@lssm/lib.contracts 0.0.0-canary-20251217083314 → 0.0.0-canary-20251219202229

package/dist/onboarding-base.js

@@ -1,6 +1,4 @@
-import { ScalarTypeEnum } from "./schema/dist/ScalarTypeEnum.js";
-import { SchemaModel } from "./schema/dist/SchemaModel.js";
-import "./schema/dist/index.js";
+import { E5, x8 } from "./schema/dist/index.js";
 import { defineCommand, defineQuery } from "./spec.js";
 import { OwnersEnum, StabilityEnum } from "./ownership.js";
 
@@ -10,24 +8,24 @@ import { OwnersEnum, StabilityEnum } from "./ownership.js";
 * These operations are reusable for any app that needs multi-step onboarding with draft persistence.
 */
 /** Save/update onboarding draft (auto-save during flow) */
-const SaveOnboardingDraftInput = new SchemaModel({
+const SaveOnboardingDraftInput = new x8({
 	name: "SaveOnboardingDraftInput",
 	description: "Input for saving onboarding draft",
 	fields: { data: {
-		type: ScalarTypeEnum.JSON(),
+		type: E5.JSON(),
 		isOptional: false
 	} }
 });
-const SaveOnboardingDraftOutput = new SchemaModel({
+const SaveOnboardingDraftOutput = new x8({
 	name: "SaveOnboardingDraftOutput",
 	description: "Output for saving onboarding draft",
 	fields: {
 		id: {
-			type: ScalarTypeEnum.ID(),
+			type: E5.ID(),
 			isOptional: false
 		},
 		organizationId: {
-			type: ScalarTypeEnum.ID(),
+			type: E5.ID(),
 			isOptional: false
 		}
 	}
@@ -57,28 +55,28 @@ const SaveOnboardingDraftBaseSpec = defineCommand({
 	}
 });
 /** Get current onboarding draft (on mount/restore) */
-const GetOnboardingDraftOutput = new SchemaModel({
+const GetOnboardingDraftOutput = new x8({
 	name: "GetOnboardingDraftOutput",
 	description: "Onboarding draft payload",
 	fields: {
 		id: {
-			type: ScalarTypeEnum.ID(),
+			type: E5.ID(),
 			isOptional: true
 		},
 		organizationId: {
-			type: ScalarTypeEnum.ID(),
+			type: E5.ID(),
 			isOptional: true
 		},
 		data: {
-			type: ScalarTypeEnum.JSON(),
+			type: E5.JSON(),
 			isOptional: true
 		},
 		createdAt: {
-			type: ScalarTypeEnum.DateTime(),
+			type: E5.DateTime(),
 			isOptional: true
 		},
 		updatedAt: {
-			type: ScalarTypeEnum.DateTime(),
+			type: E5.DateTime(),
 			isOptional: true
 		}
 	}
@@ -108,11 +106,11 @@ const GetOnboardingDraftBaseSpec = defineQuery({
 	}
 });
 /** Delete onboarding draft (cleanup after completion or cancel) */
-const DeleteOnboardingDraftOutput = new SchemaModel({
+const DeleteOnboardingDraftOutput = new x8({
 	name: "DeleteOnboardingDraftOutput",
 	description: "Result of delete operation",
 	fields: { ok: {
-		type: ScalarTypeEnum.Boolean(),
+		type: E5.Boolean(),
 		isOptional: false
 	} }
 });
@@ -141,28 +139,28 @@ const DeleteOnboardingDraftBaseSpec = defineCommand({
 	}
 });
 /** Complete onboarding (final submit, creates entities) */
-const CompleteOnboardingBaseInput = new SchemaModel({
+const CompleteOnboardingBaseInput = new x8({
 	name: "CompleteOnboardingBaseInput",
 	description: "Input for completing onboarding",
 	fields: { data: {
-		type: ScalarTypeEnum.JSON(),
+		type: E5.JSON(),
 		isOptional: false
 	} }
 });
-const CompleteOnboardingBaseOutput = new SchemaModel({
+const CompleteOnboardingBaseOutput = new x8({
 	name: "CompleteOnboardingBaseOutput",
 	description: "Result of onboarding completion",
 	fields: {
 		success: {
-			type: ScalarTypeEnum.Boolean(),
+			type: E5.Boolean(),
 			isOptional: false
 		},
 		userId: {
-			type: ScalarTypeEnum.ID(),
+			type: E5.ID(),
 			isOptional: true
 		},
 		organizationId: {
-			type: ScalarTypeEnum.ID(),
+			type: E5.ID(),
 			isOptional: true
 		}
 	}
@@ -193,4 +191,5 @@ const CompleteOnboardingBaseSpec = defineCommand({
 });
 
 //#endregion
-export { CompleteOnboardingBaseInput, CompleteOnboardingBaseOutput, CompleteOnboardingBaseSpec, DeleteOnboardingDraftBaseSpec, DeleteOnboardingDraftOutput, GetOnboardingDraftBaseSpec, GetOnboardingDraftOutput, SaveOnboardingDraftBaseSpec, SaveOnboardingDraftInput, SaveOnboardingDraftOutput };
+export { CompleteOnboardingBaseInput, CompleteOnboardingBaseOutput, CompleteOnboardingBaseSpec, DeleteOnboardingDraftBaseSpec, DeleteOnboardingDraftOutput, GetOnboardingDraftBaseSpec, GetOnboardingDraftOutput, SaveOnboardingDraftBaseSpec, SaveOnboardingDraftInput, SaveOnboardingDraftOutput };
+//# sourceMappingURL=onboarding-base.js.map

package/dist/onboarding-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-base.js","names":["SchemaModel","ScalarTypeEnum"],"sources":["../src/onboarding-base.ts"],"sourcesContent":["/**\n * Shared base contracts for onboarding flows across verticals.\n * These operations are reusable for any app that needs multi-step onboarding with draft persistence.\n */\nimport { defineCommand, defineQuery } from './spec';\nimport { ScalarTypeEnum, SchemaModel } from '@lssm/lib.schema';\nimport { OwnersEnum, StabilityEnum } from './ownership';\n\n/** Save/update onboarding draft (auto-save during flow) */\nexport const SaveOnboardingDraftInput = new SchemaModel({\n  name: 'SaveOnboardingDraftInput',\n  description: 'Input for saving onboarding draft',\n  fields: {\n    data: { type: ScalarTypeEnum.JSON(), isOptional: false },\n  },\n});\n\nexport const SaveOnboardingDraftOutput = new SchemaModel({\n  name: 'SaveOnboardingDraftOutput',\n  description: 'Output for saving onboarding draft',\n  fields: {\n    id: { type: ScalarTypeEnum.ID(), isOptional: false },\n    organizationId: { type: ScalarTypeEnum.ID(), isOptional: false },\n  },\n});\n\nexport const SaveOnboardingDraftBaseSpec = defineCommand({\n  meta: {\n    name: 'base.onboarding.saveDraft',\n    version: 1,\n    stability: StabilityEnum.Beta,\n    owners: [OwnersEnum.PlatformSigil],\n    tags: ['onboarding', 'draft'],\n    description: 'Save or update onboarding draft for active organization',\n    goal: 'Persist onboarding progress incrementally for resumption and safety',\n    context:\n      'Auto-saves every few seconds during onboarding; enables users to leave and resume',\n  },\n  io: {\n    input: SaveOnboardingDraftInput,\n    output: SaveOnboardingDraftOutput,\n  },\n  policy: {\n    auth: 'user',\n    escalate: null,\n  },\n  transport: {\n    gql: { field: 'saveOnboardingDraft' },\n    rest: { method: 'POST' },\n  },\n});\n\n/** Get current onboarding draft (on mount/restore) */\nexport const GetOnboardingDraftOutput = new SchemaModel({\n  name: 'GetOnboardingDraftOutput',\n  description: 'Onboarding draft payload',\n  fields: {\n    id: { type: ScalarTypeEnum.ID(), isOptional: true },\n    organizationId: { type: ScalarTypeEnum.ID(), isOptional: true },\n    data: { type: ScalarTypeEnum.JSON(), isOptional: true },\n    createdAt: { type: ScalarTypeEnum.DateTime(), isOptional: true },\n    updatedAt: { type: ScalarTypeEnum.DateTime(), isOptional: true },\n  },\n});\n\nexport const GetOnboardingDraftBaseSpec = defineQuery({\n  meta: {\n    name: 'base.onboarding.getDraft',\n    version: 1,\n    stability: StabilityEnum.Beta,\n    owners: [OwnersEnum.PlatformSigil],\n    tags: ['onboarding', 'draft'],\n    description: 'Get onboarding draft for active organization',\n    goal: 'Retrieve saved onboarding progress',\n    context: 'Called on mount to restore in-progress onboarding',\n  },\n  io: {\n    input: null,\n    output: GetOnboardingDraftOutput,\n  },\n  policy: {\n    auth: 'user',\n    escalate: null,\n  },\n  transport: {\n    gql: { field: 'getOnboardingDraft' },\n    rest: { method: 'GET' },\n  },\n});\n\n/** Delete onboarding draft (cleanup after completion or cancel) */\nexport const DeleteOnboardingDraftOutput = new SchemaModel({\n  name: 'DeleteOnboardingDraftOutput',\n  description: 'Result of delete operation',\n  fields: {\n    ok: { type: ScalarTypeEnum.Boolean(), isOptional: false },\n  },\n});\n\nexport const DeleteOnboardingDraftBaseSpec = defineCommand({\n  meta: {\n    name: 'base.onboarding.deleteDraft',\n    version: 1,\n    stability: StabilityEnum.Beta,\n    owners: [OwnersEnum.PlatformSigil],\n    tags: ['onboarding', 'draft'],\n    description: 'Delete onboarding draft for active organization',\n    goal: 'Clear draft after completion or if user wants to restart',\n    context: 'Called after successful onboarding or explicit user reset',\n  },\n  io: {\n    input: null,\n    output: DeleteOnboardingDraftOutput,\n  },\n  policy: {\n    auth: 'user',\n    escalate: null,\n  },\n  transport: {\n    gql: { field: 'deleteOnboardingDraft' },\n    rest: { method: 'POST' },\n  },\n});\n\n/** Complete onboarding (final submit, creates entities) */\nexport const CompleteOnboardingBaseInput = new SchemaModel({\n  name: 'CompleteOnboardingBaseInput',\n  description: 'Input for completing onboarding',\n  fields: {\n    data: { type: ScalarTypeEnum.JSON(), isOptional: false },\n  },\n});\n\nexport const CompleteOnboardingBaseOutput = new SchemaModel({\n  name: 'CompleteOnboardingBaseOutput',\n  description: 'Result of onboarding completion',\n  fields: {\n    success: { type: ScalarTypeEnum.Boolean(), isOptional: false },\n    userId: { type: ScalarTypeEnum.ID(), isOptional: true },\n    organizationId: { type: ScalarTypeEnum.ID(), isOptional: true },\n  },\n});\n\nexport const CompleteOnboardingBaseSpec = defineCommand({\n  meta: {\n    name: 'base.onboarding.complete',\n    version: 1,\n    stability: StabilityEnum.Beta,\n    owners: [OwnersEnum.PlatformSigil],\n    tags: ['onboarding'],\n    description: 'Complete onboarding and finalize user/organization setup',\n    goal: 'Transition from draft to active profile',\n    context:\n      'Validates all required fields, creates/updates entities, marks onboarding complete',\n  },\n  io: {\n    input: CompleteOnboardingBaseInput,\n    output: CompleteOnboardingBaseOutput,\n  },\n  policy: {\n    auth: 'user',\n    escalate: null,\n  },\n  transport: {\n    gql: { field: 'completeOnboarding' },\n    rest: { method: 'POST' },\n  },\n});\n"],"mappings":";;;;;;;;;;AASA,MAAa,2BAA2B,IAAIA,GAAY;CACtD,MAAM;CACN,aAAa;CACb,QAAQ,EACN,MAAM;EAAE,MAAMC,GAAe,MAAM;EAAE,YAAY;EAAO,EACzD;CACF,CAAC;AAEF,MAAa,4BAA4B,IAAID,GAAY;CACvD,MAAM;CACN,aAAa;CACb,QAAQ;EACN,IAAI;GAAE,MAAMC,GAAe,IAAI;GAAE,YAAY;GAAO;EACpD,gBAAgB;GAAE,MAAMA,GAAe,IAAI;GAAE,YAAY;GAAO;EACjE;CACF,CAAC;AAEF,MAAa,8BAA8B,cAAc;CACvD,MAAM;EACJ,MAAM;EACN,SAAS;EACT,WAAW,cAAc;EACzB,QAAQ,CAAC,WAAW,cAAc;EAClC,MAAM,CAAC,cAAc,QAAQ;EAC7B,aAAa;EACb,MAAM;EACN,SACE;EACH;CACD,IAAI;EACF,OAAO;EACP,QAAQ;EACT;CACD,QAAQ;EACN,MAAM;EACN,UAAU;EACX;CACD,WAAW;EACT,KAAK,EAAE,OAAO,uBAAuB;EACrC,MAAM,EAAE,QAAQ,QAAQ;EACzB;CACF,CAAC;;AAGF,MAAa,2BAA2B,IAAID,GAAY;CACtD,MAAM;CACN,aAAa;CACb,QAAQ;EACN,IAAI;GAAE,MAAMC,GAAe,IAAI;GAAE,YAAY;GAAM;EACnD,gBAAgB;GAAE,MAAMA,GAAe,IAAI;GAAE,YAAY;GAAM;EAC/D,MAAM;GAAE,MAAMA,GAAe,MAAM;GAAE,YAAY;GAAM;EACvD,WAAW;GAAE,MAAMA,GAAe,UAAU;GAAE,YAAY;GAAM;EAChE,WAAW;GAAE,MAAMA,GAAe,UAAU;GAAE,YAAY;GAAM;EACjE;CACF,CAAC;AAEF,MAAa,6BAA6B,YAAY;CACpD,MAAM;EACJ,MAAM;EACN,SAAS;EACT,WAAW,cAAc;EACzB,QAAQ,CAAC,WAAW,cAAc;EAClC,MAAM,CAAC,cAAc,QAAQ;EAC7B,aAAa;EACb,MAAM;EACN,SAAS;EACV;CACD,IAAI;EACF,OAAO;EACP,QAAQ;EACT;CACD,QAAQ;EACN,MAAM;EACN,UAAU;EACX;CACD,WAAW;EACT,KAAK,EAAE,OAAO,sBAAsB;EACpC,MAAM,EAAE,QAAQ,OAAO;EACxB;CACF,CAAC;;AAGF,MAAa,8BAA8B,IAAID,GAAY;CACzD,MAAM;CACN,aAAa;CACb,QAAQ,EACN,IAAI;EAAE,MAAMC,GAAe,SAAS;EAAE,YAAY;EAAO,EAC1D;CACF,CAAC;AAEF,MAAa,gCAAgC,cAAc;CACzD,MAAM;EACJ,MAAM;EACN,SAAS;EACT,WAAW,cAAc;EACzB,QAAQ,CAAC,WAAW,cAAc;EAClC,MAAM,CAAC,cAAc,QAAQ;EAC7B,aAAa;EACb,MAAM;EACN,SAAS;EACV;CACD,IAAI;EACF,OAAO;EACP,QAAQ;EACT;CACD,QAAQ;EACN,MAAM;EACN,UAAU;EACX;CACD,WAAW;EACT,KAAK,EAAE,OAAO,yBAAyB;EACvC,MAAM,EAAE,QAAQ,QAAQ;EACzB;CACF,CAAC;;AAGF,MAAa,8BAA8B,IAAID,GAAY;CACzD,MAAM;CACN,aAAa;CACb,QAAQ,EACN,MAAM;EAAE,MAAMC,GAAe,MAAM;EAAE,YAAY;EAAO,EACzD;CACF,CAAC;AAEF,MAAa,+BAA+B,IAAID,GAAY;CAC1D,MAAM;CACN,aAAa;CACb,QAAQ;EACN,SAAS;GAAE,MAAMC,GAAe,SAAS;GAAE,YAAY;GAAO;EAC9D,QAAQ;GAAE,MAAMA,GAAe,IAAI;GAAE,YAAY;GAAM;EACvD,gBAAgB;GAAE,MAAMA,GAAe,IAAI;GAAE,YAAY;GAAM;EAChE;CACF,CAAC;AAEF,MAAa,6BAA6B,cAAc;CACtD,MAAM;EACJ,MAAM;EACN,SAAS;EACT,WAAW,cAAc;EACzB,QAAQ,CAAC,WAAW,cAAc;EAClC,MAAM,CAAC,aAAa;EACpB,aAAa;EACb,MAAM;EACN,SACE;EACH;CACD,IAAI;EACF,OAAO;EACP,QAAQ;EACT;CACD,QAAQ;EACN,MAAM;EACN,UAAU;EACX;CACD,WAAW;EACT,KAAK,EAAE,OAAO,sBAAsB;EACpC,MAAM,EAAE,QAAQ,QAAQ;EACzB;CACF,CAAC"}

package/dist/openapi.d.ts

@@ -28,4 +28,5 @@ interface OpenApiDocument {
 }
 declare function openApiForRegistry(registry: SpecRegistry, options?: OpenApiExportOptions): OpenApiDocument;
 //#endregion
-export { OpenApiDocument, OpenApiExportOptions, OpenApiServer, openApiForRegistry };
+export { OpenApiDocument, OpenApiExportOptions, OpenApiServer, openApiForRegistry };
+//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","names":[],"sources":["../src/openapi.ts"],"sourcesContent":[],"mappings":";;;;AAiCY,UArBK,aAAA,CAqBL;EACY,GAAA,EAAA,MAAA;EAAf,WAAA,CAAA,EAAA,MAAA;;AAEI,UAnBI,oBAAA,CAmBJ;EAAM,KAAA,CAAA,EAAA,MAAA;EA4BH,OAAA,CAAA,EAAA,MAAA;EACJ,WAAA,CAAA,EAAA,MAAA;EACD,OAAA,CAAA,EA7CC,aA6CD,EAAA;;KA1CN,mBAAA,GAAsB,MA2CT,CAAA,MAAA,EAAA,OAAA,CAAA;UAzCD,eAAA;;;;;;;YAOL;SACH,eAAe;;aAEX,eAAe;;;iBA4BZ,kBAAA,WACJ,wBACD,uBACR"}

package/dist/openapi.js

@@ -72,4 +72,5 @@ function openApiForRegistry(registry, options = {}) {
 }
 
 //#endregion
-export { openApiForRegistry };
+export { openApiForRegistry };
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","names":["doc: OpenApiDocument","op: Record<string, unknown>","responses: Record<string, unknown>"],"sources":["../src/openapi.ts"],"sourcesContent":["/**\n * OpenAPI export utilities.\n *\n * @deprecated Import from @lssm/lib.contracts-transformers/openapi instead.\n * This file is kept for backwards compatibility.\n */\n\nimport type { SpecRegistry } from './registry';\nimport type { AnyContractSpec, ContractSpec } from './spec';\nimport { defaultRestPath, jsonSchemaForSpec } from './jsonschema';\nimport type { AnySchemaModel } from '@lssm/lib.schema';\n\nexport interface OpenApiServer {\n  url: string;\n  description?: string;\n}\n\nexport interface OpenApiExportOptions {\n  title?: string;\n  version?: string;\n  description?: string;\n  servers?: OpenApiServer[];\n}\n\ntype OpenApiSchemaObject = Record<string, unknown>;\n\nexport interface OpenApiDocument {\n  openapi: '3.1.0';\n  info: {\n    title: string;\n    version: string;\n    description?: string;\n  };\n  servers?: OpenApiServer[];\n  paths: Record<string, Record<string, unknown>>;\n  components: {\n    schemas: Record<string, OpenApiSchemaObject>;\n  };\n}\n\nfunction toOperationId(name: string, version: number) {\n  return `${name.replace(/\\./g, '_')}_v${version}`;\n}\n\nfunction toSchemaName(\n  prefix: 'Input' | 'Output',\n  name: string,\n  version: number\n) {\n  return `${prefix}_${toOperationId(name, version)}`;\n}\n\nfunction toHttpMethod(kind: 'command' | 'query', override?: 'GET' | 'POST') {\n  const method = override ?? (kind === 'query' ? 'GET' : 'POST');\n  return method.toLowerCase();\n}\n\nfunction toRestPath(spec: AnyContractSpec): string {\n  const path =\n    spec.transport?.rest?.path ??\n    defaultRestPath(spec.meta.name, spec.meta.version);\n  return path.startsWith('/') ? path : `/${path}`;\n}\n\nexport function openApiForRegistry(\n  registry: SpecRegistry,\n  options: OpenApiExportOptions = {}\n): OpenApiDocument {\n  const specs = registry\n    .listSpecs()\n    .filter(\n      (s): s is AnyContractSpec =>\n        s.meta.kind === 'command' || s.meta.kind === 'query'\n    )\n    .slice()\n    .sort((a, b) => {\n      const byName = a.meta.name.localeCompare(b.meta.name);\n      return byName !== 0 ? byName : a.meta.version - b.meta.version;\n    });\n\n  const doc: OpenApiDocument = {\n    openapi: '3.1.0',\n    info: {\n      title: options.title ?? 'ContractSpec API',\n      version: options.version ?? '0.0.0',\n      ...(options.description ? { description: options.description } : {}),\n    },\n    ...(options.servers ? { servers: options.servers } : {}),\n    paths: {},\n    components: { schemas: {} },\n  };\n\n  for (const spec of specs) {\n    const schema = jsonSchemaForSpec(\n      spec as unknown as ContractSpec<AnySchemaModel, AnySchemaModel>\n    );\n    const method = toHttpMethod(spec.meta.kind, spec.transport?.rest?.method);\n    const path = toRestPath(spec);\n\n    const operationId = toOperationId(spec.meta.name, spec.meta.version);\n\n    const pathItem = (doc.paths[path] ??= {});\n    const op: Record<string, unknown> = {\n      operationId,\n      summary: spec.meta.description ?? spec.meta.name,\n      description: spec.meta.description,\n      tags: spec.meta.tags ?? [],\n      'x-contractspec': {\n        name: spec.meta.name,\n        version: spec.meta.version,\n        kind: spec.meta.kind,\n      },\n      responses: {},\n    };\n\n    if (schema.input) {\n      const inputName = toSchemaName(\n        'Input',\n        spec.meta.name,\n        spec.meta.version\n      );\n      doc.components.schemas[inputName] = schema.input as OpenApiSchemaObject;\n      op['requestBody'] = {\n        required: true,\n        content: {\n          'application/json': {\n            schema: { $ref: `#/components/schemas/${inputName}` },\n          },\n        },\n      };\n    }\n\n    const responses: Record<string, unknown> = {};\n    if (schema.output) {\n      const outputName = toSchemaName(\n        'Output',\n        spec.meta.name,\n        spec.meta.version\n      );\n      doc.components.schemas[outputName] = schema.output as OpenApiSchemaObject;\n      responses['200'] = {\n        description: 'OK',\n        content: {\n          'application/json': {\n            schema: { $ref: `#/components/schemas/${outputName}` },\n          },\n        },\n      };\n    } else {\n      responses['200'] = { description: 'OK' };\n    }\n    op['responses'] = responses;\n\n    pathItem[method] = op;\n  }\n\n  return doc;\n}\n"],"mappings":";;;AAwCA,SAAS,cAAc,MAAc,SAAiB;AACpD,QAAO,GAAG,KAAK,QAAQ,OAAO,IAAI,CAAC,IAAI;;AAGzC,SAAS,aACP,QACA,MACA,SACA;AACA,QAAO,GAAG,OAAO,GAAG,cAAc,MAAM,QAAQ;;AAGlD,SAAS,aAAa,MAA2B,UAA2B;AAE1E,SADe,aAAa,SAAS,UAAU,QAAQ,SACzC,aAAa;;AAG7B,SAAS,WAAW,MAA+B;CACjD,MAAM,OACJ,KAAK,WAAW,MAAM,QACtB,gBAAgB,KAAK,KAAK,MAAM,KAAK,KAAK,QAAQ;AACpD,QAAO,KAAK,WAAW,IAAI,GAAG,OAAO,IAAI;;AAG3C,SAAgB,mBACd,UACA,UAAgC,EAAE,EACjB;CACjB,MAAM,QAAQ,SACX,WAAW,CACX,QACE,MACC,EAAE,KAAK,SAAS,aAAa,EAAE,KAAK,SAAS,QAChD,CACA,OAAO,CACP,MAAM,GAAG,MAAM;EACd,MAAM,SAAS,EAAE,KAAK,KAAK,cAAc,EAAE,KAAK,KAAK;AACrD,SAAO,WAAW,IAAI,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK;GACvD;CAEJ,MAAMA,MAAuB;EAC3B,SAAS;EACT,MAAM;GACJ,OAAO,QAAQ,SAAS;GACxB,SAAS,QAAQ,WAAW;GAC5B,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,aAAa,GAAG,EAAE;GACpE;EACD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,SAAS,GAAG,EAAE;EACvD,OAAO,EAAE;EACT,YAAY,EAAE,SAAS,EAAE,EAAE;EAC5B;AAED,MAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,kBACb,KACD;EACD,MAAM,SAAS,aAAa,KAAK,KAAK,MAAM,KAAK,WAAW,MAAM,OAAO;EACzE,MAAM,OAAO,WAAW,KAAK;EAE7B,MAAM,cAAc,cAAc,KAAK,KAAK,MAAM,KAAK,KAAK,QAAQ;EAEpE,MAAM,WAAY,IAAI,MAAM,UAAU,EAAE;EACxC,MAAMC,KAA8B;GAClC;GACA,SAAS,KAAK,KAAK,eAAe,KAAK,KAAK;GAC5C,aAAa,KAAK,KAAK;GACvB,MAAM,KAAK,KAAK,QAAQ,EAAE;GAC1B,kBAAkB;IAChB,MAAM,KAAK,KAAK;IAChB,SAAS,KAAK,KAAK;IACnB,MAAM,KAAK,KAAK;IACjB;GACD,WAAW,EAAE;GACd;AAED,MAAI,OAAO,OAAO;GAChB,MAAM,YAAY,aAChB,SACA,KAAK,KAAK,MACV,KAAK,KAAK,QACX;AACD,OAAI,WAAW,QAAQ,aAAa,OAAO;AAC3C,MAAG,iBAAiB;IAClB,UAAU;IACV,SAAS,EACP,oBAAoB,EAClB,QAAQ,EAAE,MAAM,wBAAwB,aAAa,EACtD,EACF;IACF;;EAGH,MAAMC,YAAqC,EAAE;AAC7C,MAAI,OAAO,QAAQ;GACjB,MAAM,aAAa,aACjB,UACA,KAAK,KAAK,MACV,KAAK,KAAK,QACX;AACD,OAAI,WAAW,QAAQ,cAAc,OAAO;AAC5C,aAAU,SAAS;IACjB,aAAa;IACb,SAAS,EACP,oBAAoB,EAClB,QAAQ,EAAE,MAAM,wBAAwB,cAAc,EACvD,EACF;IACF;QAED,WAAU,SAAS,EAAE,aAAa,MAAM;AAE1C,KAAG,eAAe;AAElB,WAAS,UAAU;;AAGrB,QAAO"}

package/dist/openbanking/docs/openbanking.docblock.d.ts

@@ -3,4 +3,5 @@ import { DocBlock } from "@lssm/lib.contracts/docs";
 //#region src/openbanking/docs/openbanking.docblock.d.ts
 declare const tech_contracts_openbanking_DocBlocks: DocBlock[];
 //#endregion
-export { tech_contracts_openbanking_DocBlocks };
+export { tech_contracts_openbanking_DocBlocks };
+//# sourceMappingURL=openbanking.docblock.d.ts.map

package/dist/openbanking/docs/openbanking.docblock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbanking.docblock.d.ts","names":[],"sources":["../../../src/openbanking/docs/openbanking.docblock.ts"],"sourcesContent":[],"mappings":";;;cAGa,sCAAsC"}

package/dist/openbanking/docs/openbanking.docblock.js

@@ -19,4 +19,5 @@ const tech_contracts_openbanking_DocBlocks = [{
 registerDocBlocks(tech_contracts_openbanking_DocBlocks);
 
 //#endregion
-export { tech_contracts_openbanking_DocBlocks };
+export { tech_contracts_openbanking_DocBlocks };
+//# sourceMappingURL=openbanking.docblock.js.map

package/dist/openbanking/docs/openbanking.docblock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbanking.docblock.js","names":["tech_contracts_openbanking_DocBlocks: DocBlock[]"],"sources":["../../../src/openbanking/docs/openbanking.docblock.ts"],"sourcesContent":["import type { DocBlock } from '@lssm/lib.contracts/docs';\nimport { registerDocBlocks } from '../../registry';\n\nexport const tech_contracts_openbanking_DocBlocks: DocBlock[] = [\n  {\n    id: 'docs.tech.contracts.openbanking',\n    title: 'Open Banking (Powens) Overview',\n    summary:\n      'The Pocket Family Office vertical now supports read-only open banking capabilities powered by Powens. This doc summarises the contract surfaces, canonical data models, workflows, telemetry, and guardrails introduced to make Powens a first-class integration.',\n    kind: 'reference',\n    visibility: 'public',\n    route: '/docs/tech/contracts/openbanking',\n    tags: ['tech', 'contracts', 'openbanking'],\n    body: '# Open Banking (Powens) Overview\\n\\nThe Pocket Family Office vertical now supports read-only open banking capabilities powered by Powens. This doc summarises the contract surfaces, canonical data models, workflows, telemetry, and guardrails introduced to make Powens a first-class integration.\\n\\n## Integration Spec\\n\\nPowens is registered under `openbanking.powens` with category `open-banking` and currently supports the BYOK ownership mode. The spec exposes three read-only capabilities:\\n\\n- `openbanking.accounts.read`\\n- `openbanking.transactions.read`\\n- `openbanking.balances.read`\\n\\nConfiguration and secrets are separated:\\n\\n| Config Field | Description |\\n| --- | --- |\\n| `environment` | Powens environment (`sandbox` \\\\| `production`) |\\n| `baseUrl?` | Optional API base URL override |\\n| `region?` | Optional Powens region identifier |\\n| `pollingIntervalMs?` | Optional custom sync cadence |\\n\\n| Secret Field | Description |\\n| --- | --- |\\n| `clientId` | Powens OAuth client identifier |\\n| `clientSecret` | Powens OAuth client secret |\\n| `apiKey?` | Optional supplemental Powens API key |\\n| `webhookSecret?` | Optional webhook signing secret |\\n\\n## Canonical Data Models\\n\\nCanonical schemas live in `@lssm/lib.contracts/integrations/openbanking/models`:\\n\\n- `BankAccountRecord` \\u2013 account metadata (institution, IBAN/BIC, masked numbers, balances, sync timestamps)\\n- `BankTransactionRecord` \\u2013 transaction ledger (amounts, categories, counterparty, status)\\n- `AccountBalanceRecord` \\u2013 balance snapshots per account and balance type\\n\\nThese schemas power the vertical contracts and workflows, ensuring downstream features never use raw Powens payloads directly.\\n\\n## Provider Implementation\\n\\n`PowensOpenBankingProvider` wraps `PowensClient` which handles OAuth token management, request retries, and error mapping. The provider maps Powens payloads to the canonical interfaces exported from `integrations/providers/openbanking`.\\n\\nFactory support lives in `IntegrationProviderFactory.createOpenBankingProvider`, which validates configuration, loads BYOK secrets, and instantiates the provider.\\n\\n## Contracts\\n\\nCommand/query contracts exist under `integrations/openbanking/contracts`:\\n\\n- `openbanking.accounts.sync` & `openbanking.accounts.list`\\n- `openbanking.transactions.sync` & `openbanking.transactions.list`\\n- `openbanking.balances.refresh` & `openbanking.balances.get`\\n\\nThe Pocket Family Office bundle also exposes `pfo.openbanking.generate-overview`, which aggregates balances and transactions into a derived knowledge document.\\n\\n## Workflows\\n\\nNew workflow specs (all requiring the `primaryOpenBanking` slot) orchestrate the sync flows:\\n\\n- `pfo.workflow.sync-openbanking-accounts`\\n- `pfo.workflow.sync-openbanking-transactions`\\n- `pfo.workflow.refresh-openbanking-balances`\\n- `pfo.workflow.generate-openbanking-overview`\\n\\nEach workflow runs against the Powens provider, persists canonical records, and emits telemetry.\\n\\n## Knowledge & LLM Exposure\\n\\nRaw Powens payloads are never stored in knowledge spaces. Instead, `knowledge.financial-overview` captures derived summaries (cashflow, category breakdowns, balance trends) produced by `pfo.openbanking.generate-overview`. The space is `operational` category with 180-day retention and automation write access.\\n\\nWhen exposing data to LLMs or analytics:\\n\\n- Use derived summaries only.\\n- Redact PII fields using `redactOpenBankingTelemetryPayload`.\\n- Never emit IBANs, unmasked account numbers, or counterparty detail in telemetry/logs.\\n\\n## Telemetry\\n\\nTelemetry constants live in `integrations/openbanking/telemetry`. Key events:\\n\\n- `openbanking.accounts.synced`\\n- `openbanking.transactions.synced`\\n- `openbanking.balances.refreshed`\\n- `openbanking.overview.generated`\\n\\nAll events require tenant/app/blueprint/config metadata, and sensitive properties are flagged to avoid accidental leakage.\\n\\n## Guardrails\\n\\n`ensurePrimaryOpenBankingIntegration` verifies `primaryOpenBanking` is bound and healthy before workflows proceed. Runtime pre-flight checks already block workflows when the connection is disconnected or in error status.\\n\\n## Blueprint & Tenant Defaults\\n\\n`pocketFamilyOfficeBlueprint` now includes:\\n\\n- `primaryOpenBanking` slot (required, BYOK)\\n- `openbanking.*.read` capabilities enabled by default\\n- Workflow bindings for the new sync flows\\n\\nSample tenant bindings (`tenant.sample.ts`) reference `conn-powens-primary` and bind the new knowledge space.\\n\\n---\\n\\nFollow this doc when extending open banking support (e.g., adding payment initiation, additional providers, or expanded analytics) to keep the integration consistent and audited.\\n\\n\\n\\n\\n\\n',\n  },\n];\nregisterDocBlocks(tech_contracts_openbanking_DocBlocks);\n"],"mappings":";;;;AAGA,MAAaA,uCAAmD,CAC9D;CACE,IAAI;CACJ,OAAO;CACP,SACE;CACF,MAAM;CACN,YAAY;CACZ,OAAO;CACP,MAAM;EAAC;EAAQ;EAAa;EAAc;CAC1C,MAAM;CACP,CACF;AACD,kBAAkB,qCAAqC"}

package/dist/ownership.d.ts

@@ -16,6 +16,7 @@ declare const OwnersEnum: {
   readonly PlatformMarketplace: "platform.marketplace";
   readonly PlatformContent: "platform.content";
   readonly PlatformFeatureFlags: "platform.featureflags";
+  readonly PlatformFinance: "platform.finance";
 };
 type Owner = (typeof OwnersEnum)[keyof typeof OwnersEnum] | (string & {});
 declare const Owners: {
@@ -26,6 +27,7 @@ declare const Owners: {
   readonly PlatformMarketplace: "platform.marketplace";
   readonly PlatformContent: "platform.content";
   readonly PlatformFeatureFlags: "platform.featureflags";
+  readonly PlatformFinance: "platform.finance";
 };
 declare const TagsEnum: {
   readonly Spots: "spots";
@@ -38,11 +40,9 @@ declare const TagsEnum: {
   readonly Guide: "guide";
   readonly Docs: "docs";
   readonly I18n: "i18n";
-  readonly AtomicPages: "atomic:pages";
   readonly Incident: "incident";
+  readonly Automation: "automation";
   readonly Hygiene: "hygiene";
-  readonly WeeklyPulse: "weekly_pulse";
-  readonly WebAuth: "webauth";
 };
 type Tag = (typeof TagsEnum)[keyof typeof TagsEnum] | (string & {});
 declare const Tags: {
@@ -56,11 +56,9 @@ declare const Tags: {
   readonly Guide: "guide";
   readonly Docs: "docs";
   readonly I18n: "i18n";
-  readonly AtomicPages: "atomic:pages";
   readonly Incident: "incident";
+  readonly Automation: "automation";
   readonly Hygiene: "hygiene";
-  readonly WeeklyPulse: "weekly_pulse";
-  readonly WebAuth: "webauth";
 };
 interface OwnerShipMeta {
   version?: number;
@@ -72,4 +70,5 @@ interface OwnerShipMeta {
   stability: Stability;
 }
 //#endregion
-export { Owner, OwnerShipMeta, Owners, OwnersEnum, Stability, StabilityEnum, Tag, Tags, TagsEnum };
+export { Owner, OwnerShipMeta, Owners, OwnersEnum, Stability, StabilityEnum, Tag, Tags, TagsEnum };
+//# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","names":[],"sources":["../src/ownership.ts"],"sourcesContent":[],"mappings":";cAEa;EAAA,SAAA,IAAA,EAAA,MAOH;EACE,SAAA,UAAS,EAAA,aAAW;EAGnB,SAAA,YASH,EAAA,cAAA;EACE,SAAK,IAAA,EAAA,MACL;EAGC,SAAmB,MAAA,EAAA,QAAA;EAGnB,SAAA,UAcH,EAAA,YAAA;AACV,CAAA;AAEa,KArCD,SAAA,GAqCgB,CAAA,OArCI,aAqCJ,CAAA,CAAA,MAAA,OArCgC,aAqChC,CAAA;AAEX,cApCJ,UAoCiB,EAAA;EAKpB,SAAA,eAAA,EAAA,kBAAA;EACF,SAAA,YAAA,EAAA,eAAA;EACK,SAAA,gBAAA,EAAA,mBAAA;EAAS,SAAA,aAAA,EAAA,gBAAA;;;;;;KAjCV,KAAA,WACA,yBAAyB;cAGxB;;;;;;;;;;cAGA;;;;;;;;;;;;;;;KAeD,GAAA,WAAc,uBAAuB;cAEpC;;;;;;;;;;;;;;;UAEI,aAAA;;;;;UAKP;QACF;aACK"}

package/dist/ownership.js

@@ -14,7 +14,8 @@ const OwnersEnum = {
 	PlatformSigil: "platform.sigil",
 	PlatformMarketplace: "platform.marketplace",
 	PlatformContent: "platform.content",
-	PlatformFeatureFlags: "platform.featureflags"
+	PlatformFeatureFlags: "platform.featureflags",
+	PlatformFinance: "platform.finance"
 };
 const Owners = OwnersEnum;
 const TagsEnum = {
@@ -28,13 +29,12 @@ const TagsEnum = {
 	Guide: "guide",
 	Docs: "docs",
 	I18n: "i18n",
-	AtomicPages: "atomic:pages",
 	Incident: "incident",
-	Hygiene: "hygiene",
-	WeeklyPulse: "weekly_pulse",
-	WebAuth: "webauth"
+	Automation: "automation",
+	Hygiene: "hygiene"
 };
 const Tags = TagsEnum;
 
 //#endregion
-export { Owners, OwnersEnum, StabilityEnum, Tags, TagsEnum };
+export { Owners, OwnersEnum, StabilityEnum, Tags, TagsEnum };
+//# sourceMappingURL=ownership.js.map

package/dist/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","names":[],"sources":["../src/ownership.ts"],"sourcesContent":["// Canonical ownership/stability/tags enums and shared meta\n\nexport const StabilityEnum = {\n  Idea: 'idea',\n  InCreation: 'in_creation',\n  Experimental: 'experimental',\n  Beta: 'beta',\n  Stable: 'stable',\n  Deprecated: 'deprecated',\n} as const;\nexport type Stability = (typeof StabilityEnum)[keyof typeof StabilityEnum];\n\n// Provide curated owner identifiers (business/product oriented), allow extension by string\nexport const OwnersEnum = {\n  ProductColiving: 'product.coliving',\n  ProductStrit: 'product.strit',\n  ProductArtisanos: 'product.artisanos',\n  PlatformSigil: 'platform.sigil',\n  PlatformMarketplace: 'platform.marketplace',\n  PlatformContent: 'platform.content',\n  PlatformFeatureFlags: 'platform.featureflags',\n  PlatformFinance: 'platform.finance',\n} as const;\nexport type Owner =\n  | (typeof OwnersEnum)[keyof typeof OwnersEnum]\n  | (string & {});\n// Back-compat alias\nexport const Owners = OwnersEnum;\n\n// Provide common tags, allow extension by string\nexport const TagsEnum = {\n  Spots: 'spots',\n  Collectivity: 'collectivity',\n  Marketplace: 'marketplace',\n  Sellers: 'sellers',\n  Auth: 'auth',\n  Login: 'login',\n  Signup: 'signup',\n  Guide: 'guide',\n  Docs: 'docs',\n  I18n: 'i18n',\n  Incident: 'incident',\n  Automation: 'automation',\n  Hygiene: 'hygiene',\n} as const;\nexport type Tag = (typeof TagsEnum)[keyof typeof TagsEnum] | (string & {});\n// Back-compat alias\nexport const Tags = TagsEnum;\n\nexport interface OwnerShipMeta {\n  version?: number;\n  title: string;\n  description: string;\n  domain: string;\n  owners: Owner[];\n  tags: Tag[];\n  stability: Stability;\n}\n"],"mappings":";AAEA,MAAa,gBAAgB;CAC3B,MAAM;CACN,YAAY;CACZ,cAAc;CACd,MAAM;CACN,QAAQ;CACR,YAAY;CACb;AAID,MAAa,aAAa;CACxB,iBAAiB;CACjB,cAAc;CACd,kBAAkB;CAClB,eAAe;CACf,qBAAqB;CACrB,iBAAiB;CACjB,sBAAsB;CACtB,iBAAiB;CAClB;AAKD,MAAa,SAAS;AAGtB,MAAa,WAAW;CACtB,OAAO;CACP,cAAc;CACd,aAAa;CACb,SAAS;CACT,MAAM;CACN,OAAO;CACP,QAAQ;CACR,OAAO;CACP,MAAM;CACN,MAAM;CACN,UAAU;CACV,YAAY;CACZ,SAAS;CACV;AAGD,MAAa,OAAO"}

package/dist/policy/docs/policy.docblock.d.ts

@@ -3,4 +3,5 @@ import { DocBlock } from "@lssm/lib.contracts/docs";
 //#region src/policy/docs/policy.docblock.d.ts
 declare const tech_contracts_policy_DocBlocks: DocBlock[];
 //#endregion
-export { tech_contracts_policy_DocBlocks };
+export { tech_contracts_policy_DocBlocks };
+//# sourceMappingURL=policy.docblock.d.ts.map

package/dist/policy/docs/policy.docblock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.docblock.d.ts","names":[],"sources":["../../../src/policy/docs/policy.docblock.ts"],"sourcesContent":[],"mappings":";;;cAGa,iCAAiC"}

package/dist/policy/docs/policy.docblock.js

@@ -19,4 +19,5 @@ const tech_contracts_policy_DocBlocks = [{
 registerDocBlocks(tech_contracts_policy_DocBlocks);
 
 //#endregion
-export { tech_contracts_policy_DocBlocks };
+export { tech_contracts_policy_DocBlocks };
+//# sourceMappingURL=policy.docblock.js.map

package/dist/policy/docs/policy.docblock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.docblock.js","names":["tech_contracts_policy_DocBlocks: DocBlock[]"],"sources":["../../../src/policy/docs/policy.docblock.ts"],"sourcesContent":["import type { DocBlock } from '@lssm/lib.contracts/docs';\nimport { registerDocBlocks } from '../../registry';\n\nexport const tech_contracts_policy_DocBlocks: DocBlock[] = [\n  {\n    id: 'docs.tech.contracts.policy',\n    title: 'PolicySpec & PolicyEngine',\n    summary:\n      '`PolicySpec` gives a declarative, typed home for access-control logic covering:',\n    kind: 'reference',\n    visibility: 'public',\n    route: '/docs/tech/contracts/policy',\n    tags: ['tech', 'contracts', 'policy'],\n    body: \"# PolicySpec & PolicyEngine\\n\\n## Purpose\\n\\n`PolicySpec` gives a declarative, typed home for access-control logic covering:\\n- **Who** can perform an action (ABAC/ReBAC style rules)\\n- **What** they can access (resources + optional field-level overrides)\\n- **When** special conditions apply (contextual expressions)\\n- **How** PII should be handled (consent/retention hints)\\n\\n`PolicyEngine` evaluates one or more policies and returns an `allow`/`deny` decision, field-level outcomes, and PII metadata suitable for downstream enforcement (`SpecRegistry` \\u2192 `ctx.decide`).\\n\\n## Location\\n\\n- Types & registry: `packages/libs/contracts/src/policy/spec.ts`\\n- Runtime evaluation: `packages/libs/contracts/src/policy/engine.ts`\\n- Tests: `packages/.../policy/engine.test.ts`\\n\\n## `PolicySpec`\\n\\n```ts\\nexport interface PolicySpec {\\n  meta: PolicyMeta;          // ownership metadata + { name, version, scope? }\\n  rules: PolicyRule[];       // allow/deny rules for actions\\n  fieldPolicies?: FieldPolicyRule[];\\n  pii?: { fields: string[]; consentRequired?: boolean; retentionDays?: number };\\n  relationships?: RelationshipDefinition[];\\n  consents?: ConsentDefinition[];\\n  rateLimits?: RateLimitDefinition[];\\n  opa?: { package: string; decision?: string };\\n}\\n```\\n\\n- `PolicyRule`\\n  - `effect`: `'allow' | 'deny'`\\n  - `actions`: e.g., `['read', 'write', 'delete']` (string namespace is flexible)\\n  - `subject`: `{ roles?: string[]; attributes?: { attr: matcher } }`\\n  - `resource`: `{ type: string; fields?: string[]; attributes?: {...} }`\\n  - `relationships`: `{ relation, objectId?, objectType? }[]` \\u2192 ReBAC checks (use `objectId: '$resource'` to target the current resource)\\n  - `requiresConsent`: `['consent_id']` \\u2192 references spec-level consent definitions\\n  - `flags`: feature flags that must be enabled (`DecisionContext.flags`)\\n  - `rateLimit`: string reference to `rateLimits` entry or inline object `{ rpm, key?, windowSeconds?, burst? }`\\n  - `escalate`: `'human_review' | null` to indicate manual approval\\n  - `conditions`: optional expression snippets evaluated against `{ subject, resource, context }`\\n- `FieldPolicyRule`\\n  - `field`: dot-path string (e.g., `contact.email`)\\n  - `actions`: subset of `['read', 'write']`\\n  - Same `subject` / `resource` / `conditions` shape\\n  - Useful for redacting specific fields, even when the global action is allowed\\n- `RelationshipDefinition`\\n  - Canonical tuples for relationship graph (`subjectType`, `relation`, `objectType`, `transitive?`)\\n- `ConsentDefinition`\\n  - `{ id, scope, purpose, lawfulBasis?, expiresInDays?, required? }`\\n- `RateLimitDefinition`\\n  - `{ id, rpm, key?, windowSeconds?, burst? }`\\n- `PolicyRef`\\n  - `{ name: string; version: number }` \\u2192 attach to contract specs / workflows\\n\\n## Registry\\n\\n```ts\\nconst registry = new PolicyRegistry();\\nregistry.register(CorePolicySpec);\\nconst spec = registry.get('core.default', 1);\\n```\\n\\nGuarantees uniqueness per `(name, version)` and exposes helpers to resolve highest versions.\\n\\n## Engine\\n\\n```ts\\nconst engine = new PolicyEngine(policyRegistry);\\n\\nconst decision = engine.decide({\\n  action: 'read',\\n  subject: { roles: ['admin'] },\\n  resource: { type: 'resident', fields: ['contact.email'] },\\n  policies: [{ name: 'core.default', version: 1 }],\\n});\\n/*\\n{\\n  effect: 'allow',\\n  reason: 'core.default',\\n  fieldDecisions: [{ field: 'contact.email', effect: 'allow' }],\\n  pii: { fields: ['contact.email'], consentRequired: true }\\n}\\n*/\\n```\\n\\n- First matching **deny** wins; otherwise the first **allow** is returned.\\n- Field policies are aggregated across referenced policies:\\n  - Later denies override earlier allows for a given field.\\n  - Returned as `fieldDecisions` to simplify downstream masking.\\n- PII metadata is surfaced when defined to help adapt logging/telemetry.\\n\\n### Expression Support\\n\\nConditions accept small JS snippets (e.g., `subject.attributes.orgId === context.orgId`). The engine runs them in a constrained scope (`subject`, `resource`, `context`) without access to global state.\\n\\n### ReBAC & Relationships\\n\\n- Provide relationship tuples via `PolicySpec.relationships` for documentation/validation.\\n- Reference them inside rules with `relationships: [{ relation: 'manager_of', objectType: 'resident', objectId: '$resource' }]`.\\n- The execution context must populate `subject.relationships` (`[{ relation, object, objectType }]`) for the engine to evaluate ReBAC guards.\\n\\n### Consent & Rate Limits\\n\\n- Declare reusable consent definitions under `consents`. Rules list the IDs they require; if a user session lacks the consent (`DecisionContext.consents`), the engine returns `effect: 'deny'` with `reason: 'consent_required'` and enumerates missing consents.\\n- Attach rate limits either inline or via `rateLimits` references. When a rule matches, the engine surfaces `{ rpm, key, windowSeconds?, burst? }` so callers can feed it to shared limiters.\\n\\n### OPA Adapter\\n\\n- `OPAPolicyAdapter` bridges engine decisions to Open Policy Agent (OPA). It forwards the evaluation context + policies to OPA and merges any override result (`effect`, `reason`, `fieldDecisions`, `requiredConsents`).\\n- Use when migrating to OPA policies or running defense-in-depth: call `engine.decide()`, then pass the preliminary decision to `adapter.evaluate(...)`. The adapter marks merged decisions with `evaluatedBy: 'opa'`.\\n- OPA inputs include meta, rules, relationships, rate limits, and consent catalogs to simplify policy authoring on the OPA side.\\n\\n## Contract Integration\\n\\n`ContractSpec.policy` now supports:\\n\\n```ts\\npolicy: {\\n  auth: 'anonymous' | 'user' | 'admin';\\n  ...\\n  policies?: PolicyRef[];                // policies evaluated before execution\\n  fieldPolicies?: {                      // field hints (read/write) per policy\\n    field: string;\\n    actions: ('read' | 'write')[];\\n    policy?: PolicyRef;\\n  }[];\\n}\\n```\\n\\nAdapters can resolve refs through a shared `PolicyEngine` and populate `ctx.decide` so `SpecRegistry.execute` benefits from centralized enforcement.\\n\\n## Authoring Guidelines\\n\\n1. Prefer **allow-by-default** policies but explicitly deny sensitive flows (defense-in-depth).\\n2. Keep rule scopes narrow (per feature/operation) and compose multiple `PolicyRef`s when necessary.\\n3. Store PII field lists here to avoid duplication across logs/telemetry.\\n4. Use explicit rule reasons for auditability and better developer feedback.\\n5. Treat versioning seriously; bump `meta.version` whenever behavior changes.\\n\\n## Future Enhancements\\n\\n- Richer expression language (composable predicates, time-based conditions).\\n- Multi-tenant relationship graph services (store/resolve relationships at scale).\\n- Tooling that auto-generates docs/tests for policies referenced in specs.\\n\\n\",\n  },\n];\nregisterDocBlocks(tech_contracts_policy_DocBlocks);\n"],"mappings":";;;;AAGA,MAAaA,kCAA8C,CACzD;CACE,IAAI;CACJ,OAAO;CACP,SACE;CACF,MAAM;CACN,YAAY;CACZ,OAAO;CACP,MAAM;EAAC;EAAQ;EAAa;EAAS;CACrC,MAAM;CACP,CACF;AACD,kBAAkB,gCAAgC"}

package/dist/policy/engine.d.ts

@@ -36,4 +36,5 @@ declare class PolicyEngine {
   private evaluateFields;
 }
 //#endregion
-export { DecisionContext, PolicyEngine, ResourceContext, SubjectContext, SubjectRelationship };
+export { DecisionContext, PolicyEngine, ResourceContext, SubjectContext, SubjectRelationship };
+//# sourceMappingURL=engine.d.ts.map

package/dist/policy/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","names":[],"sources":["../../src/policy/engine.ts"],"sourcesContent":[],"mappings":";;;;UAaiB,mBAAA;;EAAA,MAAA,EAAA,MAAA;EAMA,UAAA,CAAA,EAAA,MAAc;AAM/B;AAOiB,UAbA,cAAA,CAae;EACrB,KAAA,CAAA,EAAA,MAAA,EAAA;EACC,UAAA,CAAA,EAbG,MAaH,CAAA,MAAA,EAAA,OAAA,CAAA;EACA,aAAA,CAAA,EAbM,mBAaN,EAAA;;AAES,UAZJ,eAAA,CAYI;EAWR,IAAA,EAAA,MAAA;EAC4B,EAAA,CAAA,EAAA,MAAA;EAEzB,MAAA,CAAA,EAAA,MAAA,EAAA;EAAkB,UAAA,CAAA,EAtBnB,MAsBmB,CAAA,MAAA,EAAA,OAAA,CAAA;;UAnBjB,eAAA;WACN;YACC;YACA;;YAEA;;;;cAWC,YAAA;;wBAC4B;gBAEzB,kBAAkB"}

package/dist/policy/engine.js

@@ -220,4 +220,5 @@ function getResourceId(resource) {
 }
 
 //#endregion
-export { PolicyEngine };
+export { PolicyEngine };
+//# sourceMappingURL=engine.js.map

package/dist/policy/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","names":["registry: PolicyRegistry","allowReason: string | undefined","appliedRateLimit: PolicyDecision['rateLimit']","escalate: 'human_review' | null | undefined","specs: PolicySpec[]","allowMatch: RuleEvaluation | undefined","evaluation: RuleEvaluation","definition: RateLimitDefinition | undefined"],"sources":["../../src/policy/engine.ts"],"sourcesContent":["import {\n  PolicyRegistry,\n  type PolicyRef,\n  type PolicySpec,\n  type PolicyRule,\n  type FieldPolicyRule,\n  type PolicyCondition,\n  type ConsentDefinition,\n  type RateLimitDefinition,\n  type RelationshipMatcher,\n} from './spec';\nimport type { PolicyDecision, FieldLevelDecision } from '../types';\n\nexport interface SubjectRelationship {\n  relation: string;\n  object: string;\n  objectType?: string;\n}\n\nexport interface SubjectContext {\n  roles?: string[];\n  attributes?: Record<string, unknown>;\n  relationships?: SubjectRelationship[];\n}\n\nexport interface ResourceContext {\n  type: string;\n  id?: string;\n  fields?: string[];\n  attributes?: Record<string, unknown>;\n}\n\nexport interface DecisionContext {\n  subject: SubjectContext;\n  resource: ResourceContext;\n  context?: Record<string, unknown>;\n  action: string;\n  policies: PolicyRef[];\n  consents?: string[];\n  flags?: string[];\n}\n\ninterface RuleEvaluation {\n  rule: PolicyRule;\n  missingConsents: ConsentDefinition[];\n  rateLimit?: PolicyDecision['rateLimit'];\n}\n\nexport class PolicyEngine {\n  constructor(private readonly registry: PolicyRegistry) {}\n\n  decide(input: DecisionContext): PolicyDecision {\n    const policies = this.resolvePolicies(input.policies);\n    let allowReason: string | undefined;\n    let appliedRateLimit: PolicyDecision['rateLimit'];\n    let escalate: 'human_review' | null | undefined;\n\n    for (const policy of policies) {\n      const match = this.matchRuleSet(policy, input);\n      if (!match) continue;\n      if (match.rule.effect === 'deny') {\n        return {\n          effect: 'deny',\n          reason: match.rule.reason ?? policy.meta.name,\n          requiredConsents: match.missingConsents.length\n            ? match.missingConsents\n            : undefined,\n          evaluatedBy: 'engine',\n        };\n      }\n      if (match.rule.effect === 'allow') {\n        if (match.missingConsents.length) {\n          return {\n            effect: 'deny',\n            reason: 'consent_required',\n            requiredConsents: match.missingConsents,\n            evaluatedBy: 'engine',\n          };\n        }\n        if (!allowReason) {\n          allowReason = match.rule.reason ?? policy.meta.name;\n        }\n        if (!appliedRateLimit && match.rateLimit) {\n          appliedRateLimit = match.rateLimit;\n        }\n        if (!escalate && match.rule.escalate) {\n          escalate = match.rule.escalate;\n        }\n      }\n    }\n\n    const fieldDecisions = this.evaluateFields(policies, input);\n    const pii = policies.find((p) => p.pii)?.pii;\n    const escalateValue =\n      typeof escalate === 'undefined' ? undefined : escalate;\n\n    return {\n      effect: allowReason ? 'allow' : 'deny',\n      reason: allowReason,\n      rateLimit: appliedRateLimit,\n      escalate: escalateValue,\n      fieldDecisions: fieldDecisions.length ? fieldDecisions : undefined,\n      pii,\n      evaluatedBy: 'engine',\n    };\n  }\n\n  private resolvePolicies(refs: PolicyRef[]): PolicySpec[] {\n    const specs: PolicySpec[] = [];\n    for (const ref of refs) {\n      const spec = this.registry.get(ref.name, ref.version);\n      if (!spec)\n        throw new Error(\n          `PolicyEngine: policy not found ${ref.name}.v${ref.version}`\n        );\n      specs.push(spec);\n    }\n    return specs;\n  }\n\n  private matchRuleSet(\n    policy: PolicySpec,\n    input: DecisionContext\n  ): RuleEvaluation | undefined {\n    let allowMatch: RuleEvaluation | undefined;\n    for (const rule of policy.rules) {\n      if (!rule.actions.includes(input.action)) continue;\n      if (!matchesSubject(rule, input.subject)) continue;\n      if (!matchesResource(rule, input.resource)) continue;\n      if (!matchesFlags(rule, input)) continue;\n      if (!matchesRelationships(rule.relationships, input)) continue;\n      if (!matchesConditions(rule, input)) continue;\n      const missingConsents = collectMissingConsents(rule, policy, input);\n      const rateLimit = resolveRateLimit(rule, policy, input);\n      const evaluation: RuleEvaluation = {\n        rule,\n        missingConsents,\n        rateLimit,\n      };\n      if (rule.effect === 'deny') return evaluation;\n      if (rule.effect === 'allow' && !allowMatch) allowMatch = evaluation;\n    }\n    return allowMatch;\n  }\n\n  private evaluateFields(\n    policies: PolicySpec[],\n    input: DecisionContext\n  ): FieldLevelDecision[] {\n    const out = new Map<string, FieldLevelDecision>();\n    for (const policy of policies) {\n      if (!policy.fieldPolicies) continue;\n      for (const rule of policy.fieldPolicies) {\n        if (!rule.actions.includes(mapActionToFieldAction(input.action)))\n          continue;\n        if (!matchesSubject(rule, input.subject)) continue;\n        if (!matchesResource(rule, input.resource)) continue;\n        if (!matchesConditions(rule, input)) continue;\n        const existing = out.get(rule.field);\n        if (rule.effect === 'deny') {\n          out.set(rule.field, {\n            field: rule.field,\n            effect: 'deny',\n            reason: rule.reason ?? policy.meta.name,\n          });\n        } else if (!existing) {\n          out.set(rule.field, {\n            field: rule.field,\n            effect: 'allow',\n            reason: rule.reason ?? policy.meta.name,\n          });\n        }\n      }\n    }\n    return [...out.values()];\n  }\n}\n\nfunction mapActionToFieldAction(action: string): 'read' | 'write' {\n  if (action.startsWith('write')) return 'write';\n  return 'read';\n}\n\nfunction matchesSubject(\n  rule: { subject?: PolicyRule['subject'] | FieldPolicyRule['subject'] },\n  subject: SubjectContext\n): boolean {\n  const matcher = rule.subject;\n  if (!matcher) return true;\n  if (matcher.roles?.length) {\n    const roles = subject.roles ?? [];\n    const hasRole = matcher.roles.some((role) => roles.includes(role));\n    if (!hasRole) return false;\n  }\n  if (matcher.attributes) {\n    const attributes = subject.attributes ?? {};\n    if (!matchAttributes(matcher.attributes, attributes)) return false;\n  }\n  return true;\n}\n\nfunction matchesResource(\n  rule: { resource?: PolicyRule['resource'] | FieldPolicyRule['resource'] },\n  resource: ResourceContext\n): boolean {\n  const matcher = rule.resource;\n  if (!matcher) return true;\n  if (matcher.type && matcher.type !== resource.type) return false;\n  if (matcher.fields?.length) {\n    const targetFields = resource.fields ?? [];\n    if (!matcher.fields.some((field) => targetFields.includes(field)))\n      return false;\n  }\n  if (matcher.attributes) {\n    const attributes = resource.attributes ?? {};\n    if (!matchAttributes(matcher.attributes, attributes)) return false;\n  }\n  return true;\n}\n\nfunction matchesFlags(rule: PolicyRule, input: DecisionContext): boolean {\n  if (!rule.flags?.length) return true;\n  const available = new Set<string>();\n  if (input.flags) {\n    for (const flag of input.flags) available.add(flag);\n  }\n  const attributeFlags = input.subject.attributes?.featureFlags;\n  if (Array.isArray(attributeFlags)) {\n    for (const flag of attributeFlags) available.add(flag);\n  }\n  return rule.flags.every((flag) => available.has(flag));\n}\n\nfunction matchesRelationships(\n  matchers: RelationshipMatcher[] | undefined,\n  input: DecisionContext\n): boolean {\n  if (!matchers || matchers.length === 0) return true;\n  const relationships = input.subject.relationships ?? [];\n  const resourceId = getResourceId(input.resource);\n  const resourceType = input.resource.type;\n\n  return matchers.every((matcher) =>\n    relationships.some((relation) => {\n      if (relation.relation !== matcher.relation) return false;\n\n      const typeMatches =\n        !matcher.objectType ||\n        relation.objectType === matcher.objectType ||\n        matcher.objectType === resourceType;\n\n      if (!typeMatches) return false;\n\n      if (!matcher.objectId) return true;\n\n      if (matcher.objectId === '$resource') {\n        if (resourceId) {\n          return relation.object === resourceId;\n        }\n        return (\n          relation.object === resourceType ||\n          relation.objectType === resourceType\n        );\n      }\n\n      return relation.object === matcher.objectId;\n    })\n  );\n}\n\nfunction matchesConditions(\n  rule: { conditions?: PolicyCondition[] },\n  input: DecisionContext\n): boolean {\n  if (!rule.conditions || rule.conditions.length === 0) return true;\n  return rule.conditions.every((condition) =>\n    evaluateCondition(condition.expression, input)\n  );\n}\n\nfunction matchAttributes(\n  matcher: Record<string, import('./spec').AttributeMatcher>,\n  actual: Record<string, unknown>\n): boolean {\n  for (const [key, attrMatcher] of Object.entries(matcher)) {\n    const value = actual[key];\n    if (attrMatcher.exists && typeof value === 'undefined') return false;\n    if (typeof attrMatcher.equals !== 'undefined') {\n      if (value !== attrMatcher.equals) return false;\n    }\n    if (attrMatcher.oneOf && !attrMatcher.oneOf.includes(value)) return false;\n  }\n  return true;\n}\n\nfunction collectMissingConsents(\n  rule: PolicyRule,\n  policy: PolicySpec,\n  input: DecisionContext\n): ConsentDefinition[] {\n  if (!rule.requiresConsent?.length) return [];\n  const granted = new Set(input.consents ?? []);\n  const missingIds = rule.requiresConsent.filter((id) => !granted.has(id));\n  if (missingIds.length === 0) return [];\n  return resolveConsentDefinitions(policy, missingIds);\n}\n\nfunction resolveConsentDefinitions(\n  policy: PolicySpec,\n  ids: string[]\n): ConsentDefinition[] {\n  const catalog = policy.consents ?? [];\n  return ids.map((id) => {\n    const found = catalog.find((consent) => consent.id === id);\n    return (\n      found ?? {\n        id,\n        scope: 'unspecified',\n        purpose: 'unspecified',\n        description: `Consent \"${id}\" required by ${policy.meta.name}`,\n        required: true,\n      }\n    );\n  });\n}\n\nfunction resolveRateLimit(\n  rule: PolicyRule,\n  policy: PolicySpec,\n  input: DecisionContext\n): PolicyDecision['rateLimit'] | undefined {\n  if (!rule.rateLimit) return undefined;\n  const definition: RateLimitDefinition | undefined =\n    typeof rule.rateLimit === 'string'\n      ? (policy.rateLimits ?? []).find((item) => item.id === rule.rateLimit)\n      : rule.rateLimit;\n\n  if (!definition) {\n    throw new Error(\n      `PolicyEngine: rate limit \"${String(\n        rule.rateLimit\n      )}\" not declared in ${policy.meta.name}`\n    );\n  }\n\n  return {\n    rpm: definition.rpm,\n    key: definition.key ?? input.resource.type,\n    windowSeconds: definition.windowSeconds,\n    burst: definition.burst,\n  };\n}\n\nfunction evaluateCondition(\n  expression: string,\n  input: DecisionContext\n): boolean {\n  const trimmed = expression.trim();\n  if (!trimmed) return true;\n\n  const context = {\n    subject: input.subject,\n    resource: input.resource,\n    context: input.context ?? {},\n  };\n\n  try {\n    // very small whitelist of expressions\n    // Supports subject/resource/context dot paths, comparisons, and logical operators.\n    const fn = new Function(\n      'subject',\n      'resource',\n      'context',\n      `return (${transformExpression(trimmed)});`\n    );\n    const result = fn(context.subject, context.resource, context.context);\n    return Boolean(result);\n  } catch (_error) {\n    return false;\n  }\n}\n\nfunction transformExpression(expression: string): string {\n  return expression.replace(/&&/g, '&&').replace(/\\|\\|/g, '||');\n}\n\nfunction getResourceId(resource: ResourceContext): string | undefined {\n  if (resource.id) return resource.id;\n  const candidate = resource.attributes?.id;\n  if (typeof candidate === 'string') return candidate;\n  if (typeof candidate === 'number') return String(candidate);\n  return undefined;\n}\n"],"mappings":";AAgDA,IAAa,eAAb,MAA0B;CACxB,YAAY,AAAiBA,UAA0B;EAA1B;;CAE7B,OAAO,OAAwC;EAC7C,MAAM,WAAW,KAAK,gBAAgB,MAAM,SAAS;EACrD,IAAIC;EACJ,IAAIC;EACJ,IAAIC;AAEJ,OAAK,MAAM,UAAU,UAAU;GAC7B,MAAM,QAAQ,KAAK,aAAa,QAAQ,MAAM;AAC9C,OAAI,CAAC,MAAO;AACZ,OAAI,MAAM,KAAK,WAAW,OACxB,QAAO;IACL,QAAQ;IACR,QAAQ,MAAM,KAAK,UAAU,OAAO,KAAK;IACzC,kBAAkB,MAAM,gBAAgB,SACpC,MAAM,kBACN;IACJ,aAAa;IACd;AAEH,OAAI,MAAM,KAAK,WAAW,SAAS;AACjC,QAAI,MAAM,gBAAgB,OACxB,QAAO;KACL,QAAQ;KACR,QAAQ;KACR,kBAAkB,MAAM;KACxB,aAAa;KACd;AAEH,QAAI,CAAC,YACH,eAAc,MAAM,KAAK,UAAU,OAAO,KAAK;AAEjD,QAAI,CAAC,oBAAoB,MAAM,UAC7B,oBAAmB,MAAM;AAE3B,QAAI,CAAC,YAAY,MAAM,KAAK,SAC1B,YAAW,MAAM,KAAK;;;EAK5B,MAAM,iBAAiB,KAAK,eAAe,UAAU,MAAM;EAC3D,MAAM,MAAM,SAAS,MAAM,MAAM,EAAE,IAAI,EAAE;AAIzC,SAAO;GACL,QAAQ,cAAc,UAAU;GAChC,QAAQ;GACR,WAAW;GACX,UANA,OAAO,aAAa,cAAc,SAAY;GAO9C,gBAAgB,eAAe,SAAS,iBAAiB;GACzD;GACA,aAAa;GACd;;CAGH,AAAQ,gBAAgB,MAAiC;EACvD,MAAMC,QAAsB,EAAE;AAC9B,OAAK,MAAM,OAAO,MAAM;GACtB,MAAM,OAAO,KAAK,SAAS,IAAI,IAAI,MAAM,IAAI,QAAQ;AACrD,OAAI,CAAC,KACH,OAAM,IAAI,MACR,kCAAkC,IAAI,KAAK,IAAI,IAAI,UACpD;AACH,SAAM,KAAK,KAAK;;AAElB,SAAO;;CAGT,AAAQ,aACN,QACA,OAC4B;EAC5B,IAAIC;AACJ,OAAK,MAAM,QAAQ,OAAO,OAAO;AAC/B,OAAI,CAAC,KAAK,QAAQ,SAAS,MAAM,OAAO,CAAE;AAC1C,OAAI,CAAC,eAAe,MAAM,MAAM,QAAQ,CAAE;AAC1C,OAAI,CAAC,gBAAgB,MAAM,MAAM,SAAS,CAAE;AAC5C,OAAI,CAAC,aAAa,MAAM,MAAM,CAAE;AAChC,OAAI,CAAC,qBAAqB,KAAK,eAAe,MAAM,CAAE;AACtD,OAAI,CAAC,kBAAkB,MAAM,MAAM,CAAE;GAGrC,MAAMC,aAA6B;IACjC;IACA,iBAJsB,uBAAuB,MAAM,QAAQ,MAAM;IAKjE,WAJgB,iBAAiB,MAAM,QAAQ,MAAM;IAKtD;AACD,OAAI,KAAK,WAAW,OAAQ,QAAO;AACnC,OAAI,KAAK,WAAW,WAAW,CAAC,WAAY,cAAa;;AAE3D,SAAO;;CAGT,AAAQ,eACN,UACA,OACsB;EACtB,MAAM,sBAAM,IAAI,KAAiC;AACjD,OAAK,MAAM,UAAU,UAAU;AAC7B,OAAI,CAAC,OAAO,cAAe;AAC3B,QAAK,MAAM,QAAQ,OAAO,eAAe;AACvC,QAAI,CAAC,KAAK,QAAQ,SAAS,uBAAuB,MAAM,OAAO,CAAC,CAC9D;AACF,QAAI,CAAC,eAAe,MAAM,MAAM,QAAQ,CAAE;AAC1C,QAAI,CAAC,gBAAgB,MAAM,MAAM,SAAS,CAAE;AAC5C,QAAI,CAAC,kBAAkB,MAAM,MAAM,CAAE;IACrC,MAAM,WAAW,IAAI,IAAI,KAAK,MAAM;AACpC,QAAI,KAAK,WAAW,OAClB,KAAI,IAAI,KAAK,OAAO;KAClB,OAAO,KAAK;KACZ,QAAQ;KACR,QAAQ,KAAK,UAAU,OAAO,KAAK;KACpC,CAAC;aACO,CAAC,SACV,KAAI,IAAI,KAAK,OAAO;KAClB,OAAO,KAAK;KACZ,QAAQ;KACR,QAAQ,KAAK,UAAU,OAAO,KAAK;KACpC,CAAC;;;AAIR,SAAO,CAAC,GAAG,IAAI,QAAQ,CAAC;;;AAI5B,SAAS,uBAAuB,QAAkC;AAChE,KAAI,OAAO,WAAW,QAAQ,CAAE,QAAO;AACvC,QAAO;;AAGT,SAAS,eACP,MACA,SACS;CACT,MAAM,UAAU,KAAK;AACrB,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,QAAQ,OAAO,QAAQ;EACzB,MAAM,QAAQ,QAAQ,SAAS,EAAE;AAEjC,MAAI,CADY,QAAQ,MAAM,MAAM,SAAS,MAAM,SAAS,KAAK,CAAC,CACpD,QAAO;;AAEvB,KAAI,QAAQ,YAAY;EACtB,MAAM,aAAa,QAAQ,cAAc,EAAE;AAC3C,MAAI,CAAC,gBAAgB,QAAQ,YAAY,WAAW,CAAE,QAAO;;AAE/D,QAAO;;AAGT,SAAS,gBACP,MACA,UACS;CACT,MAAM,UAAU,KAAK;AACrB,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,QAAQ,QAAQ,QAAQ,SAAS,SAAS,KAAM,QAAO;AAC3D,KAAI,QAAQ,QAAQ,QAAQ;EAC1B,MAAM,eAAe,SAAS,UAAU,EAAE;AAC1C,MAAI,CAAC,QAAQ,OAAO,MAAM,UAAU,aAAa,SAAS,MAAM,CAAC,CAC/D,QAAO;;AAEX,KAAI,QAAQ,YAAY;EACtB,MAAM,aAAa,SAAS,cAAc,EAAE;AAC5C,MAAI,CAAC,gBAAgB,QAAQ,YAAY,WAAW,CAAE,QAAO;;AAE/D,QAAO;;AAGT,SAAS,aAAa,MAAkB,OAAiC;AACvE,KAAI,CAAC,KAAK,OAAO,OAAQ,QAAO;CAChC,MAAM,4BAAY,IAAI,KAAa;AACnC,KAAI,MAAM,MACR,MAAK,MAAM,QAAQ,MAAM,MAAO,WAAU,IAAI,KAAK;CAErD,MAAM,iBAAiB,MAAM,QAAQ,YAAY;AACjD,KAAI,MAAM,QAAQ,eAAe,CAC/B,MAAK,MAAM,QAAQ,eAAgB,WAAU,IAAI,KAAK;AAExD,QAAO,KAAK,MAAM,OAAO,SAAS,UAAU,IAAI,KAAK,CAAC;;AAGxD,SAAS,qBACP,UACA,OACS;AACT,KAAI,CAAC,YAAY,SAAS,WAAW,EAAG,QAAO;CAC/C,MAAM,gBAAgB,MAAM,QAAQ,iBAAiB,EAAE;CACvD,MAAM,aAAa,cAAc,MAAM,SAAS;CAChD,MAAM,eAAe,MAAM,SAAS;AAEpC,QAAO,SAAS,OAAO,YACrB,cAAc,MAAM,aAAa;AAC/B,MAAI,SAAS,aAAa,QAAQ,SAAU,QAAO;AAOnD,MAAI,EAJF,CAAC,QAAQ,cACT,SAAS,eAAe,QAAQ,cAChC,QAAQ,eAAe,cAEP,QAAO;AAEzB,MAAI,CAAC,QAAQ,SAAU,QAAO;AAE9B,MAAI,QAAQ,aAAa,aAAa;AACpC,OAAI,WACF,QAAO,SAAS,WAAW;AAE7B,UACE,SAAS,WAAW,gBACpB,SAAS,eAAe;;AAI5B,SAAO,SAAS,WAAW,QAAQ;GACnC,CACH;;AAGH,SAAS,kBACP,MACA,OACS;AACT,KAAI,CAAC,KAAK,cAAc,KAAK,WAAW,WAAW,EAAG,QAAO;AAC7D,QAAO,KAAK,WAAW,OAAO,cAC5B,kBAAkB,UAAU,YAAY,MAAM,CAC/C;;AAGH,SAAS,gBACP,SACA,QACS;AACT,MAAK,MAAM,CAAC,KAAK,gBAAgB,OAAO,QAAQ,QAAQ,EAAE;EACxD,MAAM,QAAQ,OAAO;AACrB,MAAI,YAAY,UAAU,OAAO,UAAU,YAAa,QAAO;AAC/D,MAAI,OAAO,YAAY,WAAW,aAChC;OAAI,UAAU,YAAY,OAAQ,QAAO;;AAE3C,MAAI,YAAY,SAAS,CAAC,YAAY,MAAM,SAAS,MAAM,CAAE,QAAO;;AAEtE,QAAO;;AAGT,SAAS,uBACP,MACA,QACA,OACqB;AACrB,KAAI,CAAC,KAAK,iBAAiB,OAAQ,QAAO,EAAE;CAC5C,MAAM,UAAU,IAAI,IAAI,MAAM,YAAY,EAAE,CAAC;CAC7C,MAAM,aAAa,KAAK,gBAAgB,QAAQ,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;AACxE,KAAI,WAAW,WAAW,EAAG,QAAO,EAAE;AACtC,QAAO,0BAA0B,QAAQ,WAAW;;AAGtD,SAAS,0BACP,QACA,KACqB;CACrB,MAAM,UAAU,OAAO,YAAY,EAAE;AACrC,QAAO,IAAI,KAAK,OAAO;AAErB,SADc,QAAQ,MAAM,YAAY,QAAQ,OAAO,GAAG,IAE/C;GACP;GACA,OAAO;GACP,SAAS;GACT,aAAa,YAAY,GAAG,gBAAgB,OAAO,KAAK;GACxD,UAAU;GACX;GAEH;;AAGJ,SAAS,iBACP,MACA,QACA,OACyC;AACzC,KAAI,CAAC,KAAK,UAAW,QAAO;CAC5B,MAAMC,aACJ,OAAO,KAAK,cAAc,YACrB,OAAO,cAAc,EAAE,EAAE,MAAM,SAAS,KAAK,OAAO,KAAK,UAAU,GACpE,KAAK;AAEX,KAAI,CAAC,WACH,OAAM,IAAI,MACR,6BAA6B,OAC3B,KAAK,UACN,CAAC,oBAAoB,OAAO,KAAK,OACnC;AAGH,QAAO;EACL,KAAK,WAAW;EAChB,KAAK,WAAW,OAAO,MAAM,SAAS;EACtC,eAAe,WAAW;EAC1B,OAAO,WAAW;EACnB;;AAGH,SAAS,kBACP,YACA,OACS;CACT,MAAM,UAAU,WAAW,MAAM;AACjC,KAAI,CAAC,QAAS,QAAO;CAErB,MAAM,UAAU;EACd,SAAS,MAAM;EACf,UAAU,MAAM;EAChB,SAAS,MAAM,WAAW,EAAE;EAC7B;AAED,KAAI;EASF,MAAM,SANK,IAAI,SACb,WACA,YACA,WACA,WAAW,oBAAoB,QAAQ,CAAC,IACzC,CACiB,QAAQ,SAAS,QAAQ,UAAU,QAAQ,QAAQ;AACrE,SAAO,QAAQ,OAAO;UACf,QAAQ;AACf,SAAO;;;AAIX,SAAS,oBAAoB,YAA4B;AACvD,QAAO,WAAW,QAAQ,OAAO,KAAK,CAAC,QAAQ,SAAS,KAAK;;AAG/D,SAAS,cAAc,UAA+C;AACpE,KAAI,SAAS,GAAI,QAAO,SAAS;CACjC,MAAM,YAAY,SAAS,YAAY;AACvC,KAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,KAAI,OAAO,cAAc,SAAU,QAAO,OAAO,UAAU"}

package/dist/policy/opa-adapter.d.ts

@@ -42,4 +42,5 @@ declare function buildOPAInput(context: DecisionContext, policies: PolicySpec[],
   }[];
 };
 //#endregion
-export { OPAAdapterOptions, OPAClient, OPAEvaluationResult, OPAPolicyAdapter, buildOPAInput };
+export { OPAAdapterOptions, OPAClient, OPAEvaluationResult, OPAPolicyAdapter, buildOPAInput };
+//# sourceMappingURL=opa-adapter.d.ts.map

package/dist/policy/opa-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-adapter.d.ts","names":[],"sources":["../../src/policy/opa-adapter.ts"],"sourcesContent":[],"mappings":";;;;;UAIiB,SAAA;qDACoC,QAAQ;AAD7D;AAIiB,UAAA,mBAAA,CAAmB;EAOnB,MAAA,CAAA,EAAA,OAAA,GAAA,MAAiB;EAWrB,MAAA,CAAA,EAAA,MAAA;EAA0B,cAAA,CAAA,EAfpB,cAeoB,CAAA,gBAAA,CAAA;EAEV,gBAAA,CAAA,EAAA,MAAA,EAAA;;AACC,UAdb,iBAca,CAAA,SAdc,mBAcd,GAAA,IAAA,CAAA,CAAA;EAIjB;;;EAGA,YAAA,EAAA,MAAA;EAAR;;AAqCL;EACW,SAAA,CAAA,EAAA,CAAA,KAAA,EAAA,OAAA,EAAA,GAnDuB,MAmDvB;;AAEO,cAlDL,gBAkDK,CAAA,SAlDqB,mBAkDrB,GAAA,IAAA,CAAA,CAAA;;;sBAhDW,oBACC,kBAAkB;oBAInC,2BACC,8BACM,iBACf,QAAQ;;iBAqCG,aAAA,UACL,2BACC,8BACM"}

package/dist/policy/opa-adapter.js

@@ -68,4 +68,5 @@ function resolveConsentAcrossPolicies(policies, id) {
 }
 
 //#endregion
-export { OPAPolicyAdapter, buildOPAInput };
+export { OPAPolicyAdapter, buildOPAInput };
+//# sourceMappingURL=opa-adapter.js.map

package/dist/policy/opa-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-adapter.js","names":["client: OPAClient","options: OPAAdapterOptions<Result>"],"sources":["../../src/policy/opa-adapter.ts"],"sourcesContent":["import type { PolicyDecision } from '../types';\nimport type { PolicySpec, ConsentDefinition } from './spec';\nimport type { DecisionContext } from './engine';\n\nexport interface OPAClient {\n  evaluate<T>(decisionPath: string, input: unknown): Promise<T>;\n}\n\nexport interface OPAEvaluationResult {\n  effect?: 'allow' | 'deny';\n  reason?: string;\n  fieldDecisions?: PolicyDecision['fieldDecisions'];\n  requiredConsents?: string[];\n}\n\nexport interface OPAAdapterOptions<Result = OPAEvaluationResult | null> {\n  /**\n   * Path fed to the OPA client (e.g., \"sigil/authz/allow\").\n   */\n  decisionPath: string;\n  /**\n   * Optional mapper when the OPA client returns a non-standard payload.\n   */\n  mapResult?: (value: unknown) => Result;\n}\n\nexport class OPAPolicyAdapter<Result = OPAEvaluationResult | null> {\n  constructor(\n    private readonly client: OPAClient,\n    private readonly options: OPAAdapterOptions<Result>\n  ) {}\n\n  async evaluate(\n    context: DecisionContext,\n    policies: PolicySpec[],\n    engineDecision: PolicyDecision\n  ): Promise<PolicyDecision> {\n    const input = buildOPAInput(context, policies, engineDecision);\n    const raw = await this.client.evaluate<unknown>(\n      this.options.decisionPath,\n      input\n    );\n    const resolved = this.options.mapResult\n      ? this.options.mapResult(raw)\n      : (raw as OPAEvaluationResult | null);\n\n    if (!resolved) {\n      return {\n        ...engineDecision,\n        evaluatedBy: engineDecision.evaluatedBy ?? 'engine',\n      };\n    }\n\n    const opaResult = resolved as OPAEvaluationResult;\n    const mergedRequiredConsents = mergeRequiredConsents(\n      policies,\n      engineDecision.requiredConsents ?? [],\n      opaResult.requiredConsents ?? []\n    );\n\n    return {\n      ...engineDecision,\n      effect: opaResult.effect ?? engineDecision.effect,\n      reason: opaResult.reason ?? engineDecision.reason,\n      fieldDecisions: opaResult.fieldDecisions ?? engineDecision.fieldDecisions,\n      requiredConsents: mergedRequiredConsents.length\n        ? mergedRequiredConsents\n        : undefined,\n      evaluatedBy: 'opa',\n    };\n  }\n}\n\nexport function buildOPAInput(\n  context: DecisionContext,\n  policies: PolicySpec[],\n  engineDecision: PolicyDecision\n) {\n  return {\n    context,\n    decision: engineDecision,\n    policies: policies.map((policy) => ({\n      meta: policy.meta,\n      rules: policy.rules,\n      fieldPolicies: policy.fieldPolicies,\n      pii: policy.pii,\n      relationships: policy.relationships,\n      consents: policy.consents,\n      rateLimits: policy.rateLimits,\n    })),\n  };\n}\n\nfunction mergeRequiredConsents(\n  policies: PolicySpec[],\n  existing: ConsentDefinition[],\n  incomingIds: string[]\n): ConsentDefinition[] {\n  if (incomingIds.length === 0) return existing;\n  const existingIds = new Set(existing.map((consent) => consent.id));\n  const merged = [...existing];\n\n  for (const id of incomingIds) {\n    if (existingIds.has(id)) continue;\n    const resolved = resolveConsentAcrossPolicies(policies, id);\n    if (resolved) {\n      merged.push(resolved);\n      existingIds.add(resolved.id);\n    }\n  }\n\n  return merged;\n}\n\nfunction resolveConsentAcrossPolicies(\n  policies: PolicySpec[],\n  id: string\n): ConsentDefinition | null {\n  for (const policy of policies) {\n    const match = policy.consents?.find((consent) => consent.id === id);\n    if (match) return match;\n  }\n\n  return {\n    id,\n    scope: 'unspecified',\n    purpose: 'unspecified',\n    description: `Consent \"${id}\" returned by OPA`,\n    required: true,\n  };\n}\n"],"mappings":";AA0BA,IAAa,mBAAb,MAAmE;CACjE,YACE,AAAiBA,QACjB,AAAiBC,SACjB;EAFiB;EACA;;CAGnB,MAAM,SACJ,SACA,UACA,gBACyB;EACzB,MAAM,QAAQ,cAAc,SAAS,UAAU,eAAe;EAC9D,MAAM,MAAM,MAAM,KAAK,OAAO,SAC5B,KAAK,QAAQ,cACb,MACD;EACD,MAAM,WAAW,KAAK,QAAQ,YAC1B,KAAK,QAAQ,UAAU,IAAI,GAC1B;AAEL,MAAI,CAAC,SACH,QAAO;GACL,GAAG;GACH,aAAa,eAAe,eAAe;GAC5C;EAGH,MAAM,YAAY;EAClB,MAAM,yBAAyB,sBAC7B,UACA,eAAe,oBAAoB,EAAE,EACrC,UAAU,oBAAoB,EAAE,CACjC;AAED,SAAO;GACL,GAAG;GACH,QAAQ,UAAU,UAAU,eAAe;GAC3C,QAAQ,UAAU,UAAU,eAAe;GAC3C,gBAAgB,UAAU,kBAAkB,eAAe;GAC3D,kBAAkB,uBAAuB,SACrC,yBACA;GACJ,aAAa;GACd;;;AAIL,SAAgB,cACd,SACA,UACA,gBACA;AACA,QAAO;EACL;EACA,UAAU;EACV,UAAU,SAAS,KAAK,YAAY;GAClC,MAAM,OAAO;GACb,OAAO,OAAO;GACd,eAAe,OAAO;GACtB,KAAK,OAAO;GACZ,eAAe,OAAO;GACtB,UAAU,OAAO;GACjB,YAAY,OAAO;GACpB,EAAE;EACJ;;AAGH,SAAS,sBACP,UACA,UACA,aACqB;AACrB,KAAI,YAAY,WAAW,EAAG,QAAO;CACrC,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,YAAY,QAAQ,GAAG,CAAC;CAClE,MAAM,SAAS,CAAC,GAAG,SAAS;AAE5B,MAAK,MAAM,MAAM,aAAa;AAC5B,MAAI,YAAY,IAAI,GAAG,CAAE;EACzB,MAAM,WAAW,6BAA6B,UAAU,GAAG;AAC3D,MAAI,UAAU;AACZ,UAAO,KAAK,SAAS;AACrB,eAAY,IAAI,SAAS,GAAG;;;AAIhC,QAAO;;AAGT,SAAS,6BACP,UACA,IAC0B;AAC1B,MAAK,MAAM,UAAU,UAAU;EAC7B,MAAM,QAAQ,OAAO,UAAU,MAAM,YAAY,QAAQ,OAAO,GAAG;AACnE,MAAI,MAAO,QAAO;;AAGpB,QAAO;EACL;EACA,OAAO;EACP,SAAS;EACT,aAAa,YAAY,GAAG;EAC5B,UAAU;EACX"}

package/dist/policy/spec.d.ts

@@ -111,4 +111,5 @@ declare class PolicyRegistry {
 }
 declare function makePolicyKey(ref: PolicyRef): string;
 //#endregion
-export { AttributeMatcher, ConsentDefinition, FieldPolicyRule, PIIPolicy, PolicyCondition, PolicyEffect, PolicyMeta, PolicyOPAConfig, PolicyRef, PolicyRegistry, PolicyRule, PolicySpec, RateLimitDefinition, RelationshipDefinition, RelationshipMatcher, ResourceMatcher, SubjectMatcher, makePolicyKey };
+export { AttributeMatcher, ConsentDefinition, FieldPolicyRule, PIIPolicy, PolicyCondition, PolicyEffect, PolicyMeta, PolicyOPAConfig, PolicyRef, PolicyRegistry, PolicyRule, PolicySpec, RateLimitDefinition, RelationshipDefinition, RelationshipMatcher, ResourceMatcher, SubjectMatcher, makePolicyKey };
+//# sourceMappingURL=spec.d.ts.map

package/dist/policy/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","names":[],"sources":["../../src/policy/spec.ts"],"sourcesContent":[],"mappings":";;;KAEY,YAAA;UAEK,sBAAA;EAFL,WAAA,EAAA,MAAY;EAEP,QAAA,EAAA,MAAA;EAQA,UAAA,EAAA,MAAA;EAMA,WAAA,CAAA,EAAA,MAAiB;EAcjB,UAAA,CAAA,EAAA,OAAA;AAQjB;AAOiB,UAnCA,mBAAA,CAmCmB;EASnB,QAAA,EAAA,MAAA;EAMA,UAAA,CAAA,EAAA,MAAc;EAKd,QAAA,CAAA,EAAA,MAAA;AAMjB;AAKiB,UA5DA,iBAAA,CA4DU;EACjB,EAAA,EAAA,MAAA;EAEE,KAAA,EAAA,MAAA;EACC,OAAA,EAAA,MAAA;EACK,WAAA,CAAA,EAAA,MAAA;EAGK,WAAA,CAAA,EAAA,SAAA,GAAA,UAAA,GAAA,kBAAA,GAAA,qBAAA;EAER,aAAA,CAAA,EAAA,MAAA;EAAe,QAAA,CAAA,EAAA,OAAA;AAI9B;AACU,UA7DO,mBAAA,CA6DP;EAGE,EAAA,EAAA,MAAA;EACC,GAAA,EAAA,MAAA;EACE,GAAA,CAAA,EAAA,MAAA;EAAe,aAAA,CAAA,EAAA,MAAA;EAIb,KAAA,CAAA,EAAA,MAAS;AAM1B;AACQ,UArES,eAAA,CAqET;EACC;EACS,OAAA,EAAA,MAAA;EACV;EACU,QAAA,CAAA,EAAA,MAAA;;AAEH,UApEE,UAAA,SAAmB,aAoErB,CAAA;EACP;EAAe,IAAA,EAAA,MAAA;EAGN;EAOJ,OAAA,EAAA,MAAA;EAGI;EAOP,KAAA,CAAA,EAAA,QAAA,GAAA,SAAA,GAAA,WAAA;;AAIuC,UApFhC,gBAAA,CAoFgC;EAejC,MAAA,CAAA,EAAA,OAAa;;;;UA7FZ,cAAA;;eAEF,eAAe;;UAGb,eAAA;;;eAGF,eAAe;;UAGb,eAAA;;;;UAKA,UAAA;UACP;;YAEE;aACC;kBACK;;;uBAGK;;eAER;;;UAIE,eAAA;UACP;;;YAGE;aACC;eACE;;;UAIE,SAAA;;;;;UAMA,UAAA;QACT;SACC;kBACS;QACV;kBACU;aACL;eACE;QACP;;UAGS,SAAA;;;;cAOJ,cAAA;;iBAGI;UAOP;uCAI6B;;iBAevB,aAAA,MAAmB"}

package/dist/policy/spec.js

@@ -30,4 +30,5 @@ function makePolicyKey(ref) {
 }
 
 //#endregion
-export { PolicyRegistry, makePolicyKey };
+export { PolicyRegistry, makePolicyKey };
+//# sourceMappingURL=spec.js.map

package/dist/policy/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","names":["candidate: PolicySpec | undefined"],"sources":["../../src/policy/spec.ts"],"sourcesContent":["import type { OwnerShipMeta } from '../ownership';\n\nexport type PolicyEffect = 'allow' | 'deny';\n\nexport interface RelationshipDefinition {\n  subjectType: string;\n  relation: string;\n  objectType: string;\n  description?: string;\n  transitive?: boolean;\n}\n\nexport interface RelationshipMatcher {\n  relation: string;\n  objectType?: string;\n  objectId?: string;\n}\n\nexport interface ConsentDefinition {\n  id: string;\n  scope: string;\n  purpose: string;\n  description?: string;\n  lawfulBasis?:\n    | 'consent'\n    | 'contract'\n    | 'legal_obligation'\n    | 'legitimate_interest';\n  expiresInDays?: number;\n  required?: boolean;\n}\n\nexport interface RateLimitDefinition {\n  id: string;\n  rpm: number;\n  key?: string;\n  windowSeconds?: number;\n  burst?: number;\n}\n\nexport interface PolicyOPAConfig {\n  /** Fully-qualified package, e.g. \"sigil.authz\" */\n  package: string;\n  /** Optional rule within package (defaults to \"allow\") */\n  decision?: string;\n}\n\nexport interface PolicyMeta extends OwnerShipMeta {\n  /** Fully-qualified policy name (e.g., \"sigil.core.default\"). */\n  name: string;\n  /** Version of the policy; bump on breaking changes. */\n  version: number;\n  /** Optional scope hint used for discovery. */\n  scope?: 'global' | 'feature' | 'operation';\n}\n\nexport interface AttributeMatcher {\n  equals?: unknown;\n  oneOf?: unknown[];\n  exists?: boolean;\n}\n\nexport interface SubjectMatcher {\n  roles?: string[];\n  attributes?: Record<string, AttributeMatcher>;\n}\n\nexport interface ResourceMatcher {\n  type: string;\n  fields?: string[];\n  attributes?: Record<string, AttributeMatcher>;\n}\n\nexport interface PolicyCondition {\n  /** Simple expression evaluated against { subject, resource, context }. */\n  expression: string;\n}\n\nexport interface PolicyRule {\n  effect: PolicyEffect;\n  actions: string[];\n  subject?: SubjectMatcher;\n  resource?: ResourceMatcher;\n  relationships?: RelationshipMatcher[];\n  requiresConsent?: string[];\n  flags?: string[];\n  rateLimit?: string | RateLimitDefinition;\n  escalate?: 'human_review' | null;\n  conditions?: PolicyCondition[];\n  reason?: string;\n}\n\nexport interface FieldPolicyRule {\n  effect: PolicyEffect;\n  field: string;\n  actions: ('read' | 'write')[];\n  subject?: SubjectMatcher;\n  resource?: ResourceMatcher;\n  conditions?: PolicyCondition[];\n  reason?: string;\n}\n\nexport interface PIIPolicy {\n  fields: string[];\n  consentRequired?: boolean;\n  retentionDays?: number;\n}\n\nexport interface PolicySpec {\n  meta: PolicyMeta;\n  rules: PolicyRule[];\n  fieldPolicies?: FieldPolicyRule[];\n  pii?: PIIPolicy;\n  relationships?: RelationshipDefinition[];\n  consents?: ConsentDefinition[];\n  rateLimits?: RateLimitDefinition[];\n  opa?: PolicyOPAConfig;\n}\n\nexport interface PolicyRef {\n  name: string;\n  version: number;\n}\n\nconst policyKey = (name: string, version: number) => `${name}.v${version}`;\n\nexport class PolicyRegistry {\n  private readonly items = new Map<string, PolicySpec>();\n\n  register(spec: PolicySpec): this {\n    const key = policyKey(spec.meta.name, spec.meta.version);\n    if (this.items.has(key)) throw new Error(`Duplicate policy ${key}`);\n    this.items.set(key, spec);\n    return this;\n  }\n\n  list(): PolicySpec[] {\n    return [...this.items.values()];\n  }\n\n  get(name: string, version?: number): PolicySpec | undefined {\n    if (version != null) return this.items.get(policyKey(name, version));\n    let candidate: PolicySpec | undefined;\n    let max = -Infinity;\n    for (const spec of this.items.values()) {\n      if (spec.meta.name !== name) continue;\n      if (spec.meta.version > max) {\n        max = spec.meta.version;\n        candidate = spec;\n      }\n    }\n    return candidate;\n  }\n}\n\nexport function makePolicyKey(ref: PolicyRef) {\n  return policyKey(ref.name, ref.version);\n}\n"],"mappings":";AA4HA,MAAM,aAAa,MAAc,YAAoB,GAAG,KAAK,IAAI;AAEjE,IAAa,iBAAb,MAA4B;CAC1B,AAAiB,wBAAQ,IAAI,KAAyB;CAEtD,SAAS,MAAwB;EAC/B,MAAM,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,KAAK,QAAQ;AACxD,MAAI,KAAK,MAAM,IAAI,IAAI,CAAE,OAAM,IAAI,MAAM,oBAAoB,MAAM;AACnE,OAAK,MAAM,IAAI,KAAK,KAAK;AACzB,SAAO;;CAGT,OAAqB;AACnB,SAAO,CAAC,GAAG,KAAK,MAAM,QAAQ,CAAC;;CAGjC,IAAI,MAAc,SAA0C;AAC1D,MAAI,WAAW,KAAM,QAAO,KAAK,MAAM,IAAI,UAAU,MAAM,QAAQ,CAAC;EACpE,IAAIA;EACJ,IAAI,MAAM;AACV,OAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,EAAE;AACtC,OAAI,KAAK,KAAK,SAAS,KAAM;AAC7B,OAAI,KAAK,KAAK,UAAU,KAAK;AAC3B,UAAM,KAAK,KAAK;AAChB,gBAAY;;;AAGhB,SAAO;;;AAIX,SAAgB,cAAc,KAAgB;AAC5C,QAAO,UAAU,IAAI,MAAM,IAAI,QAAQ"}

package/dist/presentations/docs/presentations-conventions.docblock.d.ts

@@ -3,4 +3,5 @@ import { DocBlock } from "@lssm/lib.contracts/docs";
 //#region src/presentations/docs/presentations-conventions.docblock.d.ts
 declare const tech_contracts_presentations_conventions_DocBlocks: DocBlock[];
 //#endregion
-export { tech_contracts_presentations_conventions_DocBlocks };
+export { tech_contracts_presentations_conventions_DocBlocks };
+//# sourceMappingURL=presentations-conventions.docblock.d.ts.map

package/dist/presentations/docs/presentations-conventions.docblock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentations-conventions.docblock.d.ts","names":[],"sources":["../../../src/presentations/docs/presentations-conventions.docblock.ts"],"sourcesContent":[],"mappings":";;;cAGa,oDAAoD"}

package/dist/presentations/docs/presentations-conventions.docblock.js

@@ -19,4 +19,5 @@ const tech_contracts_presentations_conventions_DocBlocks = [{
 registerDocBlocks(tech_contracts_presentations_conventions_DocBlocks);
 
 //#endregion
-export { tech_contracts_presentations_conventions_DocBlocks };
+export { tech_contracts_presentations_conventions_DocBlocks };
+//# sourceMappingURL=presentations-conventions.docblock.js.map

package/dist/presentations/docs/presentations-conventions.docblock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentations-conventions.docblock.js","names":["tech_contracts_presentations_conventions_DocBlocks: DocBlock[]"],"sources":["../../../src/presentations/docs/presentations-conventions.docblock.ts"],"sourcesContent":["import type { DocBlock } from '@lssm/lib.contracts/docs';\nimport { registerDocBlocks } from '../../registry';\n\nexport const tech_contracts_presentations_conventions_DocBlocks: DocBlock[] = [\n  {\n    id: 'docs.tech.contracts.presentations-conventions',\n    title: 'Presentations Conventions (A11y & i18n)',\n    summary:\n      '- Always provide `meta.description` (\\u2265 3 chars) \\u2014 used by a11y/docs/agents.',\n    kind: 'reference',\n    visibility: 'public',\n    route: '/docs/tech/contracts/presentations-conventions',\n    tags: ['tech', 'contracts', 'presentations-conventions'],\n    body: '## Presentations Conventions (A11y & i18n)\\n\\n- Always provide `meta.description` (\\u2265 3 chars) \\u2014 used by a11y/docs/agents.\\n- Prefer source = BlockNote for rich guides; use component key for interactive flows.\\n- i18n strings belong in host apps; descriptors carry keys/defaults only.\\n- Target selection: include only what you intend to support to avoid drift.\\n- PII: declare JSON-like paths under `policy.pii`; engine redacts in outputs.\\n',\n  },\n];\nregisterDocBlocks(tech_contracts_presentations_conventions_DocBlocks);\n"],"mappings":";;;;AAGA,MAAaA,qDAAiE,CAC5E;CACE,IAAI;CACJ,OAAO;CACP,SACE;CACF,MAAM;CACN,YAAY;CACZ,OAAO;CACP,MAAM;EAAC;EAAQ;EAAa;EAA4B;CACxD,MAAM;CACP,CACF;AACD,kBAAkB,mDAAmD"}

package/dist/presentations.backcompat.d.ts

@@ -4,4 +4,5 @@ import { PresentationSpec } from "./presentations.js";
 //#region src/presentations.backcompat.d.ts
 declare function toV2FromV1(v1: PresentationSpec): PresentationDescriptorV2;
 //#endregion
-export { toV2FromV1 };
+export { toV2FromV1 };
+//# sourceMappingURL=presentations.backcompat.d.ts.map

package/dist/presentations.backcompat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentations.backcompat.d.ts","names":[],"sources":["../src/presentations.backcompat.ts"],"sourcesContent":[],"mappings":";;;;iBAGgB,UAAA,KAAe,mBAAmB"}

package/dist/presentations.backcompat.js

@@ -44,4 +44,5 @@ function toV2FromV1(v1) {
 }
 
 //#endregion
-export { toV2FromV1 };
+export { toV2FromV1 };
+//# sourceMappingURL=presentations.backcompat.js.map

package/dist/presentations.backcompat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentations.backcompat.js","names":[],"sources":["../src/presentations.backcompat.ts"],"sourcesContent":["import type { PresentationSpec } from './presentations';\nimport type { PresentationDescriptorV2 } from './presentations.v2';\n\nexport function toV2FromV1(v1: PresentationSpec): PresentationDescriptorV2 {\n  if (v1.content.kind === 'web_component') {\n    return {\n      meta: { ...v1.meta },\n      policy: v1.policy,\n      source: {\n        type: 'component',\n        framework: v1.content.framework,\n        componentKey: v1.content.componentKey,\n        props: v1.content.props,\n      },\n      targets: ['react', 'application/json', 'application/xml'],\n    };\n  }\n  if (v1.content.kind === 'markdown') {\n    return {\n      meta: { ...v1.meta },\n      policy: v1.policy,\n      source: {\n        type: 'blocknotejs',\n        docJson: v1.content.content ?? v1.content.resourceUri ?? '',\n      },\n      targets: ['markdown', 'application/json', 'application/xml'],\n    };\n  }\n  return {\n    meta: { ...v1.meta },\n    policy: v1.policy,\n    source: {\n      type: 'blocknotejs',\n      docJson: { kind: 'data', mimeType: v1.content.mimeType, model: 'schema' },\n    },\n    targets: ['application/json', 'application/xml'],\n  };\n}\n"],"mappings":";AAGA,SAAgB,WAAW,IAAgD;AACzE,KAAI,GAAG,QAAQ,SAAS,gBACtB,QAAO;EACL,MAAM,EAAE,GAAG,GAAG,MAAM;EACpB,QAAQ,GAAG;EACX,QAAQ;GACN,MAAM;GACN,WAAW,GAAG,QAAQ;GACtB,cAAc,GAAG,QAAQ;GACzB,OAAO,GAAG,QAAQ;GACnB;EACD,SAAS;GAAC;GAAS;GAAoB;GAAkB;EAC1D;AAEH,KAAI,GAAG,QAAQ,SAAS,WACtB,QAAO;EACL,MAAM,EAAE,GAAG,GAAG,MAAM;EACpB,QAAQ,GAAG;EACX,QAAQ;GACN,MAAM;GACN,SAAS,GAAG,QAAQ,WAAW,GAAG,QAAQ,eAAe;GAC1D;EACD,SAAS;GAAC;GAAY;GAAoB;GAAkB;EAC7D;AAEH,QAAO;EACL,MAAM,EAAE,GAAG,GAAG,MAAM;EACpB,QAAQ,GAAG;EACX,QAAQ;GACN,MAAM;GACN,SAAS;IAAE,MAAM;IAAQ,UAAU,GAAG,QAAQ;IAAU,OAAO;IAAU;GAC1E;EACD,SAAS,CAAC,oBAAoB,kBAAkB;EACjD"}

package/dist/presentations.d.ts

@@ -1,6 +1,6 @@
 import { Stability } from "./ownership.js";
 import z from "zod";
-import * as _lssm_lib_schema7 from "@lssm/lib.schema";
+import * as _lssm_lib_schema35 from "@lssm/lib.schema";
 import { AnySchemaModel } from "@lssm/lib.schema";
 
 //#region src/presentations.d.ts
@@ -62,7 +62,7 @@ declare class PresentationRegistry {
 declare function jsonSchemaForPresentation(p: PresentationSpec): {
   framework: "react";
   componentKey: string;
-  props: z.core.ZodStandardJSONSchemaPayload<_lssm_lib_schema7.TopLevelZodFromModel<_lssm_lib_schema7.SchemaModelFieldsAnyConfig<AnySchemaModel | _lssm_lib_schema7.AnyFieldType | _lssm_lib_schema7.AnyEnumType>>>;
+  props: z.core.ZodStandardJSONSchemaPayload<_lssm_lib_schema35.TopLevelZodFromModel<_lssm_lib_schema35.SchemaModelFieldsAnyConfig<AnySchemaModel | _lssm_lib_schema35.AnyFieldType | _lssm_lib_schema35.AnyEnumType>>>;
   meta: {
     readonly name: string;
     readonly version: number;
@@ -84,7 +84,7 @@ declare function jsonSchemaForPresentation(p: PresentationSpec): {
   kind: PresentationKind;
 } | {
   mimeType: string;
-  model: z.core.ZodStandardJSONSchemaPayload<_lssm_lib_schema7.TopLevelZodFromModel<_lssm_lib_schema7.SchemaModelFieldsAnyConfig<AnySchemaModel | _lssm_lib_schema7.AnyFieldType | _lssm_lib_schema7.AnyEnumType>>>;
+  model: z.core.ZodStandardJSONSchemaPayload<_lssm_lib_schema35.TopLevelZodFromModel<_lssm_lib_schema35.SchemaModelFieldsAnyConfig<AnySchemaModel | _lssm_lib_schema35.AnyFieldType | _lssm_lib_schema35.AnyEnumType>>>;
   meta: {
     readonly name: string;
     readonly version: number;
@@ -95,4 +95,5 @@ declare function jsonSchemaForPresentation(p: PresentationSpec): {
   kind: PresentationKind;
 };
 //#endregion
-export { DataPresentation, MarkdownPresentation, PresentationContent, PresentationKind, PresentationMeta, PresentationPolicy, PresentationRegistry, PresentationSpec, WebComponentPresentation, jsonSchemaForPresentation };
+export { DataPresentation, MarkdownPresentation, PresentationContent, PresentationKind, PresentationMeta, PresentationPolicy, PresentationRegistry, PresentationSpec, WebComponentPresentation, jsonSchemaForPresentation };
+//# sourceMappingURL=presentations.d.ts.map

package/dist/presentations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentations.d.ts","names":[],"sources":["../src/presentations.ts"],"sourcesContent":[],"mappings":";;;;;;;KAKY,gBAAA;;AAAA,UAGK,gBAAA,CAHW;EAGX,IAAA,EAAA,MAAA;EAUA,OAAA,EAAA,MAAA;EAMA,SAAA,CAAA,EAbH,SAaG;EAWA,MAAA,CAAA,EAAA,MAAA,EAAA;EASA,IAAA,CAAA,EAAA,MAAA,EAAA;EAOL,WAAA,CAAA,EAAA,MAAA;;;AAGR,UApCa,kBAAA,CAoCb;EAAgB,KAAA,CAAA,EAAA,MAAA,EAAA;EAEH,GAAA,CAAA,EAAA,MAAA,EAAA;;;AAGN,UAnCM,wBAAA,CAmCN;EAAmB,IAAA,EAAA,eAAA;EAQjB,SAAA,EAAA,OAAA;EAGS;EAMR,YAAA,EAAA,MAAA;EAOJ;EAI6B,KAAA,EAzD9B,cAyD8B;EAAgB,SAAA,CAAA,EAAA,MAAA,EAAA;AAevD;;UAnEiB,oBAAA;;;;;;;;UASA,gBAAA;EAmEW,IAAA,EAAA,MAAA;;;SA/DnB;;KAGG,mBAAA,GACR,2BACA,uBACA;UAEa,gBAAA;QACT;EAsDoB,MAAA,CAAA,EArDjB,kBAqDiB;EAAgB,OAAA,EApDjC,mBAoDiC;;;cA5C/B,oBAAA;;sBAGS;cAMR;UAOJ;uCAI6B;;iBAevB,yBAAA,IAA6B;;;;;;;;;;;QASjB;;;;;;;;;;;QAAA;;;;;;;;;;;QAAA"}

package/dist/presentations.js

@@ -63,4 +63,5 @@ function jsonSchemaForPresentation(p) {
 }
 
 //#endregion
-export { PresentationRegistry, jsonSchemaForPresentation };
+export { PresentationRegistry, jsonSchemaForPresentation };
+//# sourceMappingURL=presentations.js.map

package/dist/presentations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentations.js","names":["candidate: PresentationSpec | undefined"],"sources":["../src/presentations.ts"],"sourcesContent":["import type { AnySchemaModel } from '@lssm/lib.schema';\nimport type { Stability } from './ownership';\nimport z from 'zod';\n\n/** V1 presentation kinds (back-compat). Prefer V2 descriptors for new work. */\nexport type PresentationKind = 'web_component' | 'markdown' | 'data';\n\n/** Minimal metadata for presentations (V1). */\nexport interface PresentationMeta {\n  name: string;\n  version: number;\n  stability?: Stability;\n  owners?: string[];\n  tags?: string[];\n  description?: string;\n}\n\n/** Policy for presentations (flags, pii). */\nexport interface PresentationPolicy {\n  flags?: string[];\n  pii?: string[];\n}\n\n/** Web component presentation (V1). */\nexport interface WebComponentPresentation {\n  kind: 'web_component';\n  framework: 'react'; // future: 'vue' | 'angular'\n  /** Symbolic key resolved by host via component map */\n  componentKey: string;\n  /** Props schema (validated at runtime) */\n  props: AnySchemaModel;\n  analytics?: string[];\n}\n\n/** Markdown presentation (V1). */\nexport interface MarkdownPresentation {\n  kind: 'markdown';\n  /** Inline markdown/MDX content */\n  content?: string;\n  /** Or a resolvable resource URI handled by ResourceRegistry */\n  resourceUri?: string;\n}\n\n/** Data presentation (V1): structured export description. */\nexport interface DataPresentation {\n  kind: 'data';\n  mimeType: string; // e.g., application/json, application/xml\n  /** Structured data schema */\n  model: AnySchemaModel;\n}\n\nexport type PresentationContent =\n  | WebComponentPresentation\n  | MarkdownPresentation\n  | DataPresentation;\n\nexport interface PresentationSpec {\n  meta: PresentationMeta;\n  policy?: PresentationPolicy;\n  content: PresentationContent;\n}\n\nfunction keyOf(p: PresentationSpec) {\n  return `${p.meta.name}.v${p.meta.version}`;\n}\n\n/** In-memory registry for V1 PresentationSpec. */\nexport class PresentationRegistry {\n  private items = new Map<string, PresentationSpec>();\n\n  constructor(items?: PresentationSpec[]) {\n    if (items) {\n      items.forEach((p) => this.register(p));\n    }\n  }\n\n  register(p: PresentationSpec): this {\n    const key = keyOf(p);\n    if (this.items.has(key)) throw new Error(`Duplicate presentation ${key}`);\n    this.items.set(key, p);\n    return this;\n  }\n\n  list(): PresentationSpec[] {\n    return [...this.items.values()];\n  }\n\n  get(name: string, version?: number): PresentationSpec | undefined {\n    if (version != null) return this.items.get(`${name}.v${version}`);\n    let candidate: PresentationSpec | undefined;\n    let max = -Infinity;\n    for (const [k, p] of this.items.entries()) {\n      if (!k.startsWith(`${name}.v`)) continue;\n      if (p.meta.version > max) {\n        max = p.meta.version;\n        candidate = p;\n      }\n    }\n    return candidate;\n  }\n}\n\nexport function jsonSchemaForPresentation(p: PresentationSpec) {\n  const base = {\n    meta: {\n      name: p.meta.name,\n      version: p.meta.version,\n      stability: p.meta.stability ?? 'stable',\n      tags: p.meta.tags ?? [],\n      description: p.meta.description ?? '',\n    },\n    kind: p.content.kind as PresentationKind,\n  } as const;\n\n  if (p.content.kind === 'web_component') {\n    return {\n      ...base,\n      framework: p.content.framework,\n      componentKey: p.content.componentKey,\n      props: z.toJSONSchema(p.content.props.getZod()),\n    };\n  }\n  if (p.content.kind === 'markdown') {\n    return {\n      ...base,\n      content: p.content.content,\n      resourceUri: p.content.resourceUri,\n    };\n  }\n  return {\n    ...base,\n    mimeType: p.content.mimeType,\n    model: z.toJSONSchema(p.content.model.getZod()),\n  };\n}\n"],"mappings":";;;AA8DA,SAAS,MAAM,GAAqB;AAClC,QAAO,GAAG,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK;;;AAInC,IAAa,uBAAb,MAAkC;CAChC,AAAQ,wBAAQ,IAAI,KAA+B;CAEnD,YAAY,OAA4B;AACtC,MAAI,MACF,OAAM,SAAS,MAAM,KAAK,SAAS,EAAE,CAAC;;CAI1C,SAAS,GAA2B;EAClC,MAAM,MAAM,MAAM,EAAE;AACpB,MAAI,KAAK,MAAM,IAAI,IAAI,CAAE,OAAM,IAAI,MAAM,0BAA0B,MAAM;AACzE,OAAK,MAAM,IAAI,KAAK,EAAE;AACtB,SAAO;;CAGT,OAA2B;AACzB,SAAO,CAAC,GAAG,KAAK,MAAM,QAAQ,CAAC;;CAGjC,IAAI,MAAc,SAAgD;AAChE,MAAI,WAAW,KAAM,QAAO,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,UAAU;EACjE,IAAIA;EACJ,IAAI,MAAM;AACV,OAAK,MAAM,CAAC,GAAG,MAAM,KAAK,MAAM,SAAS,EAAE;AACzC,OAAI,CAAC,EAAE,WAAW,GAAG,KAAK,IAAI,CAAE;AAChC,OAAI,EAAE,KAAK,UAAU,KAAK;AACxB,UAAM,EAAE,KAAK;AACb,gBAAY;;;AAGhB,SAAO;;;AAIX,SAAgB,0BAA0B,GAAqB;CAC7D,MAAM,OAAO;EACX,MAAM;GACJ,MAAM,EAAE,KAAK;GACb,SAAS,EAAE,KAAK;GAChB,WAAW,EAAE,KAAK,aAAa;GAC/B,MAAM,EAAE,KAAK,QAAQ,EAAE;GACvB,aAAa,EAAE,KAAK,eAAe;GACpC;EACD,MAAM,EAAE,QAAQ;EACjB;AAED,KAAI,EAAE,QAAQ,SAAS,gBACrB,QAAO;EACL,GAAG;EACH,WAAW,EAAE,QAAQ;EACrB,cAAc,EAAE,QAAQ;EACxB,OAAO,EAAE,aAAa,EAAE,QAAQ,MAAM,QAAQ,CAAC;EAChD;AAEH,KAAI,EAAE,QAAQ,SAAS,WACrB,QAAO;EACL,GAAG;EACH,SAAS,EAAE,QAAQ;EACnB,aAAa,EAAE,QAAQ;EACxB;AAEH,QAAO;EACL,GAAG;EACH,UAAU,EAAE,QAAQ;EACpB,OAAO,EAAE,aAAa,EAAE,QAAQ,MAAM,QAAQ,CAAC;EAChD"}