@lssm/lib.contracts 0.0.0-canary-20251217063201 → 0.0.0-canary-20251217073102

package/dist/app-config/contracts.js

@@ -1 +1,396 @@
-import{l as e}from"../schema/dist/ScalarTypeEnum.js";import{t}from"../schema/dist/SchemaModel.js";import"../schema/dist/index.js";import{defineCommand as n,defineQuery as r}from"../spec.js";import{OwnersEnum as i,StabilityEnum as a,TagsEnum as o}from"../ownership.js";const s=new t({name:`BrandingAssetInput`,fields:{type:{type:e.String_unsecure(),isOptional:!1},url:{type:e.URL(),isOptional:!1},mimeType:{type:e.String_unsecure(),isOptional:!0}}}),c=new t({name:`UpdateTenantBrandingInput`,fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},environment:{type:e.String_unsecure(),isOptional:!0},appName:{type:e.JSONObject(),isOptional:!0},assets:{type:s,isOptional:!0,isArray:!0},colors:{type:e.JSONObject(),isOptional:!0},customDomain:{type:e.String_unsecure(),isOptional:!0},subdomain:{type:e.String_unsecure(),isOptional:!0}}}),l=new t({name:`UpdateTenantBrandingOutput`,fields:{success:{type:e.Boolean(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),u=new t({name:`VerifyCustomDomainInput`,fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},domain:{type:e.String_unsecure(),isOptional:!1}}}),d=new t({name:`VerifyCustomDomainOutput`,fields:{status:{type:e.String_unsecure(),isOptional:!1},message:{type:e.String_unsecure(),isOptional:!0}}}),f=new t({name:`TranslationEntryInput`,fields:{key:{type:e.String_unsecure(),isOptional:!1},locale:{type:e.String_unsecure(),isOptional:!1},value:{type:e.String_unsecure(),isOptional:!1},context:{type:e.String_unsecure(),isOptional:!0}}}),p=new t({name:`UpdateBlueprintTranslationInput`,fields:{blueprintName:{type:e.String_unsecure(),isOptional:!1},blueprintVersion:{type:e.Int_unsecure(),isOptional:!1},catalogName:{type:e.String_unsecure(),isOptional:!1},catalogVersion:{type:e.Int_unsecure(),isOptional:!1},defaultLocale:{type:e.String_unsecure(),isOptional:!1},supportedLocales:{type:e.String_unsecure(),isOptional:!1,isArray:!0},entries:{type:f,isOptional:!1,isArray:!0}}}),m=new t({name:`UpdateTenantTranslationInput`,fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},entries:{type:f,isOptional:!1,isArray:!0},defaultLocale:{type:e.String_unsecure(),isOptional:!0},enabledLocales:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}}),h=new t({name:`MessageResolutionInput`,fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},locale:{type:e.String_unsecure(),isOptional:!1},key:{type:e.String_unsecure(),isOptional:!1}}}),g=new t({name:`MessageResolutionOutput`,fields:{value:{type:e.String_unsecure(),isOptional:!0},source:{type:e.String_unsecure(),isOptional:!0}}}),_=n({meta:{name:`appConfig.updateTenantBranding`,version:1,description:`Applies tenant branding overrides (names, assets, domains).`,owners:[i.PlatformSigil],tags:[`branding`],stability:a.Beta,goal:`Maintain tenant-specific branding assets and domains.`,context:`Invoked by the Studio or automation when a tenant updates branding settings.`},io:{input:c,output:l},policy:{auth:`admin`,policies:[{name:`platform.app-config.manage`,version:1}]}}),v=n({meta:{name:`appConfig.verifyCustomDomain`,version:1,description:`Validates DNS ownership for tenant custom domains.`,owners:[i.PlatformSigil],tags:[`branding`],stability:a.Experimental,goal:`Confirm tenant-provided domains before activation.`,context:`Triggered after the tenant adds DNS records to verify domain ownership.`},io:{input:u,output:d},policy:{auth:`admin`,policies:[{name:`platform.app-config.manage`,version:1}]}}),y=n({meta:{name:`appConfig.updateBlueprintTranslationCatalog`,version:1,description:`Registers or updates translation entries for a blueprint.`,owners:[i.PlatformSigil],tags:[o.I18n],stability:a.Beta,goal:`Keep blueprint translation catalogs in sync with shipped copy.`,context:`Executed by platform automation or CI when committing updated translation catalogs.`},io:{input:p,output:l},policy:{auth:`admin`,policies:[{name:`platform.app-config.manage`,version:1}]}}),b=n({meta:{name:`appConfig.updateTenantTranslations`,version:1,description:`Applies tenant-specific translation entries.`,owners:[i.PlatformSigil],tags:[o.I18n],stability:a.Beta,goal:`Allow tenants to override selected message keys.`,context:`Called by the Studio when a tenant customizes labels or copy for their locale.`},io:{input:m,output:l},policy:{auth:`admin`,policies:[{name:`platform.app-config.manage`,version:1}]}}),x=r({meta:{name:`appConfig.getResolvedBranding`,version:1,description:`Returns the resolved branding for a tenant/app/environment.`,owners:[i.PlatformSigil],tags:[`branding`],stability:a.Beta,goal:`Expose hydrated branding assets for rendering UI/email experiences.`,context:`Used by runtime surfaces to fetch brand assets prior to rendering tenant-specific experiences.`},io:{input:new t({name:`GetResolvedBrandingInput`,fields:{tenantId:{type:e.ID(),isOptional:!1},appId:{type:e.ID(),isOptional:!1},environment:{type:e.String_unsecure(),isOptional:!0}}}),output:new t({name:`GetResolvedBrandingOutput`,fields:{branding:{type:e.JSONObject(),isOptional:!1}}})},policy:{auth:`admin`,policies:[{name:`platform.app-config.read`,version:1}]}}),S=r({meta:{name:`appConfig.resolveMessage`,version:1,description:`Resolves a translation key for a tenant in the requested locale.`,owners:[i.PlatformSigil],tags:[o.I18n],stability:a.Experimental,goal:`Expose a server-side API for resolving message keys on demand.`,context:`Used by backend services or scripts that need translated copy outside the front-end runtime.`},io:{input:h,output:g},policy:{auth:`admin`,policies:[{name:`platform.app-config.read`,version:1}]}}),C={UpdateTenantBrandingCommand:_,VerifyCustomDomainCommand:v,UpdateBlueprintTranslationCatalogCommand:y,UpdateTenantTranslationOverridesCommand:b,GetResolvedBrandingQuery:x,ResolveMessageQuery:S};function w(e){return e.register(_).register(v).register(y).register(b).register(x).register(S)}export{x as GetResolvedBrandingQuery,S as ResolveMessageQuery,y as UpdateBlueprintTranslationCatalogCommand,_ as UpdateTenantBrandingCommand,b as UpdateTenantTranslationOverridesCommand,v as VerifyCustomDomainCommand,C as appConfigContracts,w as registerAppConfigContracts};
+import { ScalarTypeEnum } from "../schema/dist/ScalarTypeEnum.js";
+import { SchemaModel } from "../schema/dist/SchemaModel.js";
+import "../schema/dist/index.js";
+import { defineCommand, defineQuery } from "../spec.js";
+import { OwnersEnum, StabilityEnum, TagsEnum } from "../ownership.js";
+
+//#region src/app-config/contracts.ts
+const BrandingAssetInput = new SchemaModel({
+	name: "BrandingAssetInput",
+	fields: {
+		type: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		url: {
+			type: ScalarTypeEnum.URL(),
+			isOptional: false
+		},
+		mimeType: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const UpdateTenantBrandingInput = new SchemaModel({
+	name: "UpdateTenantBrandingInput",
+	fields: {
+		tenantId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		appId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		environment: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		appName: {
+			type: ScalarTypeEnum.JSONObject(),
+			isOptional: true
+		},
+		assets: {
+			type: BrandingAssetInput,
+			isOptional: true,
+			isArray: true
+		},
+		colors: {
+			type: ScalarTypeEnum.JSONObject(),
+			isOptional: true
+		},
+		customDomain: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		subdomain: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const UpdateTenantBrandingOutput = new SchemaModel({
+	name: "UpdateTenantBrandingOutput",
+	fields: {
+		success: {
+			type: ScalarTypeEnum.Boolean(),
+			isOptional: false
+		},
+		updatedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const VerifyCustomDomainInput = new SchemaModel({
+	name: "VerifyCustomDomainInput",
+	fields: {
+		tenantId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		appId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		domain: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		}
+	}
+});
+const VerifyCustomDomainOutput = new SchemaModel({
+	name: "VerifyCustomDomainOutput",
+	fields: {
+		status: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		message: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const TranslationEntryInput = new SchemaModel({
+	name: "TranslationEntryInput",
+	fields: {
+		key: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		locale: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		value: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		context: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const UpdateBlueprintTranslationInput = new SchemaModel({
+	name: "UpdateBlueprintTranslationInput",
+	fields: {
+		blueprintName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		blueprintVersion: {
+			type: ScalarTypeEnum.Int_unsecure(),
+			isOptional: false
+		},
+		catalogName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		catalogVersion: {
+			type: ScalarTypeEnum.Int_unsecure(),
+			isOptional: false
+		},
+		defaultLocale: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		supportedLocales: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false,
+			isArray: true
+		},
+		entries: {
+			type: TranslationEntryInput,
+			isOptional: false,
+			isArray: true
+		}
+	}
+});
+const UpdateTenantTranslationInput = new SchemaModel({
+	name: "UpdateTenantTranslationInput",
+	fields: {
+		tenantId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		appId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		entries: {
+			type: TranslationEntryInput,
+			isOptional: false,
+			isArray: true
+		},
+		defaultLocale: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		enabledLocales: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true,
+			isArray: true
+		}
+	}
+});
+const MessageResolutionInput = new SchemaModel({
+	name: "MessageResolutionInput",
+	fields: {
+		tenantId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		appId: {
+			type: ScalarTypeEnum.ID(),
+			isOptional: false
+		},
+		locale: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		key: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		}
+	}
+});
+const MessageResolutionOutput = new SchemaModel({
+	name: "MessageResolutionOutput",
+	fields: {
+		value: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		source: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const UpdateTenantBrandingCommand = defineCommand({
+	meta: {
+		name: "appConfig.updateTenantBranding",
+		version: 1,
+		description: "Applies tenant branding overrides (names, assets, domains).",
+		owners: [OwnersEnum.PlatformSigil],
+		tags: ["branding"],
+		stability: StabilityEnum.Beta,
+		goal: "Maintain tenant-specific branding assets and domains.",
+		context: "Invoked by the Studio or automation when a tenant updates branding settings."
+	},
+	io: {
+		input: UpdateTenantBrandingInput,
+		output: UpdateTenantBrandingOutput
+	},
+	policy: {
+		auth: "admin",
+		policies: [{
+			name: "platform.app-config.manage",
+			version: 1
+		}]
+	}
+});
+const VerifyCustomDomainCommand = defineCommand({
+	meta: {
+		name: "appConfig.verifyCustomDomain",
+		version: 1,
+		description: "Validates DNS ownership for tenant custom domains.",
+		owners: [OwnersEnum.PlatformSigil],
+		tags: ["branding"],
+		stability: StabilityEnum.Experimental,
+		goal: "Confirm tenant-provided domains before activation.",
+		context: "Triggered after the tenant adds DNS records to verify domain ownership."
+	},
+	io: {
+		input: VerifyCustomDomainInput,
+		output: VerifyCustomDomainOutput
+	},
+	policy: {
+		auth: "admin",
+		policies: [{
+			name: "platform.app-config.manage",
+			version: 1
+		}]
+	}
+});
+const UpdateBlueprintTranslationCatalogCommand = defineCommand({
+	meta: {
+		name: "appConfig.updateBlueprintTranslationCatalog",
+		version: 1,
+		description: "Registers or updates translation entries for a blueprint.",
+		owners: [OwnersEnum.PlatformSigil],
+		tags: [TagsEnum.I18n],
+		stability: StabilityEnum.Beta,
+		goal: "Keep blueprint translation catalogs in sync with shipped copy.",
+		context: "Executed by platform automation or CI when committing updated translation catalogs."
+	},
+	io: {
+		input: UpdateBlueprintTranslationInput,
+		output: UpdateTenantBrandingOutput
+	},
+	policy: {
+		auth: "admin",
+		policies: [{
+			name: "platform.app-config.manage",
+			version: 1
+		}]
+	}
+});
+const UpdateTenantTranslationOverridesCommand = defineCommand({
+	meta: {
+		name: "appConfig.updateTenantTranslations",
+		version: 1,
+		description: "Applies tenant-specific translation entries.",
+		owners: [OwnersEnum.PlatformSigil],
+		tags: [TagsEnum.I18n],
+		stability: StabilityEnum.Beta,
+		goal: "Allow tenants to override selected message keys.",
+		context: "Called by the Studio when a tenant customizes labels or copy for their locale."
+	},
+	io: {
+		input: UpdateTenantTranslationInput,
+		output: UpdateTenantBrandingOutput
+	},
+	policy: {
+		auth: "admin",
+		policies: [{
+			name: "platform.app-config.manage",
+			version: 1
+		}]
+	}
+});
+const GetResolvedBrandingQuery = defineQuery({
+	meta: {
+		name: "appConfig.getResolvedBranding",
+		version: 1,
+		description: "Returns the resolved branding for a tenant/app/environment.",
+		owners: [OwnersEnum.PlatformSigil],
+		tags: ["branding"],
+		stability: StabilityEnum.Beta,
+		goal: "Expose hydrated branding assets for rendering UI/email experiences.",
+		context: "Used by runtime surfaces to fetch brand assets prior to rendering tenant-specific experiences."
+	},
+	io: {
+		input: new SchemaModel({
+			name: "GetResolvedBrandingInput",
+			fields: {
+				tenantId: {
+					type: ScalarTypeEnum.ID(),
+					isOptional: false
+				},
+				appId: {
+					type: ScalarTypeEnum.ID(),
+					isOptional: false
+				},
+				environment: {
+					type: ScalarTypeEnum.String_unsecure(),
+					isOptional: true
+				}
+			}
+		}),
+		output: new SchemaModel({
+			name: "GetResolvedBrandingOutput",
+			fields: { branding: {
+				type: ScalarTypeEnum.JSONObject(),
+				isOptional: false
+			} }
+		})
+	},
+	policy: {
+		auth: "admin",
+		policies: [{
+			name: "platform.app-config.read",
+			version: 1
+		}]
+	}
+});
+const ResolveMessageQuery = defineQuery({
+	meta: {
+		name: "appConfig.resolveMessage",
+		version: 1,
+		description: "Resolves a translation key for a tenant in the requested locale.",
+		owners: [OwnersEnum.PlatformSigil],
+		tags: [TagsEnum.I18n],
+		stability: StabilityEnum.Experimental,
+		goal: "Expose a server-side API for resolving message keys on demand.",
+		context: "Used by backend services or scripts that need translated copy outside the front-end runtime."
+	},
+	io: {
+		input: MessageResolutionInput,
+		output: MessageResolutionOutput
+	},
+	policy: {
+		auth: "admin",
+		policies: [{
+			name: "platform.app-config.read",
+			version: 1
+		}]
+	}
+});
+const appConfigContracts = {
+	UpdateTenantBrandingCommand,
+	VerifyCustomDomainCommand,
+	UpdateBlueprintTranslationCatalogCommand,
+	UpdateTenantTranslationOverridesCommand,
+	GetResolvedBrandingQuery,
+	ResolveMessageQuery
+};
+function registerAppConfigContracts(registry) {
+	return registry.register(UpdateTenantBrandingCommand).register(VerifyCustomDomainCommand).register(UpdateBlueprintTranslationCatalogCommand).register(UpdateTenantTranslationOverridesCommand).register(GetResolvedBrandingQuery).register(ResolveMessageQuery);
+}
+
+//#endregion
+export { GetResolvedBrandingQuery, ResolveMessageQuery, UpdateBlueprintTranslationCatalogCommand, UpdateTenantBrandingCommand, UpdateTenantTranslationOverridesCommand, VerifyCustomDomainCommand, appConfigContracts, registerAppConfigContracts };

package/dist/app-config/docs/app-config.docblock.js

@@ -1,220 +1,22 @@
-import{registerDocBlocks as e}from"../../docs/registry.js";import"../../registry.js";const t=[{id:`docs.tech.contracts.app-config`,title:`App Configuration Layers`,summary:`App orchestration is split into three explicit layers:`,kind:`reference`,visibility:`public`,route:`/docs/tech/contracts/app-config`,tags:[`tech`,`contracts`,`app-config`],body:`## App Configuration Layers
-
-App orchestration is split into three explicit layers:
-
-1. **AppBlueprintSpec** – global, versioned description of what an app can look like. Stored in Git, no tenant/environment data.
-2. **TenantAppConfig** – tenant/environment overrides that the future Studio edits. Stored per tenant (DB/contract), mutable at runtime.
-3. **ResolvedAppConfig** – pure, merged view consumed by the runtime. Derived in-memory from a blueprint + tenant config.
-
-- Types & registry: \`packages/libs/contracts/src/app-config/spec.ts\`
-- Resolution helpers: \`packages/libs/contracts/src/app-config/runtime.ts\`
-- CLI wizard (blueprint scaffolding): \`contractspec create app-config\`
-
-### 1. AppBlueprintSpec
-
-\`\`\`ts
-export interface AppBlueprintSpec {
-  meta: AppBlueprintMeta;          // { name, version, appId, ownership }
-  capabilities?: { enabled?: CapabilityRef[]; disabled?: CapabilityRef[] };
-  features?: { include?: FeatureRef[]; exclude?: FeatureRef[] };
-  integrationSlots?: AppIntegrationSlot[];
-  branding?: BrandingDefaults;
-  dataViews?: Record<string, SpecPointer>;
-  workflows?: Record<string, SpecPointer>;
-  policies?: PolicyRef[];
-  theme?: AppThemeBinding;
-  telemetry?: TelemetryBinding;
-  experiments?: { active?: ExperimentRef[]; paused?: ExperimentRef[] };
-  featureFlags?: FeatureFlagState[];
-  routes?: AppRouteConfig[];
-  notes?: string;
-}
-\`\`\`
-
-Register blueprints with \`AppBlueprintRegistry\`. Blueprints only capture the default/global experience.
-
-- **Integration slots** declare the categories and capability requirements an app expects (e.g. \`"primary-payments"\` must be a payments provider that supports managed or BYOK credentials). Slots never include secrets; tenants bind concrete connections later.
-- **Branding defaults** provide message-key based names, placeholder assets, and theme token references that downstream tenants can override.
-
-### 2. TenantAppConfig
-
-\`\`\`ts
-export interface TenantAppConfig {
-  meta: TenantAppConfigMeta;  // { id, tenantId, appId, blueprintName/version, environment?, version, timestamps }
-  capabilities?: { enable?: CapabilityRef[]; disable?: CapabilityRef[] };
-  features?: { include?: FeatureRef[]; exclude?: FeatureRef[] };
-  dataViewOverrides?: TenantSpecOverride[];
-  workflowOverrides?: TenantSpecOverride[];
-  additionalPolicies?: PolicyRef[];
-  themeOverride?: { primary?: ThemeRef | null; fallbacks?: ThemeRef[] };
-  telemetryOverride?: { spec?: SpecPointer | null; disabledEvents?: string[] };
-  experiments?: { active?: ExperimentRef[]; paused?: ExperimentRef[] };
-  featureFlags?: FeatureFlagState[];
-  routeOverrides?: TenantRouteOverride[];
-  integrations?: AppIntegrationBinding[];
-  knowledge?: AppKnowledgeBinding[];
-  branding?: TenantBrandingConfig;
-  notes?: string;
-}
-\`\`\`
-
-This object represents what a tenant edits via the Studio (stored in DB/contracts later).
-
-- **AppIntegrationBinding** now maps \`slotId\` → \`connectionId\` (plus optional workflow scopes). It no longer carries capability lists; those are defined once in the slot.
-- **TenantBrandingConfig** allows per-tenant names, assets, and domain overrides while keeping secrets and large files out of blueprints.
-
-### 3. ResolvedAppConfig
-
-\`\`\`ts
-export interface ResolvedAppConfig {
-  appId: string;
-  tenantId: string;
-  environment?: string;
-  blueprintName: string;
-  blueprintVersion: number;
-  configVersion: number;
-  capabilities: { enabled: CapabilityRef[]; disabled: CapabilityRef[] };
-  features: { include: FeatureRef[]; exclude: FeatureRef[] };
-  dataViews: Record<string, SpecPointer>;
-  workflows: Record<string, SpecPointer>;
-  policies: PolicyRef[];
-  theme?: AppThemeBinding;
-  telemetry?: TelemetryBinding;
-  experiments: { catalog: ExperimentRef[]; active: ExperimentRef[]; paused: ExperimentRef[] };
-  featureFlags: FeatureFlagState[];
-  routes: AppRouteConfig[];
-  integrations: ResolvedIntegration[];
-  knowledge: ResolvedKnowledge[];
-  branding: ResolvedBranding;
-  notes?: string;
-}
-\`\`\`
-
-Use \`resolveAppConfig(blueprint, tenant)\` to produce this merged view. No IO, no registry lookups—pure data merge.
-
-- \`resolveAppConfig\` validates slot/category/mode constraints when \`integrationConnections\` and \`integrationSpecs\` are provided.
-- \`branding\` merges blueprint defaults with tenant overrides, producing a runtime-friendly shape (resolved asset URLs, color values, and effective domain).
-
-### Materializing specs
-
-\`composeAppConfig(blueprint, tenant, registries, { strict })\`:
-
-1. Calls \`resolveAppConfig\` to build the merged pointers.
-2. Looks up referenced specs in the provided registries.
-3. Returns:
-   - \`resolved\` – the merged pointer view
-   - \`capabilities\`, \`features\`, \`dataViews\`, \`workflows\`, \`policies\`, \`theme\`, \`telemetry\`, \`experiments\`
-   - \`missing\` – unresolved references (strict mode throws).
-
-\`\`\`ts
-const blueprint = blueprintRegistry.get('core.app', 1)!;
-const tenant = loadTenantConfigFromDB();
-
-const composition = composeAppConfig(blueprint, tenant, {
-  capabilities,
-  features,
-  dataViews,
-  workflows,
-  policies,
-  themes,
-  telemetry,
-  experiments,
-});
-
-if (composition.missing.length) {
-  console.warn('Unresolved references', composition.missing);
-}
-\`\`\`
-
-### CLI workflow
-
-\`\`\`
-contractspec create app-config
-\`\`\`
-
-Generates an \`AppBlueprintSpec\`. A separate flow will later scaffold tenant configs.
-
-### Best practices
-
-1. Keep blueprint and tenant versions monotonic; bump when referenced spec versions change.
-2. Favor stable slot keys (e.g. \`dataViews.dashboard\`) to align with Studio UX.
-3. Reference telemetry and experiments declared in their respective specs to maintain observability.
-4. Run \`resolveAppConfig\` in pure unit tests and \`composeAppConfig(..., { strict: true })\` in CI to catch drift early.
-5. Pair resolved configs with \`TestSpec\` scenarios to guard tenant experiences end-to-end.
-
-### Static validation
-
-Use the validation helpers in \`@lssm/lib.contracts/app-config/validation\` to keep blueprints and tenant configs safe before publish time.
-
-\`\`\`ts
-import {
-  validateConfig,
-  validateBlueprint,
-  validateTenantConfig,
-  validateResolvedConfig,
-} from '@lssm/lib.contracts/app-config/validation';
-
-const context = {
-  integrationSpecs,
-  tenantConnections,
-  knowledgeSpaces,
-  knowledgeSources,
-  translationCatalogs: {
-    blueprint: blueprintCatalog,
-    platform: platformCatalog,
-  },
-  existingConfigs,
-};
-
-const blueprintReport = validateBlueprint(blueprint, context);
-const tenantReport = validateTenantConfig(blueprint, tenant, context);
-const publishReport = validateConfig(blueprint, tenant, context);
-\`\`\`
-
-- \`ValidationResult\` exposes \`valid\`, plus structured \`errors\`, \`warnings\`, and \`info\`.
-- Core rules cover capability references, integration slot bindings (category/ownership/capabilities), knowledge bindings, branding constraints (domains + assets), and translation coverage.
-- Call \`validateBlueprint\` in CI when committing new specs, and \`validateConfig\` before promoting/publishing a tenant config.
-- \`validateResolvedConfig\` can be used as a runtime pre-flight check when composing full configs for workflows.
-- CLI usage example (blueprint + tenant):
-
-\`\`\`
-pnpm contractspec validate \\
-  packages/examples/integration-stripe/blueprint.ts \\
-  --blueprint packages/examples/integration-stripe/blueprint.ts \\
-  --tenant-config packages/examples/integration-stripe/tenant.ts
-\`\`\`
-- Repository script:
-
-\`\`\`
-bun run validate:blueprints
-\`\`\`
-
-Runs the static validator for the sample blueprints/tenants and is wired into CI.
-
-
-### Lifecycle types & events
-
-To model multi-step configuration changes, use the lifecycle helpers exported from \`@lssm/lib.contracts/app-config\`:
-
-\`\`\`ts
-import type {
-  ConfigStatus,
-  TenantAppConfigVersion,
-  ConfigTransition,
-} from '@lssm/lib.contracts/app-config';
-import {
-  ConfigDraftCreatedEvent,
-  ConfigPromotedToPreviewEvent,
-  ConfigPublishedEvent,
-  ConfigRolledBackEvent,
-} from '@lssm/lib.contracts/app-config';
-\`\`\`
-
-- \`ConfigStatus\` enumerates the canonical states: \`draft\`, \`preview\`, \`published\`, \`archived\`, \`superseded\`.
-- \`TenantAppConfigMeta\` now includes lifecycle metadata (\`status\`, \`createdBy\`, \`publishedBy\`, \`publishedAt\`, \`rolledBackFrom\`, \`rolledBackTo\`, \`changeSummary\`).
-- \`TenantAppConfigVersion\` couples the lifecycle-aware metadata with the \`TenantAppConfig\` payload for history views.
-- \`ConfigTransition\` captures state changes with actor, timestamp, and optional reason.
-- Lifecycle events (\`app_config.draft_created\`, \`app_config.promoted_to_preview\`, \`app_config.published\`, \`app_config.rolled_back\`) standardize observability across services.
-- Lifecycle contract specs (\`appConfig.lifecycle.*\`) expose typed commands/queries for create → preview → publish → rollback flows.
-
-`}];e(t);export{t as tech_contracts_app_config_DocBlocks};
+import { registerDocBlocks } from "../../docs/registry.js";
+import "../../registry.js";
+
+//#region src/app-config/docs/app-config.docblock.ts
+const tech_contracts_app_config_DocBlocks = [{
+	id: "docs.tech.contracts.app-config",
+	title: "App Configuration Layers",
+	summary: "App orchestration is split into three explicit layers:",
+	kind: "reference",
+	visibility: "public",
+	route: "/docs/tech/contracts/app-config",
+	tags: [
+		"tech",
+		"contracts",
+		"app-config"
+	],
+	body: "## App Configuration Layers\n\nApp orchestration is split into three explicit layers:\n\n1. **AppBlueprintSpec** – global, versioned description of what an app can look like. Stored in Git, no tenant/environment data.\n2. **TenantAppConfig** – tenant/environment overrides that the future Studio edits. Stored per tenant (DB/contract), mutable at runtime.\n3. **ResolvedAppConfig** – pure, merged view consumed by the runtime. Derived in-memory from a blueprint + tenant config.\n\n- Types & registry: `packages/libs/contracts/src/app-config/spec.ts`\n- Resolution helpers: `packages/libs/contracts/src/app-config/runtime.ts`\n- CLI wizard (blueprint scaffolding): `contractspec create app-config`\n\n### 1. AppBlueprintSpec\n\n```ts\nexport interface AppBlueprintSpec {\n  meta: AppBlueprintMeta;          // { name, version, appId, ownership }\n  capabilities?: { enabled?: CapabilityRef[]; disabled?: CapabilityRef[] };\n  features?: { include?: FeatureRef[]; exclude?: FeatureRef[] };\n  integrationSlots?: AppIntegrationSlot[];\n  branding?: BrandingDefaults;\n  dataViews?: Record<string, SpecPointer>;\n  workflows?: Record<string, SpecPointer>;\n  policies?: PolicyRef[];\n  theme?: AppThemeBinding;\n  telemetry?: TelemetryBinding;\n  experiments?: { active?: ExperimentRef[]; paused?: ExperimentRef[] };\n  featureFlags?: FeatureFlagState[];\n  routes?: AppRouteConfig[];\n  notes?: string;\n}\n```\n\nRegister blueprints with `AppBlueprintRegistry`. Blueprints only capture the default/global experience.\n\n- **Integration slots** declare the categories and capability requirements an app expects (e.g. `\"primary-payments\"` must be a payments provider that supports managed or BYOK credentials). Slots never include secrets; tenants bind concrete connections later.\n- **Branding defaults** provide message-key based names, placeholder assets, and theme token references that downstream tenants can override.\n\n### 2. TenantAppConfig\n\n```ts\nexport interface TenantAppConfig {\n  meta: TenantAppConfigMeta;  // { id, tenantId, appId, blueprintName/version, environment?, version, timestamps }\n  capabilities?: { enable?: CapabilityRef[]; disable?: CapabilityRef[] };\n  features?: { include?: FeatureRef[]; exclude?: FeatureRef[] };\n  dataViewOverrides?: TenantSpecOverride[];\n  workflowOverrides?: TenantSpecOverride[];\n  additionalPolicies?: PolicyRef[];\n  themeOverride?: { primary?: ThemeRef | null; fallbacks?: ThemeRef[] };\n  telemetryOverride?: { spec?: SpecPointer | null; disabledEvents?: string[] };\n  experiments?: { active?: ExperimentRef[]; paused?: ExperimentRef[] };\n  featureFlags?: FeatureFlagState[];\n  routeOverrides?: TenantRouteOverride[];\n  integrations?: AppIntegrationBinding[];\n  knowledge?: AppKnowledgeBinding[];\n  branding?: TenantBrandingConfig;\n  notes?: string;\n}\n```\n\nThis object represents what a tenant edits via the Studio (stored in DB/contracts later).\n\n- **AppIntegrationBinding** now maps `slotId` → `connectionId` (plus optional workflow scopes). It no longer carries capability lists; those are defined once in the slot.\n- **TenantBrandingConfig** allows per-tenant names, assets, and domain overrides while keeping secrets and large files out of blueprints.\n\n### 3. ResolvedAppConfig\n\n```ts\nexport interface ResolvedAppConfig {\n  appId: string;\n  tenantId: string;\n  environment?: string;\n  blueprintName: string;\n  blueprintVersion: number;\n  configVersion: number;\n  capabilities: { enabled: CapabilityRef[]; disabled: CapabilityRef[] };\n  features: { include: FeatureRef[]; exclude: FeatureRef[] };\n  dataViews: Record<string, SpecPointer>;\n  workflows: Record<string, SpecPointer>;\n  policies: PolicyRef[];\n  theme?: AppThemeBinding;\n  telemetry?: TelemetryBinding;\n  experiments: { catalog: ExperimentRef[]; active: ExperimentRef[]; paused: ExperimentRef[] };\n  featureFlags: FeatureFlagState[];\n  routes: AppRouteConfig[];\n  integrations: ResolvedIntegration[];\n  knowledge: ResolvedKnowledge[];\n  branding: ResolvedBranding;\n  notes?: string;\n}\n```\n\nUse `resolveAppConfig(blueprint, tenant)` to produce this merged view. No IO, no registry lookups—pure data merge.\n\n- `resolveAppConfig` validates slot/category/mode constraints when `integrationConnections` and `integrationSpecs` are provided.\n- `branding` merges blueprint defaults with tenant overrides, producing a runtime-friendly shape (resolved asset URLs, color values, and effective domain).\n\n### Materializing specs\n\n`composeAppConfig(blueprint, tenant, registries, { strict })`:\n\n1. Calls `resolveAppConfig` to build the merged pointers.\n2. Looks up referenced specs in the provided registries.\n3. Returns:\n   - `resolved` – the merged pointer view\n   - `capabilities`, `features`, `dataViews`, `workflows`, `policies`, `theme`, `telemetry`, `experiments`\n   - `missing` – unresolved references (strict mode throws).\n\n```ts\nconst blueprint = blueprintRegistry.get('core.app', 1)!;\nconst tenant = loadTenantConfigFromDB();\n\nconst composition = composeAppConfig(blueprint, tenant, {\n  capabilities,\n  features,\n  dataViews,\n  workflows,\n  policies,\n  themes,\n  telemetry,\n  experiments,\n});\n\nif (composition.missing.length) {\n  console.warn('Unresolved references', composition.missing);\n}\n```\n\n### CLI workflow\n\n```\ncontractspec create app-config\n```\n\nGenerates an `AppBlueprintSpec`. A separate flow will later scaffold tenant configs.\n\n### Best practices\n\n1. Keep blueprint and tenant versions monotonic; bump when referenced spec versions change.\n2. Favor stable slot keys (e.g. `dataViews.dashboard`) to align with Studio UX.\n3. Reference telemetry and experiments declared in their respective specs to maintain observability.\n4. Run `resolveAppConfig` in pure unit tests and `composeAppConfig(..., { strict: true })` in CI to catch drift early.\n5. Pair resolved configs with `TestSpec` scenarios to guard tenant experiences end-to-end.\n\n### Static validation\n\nUse the validation helpers in `@lssm/lib.contracts/app-config/validation` to keep blueprints and tenant configs safe before publish time.\n\n```ts\nimport {\n  validateConfig,\n  validateBlueprint,\n  validateTenantConfig,\n  validateResolvedConfig,\n} from '@lssm/lib.contracts/app-config/validation';\n\nconst context = {\n  integrationSpecs,\n  tenantConnections,\n  knowledgeSpaces,\n  knowledgeSources,\n  translationCatalogs: {\n    blueprint: blueprintCatalog,\n    platform: platformCatalog,\n  },\n  existingConfigs,\n};\n\nconst blueprintReport = validateBlueprint(blueprint, context);\nconst tenantReport = validateTenantConfig(blueprint, tenant, context);\nconst publishReport = validateConfig(blueprint, tenant, context);\n```\n\n- `ValidationResult` exposes `valid`, plus structured `errors`, `warnings`, and `info`.\n- Core rules cover capability references, integration slot bindings (category/ownership/capabilities), knowledge bindings, branding constraints (domains + assets), and translation coverage.\n- Call `validateBlueprint` in CI when committing new specs, and `validateConfig` before promoting/publishing a tenant config.\n- `validateResolvedConfig` can be used as a runtime pre-flight check when composing full configs for workflows.\n- CLI usage example (blueprint + tenant):\n\n```\npnpm contractspec validate \\\n  packages/examples/integration-stripe/blueprint.ts \\\n  --blueprint packages/examples/integration-stripe/blueprint.ts \\\n  --tenant-config packages/examples/integration-stripe/tenant.ts\n```\n- Repository script:\n\n```\nbun run validate:blueprints\n```\n\nRuns the static validator for the sample blueprints/tenants and is wired into CI.\n\n\n### Lifecycle types & events\n\nTo model multi-step configuration changes, use the lifecycle helpers exported from `@lssm/lib.contracts/app-config`:\n\n```ts\nimport type {\n  ConfigStatus,\n  TenantAppConfigVersion,\n  ConfigTransition,\n} from '@lssm/lib.contracts/app-config';\nimport {\n  ConfigDraftCreatedEvent,\n  ConfigPromotedToPreviewEvent,\n  ConfigPublishedEvent,\n  ConfigRolledBackEvent,\n} from '@lssm/lib.contracts/app-config';\n```\n\n- `ConfigStatus` enumerates the canonical states: `draft`, `preview`, `published`, `archived`, `superseded`.\n- `TenantAppConfigMeta` now includes lifecycle metadata (`status`, `createdBy`, `publishedBy`, `publishedAt`, `rolledBackFrom`, `rolledBackTo`, `changeSummary`).\n- `TenantAppConfigVersion` couples the lifecycle-aware metadata with the `TenantAppConfig` payload for history views.\n- `ConfigTransition` captures state changes with actor, timestamp, and optional reason.\n- Lifecycle events (`app_config.draft_created`, `app_config.promoted_to_preview`, `app_config.published`, `app_config.rolled_back`) standardize observability across services.\n- Lifecycle contract specs (`appConfig.lifecycle.*`) expose typed commands/queries for create → preview → publish → rollback flows.\n\n"
+}];
+registerDocBlocks(tech_contracts_app_config_DocBlocks);
+
+//#endregion
+export { tech_contracts_app_config_DocBlocks };