b2c-app-builder 0.221.39

package/catalog/artifacts.ts

@@ -0,0 +1,40 @@
+import { catalogId } from "./ids.js";
+import type { CatalogArtifact, CatalogWorkflowDef } from "./types.js";
+import { APP_SOURCE_FINGERPRINT_PATH } from "../kernel/engine/source-fingerprint.js";
+export { APP_SOURCE_FINGERPRINT_PATH } from "../kernel/engine/source-fingerprint.js";
+
+/**
+ * Artifacts are derived from workflow outputPaths, not hand-authored — one entry per
+ * distinct output path across the catalog. Ported in spirit from
+ * runtime/graph/graph.ts's artifact-merging loop, but simpler: v1 also discovered
+ * artifacts from `examples/workspace/business/state/business-state.json` lane evidence (a second,
+ * looser source of artifact identity that tolerated the same path being claimed by more
+ * than one workflow — see catalog/workflows/*.ts headers for the collisions that produced
+ * in this rebuild). v2 has one derived source for produced artifacts: each output path has
+ * exactly one producing workflow. The sole explicit exception is the session-observed app
+ * source fingerprint. It is an external graph input so source edits can stale consumers before
+ * the frontier is computed.
+ */
+export function buildArtifacts(workflows: readonly CatalogWorkflowDef[]): CatalogArtifact[] {
+  const artifacts: CatalogArtifact[] = [
+    {
+      id: catalogId("artifact", APP_SOURCE_FINGERPRINT_PATH),
+      path: APP_SOURCE_FINGERPRINT_PATH,
+      ownerDomainId: "domain.engineering",
+      laneIds: ["engineering"],
+      generated: true,
+    },
+  ];
+  for (const wf of workflows) {
+    for (const outputPath of wf.outputPaths) {
+      artifacts.push({
+        id: catalogId("artifact", outputPath),
+        path: outputPath,
+        ownerDomainId: wf.domainId,
+        laneIds: wf.laneIds,
+        generated: outputPath.endsWith(".html") || outputPath.startsWith("design/system/") || outputPath.includes("generated"),
+      });
+    }
+  }
+  return artifacts.sort((a, b) => a.path.localeCompare(b.path));
+}

package/catalog/authoring.ts

@@ -0,0 +1,46 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { summarizeProviderContract } from "../adapters/providers/contract.js";
+import { loadProviderContracts } from "../adapters/providers/load.js";
+import { areas } from "./areas.js";
+import { buildArtifacts } from "./artifacts.js";
+import { contextPacks } from "./context-packs.js";
+import { domains } from "./domains.js";
+import { discoverGates } from "./gates.js";
+import { lanes } from "./lanes.js";
+import { withComposition, catalogCounts } from "./packs/compose.js";
+import { phases } from "./phases.js";
+import { loadKnowledgePackages, resolveKnowledgeGraph } from "./knowledge-packages.js";
+import { roles } from "./roles.js";
+import type { Catalog } from "./types.js";
+import { workflows } from "./workflows/index.js";
+import { profiles } from "./profiles.js";
+import { repositoryProfiles } from "./repository-profiles/registry.js";
+
+export function readSkillVersion(skillRoot: string): string {
+  const parsed = JSON.parse(readFileSync(path.join(skillRoot, "skill-version.json"), "utf8")) as { version?: string };
+  return parsed.version ?? "0.0.0";
+}
+
+export function composeAuthoredCatalog(skillRoot: string): Catalog {
+  const knowledge = resolveKnowledgeGraph(loadKnowledgePackages(skillRoot), workflows, contextPacks);
+  const catalog: Catalog = {
+    schemaVersion: "2.0.0",
+    skillVersion: readSkillVersion(skillRoot),
+    areas: [...areas],
+    domains: [...domains].sort((a, b) => a.order - b.order),
+    phases: [...phases].sort((a, b) => a.order - b.order),
+    lanes: [...lanes],
+    roles: [...roles],
+    contextPacks: knowledge.contextPacks,
+    references: knowledge.references,
+    workflows: knowledge.workflows,
+    artifacts: buildArtifacts(knowledge.workflows),
+    gates: discoverGates(skillRoot, domains),
+    profiles: [...profiles],
+    repositoryProfiles: [...repositoryProfiles],
+    providerContracts: loadProviderContracts(skillRoot).contracts.map(summarizeProviderContract),
+  };
+  const counts = catalogCounts(catalog);
+  return withComposition(catalog, [], counts, {});
+}

package/catalog/bridge.ts

@@ -0,0 +1,220 @@
+import { readStoredSnapshot } from "../kernel/composition/resources.js";
+import { bindCatalogOperations } from "../kernel/composition/compile-bindings.js";
+import type { RecipeBindingResult } from "../kernel/composition/resolve.js";
+import type { CatalogArtifact as CompileArtifact, CatalogInput, CatalogWorkflowId, CatalogWorkflowNode, NodeReference } from "../kernel/engine/compile.js";
+import type { DomainId } from "../kernel/schema/types.js";
+import { APP_SOURCE_FINGERPRINT_PATH } from "./artifacts.js";
+import { resolveCatalogAuthority, resolveDomainAuthority } from "./domain-authority.js";
+import type { Catalog, CatalogDomainId, CatalogWorkflowDef } from "./types.js";
+
+function classifyDomain(catalog: Catalog, domainId: CatalogDomainId): "runtime" | "machine" | "unknown" {
+  const domain = catalog.domains.find((entry) => entry.id === domainId);
+  if (!domain) return "unknown";
+  const authority = resolveDomainAuthority(domain);
+  if (authority.machine) return "machine";
+  if (authority.grantable || authority.system) return "runtime";
+  return "unknown";
+}
+
+function isRuntimeDomain(domainId: CatalogDomainId, catalog: Catalog): domainId is DomainId {
+  return classifyDomain(catalog, domainId) === "runtime";
+}
+
+function referenceFreshness(reference: Catalog["references"][number]): string {
+  if (reference.sources.length === 0) return "internal";
+  const newestReview = [...reference.sources]
+    .map((source) => source.lastReviewDate)
+    .sort()
+    .at(-1);
+  // The executable plan must be stable for identical source bytes. The separate knowledge
+  // freshness validator evaluates review cadence against the source-freshness snapshot date
+  // and fails when stale.
+  return `reviewed ${newestReview}`;
+}
+
+/**
+ * The earliest date any source is due for re-review — lastReviewDate + reviewCadenceDays,
+ * minimum across sources. Pure source-byte arithmetic (no current date), so the compiled plan
+ * stays stable; read-time projections compare this against their own clock.
+ */
+function referenceReviewDueBy(reference: Catalog["references"][number]): string | undefined {
+  if (reference.sources.length === 0) return undefined;
+  const dueDates = reference.sources.flatMap((source) => {
+    const reviewed = new Date(`${source.lastReviewDate}T00:00:00.000Z`);
+    reviewed.setUTCDate(reviewed.getUTCDate() + source.reviewCadenceDays);
+    // A malformed date or absurd cadence must degrade to "no verdict", never crash the bridge;
+    // knowledge-validation.ts's stale gate is where bad source data gets reported.
+    return Number.isNaN(reviewed.valueOf()) ? [] : [reviewed.toISOString().slice(0, 10)];
+  });
+  return dueDates.sort()[0];
+}
+
+function toNodeReference(reference: Catalog["references"][number]): NodeReference {
+  const reviewDueBy = referenceReviewDueBy(reference);
+  return {
+    id: reference.id,
+    path: reference.path,
+    ...(reference.resource ? { resource: reference.resource } : {}),
+    title: reference.title,
+    loadWhen: reference.loadWhen,
+    freshness: referenceFreshness(reference),
+    ...(reviewDueBy ? { reviewDueBy } : {}),
+    ...(reference.sectionId ? { sectionId: reference.sectionId } : {}),
+    ...(reference.revision ? { revision: reference.revision } : {}),
+  };
+}
+
+/**
+ * The v2 catalog -> kernel/engine/compile.ts CatalogInput bridge (U8; U2 built compile.ts
+ * against a small fixture catalog and left this real bridge for U8 to deliver).
+ *
+ * Process and orchestration workflows are runtime-owned and never founder-grantable, but they
+ * remain executable prerequisites. The autonomy evaluator admits only their internal work and
+ * fails closed if a system node declares protected, costed, or external mutation authority.
+ * Machine-domain workflows remain maintainer-only and are the sole workflows filtered here.
+ */
+export function toCatalogInput(catalog: Catalog, resolvedBindings?: RecipeBindingResult): CatalogInput {
+  const unknown = catalog.workflows.filter((workflow) => classifyDomain(catalog, workflow.domainId) === "unknown");
+  if (unknown.length > 0) {
+    const detail = unknown.map((workflow) => `${workflow.id} (${workflow.domainId})`).join(", ");
+    throw new Error(`catalog.bridge.unknown_domain: ${detail} is not a runtime or machine domain; failing closed rather than dropping it.`);
+  }
+  const runtimeWorkflows = catalog.workflows.filter((wf): wf is CatalogWorkflowDef & { domainId: DomainId } => isRuntimeDomain(wf.domainId, catalog));
+  const runtimeIds = new Set<CatalogWorkflowId>(runtimeWorkflows.map((wf) => wf.id as CatalogWorkflowId));
+  const runtimeOutputPaths = new Set<string>(runtimeWorkflows.flatMap((wf) => wf.outputPaths));
+  const referencesById = new Map(catalog.references.map((reference) => [reference.id, reference]));
+  const rolesById = new Map(catalog.roles.map((role) => [role.id, role]));
+  const contextPacksById = new Map(catalog.contextPacks.map((pack) => [pack.id, pack]));
+
+  // Reuse catalog.artifacts (built once, by catalog/artifacts.ts's buildArtifacts(), from every
+  // workflow's outputPaths) rather than recomputing artifact ids independently here — two
+  // derivations of the same id from the same input have already diverged once in this repo's
+  // history (see catalog/artifacts.ts's own header on why there is now a single source).
+  const artifacts: CompileArtifact[] = catalog.artifacts
+    .filter((artifact) => runtimeOutputPaths.has(artifact.path) || artifact.path === APP_SOURCE_FINGERPRINT_PATH)
+    .map((artifact) => ({ id: artifact.id as CompileArtifact["id"], path: artifact.path }));
+
+  const workflows: CatalogWorkflowNode[] = runtimeWorkflows.map((wf) => ({
+    id: wf.id as CatalogWorkflowId,
+    title: wf.title,
+    domainId: wf.domainId,
+    actionClass: wf.actionClass,
+    protectedCategory: wf.protectedCategory,
+    // The full authored node contract crosses the bridge (the 2026-08 contract audit found this
+    // map dropped trigger and carried no instructions/knowledge at all, leaving a dispatched
+    // worker a bare title). References resolve to path+loadWhen here so the engine never needs
+    // the catalog module to compose a worker brief.
+    trigger: wf.trigger,
+    instructions: wf.instructions,
+    reads: wf.reads,
+    sourceAccess: wf.sourceAccess,
+    sharedResources: wf.sharedResources,
+    consults: wf.consults,
+    references: wf.referenceIds.map((referenceId) => {
+      const reference = referencesById.get(referenceId);
+      if (!reference) throw new Error(`${wf.id} binds unknown reference ${referenceId}`);
+      return toNodeReference(reference);
+    }),
+    role: (() => {
+      const role = rolesById.get(wf.roleId);
+      if (!role) throw new Error(`${wf.id} names unknown role ${wf.roleId}`);
+      return {
+        id: role.id,
+        name: role.name,
+        promptPath: role.promptPath,
+        parentPromptPaths: role.parentPromptPaths,
+        ...(role.promptResources ? { promptResources: role.promptResources } : {}),
+        contextPacks: role.contextPackIds.map((packId) => {
+          const pack = contextPacksById.get(packId);
+          if (!pack) throw new Error(`${role.id} names unknown context pack ${packId}`);
+          return {
+            id: pack.id,
+            title: pack.title,
+            references: pack.referenceIds.map((referenceId) => {
+              const reference = referencesById.get(referenceId);
+              if (!reference) throw new Error(`${pack.id} binds unknown reference ${referenceId}`);
+              return toNodeReference(reference);
+            }),
+          };
+        }),
+        skillRoutes: role.skillRoutes,
+        toolRoutes: role.toolRoutes,
+        ...(role.reviewedBy?.length ? { reviewedBy: [...role.reviewedBy] } : {}),
+      };
+    })(),
+    ...(wf.reviewOf?.length
+      ? { reviewOf: wf.reviewOf.filter((targetId): targetId is CatalogWorkflowId => runtimeIds.has(targetId as CatalogWorkflowId)) }
+      : {}),
+    dependencies: wf.dependencies.filter((dependencyId): dependencyId is CatalogWorkflowId => runtimeIds.has(dependencyId as CatalogWorkflowId)),
+    refreshDependencies: (wf.refreshDependencies ?? []).filter((entry) => runtimeIds.has(entry.workflowId as CatalogWorkflowId)),
+    outputPaths: wf.outputPaths,
+    providerIds: wf.providerIds,
+    laneIds: wf.laneIds,
+    founderOnlyActions: wf.founderOnlyActions,
+    gateCommands: wf.gateCommands,
+    idempotent: wf.idempotent,
+    recurrenceDays: wf.recurrenceDays,
+    maxAttempts: wf.maxAttempts,
+    maxConsecutiveNoProgressAttempts: wf.maxConsecutiveNoProgressAttempts,
+    ttlSeconds: wf.ttlSeconds,
+    tokenBudget: wf.tokenBudget,
+    costEstimate: wf.costEstimate,
+    phaseIds: wf.phaseIds,
+    groupId: wf.groupId,
+    applicability: wf.applicability,
+  }));
+
+  const input: CatalogInput = {
+    version: `${catalog.schemaVersion}+${catalog.skillVersion}`,
+    artifacts,
+    workflows,
+    profiles: catalog.profiles.map(({ id, defersLaneKeys }) => ({ id, defersLaneKeys: [...defersLaneKeys] })),
+    authority: resolveCatalogAuthority(catalog.domains),
+  };
+  return resolvedBindings ? bindCatalogOperations(input, resolvedBindings) : input;
+}
+
+/** Workflows present in the full catalog but excluded from toCatalogInput() — for reporting/diagnostics, not dispatch. */
+export function nonGrantableWorkflowIds(catalog: Catalog): string[] {
+  return catalog.workflows.filter((wf) => classifyDomain(catalog, wf.domainId) !== "runtime").map((wf) => wf.id);
+}
+
+/** Select one pinned recipe and its dependency closure through the existing catalog bridge. */
+export function toRecipeCatalogInput(catalog: Catalog, resolved: RecipeBindingResult): CatalogInput {
+  if (resolved.status !== "resolved") throw new Error("binding.composition_refused");
+  const selection = resolved.bindings[0]?.recipeSelection;
+  if (!selection) throw new Error("binding.recipe_selection_missing");
+  if (resolved.bindings.some((binding) => binding.recipeSelection.id !== selection.id || binding.recipeSelection.packageDigest !== selection.packageDigest))
+    throw new Error("binding.mixed_recipe_selection");
+  const snapshot = readStoredSnapshot(selection.packageDirectory, selection.packageDigest);
+  const recipe = snapshot.extension.recipes.find((entry) => entry.id === selection.id);
+  if (!recipe) throw new Error("binding.recipe_selection_missing");
+  const ids = new Set<string>();
+  const visiting = new Set<string>();
+  const byId = new Map(catalog.workflows.map((workflow) => [workflow.id as string, workflow]));
+  const producers = new Map(catalog.workflows.flatMap((workflow) => workflow.outputPaths.map((output) => [output, workflow.id] as const)));
+  const visit = (id: string) => {
+    if (visiting.has(id)) throw new Error(`binding.recipe_dependency_cycle:${id}`);
+    if (ids.has(id)) return;
+    const workflow = byId.get(id);
+    if (!workflow) throw new Error(`binding.recipe_workflow_missing:${id}`);
+    visiting.add(id);
+    for (const dependency of [
+      ...workflow.dependencies,
+      ...(workflow.reviewOf ?? []),
+      ...(workflow.refreshDependencies ?? []).map((entry) => entry.workflowId),
+      ...workflow.reads.flatMap((relative) => {
+        const producer = producers.get(relative);
+        return producer && producer !== id ? [producer] : [];
+      }),
+    ])
+      visit(dependency);
+    visiting.delete(id);
+    ids.add(id);
+  };
+  recipe.workflows.forEach(visit);
+  const projected = toCatalogInput({ ...catalog, workflows: catalog.workflows.filter((workflow) => ids.has(workflow.id)) }, resolved);
+  for (const workflow of projected.workflows)
+    if (workflow.providerIds.length && !workflow.selectedOperation) throw new Error(`binding.recipe_provider_unbound:${workflow.id}`);
+  return projected;
+}

package/catalog/business-primitives.ts

@@ -0,0 +1,82 @@
+import type { Binding, Entity } from "../contracts/public-api/contract.js";
+import type { PackageDependency } from "../kernel/composition/resources.js";
+import { resolveSkillRoot } from "../tooling/lib/skill-root.js";
+import { readFirstpartyPackage } from "./packs/installed-firstparty.js";
+export { MOBILE_OPERATION_IDS as MOBILE_OPERATIONS } from "../contracts/mobile-operation.js";
+const root = resolveSkillRoot(import.meta.url);
+const unique = <T>(values: T[]): T[] => [...new Map(values.map((value) => [JSON.stringify(value), value])).values()];
+
+/** Public declarations are projections of the same verified package used by composition. */
+export function projectPublicDeclarations(pack: PackageDependency): { entities: Entity[]; defaults: Record<string, Record<string, Binding>> } {
+  const extension = pack.snapshot.extension,
+    entities: Entity[] = [],
+    defaults: Record<string, Record<string, Binding>> = {};
+  const providers = (extension.providers ?? []).map((provider) => {
+    const implementations = extension.implementations.filter((implementation) => implementation.provider === provider.id);
+    return {
+      kind: "provider" as const,
+      id: provider.id,
+      version: provider.version,
+      title: provider.title,
+      description: provider.description,
+      operations: unique(implementations.map((entry) => entry.operation)),
+      targets: unique(implementations.flatMap((entry) => entry.targets)),
+      execution: "unavailable" as const,
+    };
+  });
+  const recipes = extension.recipes.map((recipe) => {
+    const bindings: Record<string, Binding> = {};
+    for (const operation of recipe.operations) {
+      const implementations = extension.implementations.filter((entry) => entry.id === operation.implementation);
+      if (implementations.length !== 1) throw new Error("composition.recipe_default_missing_or_ambiguous");
+      const provider = providers.find((entry) => entry.id === implementations[0]!.provider);
+      if (!provider) throw new Error("composition.recipe_default_provider_missing");
+      bindings[operation.operation] = { provider: { id: provider.id, version: provider.version } };
+    }
+    defaults[`${recipe.id}@${recipe.version}`] = bindings;
+    return {
+      kind: "recipe" as const,
+      id: recipe.id,
+      version: recipe.version,
+      title: recipe.title,
+      description: recipe.description ?? recipe.title,
+      operations: recipe.operations.map((entry) => entry.operation),
+      targets:
+        recipe.targets ??
+        unique(
+          extension.implementations
+            .filter((entry) => recipe.operations.some((operation) => operation.implementation === entry.id))
+            .flatMap((entry) => entry.targets),
+        ),
+      execution: "unavailable" as const,
+    };
+  });
+  const add = (entity: Entity) => {
+    if (!entities.some((existing) => existing.kind === entity.kind && existing.id === entity.id)) entities.push(entity);
+  };
+  for (const capability of extension.capabilities) {
+    const operations = capability.operations.map((entry) => entry.id);
+    add({
+      kind: "capability",
+      id: capability.id,
+      version: capability.version,
+      title: capability.title,
+      description: capability.description ?? capability.title,
+      operations,
+      targets:
+        capability.targets ?? unique(extension.implementations.filter((entry) => operations.includes(entry.operation)).flatMap((entry) => entry.targets)),
+      execution: "unavailable",
+    });
+    for (const provider of providers.filter((entry) => entry.operations.some((operation) => operations.includes(operation)))) add(provider);
+    for (const recipe of recipes.filter((entry) => entry.operations.some((operation) => operations.includes(operation)))) add(recipe);
+  }
+  for (const provider of providers) add(provider);
+  for (const recipe of recipes) add(recipe);
+  return { entities, defaults };
+}
+export function installedPublicDeclarations() {
+  return projectPublicDeclarations(readFirstpartyPackage(root));
+}
+export function installedPublicPackage() {
+  return readFirstpartyPackage(root);
+}

package/catalog/business-units.ts

@@ -0,0 +1,18 @@
+import { businessUnitDomains, grantableDomainIds, type BaseGrantableDomainId, type BusinessUnit } from "../kernel/schema/types.js";
+
+/**
+ * Business-unit copy mapping (KTD3). Single source: kernel/schema/types.ts's
+ * businessUnitDomains is the one place this many-to-one grouping is defined — catalog/
+ * derives the reverse lookup from it rather than maintaining a second copy that could
+ * silently diverge (see the duplicated-helpers-have-already-diverged lesson).
+ */
+
+/** Reverse of businessUnitDomains: every base grantable domain maps to exactly one business unit. */
+export const domainBusinessUnit: Record<BaseGrantableDomainId, BusinessUnit> = Object.fromEntries(
+  Object.entries(businessUnitDomains).flatMap(([unit, domainIds]) => domainIds.map((domainId) => [domainId, unit as BusinessUnit])),
+) as Record<BaseGrantableDomainId, BusinessUnit>;
+
+/** Every base grantable domain must appear in exactly one business unit — checked by catalog/validate.ts against the live schema export, not re-asserted as a separate literal. */
+export function businessUnitCoversAllGrantableDomains(): boolean {
+  return grantableDomainIds.every((domainId) => domainId in domainBusinessUnit);
+}

package/catalog/capabilities/paid-generative-ai/capability.yaml

@@ -0,0 +1,27 @@
+id: capability.paid-generative-ai
+title: Paid generative-AI controls
+applicability: An app capability that can create model-provider spend.
+required_facts:
+  - fact.paid-generation-entry
+authority:
+  - Operating agreement must authorize paid model-provider spend.
+readiness:
+  - The control record must name server-side auth, reservation, kill switch, and cap status.
+inputs:
+  - product
+  - spend-boundary
+outputs:
+  - A machine-readable paid-AI control record
+  - An incident runbook in the same file
+effects:
+  - Blocks paid generation until the control record exists
+evidence:
+  - trust/AI_PROVIDER_CONTROLS.md
+expected_outcome: Paid generation cannot create provider spend without the compiled control pack.
+context_selectors:
+  - knowledge.paid-generative-ai.controls
+exclusions:
+  - physical product inventory
+  - farm lot records
+extension_slots:
+  - cost-boundary

package/catalog/capabilities/paid-generative-ai/controls.md

@@ -0,0 +1,37 @@
+# Paid generative-AI control pack
+
+This pack travels with any app capability that can create model-provider spend.
+
+Safety content rules stay in `knowledge/trust/generative-ai-safety.md`.
+This pack compiles the cost-boundary contract those safety rules do not carry.
+
+## Control record
+
+Write `trust/AI_PROVIDER_CONTROLS.md` before paid generation can run.
+
+The file must include:
+
+- Server-side authentication before the first paid call
+- Server-side entitlement for paid or recurring behavior
+- Per-owner throttles and global daily and monthly ceilings
+- Atomic or compensating pre-call reservations
+- Conservative accounting for timeout, refusal, and invalid output
+- A fail-closed kill switch that keeps free and manual behavior
+- One backend secret runtime
+- Separate application cap status and provider-account cap status
+
+`check:ai-provider-controls` enforces the record. This pack does not weaken that gate.
+
+## Incident runbook
+
+Keep the incident runbook in the same control file. Record:
+
+- Who can engage the kill switch
+- How to rotate the backend secret
+- How to read application caps and provider-account caps as separate fields
+- How to restore free or manual behavior while paid generation stays closed
+
+## Composition
+
+Pack composition fails when a pack that creates provider spend is present without `capability.paid-generative-ai`.
+A workspace with an active paid-generation capability also fails `check:repository-profile` when this pack is not pinned.

package/catalog/capabilities/types.ts

@@ -0,0 +1,25 @@
+/**
+ * Reusable capability definitions. Distinct from `context.*` role knowledge bundles (KTD3, R26).
+ */
+export type CapabilityId = `capability.${string}`;
+
+export interface CapabilityDefinition {
+  id: CapabilityId;
+  title: string;
+  applicability: string;
+  requiredFacts: string[];
+  authority: string[];
+  readiness: string[];
+  inputs: string[];
+  outputs: string[];
+  effects: string[];
+  evidence: string[];
+  expectedOutcome: string;
+  contextSelectors: string[];
+  exclusions: string[];
+  extensionSlots: string[];
+}
+
+export function isCapabilityId(value: string): value is CapabilityId {
+  return /^capability\.[a-z][a-z0-9-]*$/.test(value);
+}

package/catalog/capabilities/web-presence/capability.yaml

@@ -0,0 +1,37 @@
+id: capability.web-presence
+title: Web presence
+applicability: A business that needs a current public site.
+required_facts:
+  - fact.public-site-url
+authority:
+  - Operating agreement must authorize public messaging.
+readiness:
+  - The public site must have a named owner.
+inputs:
+  - offer
+  - channel
+outputs:
+  - A current public-site record
+effects:
+  - Updates the public offer surface
+evidence:
+  - Live public URL
+  - Named measurement source
+expected_outcome: The business can present one current public offer.
+context_selectors:
+  - knowledge.web-presence.shared
+exclusions:
+  - sku-owned inventory
+  - retailer listing copy
+  - manufacturing lot records
+  - food-regulatory filings
+  - app-store-signing packets
+  - store-console packets
+  - subscription-policy documents
+extension_slots:
+  - offer
+  - channel
+  - conversion
+  - legal
+  - measurement
+  - distribution

package/catalog/capabilities/web-presence/shared.md

@@ -0,0 +1,5 @@
+# Web presence
+
+This capability covers a public site.
+Bind offer, channel, conversion, legal, measurement, and distribution in the business pack.
+Do not put a business-specific policy in this shared file.

package/catalog/context-packs.ts

@@ -0,0 +1,78 @@
+import type { CatalogContextPack } from "./types.js";
+
+/**
+ * Executable role-level routing packs. A pack is deliberately a shallow list of catalog
+ * references, not another prose index: the bridge resolves every id to path + loadWhen and the
+ * worker prompt exposes those conditions beside the task's mandatory references. This keeps the
+ * nesting useful without preloading an entire domain into every specialist context.
+ */
+export const contextPacks: readonly Omit<CatalogContextPack, "referenceIds">[] = [
+  {
+    id: "context.founder-language",
+    title: "Always-on founder language",
+  },
+  {
+    id: "context.process",
+    title: "Launch process",
+  },
+  {
+    id: "context.orchestration",
+    title: "Orchestration",
+  },
+  {
+    id: "context.operations",
+    title: "Founder-zero operations",
+  },
+  {
+    id: "context.research",
+    title: "Research",
+  },
+  { id: "context.product", title: "Product" },
+  {
+    id: "context.archetypes",
+    title: "Matched product archetype",
+  },
+  {
+    id: "context.experience",
+    title: "Experience",
+  },
+  {
+    id: "context.design",
+    title: "Design",
+  },
+  {
+    id: "context.experience-cards",
+    title: "Implemented emotional experience cards",
+  },
+  { id: "context.words", title: "Words" },
+  {
+    id: "context.engineering",
+    title: "Engineering",
+  },
+  {
+    id: "context.device",
+    title: "Device and accessibility proof",
+  },
+  {
+    id: "context.store",
+    title: "Stores",
+  },
+  {
+    id: "context.growth",
+    title: "Growth",
+  },
+  {
+    id: "context.launch-surfaces",
+    title: "Cross-surface launch production",
+  },
+  { id: "context.data", title: "Analytics" },
+  {
+    id: "context.money",
+    title: "Revenue",
+  },
+  { id: "context.trust", title: "Trust" },
+  {
+    id: "context.machine",
+    title: "Skill maintenance",
+  },
+];

package/catalog/domain-authority.ts

@@ -0,0 +1,38 @@
+import { findDomainAuthority, type DomainAuthorityRecord } from "../kernel/schema/domain-authority.js";
+import { businessUnitDomains, grantableDomainIds, type BaseGrantableDomainId, type BusinessUnit } from "../kernel/schema/types.js";
+import { machineCatalogDomainId, systemCatalogDomainIds, type CatalogDomain } from "./types.js";
+
+const operatorGroupByDomain: Record<BaseGrantableDomainId, BusinessUnit> = Object.fromEntries(
+  Object.entries(businessUnitDomains).flatMap(([unit, domainIds]) => domainIds.map((domainId) => [domainId, unit as BusinessUnit])),
+) as Record<BaseGrantableDomainId, BusinessUnit>;
+
+/**
+ * Resolve catalog-owned domain authority (KTD4). Explicit flags win. Base-catalog ids that omit
+ * flags keep their kernel defaults so existing domain records stay compatible. A pack-added
+ * domain without grantable or system is not grantable and is not a runtime domain.
+ */
+export function resolveDomainAuthority(domain: CatalogDomain): DomainAuthorityRecord {
+  const machine = domain.machine === true || (domain.machine !== false && domain.id === machineCatalogDomainId);
+  const system = domain.system === true || (domain.system !== false && (systemCatalogDomainIds as readonly string[]).includes(domain.id));
+  const baseGrantable = (grantableDomainIds as readonly string[]).includes(domain.id);
+  const grantable = machine || system ? false : domain.grantable === true || (domain.grantable !== false && baseGrantable);
+  const operatorGroup = domain.operatorGroup ?? (grantable ? operatorGroupByDomain[domain.id as BaseGrantableDomainId] : undefined);
+  return {
+    id: domain.id,
+    grantable,
+    system,
+    machine,
+    ...(operatorGroup ? { operatorGroup } : {}),
+    aliases: domain.aliases ?? [],
+    protectedCategories: domain.protectedCategories ?? [],
+  };
+}
+
+export function resolveCatalogAuthority(domains: readonly CatalogDomain[]): DomainAuthorityRecord[] {
+  return domains.map(resolveDomainAuthority);
+}
+
+export function domainAuthorityFor(domains: readonly CatalogDomain[], domainId: string): DomainAuthorityRecord | undefined {
+  const resolved = resolveCatalogAuthority(domains);
+  return findDomainAuthority(resolved, domainId) ?? resolved.find((record) => record.id === domainId);
+}