{"_id":"@auraone/platform-contracts","name":"@auraone/platform-contracts","dist-tags":{"latest":"0.3.0"},"versions":{"0.3.0":{"name":"@auraone/platform-contracts","version":"0.3.0","description":"Runtime-neutral TypeScript contracts for trust, intake, telemetry, updates, and extensions in AuraOne Open Studio.","keywords":["auraone","open-studio","typescript","telemetry","privacy","updater","keychain","contracts"],"repository":{"type":"git","url":"git+https://github.com/auraoneai/open-studio-platform.git","directory":"packages/platform-contracts"},"homepage":"https://github.com/auraoneai/open-studio-platform/tree/main/packages/platform-contracts#readme","bugs":{"url":"https://github.com/auraoneai/open-studio-platform/issues"},"type":"module","license":"MIT","main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"build":"tsc -p tsconfig.json","type-check":"tsc -p tsconfig.json --noEmit"},"devDependencies":{"typescript":"^5.7.2"},"engines":{"node":">=20.19.5"},"gitHead":"09eb9a8903a7552c9736329fe56305245b65f3f8","_id":"@auraone/platform-contracts@0.3.0","_nodeVersion":"22.22.0","_npmVersion":"11.18.0","dist":{"integrity":"sha512-M4Sv0MYLYNc/td7930BW6PwN9qLruapXvLVEWyKrACBrhLeUwZGWwVpA2oG+aOg9DfI7fZF/gPSdUbxb7E7DCA==","shasum":"93a8020da9ed6ddbc2da80dda909b307a0e2769b","tarball":"https://registry.npmjs.org/@auraone/platform-contracts/-/platform-contracts-0.3.0.tgz","fileCount":22,"unpackedSize":47272,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCjRpcpBv+6T/6ZvkiqVOpDC6CAHfXWxIi2FatKuNrwDwIhAI922LhC0Jyb5owHQZsvkMxl56ucGI1cRIczvBEEKUmJ"}]},"_npmUser":{"name":"veeronecorp","email":"gchahal@veerone.com"},"directories":{},"maintainers":[{"name":"veeronecorp","email":"gchahal@veerone.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/platform-contracts_0.3.0_1784013523215_0.5966940111311412"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-14T07:18:43.101Z","0.3.0":"2026-07-14T07:18:43.357Z","modified":"2026-07-14T07:18:43.639Z"},"maintainers":[{"name":"veeronecorp","email":"gchahal@veerone.com"}],"description":"Runtime-neutral TypeScript contracts for trust, intake, telemetry, updates, and extensions in AuraOne Open Studio.","homepage":"https://github.com/auraoneai/open-studio-platform/tree/main/packages/platform-contracts#readme","keywords":["auraone","open-studio","typescript","telemetry","privacy","updater","keychain","contracts"],"repository":{"type":"git","url":"git+https://github.com/auraoneai/open-studio-platform.git","directory":"packages/platform-contracts"},"bugs":{"url":"https://github.com/auraoneai/open-studio-platform/issues"},"license":"MIT","readme":"# @auraone/platform-contracts\n\n`@auraone/platform-contracts` is the runtime-neutral TypeScript contract layer\nfor AuraOne Open Studio trust and release behavior. It lets browser, desktop,\nCLI, and VS Code surfaces share the same schemas and validation rules without\ncoupling product code to a transport implementation.\n\n**For:** platform and Studio engineers implementing telemetry, intake, updater,\nkeychain, crash, event-log, or extension boundaries.\n\n**Differentiator:** endpoint declarations, privacy validation, and release\nmanifest shapes stay consistent across Rubric, Agent, and Robotics while each\nconsumer retains control of when and how a network or native capability runs.\n\n## Install From Source\n\nStatus verified on **July 13, 2026**: version `0.3.0` passes its package gates\nbut is not yet published on the public npm registry. Use `workspace:*` from the\ncanonical source checkout until registry authorization is restored.\n\nFrom the `open-studio-platform` root:\n\n```bash\ncorepack enable\npnpm install --frozen-lockfile\npnpm --dir packages/platform-contracts build\n```\n\nOnly `dist/` and this README are included by the package allowlist.\n\n## Contract Surface\n\n- Canonical CSP, deep-link scheme, release channels, target platforms, and\n  endpoint templates.\n- Privacy-safe telemetry event creation and forbidden-payload validation.\n- Local telemetry event-log states that distinguish preview from delivery.\n- Crash and console-text scrubbing helpers.\n- `.auraonepkg` intake roles, manifests, previews, and explicit upload-request\n  construction.\n- Keychain scopes, identifiers, and Tauri invoke adapters.\n- Signed updater manifest, checksum, rollout, fallback, and kill-switch shapes.\n- Robotics, MCP, OTLP, LLM-gateway, and other platform extension hooks.\n\n## Usage\n\n```ts\nimport {\n  CANONICAL_CSP,\n  createUpdaterEndpoint,\n  validateTelemetryEvent,\n  type UpdateManifest,\n} from \"@auraone/platform-contracts\";\n\nconst endpoint = createUpdaterEndpoint(\"rubric-studio-open\");\nconst manifest: UpdateManifest = await loadVerifiedManifest(endpoint);\nconst result = validateTelemetryEvent(candidateEvent);\n```\n\nThe consumer must still authenticate, fetch, verify signatures, persist data,\nand handle failure states. Types and helpers do not make those operations\ntrusted automatically.\n\n## Runtime, Data, And Network Boundary\n\n- The emitted package is plain ESM TypeScript output with no React or native\n  runtime dependency.\n- It does not create background workers, persist secrets, send telemetry,\n  upload intake packets, fetch updates, or open sockets.\n- Constants such as telemetry, intake, and update endpoints define the\n  allowlisted contract. A product must make the explicit transport call and\n  apply consent, redaction, authentication, signature, and error handling.\n- Telemetry validation rejects content-like fields, paths, identifiers,\n  prompts, rubric/sample/trace material, and common secret patterns.\n- Keychain interfaces define approved scopes; only a host-provided Tauri invoke\n  function can cross the native boundary.\n\n## Font Boundary\n\nThis package contains no visual assets, CSS, or fonts. Private licensed font\nbinaries must never be added to its source or tarball. Studio UI consumers\nfollow Proofline's approved same-origin branded-stylesheet boundary and retain\nthe public system-font fallback.\n\n## Proof\n\n```bash\npnpm --dir packages/platform-contracts run type-check\npnpm --dir packages/platform-contracts build\nnode --test tests/platform-contracts.test.mjs\n```\n\nThe root platform suite also exercises flagship integration, intake roles,\nschema/privacy policy, security checklists, and release-flow contracts.\n\n## Release Truth\n\nThe `0.3.0` source candidate passes typecheck, contract tests, and emitted-file\ninspection. Do not document an npm install command until the registry exposes\nthe exact version and integrity record.\n\n## Next Action\n\nUse the pinned workspace package until the first npm release is authorized.\nPublish the exact tested `0.3.0` tarball, read it back from npm, verify the\nruntime-neutral exports and integrity record, and only then add public install\nexamples or mark the registry destination verified.\n","readmeFilename":"README.md","_rev":"1-dc9c44f730534d856f2e9366b8aeb897"}