironmentConfig, ctx: z.RefinementCtx): void;

package/dist/workspace-config/environment-validation-alias.js

@@ -0,0 +1 @@
+export function validateAliasCollisions(e,n){const s=[];for(const[c,i]of Object.entries(e.variables??{}))for(const[f,o]of(i.aliases??[]).entries()){const t={...o,logicalKey:i.key},l=s.find((a)=>a.name===o.name&&a.logicalKey!==i.key&&p(a,t));if(l)n.addIssue({code:"custom",path:["variables",c,"aliases",f,"name"],message:`Alias "${o.name}" collides in target scope with logical variable "${l.logicalKey}".`});s.push(t)}}function p(e,n){return r(e.targetId,n.targetId)&&r(e.profile,n.profile)&&r(e.framework,n.framework)}function r(e,n){return e===void 0||n===void 0||e===n}

package/dist/workspace-config/environment-validation.d.ts

@@ -0,0 +1,4 @@
+import type * as z from 'zod';
+import type { EnvironmentConfig } from './environment.js';
+export declare function isPublicEnvironmentAlias(name: string): boolean;
+export declare function validateEnvironmentConfig(config: EnvironmentConfig, ctx: z.RefinementCtx): void;

package/dist/workspace-config/environment-validation.js

@@ -0,0 +1 @@
+import{validateAliasCollisions as r}from"./environment-validation-alias.js";export function isPublicEnvironmentAlias(e){return e.startsWith("NEXT_PUBLIC_")||e.startsWith("EXPO_PUBLIC_")}export function validateEnvironmentConfig(e,i){l(e,i);r(e,i)}function l(e,i){for(const[a,t]of Object.entries(e.variables??{})){const s=t.sensitivity??"internal";if((s==="secret"||s==="sensitive")&&t.defaultValue!==void 0)i.addIssue({code:"custom",path:["variables",a,"defaultValue"],message:"Secret and sensitive variables cannot define defaultValue."});for(const[o,n]of(t.aliases??[]).entries())if((n.exposure==="public-client"||n.exposure==="native-client"||n.materialization==="next-config-env"||isPublicEnvironmentAlias(n.name))&&s!=="public")i.addIssue({code:"custom",path:["variables",a,"aliases",o,"name"],message:'Public env aliases require sensitivity "public"; never expose secret or sensitive values.'})}}

package/dist/workspace-config/environment.d.ts

@@ -0,0 +1,77 @@
+import * as z from 'zod';
+export { isPublicEnvironmentAlias } from './environment-validation.js';
+export type EnvironmentSensitivity = 'public' | 'internal' | 'sensitive' | 'secret';
+export type EnvironmentLifecycle = 'build-time' | 'runtime' | 'both';
+export type EnvironmentSurface = 'server' | 'public-client' | 'native-client' | 'edge' | 'worker' | 'ci';
+export type AppEnvironmentFramework = 'next' | 'expo' | 'node' | 'vite' | 'worker' | 'custom';
+export type EnvironmentValueSourceType = 'literal' | 'env' | 'secret' | 'managed-connection' | 'byok-connection';
+export type EnvironmentAliasMaterialization = 'env-file' | 'process-env' | 'next-config-env';
+export interface EnvironmentValueSource {
+    type: EnvironmentValueSourceType;
+    ref?: string;
+    envVar?: string;
+    value?: string | number | boolean;
+    connectionId?: string;
+    secretRef?: string;
+}
+export interface EnvVariableAlias {
+    name: string;
+    targetId?: string;
+    framework?: AppEnvironmentFramework;
+    profile?: string;
+    exposure?: EnvironmentSurface;
+    materialization?: EnvironmentAliasMaterialization;
+}
+export interface EnvironmentVariableDefinition {
+    key: string;
+    description?: string;
+    sensitivity?: EnvironmentSensitivity;
+    lifecycle?: EnvironmentLifecycle;
+    allowedSurfaces?: EnvironmentSurface[];
+    requiredProfiles?: string[];
+    defaultValue?: string | number | boolean;
+    example?: string;
+    valueSource?: EnvironmentValueSource;
+    aliases?: EnvVariableAlias[];
+}
+export interface AppEnvironmentTarget {
+    id: string;
+    packageName?: string;
+    packagePath?: string;
+    appId?: string;
+    framework?: AppEnvironmentFramework;
+    surfaces?: EnvironmentSurface[];
+    profiles?: string[];
+    envFiles?: string[];
+}
+export interface EnvironmentProfileConfig {
+    envFiles?: string[];
+    secretProviders?: string[];
+    variables?: Record<string, EnvironmentValueSource>;
+}
+export interface SecretRequirementConfig {
+    key: string;
+    description?: string;
+    required?: boolean;
+    provider?: string;
+    envVar?: string;
+    secretRefPattern?: string;
+    rotationDays?: number;
+}
+export interface EnvironmentConfig {
+    profiles?: Record<string, EnvironmentProfileConfig>;
+    variables?: Record<string, EnvironmentVariableDefinition>;
+    targets?: Record<string, AppEnvironmentTarget>;
+    secretRequirements?: Record<string, SecretRequirementConfig>;
+}
+export declare const EnvironmentSensitivitySchema: z.ZodType<EnvironmentSensitivity>;
+export declare const EnvironmentLifecycleSchema: z.ZodType<EnvironmentLifecycle>;
+export declare const EnvironmentSurfaceSchema: z.ZodType<EnvironmentSurface>;
+export declare const AppEnvironmentFrameworkSchema: z.ZodType<AppEnvironmentFramework>;
+export declare const EnvironmentValueSourceSchema: z.ZodType<EnvironmentValueSource>;
+export declare const EnvVariableAliasSchema: z.ZodType<EnvVariableAlias>;
+export declare const EnvironmentVariableDefinitionSchema: z.ZodType<EnvironmentVariableDefinition>;
+export declare const AppEnvironmentTargetSchema: z.ZodType<AppEnvironmentTarget>;
+export declare const EnvironmentProfileConfigSchema: z.ZodType<EnvironmentProfileConfig>;
+export declare const SecretRequirementConfigSchema: z.ZodType<SecretRequirementConfig>;
+export declare const EnvironmentConfigSchema: z.ZodType<EnvironmentConfig>;

package/dist/workspace-config/environment.js

@@ -0,0 +1 @@
+import*as e from"zod";import{validateEnvironmentConfig as r}from"./environment-validation.js";export{isPublicEnvironmentAlias}from"./environment-validation.js";export const EnvironmentSensitivitySchema=e.enum(["public","internal","sensitive","secret"]);export const EnvironmentLifecycleSchema=e.enum(["build-time","runtime","both"]);export const EnvironmentSurfaceSchema=e.enum(["server","public-client","native-client","edge","worker","ci"]);export const AppEnvironmentFrameworkSchema=e.enum(["next","expo","node","vite","worker","custom"]);export const EnvironmentValueSourceSchema=e.object({type:e.enum(["literal","env","secret","managed-connection","byok-connection"]),ref:e.string().optional(),envVar:e.string().optional(),value:e.union([e.string(),e.number(),e.boolean()]).optional(),connectionId:e.string().optional(),secretRef:e.string().optional()});export const EnvVariableAliasSchema=e.object({name:e.string().min(1),targetId:e.string().optional(),framework:AppEnvironmentFrameworkSchema.optional(),profile:e.string().optional(),exposure:EnvironmentSurfaceSchema.optional(),materialization:e.enum(["env-file","process-env","next-config-env"]).default("env-file").optional()});export const EnvironmentVariableDefinitionSchema=e.object({key:e.string().min(1),description:e.string().optional(),sensitivity:EnvironmentSensitivitySchema.default("internal").optional(),lifecycle:EnvironmentLifecycleSchema.default("runtime").optional(),allowedSurfaces:e.array(EnvironmentSurfaceSchema).optional(),requiredProfiles:e.array(e.string()).optional(),defaultValue:e.union([e.string(),e.number(),e.boolean()]).optional(),example:e.string().optional(),valueSource:EnvironmentValueSourceSchema.optional(),aliases:e.array(EnvVariableAliasSchema).optional()});export const AppEnvironmentTargetSchema=e.object({id:e.string().min(1),packageName:e.string().optional(),packagePath:e.string().optional(),appId:e.string().optional(),framework:AppEnvironmentFrameworkSchema.optional(),surfaces:e.array(EnvironmentSurfaceSchema).optional(),profiles:e.array(e.string()).optional(),envFiles:e.array(e.string()).optional()});export const EnvironmentProfileConfigSchema=e.object({envFiles:e.array(e.string()).optional(),secretProviders:e.array(e.string()).optional(),variables:e.record(e.string(),EnvironmentValueSourceSchema).optional()});export const SecretRequirementConfigSchema=e.object({key:e.string().min(1),description:e.string().optional(),required:e.boolean().default(!0).optional(),provider:e.string().optional(),envVar:e.string().optional(),secretRefPattern:e.string().optional(),rotationDays:e.number().int().positive().optional()});export const EnvironmentConfigSchema=e.object({profiles:e.record(e.string(),EnvironmentProfileConfigSchema).optional(),variables:e.record(e.string(),EnvironmentVariableDefinitionSchema).optional(),targets:e.record(e.string(),AppEnvironmentTargetSchema).optional(),secretRequirements:e.record(e.string(),SecretRequirementConfigSchema).optional()}).superRefine((n,i)=>{r(n,i)});

package/dist/workspace-config/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Configuration module exports.
+ */
+import type { DocBlock } from '../docs/types.js';
+export type { AgentTarget, ReleaseEnforceOn, } from '../versioning/release-types.js';
+export { AgentTargetSchema, ReleaseEnforceOnSchema, } from '../versioning/schema.js';
+export { type BuilderApiConfig, BuilderApiConfigSchema, type BuilderBootstrapPreset, BuilderBootstrapPresetSchema, type BuilderConfig, BuilderConfigSchema, type BuilderLocalRuntimeConfig, BuilderLocalRuntimeConfigSchema, type BuilderRuntimeMode, BuilderRuntimeModeSchema, type BumpStrategy, BumpStrategySchema, type ChangelogFormat, ChangelogFormatSchema, type ChangelogTier, ChangelogTierSchema, type CliCommandPackDiscoveryConfig, CliCommandPackDiscoveryConfigSchema, type ConnectAdapterConfig, ConnectAdapterConfigSchema, type ConnectAdapterMode, ConnectAdapterModeSchema, type ConnectAdoptionCatalogConfig, ConnectAdoptionCatalogConfigSchema, type ConnectAdoptionConfig, ConnectAdoptionConfigSchema, type ConnectAdoptionFamiliesConfig, ConnectAdoptionFamiliesConfigSchema, type ConnectAdoptionFamily, ConnectAdoptionFamilySchema, type ConnectAdoptionThresholds, ConnectAdoptionThresholdsSchema, type ConnectAdoptionWorkspaceScanConfig, ConnectAdoptionWorkspaceScanConfigSchema, type ConnectCanonPackRef, ConnectCanonPackRefSchema, type ConnectCommandPolicy, ConnectCommandPolicySchema, type ConnectConfig, ConnectConfigSchema, type ConnectPolicyConfig, ConnectPolicyConfigSchema, type ConnectReviewThresholds, ConnectReviewThresholdsSchema, type ConnectStorageConfig, ConnectStorageConfigSchema, type ConnectStudioConfig, ConnectStudioConfigSchema, type ConnectVerdict, ConnectVerdictSchema, type ContractsrcConfig, type ContractsrcFileConfig, ContractsrcSchema, DEFAULT_CONTRACTSRC, type FolderConventions, FolderConventionsSchema, type FormatterConfig, FormatterConfigSchema, type FormatterType, FormatterTypeSchema, type OpenApiConfig, OpenApiConfigSchema, type OpenApiExportConfig, OpenApiExportConfigSchema, type OpenApiSourceConfig, OpenApiSourceConfigSchema, type PackageDeclarationConfig, PackageDeclarationConfigSchema, type PackageDeclarationRequiredByKind, PackageDeclarationRequiredByKindSchema, type PackageDeclarationRollout, PackageDeclarationRolloutSchema, type PackageDeclarationTarget, PackageDeclarationTargetSchema, type ReleaseConfig, ReleaseConfigSchema, type ResolvedContractsrcConfig, type RuleSyncConfig, RuleSyncConfigSchema, type RuleSyncTarget, RuleSyncTargetSchema, type SchemaFormat, SchemaFormatSchema, type SpecKind, SpecKindSchema, type TranslationDiagnosticsConfig, TranslationDiagnosticsConfigSchema, type UpgradeConfig, UpgradeConfigSchema, type VersioningConfig, VersioningConfigSchema, } from './contractsrc-schema.js';
+export type { AgentMode, AgentProvider, } from './contractsrc-types.js';
+export { type AppEnvironmentFramework, AppEnvironmentFrameworkSchema, type AppEnvironmentTarget, AppEnvironmentTargetSchema, type EnvironmentAliasMaterialization, type EnvironmentConfig, EnvironmentConfigSchema, type EnvironmentLifecycle, EnvironmentLifecycleSchema, type EnvironmentProfileConfig, EnvironmentProfileConfigSchema, type EnvironmentSensitivity, EnvironmentSensitivitySchema, type EnvironmentSurface, EnvironmentSurfaceSchema, type EnvironmentValueSource, EnvironmentValueSourceSchema, type EnvironmentValueSourceType, type EnvironmentVariableDefinition, EnvironmentVariableDefinitionSchema, type EnvVariableAlias, EnvVariableAliasSchema, isPublicEnvironmentAlias, type SecretRequirementConfig, SecretRequirementConfigSchema, } from './environment.js';
+export * from './lssm-os-inheritance.js';
+export * from './lssm-os-schema.js';
+export * from './lssm-os-types.js';
+export declare const tech_workspace_config_DocBlocks: DocBlock[];

package/dist/workspace-config/index.js

@@ -0,0 +1 @@
+export{AgentTargetSchema,ReleaseEnforceOnSchema}from"../versioning/schema.js";export{BuilderApiConfigSchema,BuilderBootstrapPresetSchema,BuilderConfigSchema,BuilderLocalRuntimeConfigSchema,BuilderRuntimeModeSchema,BumpStrategySchema,ChangelogFormatSchema,ChangelogTierSchema,CliCommandPackDiscoveryConfigSchema,ConnectAdapterConfigSchema,ConnectAdapterModeSchema,ConnectAdoptionCatalogConfigSchema,ConnectAdoptionConfigSchema,ConnectAdoptionFamiliesConfigSchema,ConnectAdoptionFamilySchema,ConnectAdoptionThresholdsSchema,ConnectAdoptionWorkspaceScanConfigSchema,ConnectCanonPackRefSchema,ConnectCommandPolicySchema,ConnectConfigSchema,ConnectPolicyConfigSchema,ConnectReviewThresholdsSchema,ConnectStorageConfigSchema,ConnectStudioConfigSchema,ConnectVerdictSchema,ContractsrcSchema,DEFAULT_CONTRACTSRC,FolderConventionsSchema,FormatterConfigSchema,FormatterTypeSchema,OpenApiConfigSchema,OpenApiExportConfigSchema,OpenApiSourceConfigSchema,PackageDeclarationConfigSchema,PackageDeclarationRequiredByKindSchema,PackageDeclarationRolloutSchema,PackageDeclarationTargetSchema,ReleaseConfigSchema,RuleSyncConfigSchema,RuleSyncTargetSchema,SchemaFormatSchema,SpecKindSchema,TranslationDiagnosticsConfigSchema,UpgradeConfigSchema,VersioningConfigSchema}from"./contractsrc-schema.js";export{AppEnvironmentFrameworkSchema,AppEnvironmentTargetSchema,EnvironmentConfigSchema,EnvironmentLifecycleSchema,EnvironmentProfileConfigSchema,EnvironmentSensitivitySchema,EnvironmentSurfaceSchema,EnvironmentValueSourceSchema,EnvironmentVariableDefinitionSchema,EnvVariableAliasSchema,isPublicEnvironmentAlias,SecretRequirementConfigSchema}from"./environment.js";export*from"./lssm-os-inheritance.js";export*from"./lssm-os-schema.js";export*from"./lssm-os-types.js";export const tech_workspace_config_DocBlocks=[{id:"docs.tech.contracts.workspace-config",title:"Workspace Configuration (.contractsrc)",summary:"Configuration-as-code conventions for ContractSpec workspaces (`.contractsrc.json`).",kind:"reference",visibility:"public",route:"/docs/tech/contracts/workspace-config",tags:["tech","contracts","config"],body:"## Workspace Configuration (.contractsrc)\n\nContractSpec uses a hierarchical configuration system anchored by `.contractsrc.json` files. Configuration loader supports standard rc-file discovery (cosmiconfig).\n\n### Schema Formats\n\nThe `schemaFormat` option controls the output format of schema generation commands (like `contractspec openapi import`).\n\nSupported formats:\n- `contractspec` (default): Generates standard `defineSchemaModel` code.\n- `zod`: Generates raw Zod schemas using `z.object({...})`.\n- `json-schema`: Generates JSON Schema definitions.\n- `graphql`: Generates GraphQL SDL type definitions.\n\n### Config Interface\n\n```ts\nexport interface ContractsrcConfig {\n  // ... existing fields ...\n  schemaFormat?: 'contractspec' | 'zod' | 'json-schema' | 'graphql';\n}\n```\n\nDefined in `@lssm/lib.contracts-spec/workspace-config`.\n\n### CI Package Declaration Coverage\n\nThe `ci.packageDeclarations` section lets workspaces stage package-level contract declaration enforcement across the monorepo.\n\n```ts\nexport interface ContractsrcConfig {\n  ci?: {\n    packageDeclarations?: {\n      severity?: 'off' | 'warning' | 'error';\n      requiredByKind?: {\n        libs?: 'feature';\n        modules?: 'feature';\n        integrations?: 'integration';\n        bundles?: 'module-bundle';\n        apps?: 'app-config';\n        appsRegistry?: 'app-config';\n        examples?: 'example';\n      };\n      allowMissing?: string[];\n    };\n  };\n}\n```\n\n### Connect\n\nThe `connect` section configures ContractSpec Connect as a codebase-aligned adapter layer inside the existing CLI and runtime stack.\n\n```ts\nexport interface ContractsrcConfig {\n  connect?: {\n    enabled?: boolean;\n    adapters?: {\n      cursor?: { enabled?: boolean; mode?: 'plugin' | 'rule' | 'wrapper' };\n      codex?: { enabled?: boolean; mode?: 'plugin' | 'rule' | 'wrapper' };\n      'claude-code'?: { enabled?: boolean; mode?: 'plugin' | 'rule' | 'wrapper' };\n    };\n    storage?: {\n      root?: string;\n      contextPack?: string;\n      planPacket?: string;\n      patchVerdict?: string;\n      auditFile?: string;\n      reviewPacketsDir?: string;\n    };\n    policy?: {\n      protectedPaths?: string[];\n      immutablePaths?: string[];\n      generatedPaths?: string[];\n      smokeChecks?: string[];\n      reviewThresholds?: {\n        protectedPathWrite?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        unknownImpact?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        contractDrift?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        breakingChange?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        destructiveCommand?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n      };\n    };\n    commands?: {\n      allow?: string[];\n      review?: string[];\n      deny?: string[];\n    };\n    canonPacks?: Array<{ ref: string; readOnly?: boolean }>;\n    studio?: { enabled?: boolean; mode?: 'off' | 'review-bridge'; endpoint?: string; queue?: string };\n    adoption?: {\n      enabled?: boolean;\n      catalog?: {\n        indexPath?: string;\n        overrideManifestPath?: string;\n      };\n      workspaceScan?: {\n        include?: string[];\n        exclude?: string[];\n      };\n      families?: {\n        ui?: boolean;\n        contracts?: boolean;\n        integrations?: boolean;\n        runtime?: boolean;\n        sharedLibs?: boolean;\n        solutions?: boolean;\n      };\n      thresholds?: {\n        workspaceReuse?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        contractspecReuse?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        ambiguous?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        newExternalDependency?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n        newImplementation?: 'permit' | 'rewrite' | 'require_review' | 'deny';\n      };\n    };\n  };\n}\n```\n\n### Builder\n\nThe `builder` section configures preset-driven Builder onboarding without requiring live bootstrap during setup.\n\n```ts\nexport interface ContractsrcConfig {\n  builder?: {\n    enabled?: boolean;\n    runtimeMode?: 'managed' | 'local' | 'hybrid';\n    bootstrapPreset?: 'managed_mvp' | 'local_daemon_mvp' | 'hybrid_mvp';\n    api?: {\n      baseUrl?: string;\n      controlPlaneTokenEnvVar?: string;\n    };\n    localRuntime?: {\n      runtimeId?: string;\n      grantedTo?: string;\n      providerIds?: string[];\n    };\n  };\n}\n```\n\n### LSSM OS\n\nThe optional `lssmOs` V1 section carries provider-neutral goals, contract\nreferences, workload envelopes, provider restrictions, exact minor-unit budgets,\nautonomy, infrastructure ownership, credential references, and evidence profiles.\nProvider-specific extensions are typed JSON escape hatches and reject raw secret\nfields recursively.\n\nScoped policy layers resolve deterministically in this order: platform,\norganization, workspace, environment, deployable, feature, operation, tenant.\nChildren may only tighten inherited constraints. A relaxation requires an\napproved, exact-path, exact-scope, unexpired waiver; inherited immutable rules\ncannot be waived.\n\nUse `resolveLssmOsConfigV1(config, now)` to produce a deterministic policy\nprojection and the exact scopes and waiver identifiers used by the resolution.\n"}];

package/dist/workspace-config/lssm-os-config.fixture.d.ts

@@ -0,0 +1,2 @@
+import type { LssmOsConfigV1 } from './lssm-os-types.js';
+export declare const lssmOsConfigFixture: LssmOsConfigV1;

package/dist/workspace-config/lssm-os-config.fixture.js

@@ -0,0 +1 @@
+export const lssmOsConfigFixture={version:"1",profile:"startup",goalRefs:[{id:"goal.activation",version:"1.0.0"}],contractRefs:[{id:"operation.signup",version:"2.0.0"}],workloadEnvelopes:[{id:"api",maxConcurrentUsers:5000,maxDataBytes:"100000000000",regions:["eu-west"]}],providerPolicy:{allow:["railway","vercel"],deny:["aws"],regions:["eu-west","eu-central"],residency:["eu"],portability:"preferred",requiredCapabilities:["compute"]},budget:{currency:"EUR",maxMonthlyMinorUnits:"100000",hardGateOnUnknownOrStale:!0,unitEconomics:[{metric:"activated_workspace",maxCostMinorUnits:"300",unit:"one"}]},autonomy:{default:"apply_with_approval"},infrastructure:{iac:"opentofu",stateBackend:"postgres",stateRef:"state.production",ownerByResource:{database:"opentofu"}},credentialRefs:[{id:"credential.railway",kind:"oidc",provider:"railway"}],evidence:{observability:{backend:"otel",region:"eu",retentionDays:30,privacyPreset:"strict"},analytics:{backend:"posthog",region:"eu",consentRequired:!0}},providerExtensions:[{provider:"railway",capability:"private-networking",config:{enabled:!0,credentialRef:"credential.railway"}}]};

package/dist/workspace-config/lssm-os-constraints.d.ts

@@ -0,0 +1,14 @@
+import type { LssmOsConfigLayerV1 } from './lssm-os-types.js';
+export declare class LssmOsConfigResolutionError extends Error {
+    readonly scopeId: string;
+    readonly constraintPath: string;
+    constructor(message: string, scopeId: string, constraintPath: string);
+}
+export declare function constrainedSubset(parent: string[] | undefined, child: string[] | undefined, path: string, layer: LssmOsConfigLayerV1, mayRelax: (path: string) => boolean): string[] | undefined;
+export declare function constrainedSuperset(parent: string[] | undefined, child: string[] | undefined, path: string, layer: LssmOsConfigLayerV1, mayRelax: (path: string) => boolean): string[] | undefined;
+export declare function orderedConstraint<T extends string>(parent: T | undefined, child: T | undefined, order: readonly T[], path: string, layer: LssmOsConfigLayerV1, mayRelax: (path: string) => boolean, higherIsTighter: boolean): T | undefined;
+export declare function maxConstraint(parent: string | undefined, child: string | undefined, path: string, layer: LssmOsConfigLayerV1, mayRelax: (path: string) => boolean): string | undefined;
+export declare function maxNumberConstraint(parent: number | undefined, child: number | undefined, path: string, layer: LssmOsConfigLayerV1, mayRelax: (path: string) => boolean): number | undefined;
+export declare function booleanConstraint(parent: boolean | undefined, child: boolean | undefined, path: string, layer: LssmOsConfigLayerV1, mayRelax: (path: string) => boolean): boolean | undefined;
+export declare function unique(values: string[] | undefined): string[] | undefined;
+export declare function fail(layer: LssmOsConfigLayerV1, path: string, message: string): never;

package/dist/workspace-config/lssm-os-constraints.js

@@ -0,0 +1 @@
+export class LssmOsConfigResolutionError extends Error{scopeId;constraintPath;constructor(n,e,r){super(n);this.scopeId=e;this.constraintPath=r;this.name="LssmOsConfigResolutionError"}}export function constrainedSubset(n,e,r,i,t){if(!e)return n;if(!n||e.every((s)=>n.includes(s))||t(r))return unique(e);return fail(i,r,`${r} may only remove inherited values.`)}export function constrainedSuperset(n,e,r,i,t){if(!e)return n;if(!n||n.every((s)=>e.includes(s))||t(r))return unique(e);return fail(i,r,`${r} may only add inherited values.`)}export function orderedConstraint(n,e,r,i,t,s,u){if(!e||!n)return e??n;const o=r.indexOf(e)-r.indexOf(n);if((u?o>=0:o<=0)||s(i))return e;return fail(t,i,`${i} cannot be relaxed without a valid waiver.`)}export function maxConstraint(n,e,r,i,t){if(!e||!n||BigInt(e)<=BigInt(n)||t(r))return e??n;return fail(i,r,`${r} cannot increase without a valid waiver.`)}export function maxNumberConstraint(n,e,r,i,t){if(e===void 0||n===void 0||e<=n||t(r))return e??n;return fail(i,r,`${r} cannot increase without a valid waiver.`)}export function booleanConstraint(n,e,r,i,t){if(e===void 0||n===void 0||e||!n||t(r))return e??n;return fail(i,r,`${r} cannot be disabled without a valid waiver.`)}export function unique(n){return n?[...new Set(n)].sort():void 0}export function fail(n,e,r){throw new LssmOsConfigResolutionError(r,n.scope.id,e)}

package/dist/workspace-config/lssm-os-extension-schema.d.ts

@@ -0,0 +1,3 @@
+import * as z from 'zod';
+import type { LssmOsProviderExtensionV1 } from './lssm-os-types.js';
+export declare const LssmOsProviderExtensionV1Schema: z.ZodType<LssmOsProviderExtensionV1>;

package/dist/workspace-config/lssm-os-extension-schema.js

@@ -0,0 +1 @@
+import*as s from"zod";const r=s.string().trim().min(1);const o=s.lazy(()=>s.union([s.string(),s.number().finite(),s.boolean(),s.null(),s.array(o),s.record(s.string(),o)]));export const LssmOsProviderExtensionV1Schema=s.object({provider:r,capability:r,config:s.record(s.string(),o)}).strict();

package/dist/workspace-config/lssm-os-inheritance.d.ts

@@ -0,0 +1,3 @@
+import { type LssmOsConfigResolutionV1, type LssmOsConfigV1 } from './lssm-os-types.js';
+export { LssmOsConfigResolutionError } from './lssm-os-constraints.js';
+export declare function resolveLssmOsConfigV1(input: LssmOsConfigV1, now?: Date): LssmOsConfigResolutionV1;

package/dist/workspace-config/lssm-os-inheritance.js

@@ -0,0 +1 @@
+import{LssmOsConfigResolutionError as a}from"./lssm-os-constraints.js";import{mergeLssmOsPolicy as c,normalizeLssmOsPolicy as p}from"./lssm-os-policy-merge.js";import{LSSM_OS_SCOPE_ORDER as t}from"./lssm-os-types.js";export{LssmOsConfigResolutionError}from"./lssm-os-constraints.js";export function resolveLssmOsConfigV1(n,i=new Date){const o=m(n.layers??[]);let s=p(n);const e=[];for(const r of o)s=c(s,r,i,e);return{config:s,appliedScopes:o.map((r)=>r.scope),appliedWaiverIds:e}}function m(n){const i=new Set,o=[...n].sort((s,e)=>{return t.indexOf(s.scope.kind)-t.indexOf(e.scope.kind)||s.scope.id.localeCompare(e.scope.id)});for(const s of o){if(i.has(s.scope.kind))throw new a(`Only one ${s.scope.kind} layer may participate in a resolution chain.`,s.scope.id,"scope.kind");i.add(s.scope.kind)}return o}

package/dist/workspace-config/lssm-os-policy-merge.d.ts

@@ -0,0 +1,3 @@
+import type { LssmOsConfigLayerV1, LssmOsPolicyConfigV1 } from './lssm-os-types.js';
+export declare function normalizeLssmOsPolicy(input: LssmOsPolicyConfigV1): LssmOsPolicyConfigV1;
+export declare function mergeLssmOsPolicy(parent: LssmOsPolicyConfigV1, layer: LssmOsConfigLayerV1, now: Date, appliedWaiverIds: string[]): LssmOsPolicyConfigV1;

package/dist/workspace-config/lssm-os-policy-merge.js

@@ -0,0 +1 @@
+import{booleanConstraint as d,fail as f,maxConstraint as m,maxNumberConstraint as y,orderedConstraint as u,unique as l}from"./lssm-os-constraints.js";import{mergeProviderPolicy as b,normalizeProviderPolicy as O}from"./lssm-os-provider-merge.js";const a=["observe","recommend","plan","apply_with_approval","auto_apply_qualified"];export function normalizeLssmOsPolicy(n){return{providerPolicy:O(n.providerPolicy),budget:n.budget?{...n.budget,unitEconomics:n.budget.unitEconomics?.map((s)=>({...s}))}:void 0,autonomy:n.autonomy?{...n.autonomy,byScope:{...n.autonomy.byScope}}:void 0,immutableRules:l(n.immutableRules)}}export function mergeLssmOsPolicy(n,s,i,t){const o=normalizeLssmOsPolicy(s.policy),e=(r)=>C(n,s,r,i,t);return{providerPolicy:b(n.providerPolicy,o.providerPolicy,s,e),budget:L(n,o,s,e),autonomy:p(n,o,s,e),immutableRules:l([...n.immutableRules??[],...o.immutableRules??[]])}}function L(n,s,i,t){const o=n.budget,e=s.budget;if(!e)return o;if(!o)return e;if(o.currency!==e.currency&&!t("budget.currency"))f(i,"budget.currency","Budget currency cannot change in a child scope.");return{...o,...e,maxMonthlyMinorUnits:m(o.maxMonthlyMinorUnits,e.maxMonthlyMinorUnits,"budget.maxMonthlyMinorUnits",i,t),maxChangeMinorUnits:m(o.maxChangeMinorUnits,e.maxChangeMinorUnits,"budget.maxChangeMinorUnits",i,t),hardGateOnUnknownOrStale:d(o.hardGateOnUnknownOrStale,e.hardGateOnUnknownOrStale,"budget.hardGateOnUnknownOrStale",i,t),warningPercent:y(o.warningPercent,e.warningPercent,"budget.warningPercent",i,t),unitEconomics:e.unitEconomics??o.unitEconomics}}function p(n,s,i,t){const o=n.autonomy,e=s.autonomy;if(!e)return o;if(!o)return e;const r={...o.byScope};for(const[c,g]of Object.entries(e.byScope??{}))r[c]=u(o.byScope?.[c]??o.default,g,a,`autonomy.byScope.${c}`,i,t,!1);return{default:u(o.default,e.default,a,"autonomy.default",i,t,!1),byScope:r}}function C(n,s,i,t,o){if([...n.immutableRules??[],...s.policy.immutableRules??[]].some((r)=>i===r||i.startsWith(`${r}.`)))return!1;const e=(s.waivers??[]).find((r)=>P(r,s,i,t));if(!e)return!1;if(!o.includes(e.id))o.push(e.id);return!0}function P(n,s,i,t){return n.constraintPath===i&&n.scope.kind===s.scope.kind&&n.scope.id===s.scope.id&&new Date(n.expiresAt).getTime()>t.getTime()}

package/dist/workspace-config/lssm-os-provider-merge.d.ts

@@ -0,0 +1,3 @@
+import type { LssmOsConfigLayerV1, LssmOsProviderPolicyV1 } from './lssm-os-types.js';
+export declare function normalizeProviderPolicy(policy: LssmOsProviderPolicyV1 | undefined): LssmOsProviderPolicyV1 | undefined;
+export declare function mergeProviderPolicy(parent: LssmOsProviderPolicyV1 | undefined, child: LssmOsProviderPolicyV1 | undefined, layer: LssmOsConfigLayerV1, mayRelax: (path: string) => boolean): LssmOsProviderPolicyV1 | undefined;

package/dist/workspace-config/lssm-os-provider-merge.js

@@ -0,0 +1 @@
+import{constrainedSubset as d,constrainedSuperset as u,fail as P,orderedConstraint as y,unique as n}from"./lssm-os-constraints.js";const f=["none","preferred","required"];export function normalizeProviderPolicy(e){if(!e)return;return{...e,allow:n(e.allow),deny:n(e.deny),regions:n(e.regions),residency:n(e.residency),requiredCapabilities:n(e.requiredCapabilities)}}export function mergeProviderPolicy(e,i,r,s){if(!i)return e;if(!e)return i;const o={...e};o.allow=d(e.allow,i.allow,"providerPolicy.allow",r,s);o.regions=d(e.regions,i.regions,"providerPolicy.regions",r,s);o.residency=d(e.residency,i.residency,"providerPolicy.residency",r,s);o.deny=u(e.deny,i.deny,"providerPolicy.deny",r,s);o.requiredCapabilities=u(e.requiredCapabilities,i.requiredCapabilities,"providerPolicy.requiredCapabilities",r,s);o.portability=y(e.portability,i.portability,f,"providerPolicy.portability",r,s,!0);o.managedPosture=v(e.managedPosture,i.managedPosture,r,s);const a=new Set(o.deny??[]),t=(o.allow??[]).filter((l)=>a.has(l));if(t.length)P(r,"providerPolicy",`Provider policy is unsatisfiable: ${t.join(", ")} are both allowed and denied.`);return o}function v(e,i,r,s){if(!i||!e||e===i||e==="either")return i??e;if(s("providerPolicy.managedPosture"))return i;return P(r,"providerPolicy.managedPosture","Managed posture cannot change or widen without a valid waiver.")}

package/dist/workspace-config/lssm-os-schema.d.ts

@@ -0,0 +1,20 @@
+import * as z from 'zod';
+import type { LssmOsAutonomyLevelV1, LssmOsAutonomyPolicyV1, LssmOsBudgetPolicyV1, LssmOsConfigLayerV1, LssmOsConfigV1, LssmOsConstraintWaiverV1, LssmOsCredentialRefV1, LssmOsDataProfileV1, LssmOsEvidenceConfigV1, LssmOsInfrastructureOwnershipV1, LssmOsPolicyConfigV1, LssmOsProfileV1, LssmOsProviderPolicyV1, LssmOsRefV1, LssmOsScopeKindV1, LssmOsScopeRefV1, LssmOsWorkloadEnvelopeV1 } from './lssm-os-types.js';
+export { LssmOsProviderExtensionV1Schema } from './lssm-os-extension-schema.js';
+export declare const LssmOsScopeKindV1Schema: z.ZodType<LssmOsScopeKindV1>;
+export declare const LssmOsProfileV1Schema: z.ZodType<LssmOsProfileV1>;
+export declare const LssmOsAutonomyLevelV1Schema: z.ZodType<LssmOsAutonomyLevelV1>;
+export declare const LssmOsRefV1Schema: z.ZodType<LssmOsRefV1>;
+export declare const LssmOsScopeRefV1Schema: z.ZodType<LssmOsScopeRefV1>;
+export declare const LssmOsWorkloadEnvelopeV1Schema: z.ZodType<LssmOsWorkloadEnvelopeV1>;
+export declare const LssmOsProviderPolicyV1Schema: z.ZodType<LssmOsProviderPolicyV1>;
+export declare const LssmOsBudgetPolicyV1Schema: z.ZodType<LssmOsBudgetPolicyV1>;
+export declare const LssmOsAutonomyPolicyV1Schema: z.ZodType<LssmOsAutonomyPolicyV1>;
+export declare const LssmOsInfrastructureOwnershipV1Schema: z.ZodType<LssmOsInfrastructureOwnershipV1>;
+export declare const LssmOsCredentialRefV1Schema: z.ZodType<LssmOsCredentialRefV1>;
+export declare const LssmOsDataProfileV1Schema: z.ZodType<LssmOsDataProfileV1>;
+export declare const LssmOsEvidenceConfigV1Schema: z.ZodType<LssmOsEvidenceConfigV1>;
+export declare const LssmOsConstraintWaiverV1Schema: z.ZodType<LssmOsConstraintWaiverV1>;
+export declare const LssmOsPolicyConfigV1Schema: z.ZodType<LssmOsPolicyConfigV1>;
+export declare const LssmOsConfigLayerV1Schema: z.ZodType<LssmOsConfigLayerV1>;
+export declare const LssmOsConfigV1Schema: z.ZodType<LssmOsConfigV1>;

package/dist/workspace-config/lssm-os-schema.js

@@ -0,0 +1 @@
+import*as o from"zod";import{LssmOsProviderExtensionV1Schema as m}from"./lssm-os-extension-schema.js";import{rejectLssmOsSecretValues as p}from"./lssm-os-secrets.js";export{LssmOsProviderExtensionV1Schema}from"./lssm-os-extension-schema.js";const e=o.string().trim().min(1);const s=o.string().regex(/^(0|[1-9]\d*)$/);export const LssmOsScopeKindV1Schema=o.enum(["platform","organization","workspace","environment","deployable","feature","operation","tenant"]);export const LssmOsProfileV1Schema=o.enum(["bootstrap","startup","growth","regulated","enterprise","custom"]);export const LssmOsAutonomyLevelV1Schema=o.enum(["observe","recommend","plan","apply_with_approval","auto_apply_qualified"]);export const LssmOsRefV1Schema=o.object({id:e,version:e.optional()}).strict();export const LssmOsScopeRefV1Schema=o.object({kind:LssmOsScopeKindV1Schema,id:e}).strict();export const LssmOsWorkloadEnvelopeV1Schema=o.object({id:e,maxConcurrentUsers:o.number().int().positive().optional(),maxRequestsPerSecond:o.number().positive().optional(),maxBurstRequestsPerSecond:o.number().positive().optional(),maxLatencyMs:o.number().int().positive().optional(),minAvailabilityPercent:o.number().min(0).max(100).optional(),maxDataBytes:s.optional(),maxMonthlyDataGrowthBytes:s.optional(),maxStorageBytes:s.optional(),maxMonthlyEgressBytes:s.optional(),maxBackgroundJobsPerHour:o.number().int().nonnegative().optional(),maxRpoSeconds:o.number().int().nonnegative().optional(),maxRtoSeconds:o.number().int().nonnegative().optional(),regions:o.array(e).min(1).optional()}).strict();export const LssmOsProviderPolicyV1Schema=o.object({allow:o.array(e).min(1).optional(),deny:o.array(e).optional(),regions:o.array(e).min(1).optional(),residency:o.array(e).min(1).optional(),portability:o.enum(["none","preferred","required"]).optional(),managedPosture:o.enum(["managed","self_hosted","either"]).optional(),requiredCapabilities:o.array(e).optional()}).strict().superRefine((t,i)=>{const n=new Set(t.deny??[]);for(const a of t.allow??[])if(n.has(a))i.addIssue({code:"custom",message:`Provider "${a}" cannot be both allowed and denied.`,path:["allow"]})});export const LssmOsBudgetPolicyV1Schema=o.object({currency:o.string().regex(/^[A-Z]{3}$/),maxMonthlyMinorUnits:s.optional(),maxChangeMinorUnits:s.optional(),hardGateOnUnknownOrStale:o.boolean().optional(),warningPercent:o.number().min(0).max(100).optional(),unitEconomics:o.array(o.object({metric:e,maxCostMinorUnits:s,unit:e}).strict()).optional()}).strict();export const LssmOsAutonomyPolicyV1Schema=o.object({default:LssmOsAutonomyLevelV1Schema,byScope:o.record(e,LssmOsAutonomyLevelV1Schema).optional()}).strict();export const LssmOsInfrastructureOwnershipV1Schema=o.object({iac:o.enum(["provider_native","opentofu","docker_compose","none"]),ownerByResource:o.record(e,e).optional(),stateBackend:o.enum(["git","sqlite","pglite","postgres","supabase"]).optional(),stateRef:e.optional()}).strict();export const LssmOsCredentialRefV1Schema=o.object({id:e,kind:o.enum(["environment","oidc","github_app","managed_custody"]),provider:e.optional(),envVar:o.string().regex(/^[A-Z][A-Z0-9_]*$/).optional()}).strict();export const LssmOsDataProfileV1Schema=o.object({backend:e.optional(),region:e.optional(),retentionDays:o.number().int().nonnegative().optional(),samplingRate:o.number().min(0).max(1).optional(),privacyPreset:o.enum(["strict","balanced","custom"]).optional(),consentRequired:o.boolean().optional()}).strict();export const LssmOsEvidenceConfigV1Schema=o.object({observability:LssmOsDataProfileV1Schema.optional(),analytics:LssmOsDataProfileV1Schema.optional(),featureFlags:LssmOsDataProfileV1Schema.optional(),experiments:LssmOsDataProfileV1Schema.optional()}).strict();export const LssmOsConstraintWaiverV1Schema=o.object({id:e,constraintPath:o.string().regex(/^[a-zA-Z][a-zA-Z0-9.[\]_-]*$/),scope:LssmOsScopeRefV1Schema,expiresAt:o.iso.datetime({offset:!0}),approvedByRef:e,evidenceRefs:o.array(e).min(1),reason:e}).strict();export const LssmOsPolicyConfigV1Schema=o.object({providerPolicy:LssmOsProviderPolicyV1Schema.optional(),budget:LssmOsBudgetPolicyV1Schema.optional(),autonomy:LssmOsAutonomyPolicyV1Schema.optional(),immutableRules:o.array(e).optional()}).strict();export const LssmOsConfigLayerV1Schema=o.object({scope:LssmOsScopeRefV1Schema,policy:LssmOsPolicyConfigV1Schema,waivers:o.array(LssmOsConstraintWaiverV1Schema).optional()}).strict();export const LssmOsConfigV1Schema=o.object({version:o.literal("1"),profile:LssmOsProfileV1Schema,goalRefs:o.array(LssmOsRefV1Schema).optional(),contractRefs:o.array(LssmOsRefV1Schema).optional(),workloadEnvelopes:o.array(LssmOsWorkloadEnvelopeV1Schema).optional(),providerPolicy:LssmOsProviderPolicyV1Schema.optional(),budget:LssmOsBudgetPolicyV1Schema.optional(),autonomy:LssmOsAutonomyPolicyV1Schema.optional(),infrastructure:LssmOsInfrastructureOwnershipV1Schema.optional(),credentialRefs:o.array(LssmOsCredentialRefV1Schema).optional(),evidence:LssmOsEvidenceConfigV1Schema.optional(),providerExtensions:o.array(m).optional(),immutableRules:o.array(e).optional(),layers:o.array(LssmOsConfigLayerV1Schema).optional()}).strict().superRefine((t,i)=>{p(t,i);const n=t.layers?.flatMap((a)=>a.waivers?.map((r)=>r.id)??[]);if(n&&new Set(n).size!==n.length)i.addIssue({code:"custom",message:"Waiver identifiers must be unique across all layers.",path:["layers"]})});

package/dist/workspace-config/lssm-os-secrets.d.ts

@@ -0,0 +1,2 @@
+import type * as z from 'zod';
+export declare function rejectLssmOsSecretValues(value: unknown, context: z.RefinementCtx): void;

package/dist/workspace-config/lssm-os-secrets.js

@@ -0,0 +1 @@
+export function rejectLssmOsSecretValues(e,t){o(e,[],t)}function o(e,t,s){if(!e||typeof e!=="object")return;for(const[r,i]of Object.entries(e)){const n=[...t,r];if(a(r))s.addIssue({code:"custom",message:`Raw secret field "${r}" is forbidden; use a credential reference.`,path:n});o(i,n,s)}}function a(e){const t=e.replaceAll(/[-_]/g,"").toLowerCase();if(/(ref|refid|envvar)$/.test(t))return!1;return/(secret|password|passphrase|privatekey|apikey|accesstoken|authtoken)/.test(t)}

package/dist/workspace-config/lssm-os-types.d.ts

@@ -0,0 +1,125 @@
+export declare const LSSM_OS_SCOPE_ORDER: readonly ['platform', 'organization', 'workspace', 'environment', 'deployable', 'feature', 'operation', 'tenant'];
+export type LssmOsScopeKindV1 = (typeof LSSM_OS_SCOPE_ORDER)[number];
+export type LssmOsProfileV1 = 'bootstrap' | 'startup' | 'growth' | 'regulated' | 'enterprise' | 'custom';
+export type LssmOsAutonomyLevelV1 = 'observe' | 'recommend' | 'plan' | 'apply_with_approval' | 'auto_apply_qualified';
+export type LssmOsPortabilityV1 = 'none' | 'preferred' | 'required';
+export type LssmOsJsonValueV1 = string | number | boolean | null | LssmOsJsonValueV1[] | {
+    [key: string]: LssmOsJsonValueV1;
+};
+export interface LssmOsRefV1 {
+    id: string;
+    version?: string;
+}
+export interface LssmOsScopeRefV1 {
+    kind: LssmOsScopeKindV1;
+    id: string;
+}
+export interface LssmOsWorkloadEnvelopeV1 {
+    id: string;
+    maxConcurrentUsers?: number;
+    maxRequestsPerSecond?: number;
+    maxBurstRequestsPerSecond?: number;
+    maxLatencyMs?: number;
+    minAvailabilityPercent?: number;
+    maxDataBytes?: string;
+    maxMonthlyDataGrowthBytes?: string;
+    maxStorageBytes?: string;
+    maxMonthlyEgressBytes?: string;
+    maxBackgroundJobsPerHour?: number;
+    maxRpoSeconds?: number;
+    maxRtoSeconds?: number;
+    regions?: string[];
+}
+export interface LssmOsProviderPolicyV1 {
+    allow?: string[];
+    deny?: string[];
+    regions?: string[];
+    residency?: string[];
+    portability?: LssmOsPortabilityV1;
+    managedPosture?: 'managed' | 'self_hosted' | 'either';
+    requiredCapabilities?: string[];
+}
+export interface LssmOsBudgetPolicyV1 {
+    currency: string;
+    maxMonthlyMinorUnits?: string;
+    maxChangeMinorUnits?: string;
+    hardGateOnUnknownOrStale?: boolean;
+    warningPercent?: number;
+    unitEconomics?: Array<{
+        metric: string;
+        maxCostMinorUnits: string;
+        unit: string;
+    }>;
+}
+export interface LssmOsAutonomyPolicyV1 {
+    default: LssmOsAutonomyLevelV1;
+    byScope?: Record<string, LssmOsAutonomyLevelV1>;
+}
+export interface LssmOsInfrastructureOwnershipV1 {
+    iac: 'provider_native' | 'opentofu' | 'docker_compose' | 'none';
+    ownerByResource?: Record<string, string>;
+    stateBackend?: 'git' | 'sqlite' | 'pglite' | 'postgres' | 'supabase';
+    stateRef?: string;
+}
+export interface LssmOsCredentialRefV1 {
+    id: string;
+    kind: 'environment' | 'oidc' | 'github_app' | 'managed_custody';
+    provider?: string;
+    envVar?: string;
+}
+export interface LssmOsDataProfileV1 {
+    backend?: string;
+    region?: string;
+    retentionDays?: number;
+    samplingRate?: number;
+    privacyPreset?: 'strict' | 'balanced' | 'custom';
+    consentRequired?: boolean;
+}
+export interface LssmOsEvidenceConfigV1 {
+    observability?: LssmOsDataProfileV1;
+    analytics?: LssmOsDataProfileV1;
+    featureFlags?: LssmOsDataProfileV1;
+    experiments?: LssmOsDataProfileV1;
+}
+export interface LssmOsProviderExtensionV1 {
+    provider: string;
+    capability: string;
+    config: Record<string, LssmOsJsonValueV1>;
+}
+export interface LssmOsConstraintWaiverV1 {
+    id: string;
+    constraintPath: string;
+    scope: LssmOsScopeRefV1;
+    expiresAt: string;
+    approvedByRef: string;
+    evidenceRefs: string[];
+    reason: string;
+}
+export interface LssmOsPolicyConfigV1 {
+    providerPolicy?: LssmOsProviderPolicyV1;
+    budget?: LssmOsBudgetPolicyV1;
+    autonomy?: LssmOsAutonomyPolicyV1;
+    immutableRules?: string[];
+}
+export interface LssmOsConfigLayerV1 {
+    scope: LssmOsScopeRefV1;
+    policy: LssmOsPolicyConfigV1;
+    waivers?: LssmOsConstraintWaiverV1[];
+}
+export interface LssmOsConfigV1 extends LssmOsPolicyConfigV1 {
+    version: '1';
+    profile: LssmOsProfileV1;
+    goalRefs?: LssmOsRefV1[];
+    contractRefs?: LssmOsRefV1[];
+    workloadEnvelopes?: LssmOsWorkloadEnvelopeV1[];
+    infrastructure?: LssmOsInfrastructureOwnershipV1;
+    credentialRefs?: LssmOsCredentialRefV1[];
+    evidence?: LssmOsEvidenceConfigV1;
+    providerExtensions?: LssmOsProviderExtensionV1[];
+    layers?: LssmOsConfigLayerV1[];
+}
+export interface LssmOsConfigResolutionV1 {
+    config: LssmOsPolicyConfigV1;
+    appliedScopes: LssmOsScopeRefV1[];
+    appliedWaiverIds: string[];
+}

package/dist/workspace-config/lssm-os-types.js

@@ -0,0 +1 @@
+export const LSSM_OS_SCOPE_ORDER=["platform","organization","workspace","environment","deployable","feature","operation","tenant"];