{"id":"@lssm-tech/app.personalos-web","slug":"app.personalos-web","name":"@lssm-tech/app.personalos-web","version":"0.2.2","path":"packages/apps/personalos-web","manifestPath":"packages/apps/personalos-web/package.json","manifestBlobSha":"ee244ab4221d0f72bf9c16b1165bcbbed4cbe058","layer":"apps","physicalArea":null,"primaryArea":"personal-and-learning","classification":{"privateDeclared":true,"catalogFamily":null,"catalogKind":null,"catalogStatus":null,"adoptionMode":null,"stability":null},"description":"Private, accessible Next.js and PWA shell for PersonalOS.","descriptionOrigin":"package.json","catalog":{"visualTesting":{"status":"deferred","owner":"@contractspec-core","targetWave":"wave-3-react-packages","rationale":"Foundational Storybook adoption establishes shared catalogs and guardrails before this package migrates."}},"canonicalImports":[],"scripts":{"dev":"next dev","build":"node ./node_modules/next/dist/bin/next build && bun run verify:browser-artifacts","start":"bun --bun next start","typecheck":"tsgo --noEmit","test":"bun test src ./tests-e2e/fixture-workspace.test.ts","test:e2e":"bun run build && playwright test --config playwright.config.ts","test:browser-contract":"bun run build && playwright test --config playwright.contract.config.ts","verify:browser-artifacts":"bun tests-e2e/check-browser-artifacts.ts","test:e2e:install":"playwright install chromium","lint:check":"node ../../../scripts/biome.cjs check package.json tsconfig.json next.config.ts postcss.config.mjs playwright.config.ts playwright.contract.config.ts src public tests-e2e","lint:fix":"node ../../../scripts/biome.cjs check --write package.json tsconfig.json next.config.ts postcss.config.mjs playwright.config.ts playwright.contract.config.ts src public tests-e2e"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/lib.design-system":"workspace:*","@lssm-tech/lib.personal-health-spec":"workspace:^","@lssm-tech/lib.personal-os-runtime":"workspace:^","@lssm-tech/lib.personal-os-spec":"workspace:^","@lssm-tech/lib.presentation-runtime-core":"workspace:*","@lssm-tech/module.personal-experience":"workspace:*","@lssm-tech/module.personal-goals":"workspace:*","@lssm-tech/module.personal-health":"workspace:*","@lssm-tech/module.personal-household":"workspace:*","@lssm-tech/module.personal-life-admin":"workspace:*","@lssm-tech/module.personal-operations":"workspace:*","@lssm-tech/module.personal-productivity":"workspace:*","next":"catalog:","react":"catalog:","react-dom":"catalog:","zod":"catalog:"},"devDependencies":{"@axe-core/playwright":"^4.13.0","@playwright/test":"^1.63.0","@lssm-tech/tool.typescript":"workspace:*","@tailwindcss/postcss":"4.3.3","@types/bun":"catalog:types","@types/react":"catalog:types","@types/react-dom":"catalog:types","tailwindcss":"catalog:build","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":null,"publishExports":null,"types":null,"files":null,"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[],"entryCount":0,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-web","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-web/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-web/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.personalos-web.txt"},"readme":{"status":"available","body":"# `@lssm-tech/app.personalos-web`\n\nPrivate Next.js/PWA delivery shell for the PersonalOS golden journey. It\ncomposes PersonalOS goals, productivity, health, household, privacy, and\nexperience modules without duplicating their authority or offline policy.\n\nThe app exposes executable Today, goals, health, household, review, and privacy\nroutes, including every exact shared golden-journey deep link. Authenticated\nServer Components load the strict subject/actor-bound experience and workspace\nprojections with `no-store`; Server Actions submit shared, schema-validated\ndomain commands with expected revisions, idempotency, payload digests, and\naction classification. Missing AuthOS sessions, invalid payloads, scope\nmismatches, and stale revisions fail closed without discarding entered data.\nThe goals surface also renders minimized baseline, target, unit, confidence,\ncorrection, and removal counts and exposes explicit online-only controls to\nrecord, correct, or remove self-observed outcome values without overwriting\ntheir encrypted history.\nThe health surface also renders the optional bounded wellbeing-goal window with\nlocalized status, safe metric, direction, dates, observation count, and\nuncertainty-aware outcome. It explicitly states that observations do not prove\ncause and are not medical advice; raw targets, values, evidence, and provider\nfields are absent from the browser contract.\nPrivacy routes render the minimized consent dashboard with human-readable\npurpose, downstream consumer destinations, expiry, and lifecycle status. The\nbrowser never receives consent evidence or authority receipts; truncated views\nretain exact totals and clearly disclose that the list is bounded.\nThe subject can grant one fixed, typed PersonalOS planning scope for one year\nand revoke an active grant from the same route. Both controls construct the\nshared consent lifecycle command, require current online human authority, and\npreserve the selected grant when authority or revision checks deny the request.\nThe scope transparently includes optional coach adaptations and private progress\ncelebration for the PersonalOS and coach runtimes. The goals route then offers a\nseparate opt-in celebration form: the subject selects an active goal, active\nconsent, one or more contract-defined evidence kinds, points per verified event,\nand a total cap. Configure and disable commands are online-only, human-required,\nrevision-bound, and preserve every entry after denial. The minimized browser\nsummary exposes no consent evidence or receipts, cannot grant authority, and\nstates that the policy is private, presentation-only, leaderboard-free, and\nfree of pay-to-win or artificial scarcity.\nHousehold invitation, activation, delegation, and revocation use the shared\nruntime constructor; web supplies only authenticated context, human evidence,\nform values, and opaque command IDs instead of redefining household policy.\n\n`/today/organize` composes the encrypted life-administration host through a\nstrict subject-bound, private/no-store projection. It renders bounded calendar\nand reminder metadata, exact-actor assigned-care rows, and knowledge and\nconnection counts. Care uses design-system list semantics, translated empty\ncopy, exact actor binding, and never exposes purpose text, capabilities, or\nauthority receipts. The route submits only canonical online calendar/reminder\ncommands with the current life-admin revision. Unified search is consent-bound and metadata-only across calendar,\nreminder, knowledge, file, and project sources; unavailable sources are\nreported without leaking their rows. Denials and conflicts preserve entries.\nEncrypted content, provider records, cursors, receipts, and evidence never\nenter the browser contract.\n\nEvery privacy surface links to a dedicated human-support route. The route opens\nand reloads exact subject-owned support incidents through the shared operations\ncontract and the authenticated PersonalOS API. It selects only an active\nconsent from the current bounded workspace projection, offers accessible\ncontact channels and accessibility preferences, and submits only canonical\nSHA-256 summary, appeal, or evidence references—never free-form personal\nnarrative. Mutations re-fetch the no-store incident projection, bind its exact\nrevision, and preserve form values after confirmation, authority, or revision\ndenial. Incident state is minimized to status, requested-response state,\naccessibility preferences, and allowed person transitions; support-agent\nacknowledgement, escalation, and resolution remain host-owned.\n\nThe shell consumes the subject/actor-bound `presentation` projection for all\nsix area/component access decisions, all `${area}.manage` boundaries, and the\nseven presentation preferences. Hidden actions are omitted, blocked actions\nremain visibly unavailable, and approval-required actions need an explicit\nper-submission confirmation. Every Server Action re-fetches the no-store\nprojection before an effect, so missing, invalid, duplicate, or stale decisions\ncannot be bypassed with a handcrafted browser request. Missing presentation\nstill permits a calm, truthful display-only fallback. Preference reset and undo\nare local presentation changes and never grant authority or weaken API policy.\n\nThe root client provider keeps one shared Personalization identity boundary\nacross route navigation. Authenticated projections bind it to the exact\nsubject, actor, opaque tenant, and consent tuple. A confirmed missing AuthOS\nsession discards the retiring buffers, while loading, projection denial,\noffline, and reconnect states preserve them without changing identity. This\nboundary exposes buffer attachment only after granted consent; no telemetry is\ncollected when the host omits the exact binding.\n\nHousehold routes also expose goal-scoped support as a separate governed layer\nafter membership and `propose_support` delegation. The subject chooses one\nactive goal, consent, trusted member, and purpose; the browser submits the exact\nshared support command with current goal-source revision and a canonical scope\ndigest. Revoke, block, and categorical report controls remain high-risk,\nhuman-required, and online-only.\n\nThe shipped `en`, `fr`, and `es` catalogs are left-to-right. An `ar` readiness\noption intentionally uses the English fallback catalog while exercising RTL\ndocument direction and logical layout semantics; this is RTL browser evidence,\nnot a claim of translated Arabic copy.\n\nWorkspace cards consume the minimized planning, delegation, aggregate wellness,\nand coach summary contracts. Coach adaptation inspection, undo, and reset remain\nhuman-required. Remote wellness connection starts only through the host broker:\nthe browser sends its exact client-safe request, receives an opaque ticket and\nHTTPS redirect, then polls the subject-bound status through a same-origin route.\nProvider state, PKCE verifiers, credentials, raw measurements, and raw payloads\nnever enter the browser contract. HealthKit and Health Connect remain native-only.\nThe health route renders only consented category status, observation and\nquarantine counts, and the latest source-observation timestamp. It never renders\nraw measurements, provider payloads, credentials, or clinical conclusions.\n\nAll personal responses carry `private, no-store` headers. The service worker\ncaches only public shell assets and the data-free offline page; private\nnavigations and APIs stay network-only.\n\nLow-risk offline commands are validated against the trusted shared registry,\nsealed with a non-extractable AES-GCM key in IndexedDB, and replayed through a\nsame-origin proxy. The server revalidates authority and revision; conflicts or\nconfirmation decisions remain blocked in the outbox without data loss.\n\n## Local verification\n\n```bash\nbun run lint:check\nbun run typecheck\nbun run test\nbun run build\nbun run verify:browser-artifacts\nbun run test:browser-contract\nbun run test:e2e\n```\n\nThe browser-contract command builds first, then starts an isolated API fixture and\nthe production Next server. It checks\nthe authenticated golden command journey, denial/conflict preservation, opaque\nremote-provider begin and status behavior, sealed offline/reconnect replay, and\nan automated axe scan in desktop Chromium. Tailwind scans the exact published\ndesign-system button leaf as well as workspace sources, so sparse-worktree builds\nretain the foreground and hover utilities required for button contrast. The\nfixture is contract-valid test evidence; it\nis not evidence for a production provider, database, deployment, or canary.\nThe production build also scans every emitted browser chunk and fails if internal\ndesign ownership, RoleMorph registry, task-fixture, or private execution markers\nenter the public artifact graph.\nProduction builds use Next.js's default Turbopack. Tailwind tracks the UI kit's\n`ui/` and `src/` trees explicitly, avoiding recursive package-root scans through\nBun's linked `node_modules`.\nRun the Next.js compiler under genuine Node.js, including when launching Turbo;\ndo not use `bun --bun` for the parent build launcher, which can inject a Node shim\nand force compiler workers onto Bun. The browser-artifact check still runs with Bun.\n`next.config.ts` uses Next's built-in config transpiler and the dedicated\n`@lssm-tech/lib.presentation-runtime-core/next` entrypoint to load workspace\nTypeScript helpers without a custom loader or the runtime root barrel.\n`test:e2e` is reserved for the actual PersonalOS API production composition and\nmust not be replaced with the fixture harness. Its four-minute scenario budget\ndoes not relax the ten-second action and revision assertions; it prevents the\nfull multi-domain journey from being cancelled merely because secure server\nactions complete sequentially on a constrained qualification host. Root and\nsegment error documents remain provider-independent, redact thrown details,\nand never require authenticated personalization context to render recovery.\n\nThe actual production-composition Playwright journey also configures and\ndisables private progress celebration, verifies bounded minimized state and\ngoal-history preservation, and runs axe on the labelled opt-in surface plus the\nfinal journey. These automated checks do not replace manual screen-reader,\nzoom, visual, real-device, or cross-browser accessibility qualification.\n\nThe production journey includes the human-support denial/recovery path: an\n`other` category requires authority confirmation and preserves the form, then\nan accessibility case can be opened with the same active consent and checked\nwith axe. If local Chromium cannot launch, that run must be recorded as an\nenvironment gap rather than substituted with fixture evidence.\n\nSet `PERSONAL_OS_API_BASE_URL` to the HTTPS API host and provide an AuthOS\nBearer session or Better Auth session-token cookie. Production provider callback\nand credential exchange are host-owned. HTTPS PWA installation, Safari/Firefox,\nreal-provider qualification, production restore/deletion propagation, canary,\nand real-device evidence remain release-environment gates and are not claimed by\nthis package.\n\nNext's global `typedRoutes` switch remains disabled because the current shared\ndesign-system `Link` intentionally accepts general internal and external URLs.\nThe app instead fail-closes through its typed route inventory and exact shared\ngolden-journey projection. Enabling framework-global route types requires a\nseparate shared Link contract evolution.\n","sourcePath":"packages/apps/personalos-web/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-web/README.md","blobSha":"f265e97f3024ab8f3d698556a24a9a5492db0de6","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"personal-and-learning","areaTitle":"Personal workflows, learning and progress","displayName":"app.personalos-web","runtimes":[],"platforms":[],"kind":"apps","scope":"Workspace only","canonicalRoute":"/docs/packages/app.personalos-web/","contextUrl":"/docs/packages/app.personalos-web.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}